Registro público
Informe de salud del softwareesquema 0.27.0 · métricas 1.13.0 · 2026-07-25 10:34 UTC

joshbressers / syft

CLI tool and library for generating a Software Bill of Materials from container images and filesystems

GoApache-2.0★ 0 estrellas⑂ 0 forksdesde oct 2021forkVer en GitHub ↗

joshbressers/syft tiene un índice de salud de 43 sobre 100, lo que lo sitúa en la banda En riesgo. Su puntuación más alta es AI Readiness (68/100) y la más baja, Community & Adoption (12/100). Se actualizó por última vez hace 116 días. 2 personas concentran la mayor parte del trabajo reciente.

43
global / 100
En riesgo

Índice de salud del software

Las métricas se agrupan en categorías ponderadas sobre una escala de 1 a 100. El resultado global parte de su media; cuando la evidencia pública activa la Política de Jurisdicciones de Alto Riesgo, la calificación se ajusta y recibe el límite 49 (En riesgo). Preparación para IA queda fuera.

43
Excelente85-100Ejemplar; cumple prácticamente todos los criterios evaluados
Bueno70-84Saludable; carencias menores
Moderado50-69Aceptable con carencias notables; se recomienda revisión
En riesgo30-49Debilidades significativas; su adopción exige cautela
Crítico1-29Problemas graves (proyecto abandonado, un solo mantenedor, sin higiene)
VitalidadComunidad yAdopciónSostenibilidady GobernanzaCalidad deIngenieríaSeguridadPreparaciónpara IA

Perfil de puntuación

Cada eje es una categoría. La forma importa más que la media: un proyecto sano llena toda la figura, mientras que un perfil de picos y cráteres indica que la fortaleza en una dimensión enmascara el riesgo en otra.

Titularidad

Josh BressersCuenta personal
111 seguidores109 repositorios públicosdesde abr 2012@anchore

Este repositorio pertenece a una cuenta personal. Un proyecto con un único propietario conlleva más riesgo de continuidad que uno respaldado por una organización.

Ecosistemas de paquetes

RegistroPaqueteVersiónDescargas / mesVersionesÚltima publicación
Gogithub.com/anchore/syftapunta a otro repositorio; no se puntúav1.49.0-268hace 4 días

Métricas por categoría

Vitalidad

¿Está vivo el proyecto: se escribe código y se publican versiones?

50Moderado · 22% del índice global

Actividad de desarrollo

51Moderado
Cómo se puntúa
9.9/36Recencia de push — último push hace 116 días
23.5/36Cadencia de commits — 34/52 semanas con commits
18/18Volumen de commits — 375 commits en el último año
0/10OpenSSF Scorecard: Maintained — 0 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 0
Datos de entrada utilizados
commits_last_year375
human_commit_share0,38
days_since_last_push116
active_weeks_last_year34

Disciplina de publicación

48En riesgo
Cómo se puntúa
16.2/27Publica versiones — 49 etiquetas de versión (sin releases de GitHub)
0/36Recencia de las versiones — última versión hace 1761 días
27/27Cadencia de publicación — una versión cada ~11,1 días
0/10OpenSSF Scorecard: Signed-Releases — sin datos
Datos de entrada utilizados
releases_count49
latest_release_tagv0.24.1
releases_from_tagssí
days_since_latest_release1761
mean_days_between_releases11,1
Excluidos de la puntuación (sin datos o no aplicable): OpenSSF Scorecard: Signed-Releases. Los pesos restantes se han renormalizado.

Comunidad y Adopción

¿Tiene el proyecto usuarios, descargas, atención y unas condiciones acogedoras para quienes contribuyen?

12Crítico · 18% del índice global

Popularidad y adopción

1Crítico
Cómo se puntúa
0/60Estrellas — 0 estrellas
0/25Forks — 0 forks
0/15Observadores — 0 observadores
Datos de entrada utilizados
forks0
stars0
watchers0
growth_stateunverified
growth_factor_pct100
growth_unverified_reasonno_history

Salud de la comunidad

25Crítico
Cómo se puntúa
0/22.5README
22.5/22.5Licencia — licencia reconocida (Apache-2.0)
0/18Guía CONTRIBUTING
0/13.5Código de conducta
0/7.2Plantilla de issues
0/6.3Plantilla de PR
Datos de entrada utilizados
has_readmeno
has_licenseno
has_contributingno
has_issue_templateno
has_code_of_conductno
has_pull_request_templateno

Sostenibilidad y Gobernanza

¿Sobrevivirá el proyecto a sus personas: factor bus, capacidad de respuesta, quién lo respalda y mantenimiento del paquete?

43En riesgo · 24% del índice global

Resiliencia de mantenedores (factor bus)

61Moderado
Cómo se puntúa
25.2/54Factor bus — la mitad de los commits recae en 2 contribuyente(s)
12.7/22.5Distribución de commits — el principal contribuyente firma el 44% de los commits
13.5/13.5Amplitud de contribuyentes — 98 contribuyentes
10/10OpenSSF Scorecard: Contributors — project has 35 contributing companies or organizations
Datos de entrada utilizados
bus_factor2
contributors_sampled98
top_contributor_share0,435

Capacidad de respuesta a issues y PR

1Crítico
Cómo se puntúa
0/46.8Resolución de issues — sin issues o sin datos
0/38.3Aceptación de PR — sin PR decididos o sin datos
0/15OpenSSF Scorecard: Code-Review — Found 0/30 approved changesets -- score normalized to 0
Datos de entrada utilizados
merged_prs0
open_issues0
closed_issues0
issue_closed_ratio—
closed_unmerged_prs0
Excluidos de la puntuación (sin datos o no aplicable): Resolución de issues, Aceptación de PR. Los pesos restantes se han renormalizado.

Propiedad y custodia

62Moderado
Cómo se puntúa
10/30Respaldo de la propiedad — cuenta personal (usuario)
0/20Dominio verificado — no aplicable a cuentas de usuario
14.7/25Alcance del propietario — 111 seguidores de joshbressers
25/25Trayectoria — 109 repos públicos, cuenta de ~14 años
Datos de entrada utilizados
followers111
owner_typeUser
is_verified—
owner_loginjoshbressers
public_repos109
account_age_days5198
Excluidos de la puntuación (sin datos o no aplicable): Dominio verificado. Los pesos restantes se han renormalizado.

Calidad de Ingeniería

¿Existen unas prácticas mínimas de ingeniería y documentación?

52Moderado · 20% del índice global

Prácticas de ingeniería

80Bueno
Cómo se puntúa
24/24Flujos de trabajo de CI — 13 flujo(s) de trabajo
24/24Pruebas presentes
16/16Configuración de linter — .golangci.yaml
0/9.6Hooks de pre-commit
0/6.4.editorconfig
0/20OpenSSF Scorecard: CI-Tests — sin datos
Datos de entrada utilizados
has_cisí
has_testssí
has_editorconfigno
has_linter_configsí
has_precommit_configno
Excluidos de la puntuación (sin datos o no aplicable): OpenSSF Scorecard: CI-Tests. Los pesos restantes se han renormalizado.

Documentación

10Crítico
Cómo se puntúa
0/30README
0/25Directorio de documentación
0/15Sitio de documentación / página del proyecto
0/10Descripción del repositorio
0/10Topics
10/10Wiki
Datos de entrada utilizados
topics—
has_wikisí
homepage—
has_readmeno
has_docs_dirno
has_descriptionno

Seguridad

¿Son sólidas las prácticas visibles de seguridad y de cadena de suministro, sin exposición jurisdiccional de alto riesgo sin resolver?

54Moderado · 16% del índice global

Postura de seguridad

56Moderado
Cómo se puntúa
7.5/7.5Binary-Artifacts — no binaries found in the repo
0/7.5Branch-Protection — branch protection not enabled on development/release branches
0/2.5CI-Tests — sin datos
0/2.5CII-Best-Practices — no effort to earn an OpenSSF best practices badge detected
0/7.5Code-Review — Found 0/30 approved changesets -- score normalized to 0
2.5/2.5Contributors — project has 35 contributing companies or organizations
10/10Dangerous-Workflow — no dangerous workflow patterns detected
7.5/7.5Dependency-Update-Tool — update tool detected
0/5Fuzzing — project is not fuzzed
2.5/2.5Licencia — license file detected
0/7.5Maintained — 0 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 0
0/5Packaging — sin datos
3.5/5Pinned-Dependencies — dependency not pinned by hash detected -- score normalized to 7
5/5SAST — SAST tool detected: CodeQL
5/5Security-Policy — security policy file detected
0/7.5Signed-Releases — sin datos
6.8/7.5Token-Permissions — detected GitHub workflow tokens with excessive permissions
0/7.5Vulnerabilities — 337 existing vulnerabilities detected
Datos de entrada utilizados
sourceopenssf_scorecard
checks_evaluated15
scorecard_versionv5.5.0
checks_inconclusive3
scorecard_aggregate5,6
Excluidos de la puntuación (sin datos o no aplicable): ci_tests, packaging, signed_releases. Los pesos restantes se han renormalizado.

Avisos de dependencias

46En riesgo
Cómo se puntúa
7.5/35Dependencias directas libres de avisos conocidos — 5 afectados: github.com/go-git/go-billy/v5 v5.8.0 (high 8.1), github.com/hashicorp/go-getter v1.8.5 (high 7.5), github.com/go-git/go-git/v5 v5.17.0 (moderate 6.5), +2 más
0/25Dependencias indirectas libres de avisos conocidos — el conjunto transitivo no es separable de las dependencias de desarrollo y prueba en este alcance
27/40Sin avisos pendientes — 3 paquete(s) con avisos sin atender más allá de 90 días; el más antiguo publicado hace 392 días
Datos de entrada utilizados
sourceosv
advisories87
affected_packages17
assessed_packages333
unassessed_packages0
affected_by_severitycritical 3, high 5, moderate 5, unknown 4
direct_affected_packages5
Excluidos de la puntuación (sin datos o no aplicable): Dependencias indirectas libres de avisos conocidos. Los pesos restantes se han renormalizado. Se cotejaron 333 dependencias resueltas con OSV. Este repositorio no publica ningún paquete que el índice resuelva, por lo que se evaluó en su lugar el grafo de dependencias del repositorio. Ese grafo mezcla fijaciones de desarrollo y prueba con las dependencias distribuidas, de modo que solo se puntúan las dependencias declaradas en tiempo de ejecución; los hallazgos transitivos se informan como contexto y quedan excluidos de la puntuación. No se analiza la alcanzabilidad.

Preparación para IA

¿Hasta qué punto está el repositorio preparado para desarrollarse y mantenerse con agentes de codificación de IA? Es una insignia independiente y experimental — peso 0,0, de modo que se presenta por separado y no afecta a la puntuación de salud global.

68Moderado · 0% del índice global

Contexto y guía para agentes

40En riesgo
Cómo se puntúa
0/45Instrucciones para agentes — sin CLAUDE.md / AGENTS.md / reglas de editor
0/15Documentación legible por máquinas (llms.txt)
40/40Historial de commits legible — 38 de 38 commits humanos declaran su intención (asunto estructurado o cuerpo explicativo)
Datos de entrada utilizados
has_llms_txtno
legible_history_share1
agent_instruction_files—
agent_instruction_max_bytes—

Bucle de verificación (compilación / pruebas / verificación de tipos)

87Excelente
Cómo se puntúa
18/18Arranque con un solo comando — Makefile, Taskfile.yaml, cmd/syft/internal/test/integration/testdata/Makefile, schema/cyclonedx/Makefile, syft/file/cataloger/executable/testdata/Makefile, syft/file/cataloger/executable/testdata/elf/Makefile, syft/file/cataloger/executable/testdata/elf/project/Makefile, syft/file/cataloger/executable/testdata/shared-info/Makefile, syft/file/cataloger/executable/testdata/shared-info/project/Makefile, syft/file/cataloger/executable/testdata/shared-info/project/hello/Makefile, syft/file/cataloger/executable/testdata/shared-info/project/libhello/Makefile, syft/pkg/cataloger/binary/testdata/Makefile, syft/pkg/cataloger/binary/testdata/elf-testdata/elfbinwithcorrupt/elfsrc/makefile, syft/pkg/cataloger/binary/testdata/elf-testdata/elfbinwithcorrupt/makefile, syft/pkg/cataloger/binary/testdata/elf-testdata/elfbinwithnestedlib/elfsrc/makefile, syft/pkg/cataloger/binary/testdata/elf-testdata/elfbinwithnestedlib/makefile, syft/pkg/cataloger/binary/testdata/elf-testdata/elfbinwithsisterlib/elfsrc1/makefile, syft/pkg/cataloger/binary/testdata/elf-testdata/elfbinwithsisterlib/elfsrc2/makefile, syft/pkg/cataloger/binary/testdata/elf-testdata/elfbinwithsisterlib/makefile, syft/pkg/cataloger/dotnet/testdata/Makefile, syft/pkg/cataloger/golang/testdata/Makefile, syft/pkg/cataloger/golang/testdata/archs/Makefile, syft/pkg/cataloger/internal/pe/testdata/Makefile, syft/pkg/cataloger/java/testdata/Makefile, syft/pkg/cataloger/java/testdata/jar-metadata/Makefile, syft/pkg/cataloger/java/testdata/java-builds/Makefile, syft/pkg/cataloger/kernel/testdata/Makefile, syft/pkg/cataloger/redhat/testdata/Makefile, test/cli/testdata/Makefile, test/cli/testdata/image-java-spdx-tools/Makefile, test/cli/testdata/registry/Makefile, test/install/Makefile
22/22Pruebas automatizadas
11/11Configuración de lint / formato — .golangci.yaml
11/11Verificación estática de tipos — Go (tipado estático)
10/10Entorno reproducible — Dockerfile, lockfile
0/10Práctica demostrada con agentes — ningún commit con autoría de agente entre los últimos 100
8/8Mantenimiento automatizado — 35 de los últimos 100 commits son actualizaciones automáticas de dependencias
7/10OpenSSF Scorecard: Pinned-Dependencies — dependency not pinned by hash detected -- score normalized to 7
Datos de entrada utilizados
has_nixno
has_testssí
lockfilesCargo.lock, Gemfile.lock, Pipfile.lock, composer.lock, go.sum, mix.lock, package-lock.json, packages.lock.json, pdm.lock, pnpm-lock.yaml, poetry.lock, uv.lock, yarn.lock
has_dockerfilesí
typed_languagesí
bootstrap_filesMakefile, Taskfile.yaml, cmd/syft/internal/test/integration/testdata/Makefile, schema/cyclonedx/Makefile, syft/file/cataloger/executable/testdata/Makefile, syft/file/cataloger/executable/testdata/elf/Makefile, syft/file/cataloger/executable/testdata/elf/project/Makefile, syft/file/cataloger/executable/testdata/shared-info/Makefile, syft/file/cataloger/executable/testdata/shared-info/project/Makefile, syft/file/cataloger/executable/testdata/shared-info/project/hello/Makefile, syft/file/cataloger/executable/testdata/shared-info/project/libhello/Makefile, syft/pkg/cataloger/binary/testdata/Makefile, syft/pkg/cataloger/binary/testdata/elf-testdata/elfbinwithcorrupt/elfsrc/makefile, syft/pkg/cataloger/binary/testdata/elf-testdata/elfbinwithcorrupt/makefile, syft/pkg/cataloger/binary/testdata/elf-testdata/elfbinwithnestedlib/elfsrc/makefile, syft/pkg/cataloger/binary/testdata/elf-testdata/elfbinwithnestedlib/makefile, syft/pkg/cataloger/binary/testdata/elf-testdata/elfbinwithsisterlib/elfsrc1/makefile, syft/pkg/cataloger/binary/testdata/elf-testdata/elfbinwithsisterlib/elfsrc2/makefile, syft/pkg/cataloger/binary/testdata/elf-testdata/elfbinwithsisterlib/makefile, syft/pkg/cataloger/dotnet/testdata/Makefile, syft/pkg/cataloger/golang/testdata/Makefile, syft/pkg/cataloger/golang/testdata/archs/Makefile, syft/pkg/cataloger/internal/pe/testdata/Makefile, syft/pkg/cataloger/java/testdata/Makefile, syft/pkg/cataloger/java/testdata/jar-metadata/Makefile, syft/pkg/cataloger/java/testdata/java-builds/Makefile, syft/pkg/cataloger/kernel/testdata/Makefile, syft/pkg/cataloger/redhat/testdata/Makefile, test/cli/testdata/Makefile, test/cli/testdata/image-java-spdx-tools/Makefile, test/cli/testdata/registry/Makefile, test/install/Makefile
has_devcontainerno
has_linter_configsí
typecheck_configs—
agent_commit_share0
toolchain_manifestscmd/syft/internal/test/integration/testdata/image-go-bin-arch-coverage/go.mod, cmd/syft/internal/test/integration/testdata/image-pkg-coverage/pkgs/go/go.mod, cmd/syft/internal/test/integration/testdata/image-pkg-coverage/pkgs/java/pom.xml, cmd/syft/internal/test/integration/testdata/image-sbom-cataloger/go.mod, go.mod, syft/pkg/cataloger/dotnet/testdata/image-net2-app/src/helloworld.csproj, syft/pkg/cataloger/dotnet/testdata/image-net6-asp-libman/src/LibManSample.csproj, syft/pkg/cataloger/dotnet/testdata/image-net8-app-no-depjson/src/dotnetapp.csproj, syft/pkg/cataloger/dotnet/testdata/image-net8-app-self-contained/src/dotnetapp.csproj, syft/pkg/cataloger/dotnet/testdata/image-net8-app-single-file/src/dotnetapp.csproj, syft/pkg/cataloger/dotnet/testdata/image-net8-app-with-runtime-nodepsjson/src/dotnetapp.csproj, syft/pkg/cataloger/dotnet/testdata/image-net8-app-with-runtime/src/dotnetapp.csproj, syft/pkg/cataloger/dotnet/testdata/image-net8-app/src/dotnetapp.csproj, syft/pkg/cataloger/dotnet/testdata/image-net8-compile-target/src/helloworld.csproj, syft/pkg/cataloger/dotnet/testdata/image-net8-ilrepack/src/dotnetapp.csproj, syft/pkg/cataloger/dotnet/testdata/image-net8-privateassets/src/dotnetapp.csproj, syft/pkg/cataloger/golang/internal/gotestdata/go-source/go.mod, syft/pkg/cataloger/golang/testdata/archs/src/go.mod, syft/pkg/cataloger/golang/testdata/corrupt/go.mod, syft/pkg/cataloger/golang/testdata/glob-paths/src/go.mod, syft/pkg/cataloger/golang/testdata/go-mod-fixtures/many-packages/go.mod, syft/pkg/cataloger/golang/testdata/go-mod-fixtures/one-package/go.mod, syft/pkg/cataloger/golang/testdata/go-mod-fixtures/relative-replace/go.mod, syft/pkg/cataloger/golang/testdata/go-sum-hashes/go.mod, syft/pkg/cataloger/golang/testdata/image-not-a-module/go.mod, syft/pkg/cataloger/golang/testdata/image-small-upx/go.mod, syft/pkg/cataloger/golang/testdata/image-small/go.mod, syft/pkg/cataloger/internal/pe/testdata/image-dotnet31-single-file/src/hello.csproj, syft/pkg/cataloger/internal/pe/testdata/image-dotnet5-single-file/src/hello.csproj, syft/pkg/cataloger/internal/pe/testdata/image-dotnet6-single-file/src/hello.csproj, syft/pkg/cataloger/java/internal/maven/testdata/local/child-1/pom.xml, syft/pkg/cataloger/java/internal/maven/testdata/local/child-2/pom.xml, syft/pkg/cataloger/java/internal/maven/testdata/local/child-3/pom.xml, syft/pkg/cataloger/java/internal/maven/testdata/local/circular-1/pom.xml, syft/pkg/cataloger/java/internal/maven/testdata/local/circular-2/pom.xml, syft/pkg/cataloger/java/internal/maven/testdata/local/contains-child-1/pom.xml, syft/pkg/cataloger/java/internal/maven/testdata/local/parent-1/pom.xml, syft/pkg/cataloger/java/internal/maven/testdata/local/parent-2/pom.xml, syft/pkg/cataloger/java/internal/maven/testdata/local/parent-3/pom.xml, syft/pkg/cataloger/java/testdata/corrupt/pom.xml, syft/pkg/cataloger/java/testdata/glob-paths/src/pom.xml, syft/pkg/cataloger/java/testdata/gradle/build.gradle, syft/pkg/cataloger/java/testdata/jar-metadata/api-all-2.0.0-sources/META-INF/maven/org.apache.directory.api/api-all/pom.xml, syft/pkg/cataloger/java/testdata/jar-metadata/api-all-2.0.0-sources/META-INF/maven/org.apache.directory.api/api-asn1-api/pom.xml, syft/pkg/cataloger/java/testdata/jar-metadata/com.fasterxml.jackson.core.jackson-core-2.15.2/META-INF/maven/com.fasterxml.jackson.core/jackson-core/pom.xml, syft/pkg/cataloger/java/testdata/jar-metadata/commons-lang3-3.12.0/META-INF/maven/org.apache.commons-lang3/pom.xml, syft/pkg/cataloger/java/testdata/jar-metadata/jackson-core-2.15.2/META-INF/maven/com.fasterxml.jackson.core/jackson-core/pom.xml, syft/pkg/cataloger/java/testdata/jar-metadata/micronaut-aop-4.9.11/META-INF/maven/io.micronaut/micronaut-aop/pom.xml, syft/pkg/cataloger/java/testdata/jar-metadata/multiple-matching-2.11.5/META-INF/maven/org.multiple/multiple-matching-1/pom.xml, syft/pkg/cataloger/java/testdata/jar-metadata/multiple-matching-2.11.5/META-INF/maven/org.multiple/multiple-matching-2/pom.xml, syft/pkg/cataloger/java/testdata/jar-metadata/multiple-matching-2.11.5/META-INF/maven/org.multiple/multiple-matching-3/pom.xml, syft/pkg/cataloger/java/testdata/jar-metadata/opensaml-core-3.4.6/META-INF/maven/org.opensaml/opensaml-core/pom.xml, syft/pkg/cataloger/java/testdata/jar-metadata/org.multiple-thename/META-INF/maven/com.multiple/thename/pom.xml, syft/pkg/cataloger/java/testdata/jar-metadata/org.multiple-thename/META-INF/maven/org.multiple/thename/pom.xml, syft/pkg/cataloger/java/testdata/java-builds/example-java-app/build.gradle, syft/pkg/cataloger/java/testdata/java-builds/example-java-app/pom.xml, syft/pkg/cataloger/java/testdata/java-builds/example-jenkins-plugin/pom.xml, syft/pkg/cataloger/java/testdata/java-builds/example-sb-app/pom.xml, syft/pkg/cataloger/java/testdata/pom/commons-text-1.10.0/pom.xml, syft/pkg/cataloger/java/testdata/pom/example-java-app-maven/pom.xml, syft/pkg/cataloger/java/testdata/pom/transitive-top-level/pom.xml, syft/pkg/cataloger/rust/testdata/image-audit/Cargo.toml
dependency_bot_commit_share0,35

Legibilidad del código para modelos

100Excelente
Cómo se puntúa
45/45Código verificable por tipos — Go (tipado estático)
54.7/55Tamaños de archivo manejables — 6/1197 archivos fuente de más de 60 KB
Datos de entrada utilizados
primary_languageGo
largest_source_bytes202.860
source_files_sampled1197
oversized_source_files6

Interfaces legibles por máquina

40En riesgo
Cómo se puntúa
0/40Esquema de API (OpenAPI/GraphQL/proto)
0/20Servidor MCP
40/40Ejemplos ejecutables — example, examples, sample
Datos de entrada utilizados
example_dirsexample, examples, sample
has_mcp_signalno
api_schema_files—

Datos clave

0estrellas de GitHub
98contribuidores
375commits en los últimos 12 meses
116días desde el último push
49versiones publicadas
2factor bus
0issues abiertas
Goecosistemas de paquetes

Advertencias de recopilación de datos

  • Community profile unavailable
  • go package 'github.com/anchore/syft' points at a different repository (https://github.com/anchore/syft); excluded from ecosystem scoring

Más detalle

OpenSSF Scorecard 5.6 / 10
5.6agregado

Evaluación de seguridad independiente y agnóstica en cuanto a herramientas, procedente del proyecto de código abierto OpenSSF Scorecard. Cada comprobación premia una práctica de seguridad, no la herramienta de un proveedor concreto. Las comprobaciones que Scorecard no pudo determinar se marcan como n/d y se excluyen de la puntuación de seguridad (nunca se cuentan como cero).Scorecard v5.5.0 · 2026-07-25 10:34 UTC

10Binary-Artifactsno binaries found in the repo
0Branch-Protectionbranch protection not enabled on development/release branches
n/dCI-Testsno pull request found
0CII-Best-Practicesno effort to earn an OpenSSF best practices badge detected
0Code-ReviewFound 0/30 approved changesets -- score normalized to 0
10Contributorsproject has 35 contributing companies or organizations
10Dangerous-Workflowno dangerous workflow patterns detected
10Dependency-Update-Toolupdate tool detected
0Fuzzingproject is not fuzzed
10Licenselicense file detected
0Maintained0 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 0
n/dPackagingpackaging workflow not detected
7Pinned-Dependenciesdependency not pinned by hash detected -- score normalized to 7
10SASTSAST tool detected: CodeQL
10Security-Policysecurity policy file detected
n/dSigned-Releasesno releases found
9Token-Permissionsdetected GitHub workflow tokens with excessive permissions
0Vulnerabilities337 existing vulnerabilities detected
Dependencias directas 95
RegistroPaqueteRestricción de versiónManifiesto
Gogithub.com/BurntSushi/tomlv1.6.0go.mod
Gogithub.com/CycloneDX/cyclonedx-gov0.10.0go.mod
Gogithub.com/Masterminds/semver/v3v3.4.0go.mod
Gogithub.com/Masterminds/sprig/v3v3.3.0go.mod
Gogithub.com/OneOfOne/xxhashv1.2.8go.mod
Gogithub.com/acarl005/stripansiv0.0.0-20180116102854-5a71ef0e047dgo.mod
Gogithub.com/adrg/xdgv0.5.3go.mod
Gogithub.com/anchore/bubblyv0.0.0-20231115134915-def0aba654a9go.mod
Gogithub.com/anchore/cliov0.0.0-20250319180342-2cfe4b0cb716go.mod
Gogithub.com/anchore/fangsv0.0.0-20250319222917-446a1e748ec2go.mod
Gogithub.com/anchore/go-collectionsv0.0.0-20251016125210-a3c352120e8cgo.mod
Gogithub.com/anchore/go-homedirv0.0.0-20250319154043-c29668562e4dgo.mod
Gogithub.com/anchore/go-loggerv0.0.0-20250318195838-07ae343dd722go.mod
Gogithub.com/anchore/go-macholibrev0.0.0-20220308212642-53e6d0aaf6fbgo.mod
Gogithub.com/anchore/go-rpmdbv0.0.0-20250516171929-f77691e1faecgo.mod
Gogithub.com/anchore/go-syncv0.0.0-20250326131806-4eda43a485b6go.mod
Gogithub.com/anchore/go-versionv1.2.2-0.20200701162849-18adb9c92b9bgo.mod
Gogithub.com/anchore/packageurl-gov0.1.1-0.20250220190351-d62adb6e1115go.mod
Gogithub.com/anchore/stereoscopev0.1.22go.mod
Gogithub.com/aquasecurity/go-pep440-versionv0.0.1go.mod
Gogithub.com/bitnami/go-versionv0.0.0-20250131085805-b1f57a8634efgo.mod
Gogithub.com/blakesmith/arv0.0.0-20190502131153-809d4375e1fbgo.mod
Gogithub.com/bmatcuk/doublestar/v4v4.10.0go.mod
Gogithub.com/charmbracelet/bubblesv1.0.0go.mod
Gogithub.com/charmbracelet/bubbleteav1.3.10go.mod
Gogithub.com/charmbracelet/lipglossv1.1.0go.mod
Gogithub.com/dave/jenniferv1.7.1go.mod
Gogithub.com/deitch/magicv0.0.0-20230404182410-1ff89d7342dago.mod
Gogithub.com/diskfs/go-diskfsv1.7.0go.mod
Gogithub.com/distribution/referencev0.6.0go.mod
Gogithub.com/dustin/go-humanizev1.0.1go.mod
Gogithub.com/elliotchance/phpserializev1.4.0go.mod
Gogithub.com/facebookincubator/nvdtoolsv0.1.5go.mod
Gogithub.com/github/go-spdx/v2v2.4.0go.mod
Gogithub.com/gkampitakis/go-snapsv0.5.21go.mod
Gogithub.com/go-git/go-billy/v5v5.8.0go.mod
Gogithub.com/go-git/go-git/v5v5.17.0go.mod
Gogithub.com/go-test/deepv1.1.1go.mod
Gogithub.com/go-viper/mapstructure/v2v2.5.0go.mod
Gogithub.com/gohugoio/hashstructurev0.6.0go.mod
Gogithub.com/google/go-cmpv0.7.0go.mod
Gogithub.com/google/go-containerregistryv0.21.2go.mod
Gogithub.com/google/licensecheckv0.3.1go.mod
Gogithub.com/google/uuidv1.6.0go.mod
Gogithub.com/gookit/colorv1.6.0go.mod
Gogithub.com/hashicorp/go-cleanhttpv0.5.2go.mod
Gogithub.com/hashicorp/go-getterv1.8.5go.mod
Gogithub.com/hashicorp/go-multierrorv1.1.1go.mod
Gogithub.com/hashicorp/hcl/v2v2.24.0go.mod
Gogithub.com/iancoleman/strcasev0.3.0go.mod
Gogithub.com/invopop/jsonschemav0.13.0go.mod
Gogithub.com/jedib0t/go-pretty/v6v6.7.8go.mod
Gogithub.com/jinzhu/copierv0.4.0go.mod
Gogithub.com/kastenhq/goversionv0.0.0-20230811215019-93b2f8823953go.mod
Gogithub.com/magiconair/propertiesv1.8.10go.mod
Gogithub.com/mholt/archivesv0.1.5go.mod
Gogithub.com/moby/sys/mountinfov0.7.2go.mod
Gogithub.com/nix-community/go-nixv0.0.0-20250101154619-4bdde671e0a1go.mod
Gogithub.com/olekukonko/tablewriterv1.1.4go.mod
Gogithub.com/opencontainers/go-digestv1.0.0go.mod
Gogithub.com/pelletier/go-tomlv1.9.5go.mod
Gogithub.com/quasilyte/go-ruleguard/dslv0.3.23go.mod
Gogithub.com/rust-secure-code/go-rustauditv0.0.0-20250226111315-e20ec32e963cgo.mod
Gogithub.com/saintfish/chardetv0.0.0-20230101081208-5e3ef4b5456dgo.mod
Gogithub.com/sanity-io/litterv1.5.8go.mod
Gogithub.com/sassoftware/go-rpmutilsv0.4.0go.mod
Gogithub.com/scylladb/go-setv1.0.3-0.20200225121959-cc7b2070d91ego.mod
Gogithub.com/sergi/go-diffv1.4.0go.mod
Gogithub.com/spdx/gordfv0.0.0-20201111095634-7098f93598fbgo.mod
Gogithub.com/spdx/tools-golangv0.5.7go.mod
Gogithub.com/spf13/aferov1.15.0go.mod
Gogithub.com/spf13/cobrav1.10.2go.mod
Gogithub.com/stretchr/testifyv1.11.1go.mod
Gogithub.com/vbatts/go-mtreev0.7.0go.mod
Gogithub.com/vifraa/gopomv1.0.0go.mod
Gogithub.com/wagoodman/go-partybusv0.0.0-20230516145632-8ccac152c651go.mod
Gogithub.com/wagoodman/go-progressv0.0.0-20260303201901-10176f79b2c0go.mod
Gogithub.com/xeipuuv/gojsonschemav1.2.0go.mod
Gogithub.com/zyedidia/genericv1.2.2-0.20230320175451-4410d2372cb1go.mod
Gogo.uber.org/goleakv1.3.0go.mod
Gogo.yaml.in/yaml/v3v3.0.4go.mod
Gogolang.org/x/expv0.0.0-20251023183803-a4bb9ffd2546go.mod
Gogolang.org/x/modv0.34.0go.mod
Gogolang.org/x/netv0.52.0go.mod
Gomodernc.org/sqlitev1.46.2go.mod
Gogithub.com/goccy/go-yamlv1.19.2go.mod
Gogithub.com/ulikunitz/xzv0.5.15go.mod
Gogolang.org/x/timev0.15.0go.mod
Gogolang.org/x/toolsv0.43.0go.mod
Gogopkg.in/yaml.v3v3.0.1go.mod
Gogithub.com/acobaugh/osreleasev0.1.0go.mod
Gogithub.com/anmitsu/go-shlexv0.0.0-20200514113438-38f4b401e2bego.mod
Gogithub.com/cespare/xxhash/v2v2.3.0go.mod
Gogithub.com/gpustack/gguf-parser-gov0.24.0go.mod
Gogithub.com/wk8/go-ordered-map/v2v2.1.8go.mod
Todas las dependencias 333

Conjunto completo de dependencias resueltas según el grafo de dependencias de GitHub: 98 paquetes directos y 235 indirectos (transitivos). El cierre transitivo es completo cuando el repositorio incluye un lockfile.

RegistroPaqueteVersiónRelación
Gogithub.com/acarl005/stripansiv0.0.0-20180116102854-5a71ef0e047ddirecta
Gogithub.com/acobaugh/osreleasev0.1.0directa
Gogithub.com/adrg/xdgv0.5.3directa
Gogithub.com/anchore/bubblyv0.0.0-20231115134915-def0aba654a9directa
Gogithub.com/anchore/cliov0.0.0-20250319180342-2cfe4b0cb716directa
Gogithub.com/anchore/fangsv0.0.0-20250319222917-446a1e748ec2directa
Gogithub.com/anchore/go-collectionsv0.0.0-20251016125210-a3c352120e8cdirecta
Gogithub.com/anchore/go-homedirv0.0.0-20250319154043-c29668562e4ddirecta
Gogithub.com/anchore/go-loggerv0.0.0-20250318195838-07ae343dd722directa
Gogithub.com/anchore/go-macholibrev0.0.0-20220308212642-53e6d0aaf6fbdirecta
Gogithub.com/anchore/go-rpmdbv0.0.0-20250516171929-f77691e1faecdirecta
Gogithub.com/anchore/go-syncv0.0.0-20250326131806-4eda43a485b6directa
Gogithub.com/anchore/go-versionv1.2.2-0.20200701162849-18adb9c92b9bdirecta
Gogithub.com/anchore/packageurl-gov0.1.1-0.20250220190351-d62adb6e1115directa
Gogithub.com/anchore/stereoscopev0.1.22directa
Gogithub.com/anmitsu/go-shlexv0.0.0-20200514113438-38f4b401e2bedirecta
Gogithub.com/aquasecurity/go-pep440-versionv0.0.1directa
Gogithub.com/bitnami/go-versionv0.0.0-20250131085805-b1f57a8634efdirecta
Gogithub.com/blakesmith/arv0.0.0-20190502131153-809d4375e1fbdirecta
Gogithub.com/bmatcuk/doublestar/v4v4.10.0directa
Gogithub.com/burntsushi/tomlv1.6.0directa
Gogithub.com/cespare/xxhash/v2v2.3.0directa
Gogithub.com/charmbracelet/bubblesv1.0.0directa
Gogithub.com/charmbracelet/bubbleteav1.3.10directa
Gogithub.com/charmbracelet/lipglossv1.1.0directa
Gogithub.com/cyclonedx/cyclonedx-gov0.10.0directa
Gogithub.com/dave/jenniferv1.7.1directa
Gogithub.com/deitch/magicv0.0.0-20230404182410-1ff89d7342dadirecta
Gogithub.com/diskfs/go-diskfsv1.7.0directa
Gogithub.com/distribution/referencev0.6.0directa
Gogithub.com/dustin/go-humanizev1.0.1directa
Gogithub.com/elliotchance/phpserializev1.4.0directa
Gogithub.com/facebookincubator/nvdtoolsv0.1.5directa
Gogithub.com/github/go-spdx/v2v2.4.0directa
Gogithub.com/gkampitakis/go-snapsv0.5.21directa
Gogithub.com/go-git/go-billy/v5v5.8.0directa
Gogithub.com/go-git/go-git/v5v5.17.0directa
Gogithub.com/go-test/deepv1.1.1directa
Gogithub.com/go-viper/mapstructure/v2v2.2.1directa
Gogithub.com/go-viper/mapstructure/v2v2.5.0directa
Gogithub.com/goccy/go-yamlv1.19.2directa
Gogithub.com/gohugoio/hashstructurev0.6.0directa
Gogithub.com/google/go-cmpv0.7.0directa
Gogithub.com/google/go-containerregistryv0.21.2directa
Gogithub.com/google/licensecheckv0.3.1directa
Gogithub.com/google/uuidv1.6.0directa
Gogithub.com/gookit/colorv1.6.0directa
Gogithub.com/gpustack/gguf-parser-gov0.24.0directa
Gogithub.com/hashicorp/go-cleanhttpv0.5.2directa
Gogithub.com/hashicorp/go-getterv1.8.5directa
Gogithub.com/hashicorp/go-multierrorv1.1.1directa
Gogithub.com/hashicorp/hcl/v2v2.24.0directa
Gogithub.com/iancoleman/strcasev0.3.0directa
Gogithub.com/invopop/jsonschemav0.13.0directa
Gogithub.com/jedib0t/go-pretty/v6v6.7.8directa
Gogithub.com/jinzhu/copierv0.4.0directa
Gogithub.com/kastenhq/goversionv0.0.0-20230811215019-93b2f8823953directa
Gogithub.com/magiconair/propertiesv1.8.10directa
Gogithub.com/masterminds/semver/v3v3.4.0directa
Gogithub.com/masterminds/sprig/v3v3.3.0directa
Gogithub.com/mholt/archivesv0.1.5directa
Gogithub.com/moby/sys/mountinfov0.7.2directa
Gogithub.com/nix-community/go-nixv0.0.0-20250101154619-4bdde671e0a1directa
Gogithub.com/olekukonko/tablewriterv1.1.4directa
Gogithub.com/oneofone/xxhashv1.2.8directa
Gogithub.com/opencontainers/go-digestv1.0.0directa
Gogithub.com/pelletier/go-tomlv1.9.5directa
Gogithub.com/quasilyte/go-ruleguard/dslv0.3.23directa
Gogithub.com/rust-secure-code/go-rustauditv0.0.0-20250226111315-e20ec32e963cdirecta
Gogithub.com/saintfish/chardetv0.0.0-20230101081208-5e3ef4b5456ddirecta
Gogithub.com/sanity-io/litterv1.5.8directa
Gogithub.com/sassoftware/go-rpmutilsv0.4.0directa
Gogithub.com/scylladb/go-setv1.0.3-0.20200225121959-cc7b2070d91edirecta
Gogithub.com/sergi/go-diffv1.4.0directa
Gogithub.com/spdx/gordfv0.0.0-20201111095634-7098f93598fbdirecta
Gogithub.com/spdx/tools-golangv0.5.7directa
Gogithub.com/spf13/aferov1.12.0directa
Gogithub.com/spf13/aferov1.15.0directa
Gogithub.com/spf13/cobrav1.10.2directa
Gogithub.com/stretchr/testifyv1.10.0directa
Gogithub.com/stretchr/testifyv1.11.1directa
Gogithub.com/ulikunitz/xzv0.5.15directa
Gogithub.com/vbatts/go-mtreev0.7.0directa
Gogithub.com/vifraa/gopomv1.0.0directa
Gogithub.com/wagoodman/go-partybusv0.0.0-20230516145632-8ccac152c651directa
Gogithub.com/wagoodman/go-progressv0.0.0-20260303201901-10176f79b2c0directa
Gogithub.com/wk8/go-ordered-map/v2v2.1.8directa
Gogithub.com/xeipuuv/gojsonschemav1.2.0directa
Gogithub.com/zyedidia/genericv1.2.2-0.20230320175451-4410d2372cb1directa
Gogo.uber.org/goleakv1.3.0directa
Gogo.yaml.in/yaml/v3v3.0.4directa
Gogolang.org/x/expv0.0.0-20251023183803-a4bb9ffd2546directa
Gogolang.org/x/modv0.34.0directa
Gogolang.org/x/netv0.52.0directa
Gogolang.org/x/timev0.15.0directa
Gogolang.org/x/toolsv0.43.0directa
Gogopkg.in/yaml.v3v3.0.1directa
Gomodernc.org/sqlitev1.46.2directa
Gocel.dev/exprv0.25.1indirecta
Gocloud.google.com/gov0.123.0indirecta
Gocloud.google.com/go/authv0.18.1indirecta
Gocloud.google.com/go/auth/oauth2adaptv0.2.8indirecta
Gocloud.google.com/go/compute/metadatav0.9.0indirecta
Gocloud.google.com/go/iamv1.5.3indirecta
Gocloud.google.com/go/monitoringv1.24.3indirecta
Gocloud.google.com/go/storagev1.60.0indirecta
Gocyphar.com/go-pathrsv0.2.1indirecta
Godario.cat/mergov1.0.2indirecta
Gogithub.com/agext/levenshteinv1.2.1indirecta
Gogithub.com/anchore/go-lzov0.1.0indirecta
Gogithub.com/anchore/go-struct-converterv0.1.0indirecta
Gogithub.com/andybalholm/brotliv1.2.0indirecta
Gogithub.com/apparentlymart/go-textseg/v15v15.0.0indirecta
Gogithub.com/aquasecurity/go-versionv0.0.1indirecta
Gogithub.com/atotto/clipboardv0.1.4indirecta
Gogithub.com/aws/aws-sdk-go-v2v1.41.2indirecta
Gogithub.com/aws/aws-sdk-go-v2/aws/protocol/eventstreamv1.7.4indirecta
Gogithub.com/aws/aws-sdk-go-v2/configv1.32.10indirecta
Gogithub.com/aws/aws-sdk-go-v2/credentialsv1.19.10indirecta
Gogithub.com/aws/aws-sdk-go-v2/feature/ec2/imdsv1.18.18indirecta
Gogithub.com/aws/aws-sdk-go-v2/internal/configsourcesv1.4.18indirecta
Gogithub.com/aws/aws-sdk-go-v2/internal/endpoints/v2v2.7.18indirecta
Gogithub.com/aws/aws-sdk-go-v2/internal/iniv1.8.4indirecta
Gogithub.com/aws/aws-sdk-go-v2/internal/v4av1.4.17indirecta
Gogithub.com/aws/aws-sdk-go-v2/service/internal/accept-encodingv1.13.5indirecta
Gogithub.com/aws/aws-sdk-go-v2/service/internal/checksumv1.9.8indirecta
Gogithub.com/aws/aws-sdk-go-v2/service/internal/presigned-urlv1.13.18indirecta
Gogithub.com/aws/aws-sdk-go-v2/service/internal/s3sharedv1.19.17indirecta
Gogithub.com/aws/aws-sdk-go-v2/service/s3v1.96.0indirecta
Gogithub.com/aws/aws-sdk-go-v2/service/signinv1.0.6indirecta
Gogithub.com/aws/aws-sdk-go-v2/service/ssov1.30.11indirecta
Gogithub.com/aws/aws-sdk-go-v2/service/ssooidcv1.35.15indirecta
Gogithub.com/aws/aws-sdk-go-v2/service/stsv1.41.7indirecta
Gogithub.com/aws/smithy-gov1.24.1indirecta
Gogithub.com/aymanbagabas/go-osc52/v2v2.0.1indirecta
Gogithub.com/bahlo/generic-list-gov0.2.0indirecta
Gogithub.com/becheran/wildmatch-gov1.0.0indirecta
Gogithub.com/bgentry/go-netrcv0.0.0-20140422174119-9fd32a8b3d3dindirecta
Gogithub.com/bodgit/plumbingv1.3.0indirecta
Gogithub.com/bodgit/sevenzipv1.6.1indirecta
Gogithub.com/bodgit/windowsv1.0.1indirecta
Gogithub.com/buger/jsonparserv1.1.2indirecta
Gogithub.com/charmbracelet/colorprofilev0.4.1indirecta
Gogithub.com/charmbracelet/harmonicav0.2.0indirecta
Gogithub.com/charmbracelet/x/ansiv0.11.6indirecta
Gogithub.com/charmbracelet/x/cellbufv0.0.15indirecta
Gogithub.com/charmbracelet/x/termv0.2.2indirecta
Gogithub.com/clipperhouse/displaywidthv0.10.0indirecta
Gogithub.com/clipperhouse/uax29/v2v2.6.0indirecta
Gogithub.com/cloudflare/circlv1.6.3indirecta
Gogithub.com/cncf/xds/gov0.0.0-20251210132809-ee656c7534f5indirecta
Gogithub.com/containerd/cgroups/v3v3.1.2indirecta
Gogithub.com/containerd/containerd/apiv1.10.0indirecta
Gogithub.com/containerd/containerd/v2v2.2.1indirecta
Gogithub.com/containerd/continuityv0.4.5indirecta
Gogithub.com/containerd/errdefsv1.0.0indirecta
Gogithub.com/containerd/errdefs/pkgv0.3.0indirecta
Gogithub.com/containerd/fifov1.1.0indirecta
Gogithub.com/containerd/logv0.1.0indirecta
Gogithub.com/containerd/platformsv1.0.0-rc.2indirecta
Gogithub.com/containerd/pluginv1.0.0indirecta
Gogithub.com/containerd/stargz-snapshotter/estargzv0.18.2indirecta
Gogithub.com/containerd/ttrpcv1.2.7indirecta
Gogithub.com/containerd/typeurl/v2v2.2.3indirecta
Gogithub.com/cyphar/filepath-securejoinv0.6.0indirecta
Gogithub.com/datadog/zstdv1.5.5indirecta
Gogithub.com/davecgh/go-spewv1.1.1indirecta
Gogithub.com/davecgh/go-spewv1.1.2-0.20180830191138-d8f796af33ccindirecta
Gogithub.com/docker/cliv29.3.0+incompatibleindirecta
Gogithub.com/docker/distributionv2.8.3+incompatibleindirecta
Gogithub.com/docker/docker-credential-helpersv0.9.5indirecta
Gogithub.com/docker/go-connectionsv0.6.0indirecta
Gogithub.com/docker/go-unitsv0.5.0indirecta
Gogithub.com/dsnet/compressv0.0.2-0.20230904184137-39efe44ab707indirecta
Gogithub.com/emirpasic/godsv1.18.1indirecta
Gogithub.com/envoyproxy/go-control-plane/envoyv1.36.0indirecta
Gogithub.com/envoyproxy/protoc-gen-validatev1.3.0indirecta
Gogithub.com/erikgeiser/coninputv0.0.0-20211004153227-1c3628e74d0findirecta
Gogithub.com/fatih/colorv1.18.0indirecta
Gogithub.com/felixge/fgprofv0.9.5indirecta
Gogithub.com/felixge/httpsnoopv1.0.4indirecta
Gogithub.com/fsnotify/fsnotifyv1.8.0indirecta
Gogithub.com/fsnotify/fsnotifyv1.9.0indirecta
Gogithub.com/gabriel-vasile/mimetypev1.4.13indirecta
Gogithub.com/gkampitakis/ciinfov0.3.2indirecta
Gogithub.com/go-git/gcfgv1.5.1-0.20230307220236-3a3c6141e376indirecta
Gogithub.com/go-jose/go-jose/v4v4.1.3indirecta
Gogithub.com/go-logr/logrv1.4.3indirecta
Gogithub.com/go-logr/stdrv1.2.2indirecta
Gogithub.com/go-restruct/restructv1.2.0-alphaindirecta
Gogithub.com/gogo/protobufv1.3.2indirecta
Gogithub.com/golang/groupcachev0.0.0-20241129210726-2c02b8208cf8indirecta
Gogithub.com/google/pprofv0.0.0-20250317173921-a4b03ec1a45eindirecta
Gogithub.com/google/s2a-gov0.1.9indirecta
Gogithub.com/googleapis/enterprise-certificate-proxyv0.3.11indirecta
Gogithub.com/googleapis/gax-go/v2v2.17.0indirecta
Gogithub.com/googlecloudplatform/opentelemetry-operations-go/detectors/gcpv1.30.0indirecta
Gogithub.com/googlecloudplatform/opentelemetry-operations-go/exporter/metricv0.55.0indirecta
Gogithub.com/googlecloudplatform/opentelemetry-operations-go/internal/resourcemappingv0.55.0indirecta
Gogithub.com/hashicorp/aws-sdk-go-base/v2v2.0.0-beta.70indirecta
Gogithub.com/hashicorp/errwrapv1.1.0indirecta
Gogithub.com/hashicorp/go-versionv1.8.0indirecta
Gogithub.com/hashicorp/golang-lru/v2v2.0.7indirecta
Gogithub.com/henvic/httprettyv0.1.4indirecta
Gogithub.com/huandu/xstringsv1.5.0indirecta
Gogithub.com/inconshreveable/mousetrapv1.1.0indirecta
Gogithub.com/jbenet/go-contextv0.0.0-20150711004518-d14ea06fba99indirecta
Gogithub.com/json-iterator/gov1.1.12indirecta
Gogithub.com/kevinburke/ssh_configv1.2.0indirecta
Gogithub.com/klauspost/compressv1.18.4indirecta
Gogithub.com/klauspost/pgzipv1.2.6indirecta
Gogithub.com/kr/prettyv0.3.1indirecta
Gogithub.com/kr/textv0.2.0indirecta
Gogithub.com/lucasb-eyer/go-colorfulv1.3.0indirecta
Gogithub.com/mailru/easyjsonv0.7.7indirecta
Gogithub.com/maruel/naturalv1.1.1indirecta
Gogithub.com/masterminds/goutilsv1.1.1indirecta
Gogithub.com/mattn/go-colorablev0.1.14indirecta
Gogithub.com/mattn/go-isattyv0.0.20indirecta
Gogithub.com/mattn/go-localereaderv0.0.2-0.20220822084749-2491eb6c1c75indirecta
Gogithub.com/mattn/go-runewidthv0.0.19indirecta
Gogithub.com/mgutz/ansiv0.0.0-20200706080929-d51e80ef957dindirecta
Gogithub.com/microsoft/go-winiov0.6.2indirecta
Gogithub.com/microsoft/hcsshimv0.14.0-rc.1indirecta
Gogithub.com/mikelolasagasti/xzv1.0.1indirecta
Gogithub.com/minio/minlzv1.0.1indirecta
Gogithub.com/mitchellh/copystructurev1.2.0indirecta
Gogithub.com/mitchellh/go-homedirv1.1.0indirecta
Gogithub.com/mitchellh/go-wordwrapv1.0.1indirecta
Gogithub.com/mitchellh/reflectwalkv1.0.2indirecta
Gogithub.com/moby/docker-image-specv1.3.1indirecta
Gogithub.com/moby/lockerv1.0.1indirecta
Gogithub.com/moby/moby/apiv1.54.0indirecta
Gogithub.com/moby/moby/clientv0.3.0indirecta
Gogithub.com/moby/sys/sequentialv0.6.0indirecta
Gogithub.com/moby/sys/signalv0.7.1indirecta
Gogithub.com/moby/sys/userv0.4.0indirecta
Gogithub.com/moby/sys/usernsv0.1.0indirecta
Gogithub.com/modern-go/concurrentv0.0.0-20180306012644-bacd9c7ef1ddindirecta
Gogithub.com/modern-go/reflect2v1.0.3-0.20250322232337-35a7c28c31eeindirecta
Gogithub.com/muesli/ansiv0.0.0-20230316100256-276c6243b2f6indirecta
Gogithub.com/muesli/cancelreaderv0.2.2indirecta
Gogithub.com/muesli/termenvv0.16.0indirecta
Gogithub.com/ncruces/go-strftimev1.0.0indirecta
Gogithub.com/nwaples/rardecode/v2v2.2.0indirecta
Gogithub.com/olekukonko/catv0.0.0-20250911104152-50322a0618f6indirecta
Gogithub.com/olekukonko/errorsv1.2.0indirecta
Gogithub.com/olekukonko/llv0.1.6indirecta
Gogithub.com/opencontainers/image-specv1.1.1indirecta
Gogithub.com/opencontainers/runtime-specv1.3.0indirecta
Gogithub.com/opencontainers/selinuxv1.13.1indirecta
Gogithub.com/pborman/indentv1.2.1indirecta
Gogithub.com/pelletier/go-toml/v2v2.2.3indirecta
Gogithub.com/pelletier/go-toml/v2v2.2.4indirecta
Gogithub.com/pierrec/lz4/v4v4.1.22indirecta
Gogithub.com/pjbgf/sha1cdv0.3.2indirecta
Gogithub.com/pkg/errorsv0.9.1indirecta
Gogithub.com/pkg/profilev1.7.0indirecta
Gogithub.com/pkg/xattrv0.4.9indirecta
Gogithub.com/planetscale/vtprotobufv0.6.1-0.20240319094008-0393e58bdf10indirecta
Gogithub.com/pmezard/go-difflibv1.0.0indirecta
Gogithub.com/pmezard/go-difflibv1.0.1-0.20181226105442-5d4384ee4fb2indirecta
Gogithub.com/protonmail/go-cryptov1.4.0indirecta
Gogithub.com/remyoudompheng/bigfftv0.0.0-20230129092748-24d4a6f8daecindirecta
Gogithub.com/rivo/unisegv0.4.7indirecta
Gogithub.com/rogpeppe/go-internalv1.14.1indirecta
Gogithub.com/sagikazarmark/locaferov0.7.0indirecta
Gogithub.com/sahilm/fuzzyv0.1.1indirecta
Gogithub.com/shopspring/decimalv1.4.0indirecta
Gogithub.com/sirupsen/logrusv1.9.3indirecta
Gogithub.com/sirupsen/logrusv1.9.4indirecta
Gogithub.com/skeema/knownhostsv1.3.1indirecta
Gogithub.com/smallnest/ringbufferv0.0.0-20241116012123-461381446e3dindirecta
Gogithub.com/sorairolake/lzip-gov0.3.8indirecta
Gogithub.com/sourcegraph/concv0.3.0indirecta
Gogithub.com/spf13/castv1.7.1indirecta
Gogithub.com/spf13/pflagv1.0.10indirecta
Gogithub.com/spf13/pflagv1.0.6indirecta
Gogithub.com/spf13/viperv1.20.0indirecta
Gogithub.com/spf13/viperv1.20.1indirecta
Gogithub.com/spiffe/go-spiffe/v2v2.6.0indirecta
Gogithub.com/starry-s/zipv0.2.3indirecta
Gogithub.com/stretchr/objxv0.5.2indirecta
Gogithub.com/subosito/gotenvv1.6.0indirecta
Gogithub.com/sylabs/sif/v2v2.24.0indirecta
Gogithub.com/sylabs/squashfsv1.0.6indirecta
Gogithub.com/therootcompany/xzv1.0.1indirecta
Gogithub.com/tidwall/gjsonv1.18.0indirecta
Gogithub.com/tidwall/matchv1.1.1indirecta
Gogithub.com/tidwall/prettyv1.2.1indirecta
Gogithub.com/tidwall/sjsonv1.2.5indirecta
Gogithub.com/vbatts/tar-splitv0.12.2indirecta
Gogithub.com/xanzy/ssh-agentv0.3.3indirecta
Gogithub.com/xeipuuv/gojsonpointerv0.0.0-20190905194746-02993c407bfbindirecta
Gogithub.com/xeipuuv/gojsonreferencev0.0.0-20180127040603-bd5ef7bd5415indirecta
Gogithub.com/xi2/xzv0.0.0-20171230120015-48954b6210f8indirecta
Gogithub.com/xo/terminfov0.0.0-20220910002029-abceb7e1c41eindirecta
Gogithub.com/zclconf/go-ctyv1.16.3indirecta
Gogo.opencensus.iov0.24.0indirecta
Gogo.opentelemetry.io/auto/sdkv1.2.1indirecta
Gogo.opentelemetry.io/contrib/detectors/gcpv1.39.0indirecta
Gogo.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpcv0.63.0indirecta
Gogo.opentelemetry.io/contrib/instrumentation/net/http/otelhttpv0.61.0indirecta
Gogo.opentelemetry.io/otelv1.40.0indirecta
Gogo.opentelemetry.io/otel/metricv1.40.0indirecta
Gogo.opentelemetry.io/otel/sdkv1.40.0indirecta
Gogo.opentelemetry.io/otel/sdk/metricv1.40.0indirecta
Gogo.opentelemetry.io/otel/tracev1.40.0indirecta
Gogo.uber.org/atomicv1.9.0indirecta
Gogo.uber.org/multierrv1.10.0indirecta
Gogo.uber.org/multierrv1.9.0indirecta
Gogo.uber.org/zapv1.27.0indirecta
Gogo4.orgv0.0.0-20230225012048-214862532bf5indirecta
Gogolang.org/x/cryptov0.49.0indirecta
Gogolang.org/x/oauth2v0.36.0indirecta
Gogolang.org/x/syncv0.20.0indirecta
Gogolang.org/x/sysv0.33.0indirecta
Gogolang.org/x/sysv0.42.0indirecta
Gogolang.org/x/termv0.41.0indirecta
Gogolang.org/x/textv0.21.0indirecta
Gogolang.org/x/textv0.35.0indirecta
Gogolang.org/x/xerrorsv0.0.0-20231012003039-104605ab7028indirecta
Gogonum.org/v1/gonumv0.16.0indirecta
Gogoogle.golang.org/apiv0.267.0indirecta
Gogoogle.golang.org/genprotov0.0.0-20260128011058-8636f8732409indirecta
Gogoogle.golang.org/genproto/googleapis/apiv0.0.0-20260203192932-546029d2fa20indirecta
Gogoogle.golang.org/genproto/googleapis/rpcv0.0.0-20260203192932-546029d2fa20indirecta
Gogoogle.golang.org/grpcv1.79.3indirecta
Gogoogle.golang.org/protobufv1.36.11indirecta
Gogopkg.in/warnings.v0v0.1.2indirecta
Gomodernc.org/libcv1.70.0indirecta
Gomodernc.org/mathutilv1.7.1indirecta
Gomodernc.org/memoryv1.11.0indirecta
Avisos de dependencias 17

Este repositorio no publica ningún paquete que el índice resuelva, así que se evaluó su propio grafo de dependencias — 333 paquetes, que incluyen también fijaciones de desarrollo y prueba que nunca se distribuyen: 17 tienen avisos conocidos, de los cuales 5 son directas.

PaqueteVersiónRelaciónGravedadAvisosCorregido en
github.com/containerd/containerd/v2v2.2.1indirectacrítica122.3.2
golang.org/x/cryptov0.49.0indirectacrítica270.52.0
google.golang.org/grpcv1.79.3indirectacrítica11.82.1
github.com/go-git/go-billy/v5v5.8.0directaalta46.0.0-alpha.1
github.com/hashicorp/go-getterv1.8.5directaalta21.8.6
github.com/go-jose/go-jose/v4v4.1.3indirectaalta24.1.4
go.opentelemetry.io/otelv1.40.0indirectaalta21.41.0
go.opentelemetry.io/otel/sdkv1.40.0indirectaalta21.43.0
github.com/go-git/go-git/v5v5.17.0directamoderada146.0.0-alpha.4
github.com/go-viper/mapstructure/v2v2.2.1directamoderada42.4.0
golang.org/x/netv0.52.0directamoderada91.26.3
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstreamv1.7.4indirectamoderada21.97.3
github.com/aws/aws-sdk-go-v2/service/s3v1.96.0indirectamoderada21.97.3
golang.org/x/sysv0.33.0indirectadesconocida10.44.0
golang.org/x/sysv0.42.0indirectadesconocida10.44.0
golang.org/x/textv0.21.0indirectadesconocida10.39.0
golang.org/x/textv0.35.0indirectadesconocida10.39.0

Un aviso significa que la versión registrada en el grafo de dependencias cae dentro del rango afectado de un aviso. No se analiza la alcanzabilidad, y el grafo incluye fijaciones de desarrollo y prueba: un hallazgo puede referirse al utillaje y no al software distribuido.

Informe JSON sin procesar legible por máquina
{
  "data": {
    "repo": {
      "topics": [],
      "is_fork": true,
      "size_kb": 20330,
      "has_wiki": true,
      "homepage": null,
      "languages": {
        "Go": 5510197,
        "Shell": 49583,
        "Python": 5206,
        "Makefile": 6742,
        "Dockerfile": 1164
      },
      "pushed_at": "2026-03-30T13:43:39Z",
      "created_at": "2021-10-06T12:59:27Z",
      "owner_type": "User",
      "updated_at": "2026-03-30T13:32:40Z",
      "description": "CLI tool and library for generating a Software Bill of Materials from container images and filesystems",
      "is_archived": false,
      "is_disabled": false,
      "license_spdx": "Apache-2.0",
      "default_branch": "main",
      "license_spdx_raw": "Apache-2.0",
      "primary_language": "Go",
      "significant_languages": [
        "Go"
      ]
    },
    "owner": {
      "blog": "https://opensourcesecurity.io/",
      "name": "Josh Bressers",
      "type": "User",
      "login": "joshbressers",
      "company": "@anchore",
      "location": "localhost",
      "followers": 111,
      "avatar_url": "https://avatars.githubusercontent.com/u/1692786?v=4",
      "created_at": "2012-04-30T15:02:49Z",
      "is_verified": null,
      "public_repos": 109,
      "account_age_days": 5198
    },
    "license": {
      "state": "standard",
      "spdx_id": "Apache-2.0",
      "raw_spdx": "Apache-2.0",
      "file_present": true,
      "scorecard_found": true,
      "profile_has_license": false
    },
    "activity": {
      "releases": [
        {
          "tag": "v0.24.1",
          "kind": "patch",
          "published_at": "2021-09-27T22:31:59Z"
        },
        {
          "tag": "v0.24.0",
          "kind": "minor",
          "published_at": "2021-09-23T00:55:03Z"
        },
        {
          "tag": "v0.23.0",
          "kind": "minor",
          "published_at": "2021-09-13T17:06:23Z"
        },
        {
          "tag": "v0.22.0",
          "kind": "minor",
          "published_at": "2021-09-03T21:29:34Z"
        },
        {
          "tag": "v0.21.0",
          "kind": "minor",
          "published_at": "2021-08-20T17:50:28Z"
        },
        {
          "tag": "v0.20.0",
          "kind": "minor",
          "published_at": "2021-08-18T15:00:49Z"
        },
        {
          "tag": "v0.19.1",
          "kind": "patch",
          "published_at": "2021-06-30T17:10:00Z"
        },
        {
          "tag": "v0.19.0",
          "kind": "minor",
          "published_at": "2021-06-29T22:16:32Z"
        },
        {
          "tag": "v0.18.0",
          "kind": "minor",
          "published_at": "2021-06-29T18:28:09Z"
        },
        {
          "tag": "v0.17.1",
          "kind": "patch",
          "published_at": "2021-06-19T18:32:13Z"
        },
        {
          "tag": "v0.17.0",
          "kind": "minor",
          "published_at": "2021-06-04T16:50:22Z"
        },
        {
          "tag": "v0.16.1",
          "kind": "patch",
          "published_at": "2021-05-25T21:13:58Z"
        },
        {
          "tag": "v0.16.0",
          "kind": "minor",
          "published_at": "2021-05-25T19:01:02Z"
        },
        {
          "tag": "v0.15.2",
          "kind": "patch",
          "published_at": "2021-05-12T21:28:52Z"
        },
        {
          "tag": "v0.15.1",
          "kind": "patch",
          "published_at": "2021-04-22T20:38:09Z"
        },
        {
          "tag": "v0.15.0",
          "kind": "minor",
          "published_at": "2021-04-22T19:56:18Z"
        },
        {
          "tag": "v0.14.0",
          "kind": "minor",
          "published_at": "2021-03-20T16:23:57Z"
        },
        {
          "tag": "v0.13.1",
          "kind": "patch",
          "published_at": "2021-02-26T20:59:49Z"
        },
        {
          "tag": "v0.13.0",
          "kind": "minor",
          "published_at": "2021-02-25T18:47:13Z"
        },
        {
          "tag": "v0.12.7",
          "kind": "patch",
          "published_at": "2021-02-17T13:14:18Z"
        },
        {
          "tag": "v0.12.6",
          "kind": "patch",
          "published_at": "2021-02-05T16:26:40Z"
        },
        {
          "tag": "v0.12.5",
          "kind": "patch",
          "published_at": "2021-02-01T17:03:28Z"
        },
        {
          "tag": "v0.12.4",
          "kind": "patch",
          "published_at": "2021-01-27T16:51:40Z"
        },
        {
          "tag": "v0.12.3",
          "kind": "patch",
          "published_at": "2021-01-22T21:10:06Z"
        },
        {
          "tag": "v0.12.2",
          "kind": "patch",
          "published_at": "2021-01-06T02:32:24Z"
        },
        {
          "tag": "v0.12.1",
          "kind": "patch",
          "published_at": "2021-01-05T00:45:03Z"
        },
        {
          "tag": "v0.12.0",
          "kind": "minor",
          "published_at": "2021-01-04T21:50:35Z"
        },
        {
          "tag": "v0.11.1",
          "kind": "patch",
          "published_at": "2020-12-23T18:23:01Z"
        },
        {
          "tag": "v0.11.0",
          "kind": "minor",
          "published_at": "2020-12-18T21:59:30Z"
        },
        {
          "tag": "v0.10.0",
          "kind": "minor",
          "published_at": "2020-12-10T03:20:53Z"
        },
        {
          "tag": "v0.9.2",
          "kind": "patch",
          "published_at": "2020-12-03T21:32:24Z"
        },
        {
          "tag": "v0.9.1",
          "kind": "patch",
          "published_at": "2020-12-02T12:50:31Z"
        },
        {
          "tag": "v0.9.0",
          "kind": "minor",
          "published_at": "2020-11-30T16:37:44Z"
        },
        {
          "tag": "v0.8.0",
          "kind": "minor",
          "published_at": "2020-11-17T18:21:57Z"
        },
        {
          "tag": "v0.7.1",
          "kind": "patch",
          "published_at": "2020-11-12T14:36:20Z"
        },
        {
          "tag": "v0.7.0",
          "kind": "minor",
          "published_at": "2020-11-11T20:15:12Z"
        },
        {
          "tag": "v0.6.0",
          "kind": "minor",
          "published_at": "2020-11-09T19:18:48Z"
        },
        {
          "tag": "v0.5.1",
          "kind": "patch",
          "published_at": "2020-11-04T20:47:55Z"
        },
        {
          "tag": "v0.5.0",
          "kind": "minor",
          "published_at": "2020-10-30T19:14:32Z"
        },
        {
          "tag": "v0.4.1",
          "kind": "patch",
          "published_at": "2020-10-26T15:19:25Z"
        },
        {
          "tag": "v0.4.0",
          "kind": "minor",
          "published_at": "2020-10-23T15:06:51Z"
        },
        {
          "tag": "v0.3.0",
          "kind": "minor",
          "published_at": "2020-10-15T18:41:28Z"
        },
        {
          "tag": "v0.2.0",
          "kind": "minor",
          "published_at": "2020-10-08T18:37:06Z"
        },
        {
          "tag": "v0.1.0",
          "kind": "minor",
          "published_at": "2020-09-29T20:33:40Z"
        },
        {
          "tag": "v0.1.0-beta.5",
          "kind": "prerelease",
          "published_at": "2020-09-26T02:59:19Z"
        },
        {
          "tag": "v0.1.0-beta.4",
          "kind": "prerelease",
          "published_at": "2020-08-10T22:28:43Z"
        },
        {
          "tag": "v0.1.0-beta.3",
          "kind": "prerelease",
          "published_at": "2020-08-10T14:33:44Z"
        },
        {
          "tag": "v0.1.0-beta.2",
          "kind": "prerelease",
          "published_at": "2020-07-27T19:13:41Z"
        },
        {
          "tag": "v0.1.0-beta.1",
          "kind": "prerelease",
          "published_at": "2020-07-27T13:55:11Z"
        }
      ],
      "recent_commits": [
        {
          "oid": "d71b747cd1600ce4eefbfc2d449496c89e07aaef",
          "body": "…4684)\n\nBumps [slackapi/slack-github-action](https://github.com/slackapi/slack-github-action) from 2.1.1 to 3.0.1.\n- [Release notes](https://github.com/slackapi/slack-github-action/releases)\n- [Commits](https://github.com/slackapi/slack-github-action/compare/91efab103c0de0a537f72a35f6b8cda0ee76bf0a.\n[…]\nirect:production\n  update-type: version-update:semver-major\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump slackapi/slack-github-action from 2.1.1 to 3.0.1 (#…",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-03-26T15:12:33Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "58a8a95e26b20d08acc7d242fdb9b7490d4cc0ab",
          "body": "Bumps [marocchino/sticky-pull-request-comment](https://github.com/marocchino/sticky-pull-request-comment) from 2.9.4 to 3.0.2.\n- [Release notes](https://github.com/marocchino/sticky-pull-request-comment/releases)\n- [Commits](https://github.com/marocchino/sticky-pull-request-comment/compare/773744901\n[…]\nirect:production\n  update-type: version-update:semver-major\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump marocchino/sticky-pull-request-comment (#4685)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-03-25T23:27:59Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "78a21b9c88bd21f0eadfe4f0467b9052fb4fdb27",
          "body": "Bumps the go-minor-patch group with 2 updates: [github.com/gkampitakis/go-snaps](https://github.com/gkampitakis/go-snaps) and [modernc.org/sqlite](https://gitlab.com/cznic/sqlite).\n\n\nUpdates `github.com/gkampitakis/go-snaps` from 0.5.20 to 0.5.21\n- [Release notes](https://github.com/gkampitakis/go-s\n[…]\nsion-update:semver-patch\n  dependency-group: go-minor-patch\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump the go-minor-patch group with 2 updates (#4697)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-03-25T23:27:50Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "7d3882a4253dc46cca1d2a9f133bc73a260c96a0",
          "body": "… (#4699)\n\nBumps [actions/create-github-app-token](https://github.com/actions/create-github-app-token) from 2.2.1 to 3.0.0.\n- [Release notes](https://github.com/actions/create-github-app-token/releases)\n- [Commits](https://github.com/actions/create-github-app-token/compare/29824e69f54612133e76f7eaac\n[…]\nirect:production\n  update-type: version-update:semver-major\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump actions/create-github-app-token from 2.2.1 to 3.0.0…",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-03-25T23:27:31Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "673c85754ca0a8959bb64597e6166df526e375cc",
          "body": "Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>\nCo-authored-by: wagoodman <590471+wagoodman@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): update CPE dictionary index (#4689)",
          "author_name": "anchore-actions-token-generator[bot]",
          "author_login": "anchore-actions-token-generator[bot]",
          "committed_at": "2026-03-25T12:38:49Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "c5114fd745f51d092c2b3030e912366b2cef016a",
          "body": "Prevent some packages from being updated.\n\nSigned-off-by: Will Murphy <willmurphyscode@users.noreply.github.com>",
          "is_bot": false,
          "headline": "chore(deps): ignore some dependabot deps (#4696)",
          "author_name": "Will Murphy",
          "author_login": "willmurphyscode",
          "committed_at": "2026-03-24T12:12:50Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "f68a7cc899e2869e2ba6e13ae690430d92a2c2a8",
          "body": "Signed-off-by: Weston Steimel <author@code.w.steimel.me.uk>",
          "is_bot": false,
          "headline": "ci: further pr target code checkout assurances (#4695)",
          "author_name": "Weston Steimel",
          "author_login": "westonsteimel",
          "committed_at": "2026-03-24T11:16:16Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "7800b16529c4a52278cb5cccf57337656371ddc9",
          "body": "Signed-off-by: witchcraze <witchcraze@gmail.com>",
          "is_bot": false,
          "headline": "fix: update arangodb classifier and capture-snippet.sh (#4662)",
          "author_name": "witchcraze",
          "author_login": "witchcraze",
          "committed_at": "2026-03-23T20:29:39Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "834ddcb1c0c798db7554614f2b7236ed029dccf7",
          "body": "Signed-off-by: Keith Zantow <kzantow@gmail.com>",
          "is_bot": false,
          "headline": "fix: golang version file regex (#4694)",
          "author_name": "Keith Zantow",
          "author_login": "kzantow",
          "committed_at": "2026-03-23T19:56:29Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "f5d318d93431e9e458b8375fb58113980f8ecf58",
          "body": "…flow (#4693)\n\nSigned-off-by: Weston Steimel <author@code.w.steimel.me.uk>",
          "is_bot": false,
          "headline": "ci: add explicit ref to main and warning for pull_request_target work…",
          "author_name": "Weston Steimel",
          "author_login": "westonsteimel",
          "committed_at": "2026-03-23T16:45:18Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "8531e1917bf552197da23f4414ba0b5a69181082",
          "body": "Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>\nCo-authored-by: spiffcs <32073428+spiffcs@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): update tools to latest versions (#4690)",
          "author_name": "anchore-actions-token-generator[bot]",
          "author_login": "anchore-actions-token-generator[bot]",
          "committed_at": "2026-03-23T16:01:27Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "860126c650c2d05b63b83a3895e41268162315a3",
          "body": "Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>\nCo-authored-by: willmurphyscode <12529630+willmurphyscode@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): update anchore dependencies (#4681)",
          "author_name": "anchore-actions-token-generator[bot]",
          "author_login": "anchore-actions-token-generator[bot]",
          "committed_at": "2026-03-19T16:44:55Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "36639f136baf470505f0dfc4ef06e83249eb6d11",
          "body": "Signed-off-by: Will Murphy <willmurphyscode@users.noreply.github.com>",
          "is_bot": false,
          "headline": "chore(deps): bump github.com/buger/jsonsparser to v1.1.2 (#4680)",
          "author_name": "Will Murphy",
          "author_login": "willmurphyscode",
          "committed_at": "2026-03-19T15:08:18Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "f32238c26839b0ae2c7f7582bec8c8d332f9fdb8",
          "body": "Bumps the go-minor-patch group with 2 updates: [golang.org/x/net](https://github.com/golang/net) and [golang.org/x/tools](https://github.com/golang/tools).\n\n\nUpdates `golang.org/x/net` from 0.51.0 to 0.52.0\n- [Commits](https://github.com/golang/net/compare/v0.51.0...v0.52.0)\n\nUpdates `golang.org/x/t\n[…]\nsion-update:semver-minor\n  dependency-group: go-minor-patch\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump the go-minor-patch group with 2 updates (#4678)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-03-19T14:25:19Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "0c8eef65f0bd3720f9a8acf96e8178b77b6bdd48",
          "body": "Bumps [google.golang.org/grpc](https://github.com/grpc/grpc-go) from 1.78.0 to 1.79.3.\n- [Release notes](https://github.com/grpc/grpc-go/releases)\n- [Commits](https://github.com/grpc/grpc-go/compare/v1.78.0...v1.79.3)\n\n---\nupdated-dependencies:\n- dependency-name: google.golang.org/grpc\n  dependency-version: 1.79.3\n  dependency-type: indirect\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump google.golang.org/grpc from 1.78.0 to 1.79.3 (#4675)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-03-18T20:55:30Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "4d42f8af321629d5f8b0c5ed8607aa3d4e38378c",
          "body": "Bumps the go-minor-patch group with 2 updates: [github.com/hashicorp/go-getter](https://github.com/hashicorp/go-getter) and [golang.org/x/mod](https://github.com/golang/mod).\n\n\nUpdates `github.com/hashicorp/go-getter` from 1.8.4 to 1.8.5\n- [Release notes](https://github.com/hashicorp/go-getter/relea\n[…]\nsion-update:semver-minor\n  dependency-group: go-minor-patch\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump the go-minor-patch group with 2 updates (#4674)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-03-18T20:13:35Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "e38851143eaec96c0ca6b10a296ae10a301bff6e",
          "body": "* chore: centralize temp files and prefer streaming IO\n\nCatalogers that create temp files ad-hoc can easily forget cleanup,\nleaking files on disk. Similarly, io.ReadAll is convenient but risks\nOOM on large or malicious inputs.\n\nIntroduce internal/tmpdir to manage all cataloger temp storage under\na s\n[…]\n>\n\n* simplify supplement release to limitreader\n\nSigned-off-by: Will Murphy <willmurphyscode@users.noreply.github.com>\n\n---------\n\nSigned-off-by: Will Murphy <willmurphyscode@users.noreply.github.com>",
          "is_bot": false,
          "headline": "chore: centralize temp files and prefer streaming IO (#4668)",
          "author_name": "Will Murphy",
          "author_login": "willmurphyscode",
          "committed_at": "2026-03-18T14:53:51Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "a3dacf5ecdea6c9ccecb50deebeb9cbe06281314",
          "body": "Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>\nCo-authored-by: spiffcs <32073428+spiffcs@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): update tools to latest versions (#4663)",
          "author_name": "anchore-actions-token-generator[bot]",
          "author_login": "anchore-actions-token-generator[bot]",
          "committed_at": "2026-03-16T15:26:06Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "cccc9bf7f954bea49708da37ceb82d3be70d5039",
          "body": "Bumps the go-minor-patch group with 3 updates: [github.com/google/go-containerregistry](https://github.com/google/go-containerregistry), [github.com/olekukonko/tablewriter](https://github.com/olekukonko/tablewriter) and [golang.org/x/time](https://github.com/golang/time).\n\n\nUpdates `github.com/googl\n[…]\nsion-update:semver-minor\n  dependency-group: go-minor-patch\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump the go-minor-patch group with 3 updates (#4669)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-03-16T15:25:41Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "59f7725d0d8bfe291bfd796f2bb87277b7b45664",
          "body": "Bumps the actions-minor-patch group with 1 update in the / directory: [github/codeql-action](https://github.com/github/codeql-action).\n\n\nUpdates `github/codeql-action` from 4.32.3 to 4.32.6\n- [Release notes](https://github.com/github/codeql-action/releases)\n- [Changelog](https://github.com/github/co\n[…]\nupdate:semver-patch\n  dependency-group: actions-minor-patch\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump github/codeql-action (#4670)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-03-16T15:25:27Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "7a6b1575aee15f0f6bfbfe894c7b09ce56c12069",
          "body": "Bumps [docker/login-action](https://github.com/docker/login-action) from 3.7.0 to 4.0.0.\n- [Release notes](https://github.com/docker/login-action/releases)\n- [Commits](https://github.com/docker/login-action/compare/c94ce9fb468520275223c153574b00df6fe4bcc9...b45d80f862d83dbcd57f89517bcf500b2ab88fb2)\n\n[…]\nirect:production\n  update-type: version-update:semver-major\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump docker/login-action from 3.7.0 to 4.0.0 (#4671)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-03-16T15:25:16Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "92a6b36e890d28207acc1b98ede8e805005149cd",
          "body": "Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>\nCo-authored-by: wagoodman <590471+wagoodman@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): update CPE dictionary index (#4673)",
          "author_name": "anchore-actions-token-generator[bot]",
          "author_login": "anchore-actions-token-generator[bot]",
          "committed_at": "2026-03-16T15:25:05Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "7158535fe6f3971e1ceed0ea4e572a3bf5bced70",
          "body": "BUILDPLATFORM is automatically set to the host's platform in new Docker,\nso having it defined as an arg results in it being overridden by this\nautomatic value. Since it was always assigned to a literal string in the\ntest files, just use that string.\n\nAdditionally, image platform is better pulled fro\n[…]\ne\nimage config, in containerd store, so try that first.\n\nAdditionally, python3 is on PATH on new macs by default, but not python.\n\nSigned-off-by: Will Murphy <willmurphyscode@users.noreply.github.com>",
          "is_bot": false,
          "headline": "chore(tests): fix test fixture build on modern ARM Mac (#4666)",
          "author_name": "Will Murphy",
          "author_login": "willmurphyscode",
          "committed_at": "2026-03-11T13:37:40Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "75455f050ab028977a6b625165e2ad3644fcc845",
          "body": "Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>\nCo-authored-by: willmurphyscode <12529630+willmurphyscode@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): update anchore dependencies (#4631)",
          "author_name": "anchore-actions-token-generator[bot]",
          "author_login": "anchore-actions-token-generator[bot]",
          "committed_at": "2026-03-09T18:10:53Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "22e78c7be17479a6a03212be071894246052abb1",
          "body": "* chore(deps): update tools to latest versions\n\nSigned-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>\n\n* chore(lint): fix errors in new golangci-lint\n\nTwo fixes:\n\nFirst, replace sb.WriteString(fmt.Sprintf(...)) with fmt.Fprintf(&sb, ...)\nSecond, suppress errors w\n[…]\nff-by: Will Murphy <willmurphyscode@users.noreply.github.com>\nCo-authored-by: spiffcs <32073428+spiffcs@users.noreply.github.com>\nCo-authored-by: Will Murphy <willmurphyscode@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): update tools to latest versions (#4630)",
          "author_name": "anchore-actions-token-generator[bot]",
          "author_login": "anchore-actions-token-generator[bot]",
          "committed_at": "2026-03-09T16:17:09Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "d2461a9e0abd29e0c059a0d8cce3441f8fa64335",
          "body": "Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>\nCo-authored-by: wagoodman <590471+wagoodman@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): update SPDX license list (#4637)",
          "author_name": "anchore-actions-token-generator[bot]",
          "author_login": "anchore-actions-token-generator[bot]",
          "committed_at": "2026-03-09T15:02:47Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "01f0e332c2f12bd1d32b525fbd6e255159601573",
          "body": "Bumps [actions/download-artifact](https://github.com/actions/download-artifact) from 7.0.0 to 8.0.0.\n- [Release notes](https://github.com/actions/download-artifact/releases)\n- [Commits](https://github.com/actions/download-artifact/compare/37930b1c2abaa49bbe596cd826c3c89aef350131...70fc10c6e5e1ce46ad\n[…]\nirect:production\n  update-type: version-update:semver-major\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump actions/download-artifact from 7.0.0 to 8.0.0 (#4658)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-03-09T14:37:33Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "c88051d74ec3f1dd83fa5d04e8e910fe49c0bf1d",
          "body": "…638)\n\nBumps [github.com/cloudflare/circl](https://github.com/cloudflare/circl) from 1.6.1 to 1.6.3.\n- [Release notes](https://github.com/cloudflare/circl/releases)\n- [Commits](https://github.com/cloudflare/circl/compare/v1.6.1...v1.6.3)\n\n---\nupdated-dependencies:\n- dependency-name: github.com/cloud\n[…]\nrcl\n  dependency-version: 1.6.3\n  dependency-type: indirect\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump github.com/cloudflare/circl from 1.6.1 to 1.6.3 (#4…",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-03-09T14:34:11Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "7d3d1c6237c6bc67c609b320258a1b3c574542ed",
          "body": "…with 2 updates (#4657)\n\nBumps the actions-minor-patch group with 2 updates in the / directory: [actions/setup-go](https://github.com/actions/setup-go) and [anchore/sbom-action](https://github.com/anchore/sbom-action).\nBumps the actions-minor-patch group with 1 update in the /.github/actions/bootstr\n[…]\nupdate:semver-minor\n  dependency-group: actions-minor-patch\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump the actions-minor-patch group across 2 directories …",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-03-09T14:33:14Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "dcba765d86b5583f153c011db453f115273c44d9",
          "body": "Bumps [actions/upload-artifact](https://github.com/actions/upload-artifact) from 6.0.0 to 7.0.0.\n- [Release notes](https://github.com/actions/upload-artifact/releases)\n- [Commits](https://github.com/actions/upload-artifact/compare/b7c566a772e6b6bfb58ed0dc250532a479d7789f...bbbca2ddaa5d8feaa63e36b76f\n[…]\nirect:production\n  update-type: version-update:semver-major\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump actions/upload-artifact from 6.0.0 to 7.0.0 (#4659)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-03-09T14:32:22Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "2c201469c32eadfef87cea8263fe2cbfaf06bb1a",
          "body": "…(#4646)\n\nBumps [go.opentelemetry.io/otel/sdk](https://github.com/open-telemetry/opentelemetry-go) from 1.39.0 to 1.40.0.\n- [Release notes](https://github.com/open-telemetry/opentelemetry-go/releases)\n- [Changelog](https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md)\n- [Commits\n[…]\ndk\n  dependency-version: 1.40.0\n  dependency-type: indirect\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump go.opentelemetry.io/otel/sdk from 1.39.0 to 1.40.0 …",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-03-09T14:29:46Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "c583da1c15ebc36c5cb35d260bf3d1b31a26d1b7",
          "body": "Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>\nCo-authored-by: wagoodman <590471+wagoodman@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): update CPE dictionary index (#4647)",
          "author_name": "anchore-actions-token-generator[bot]",
          "author_login": "anchore-actions-token-generator[bot]",
          "committed_at": "2026-03-09T14:26:42Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "22014b6022a49a160dbcbdaa9c486a691ac6dafd",
          "body": "…updates (#4661)\n\nBumps the go-minor-patch group with 5 updates in the / directory:\n\n| Package | From | To |\n| --- | --- | --- |\n| [github.com/github/go-spdx/v2](https://github.com/github/go-spdx) | `2.3.6` | `2.4.0` |\n| [github.com/go-git/go-billy/v5](https://github.com/go-git/go-billy) | `5.7.0` |\n[…]\nsion-update:semver-minor\n  dependency-group: go-minor-patch\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump the go-minor-patch group across 1 directory with 5 …",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-03-09T14:20:06Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "b5e85c3ea54b7307337c3e570145ba4ec0436873",
          "body": "* migrate fixtures to testdata\n\nSigned-off-by: Alex Goodman <wagoodman@users.noreply.github.com>\n\n* fix: correct broken symlinks after testdata migration\n\nThe migration from test-fixtures to testdata broke several symlinks:\n- elf-test-fixtures symlinks pointed to old test-fixtures paths\n- elf-test-f\n[…]\nrs.noreply.github.com>\n\n* bump stereoscope commit to main\n\nSigned-off-by: Alex Goodman <wagoodman@users.noreply.github.com>\n\n---------\n\nSigned-off-by: Alex Goodman <wagoodman@users.noreply.github.com>",
          "is_bot": false,
          "headline": "chore: migrate fixtures to testdata (#4651)",
          "author_name": "Alex Goodman",
          "author_login": "wagoodman",
          "committed_at": "2026-03-06T19:42:04Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "35278f3d3d78ee9dd708c75096fc7481f491e180",
          "body": "Signed-off-by: Dimitri John Ledkov <dimitri.ledkov@surgut.co.uk>\nSigned-off-by: Keith Zantow <kzantow@gmail.com>\nCo-authored-by: Keith Zantow <kzantow@gmail.com>",
          "is_bot": false,
          "headline": "fix(java): improve lz4 detection (#4642)",
          "author_name": "Dimitri John Ledkov",
          "author_login": "xnox",
          "committed_at": "2026-02-27T19:38:05Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "db76d85d51632c5ebe077b024206fb77f182bbc8",
          "body": "Signed-off-by: Paweł Pałucha <pawel.palucha@chainguard.dev>",
          "is_bot": false,
          "headline": "fix: use correct hashes for empty files (#4620)",
          "author_name": "Paweł Pałucha",
          "author_login": "ppalucha",
          "committed_at": "2026-02-24T14:52:29Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "e9e7e20cc8ca75334403716e733ac953a5f514ec",
          "body": "Signed-off-by: witchcraze <witchcraze@gmail.com>",
          "is_bot": false,
          "headline": "fix: grafana classifier (#4635)",
          "author_name": "witchcraze",
          "author_login": "witchcraze",
          "committed_at": "2026-02-23T14:38:02Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "eb072deb9ce0395e88523654df5483c2166ce7ea",
          "body": "Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>\nCo-authored-by: wagoodman <590471+wagoodman@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): update CPE dictionary index (#4636)",
          "author_name": "anchore-actions-token-generator[bot]",
          "author_login": "anchore-actions-token-generator[bot]",
          "committed_at": "2026-02-23T13:19:30Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "f4fc2d669a1b9c38292ce94e53d2ee352df5441e",
          "body": "Bumps the actions-minor-patch group with 1 update in the / directory: [github/codeql-action](https://github.com/github/codeql-action).\n\n\nUpdates `github/codeql-action` from 4.31.10 to 4.32.3\n- [Release notes](https://github.com/github/codeql-action/releases)\n- [Changelog](https://github.com/github/c\n[…]\nupdate:semver-minor\n  dependency-group: actions-minor-patch\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump github/codeql-action (#4634)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-02-20T13:41:46Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "f5110f109a0d2682664463857fc9098df14a7441",
          "body": "….0 (#4633)\n\nBumps [github.com/charmbracelet/bubbles](https://github.com/charmbracelet/bubbles) from 0.21.1 to 1.0.0.\n- [Release notes](https://github.com/charmbracelet/bubbles/releases)\n- [Commits](https://github.com/charmbracelet/bubbles/compare/v0.21.1...v1.0.0)\n\n---\nupdated-dependencies:\n- depen\n[…]\nirect:production\n  update-type: version-update:semver-major\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump github.com/charmbracelet/bubbles from 0.21.1 to 1.0…",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-02-20T13:41:21Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "612eadb22eb4d7ec9047a063ade3974fd8487e7c",
          "body": "Bumps the go-minor-patch group with 5 updates:\n\n| Package | From | To |\n| --- | --- | --- |\n| [golang.org/x/mod](https://github.com/golang/mod) | `0.32.0` | `0.33.0` |\n| [golang.org/x/net](https://github.com/golang/net) | `0.49.0` | `0.50.0` |\n| [modernc.org/sqlite](https://gitlab.com/cznic/sqlite) \n[…]\nsion-update:semver-minor\n  dependency-group: go-minor-patch\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump the go-minor-patch group with 5 updates (#4632)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-02-20T13:40:09Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "0a3f7bb06ee168495ee54b8b66fccb22a056fe99",
          "body": "…ams (#4629)\n\n* fix(deb and snaps): prevent excess reads\n\nPreviously, Syft could allocate excess memory or tempfile space if there\nwere highly compressed objects in deb archives, or at paths where the\nkernel changelog was expected by the snap cataloger. Use io.LimitReaders\nfor extracting parts of de\n[…]\ncom>\n\n* use streaming strategy for deb archives\n\nSigned-off-by: Will Murphy <willmurphyscode@users.noreply.github.com>\n\n---------\n\nSigned-off-by: Will Murphy <willmurphyscode@users.noreply.github.com>",
          "is_bot": false,
          "headline": "chore: call cleanup on tmpfile and replace some io.ReadAlls with stre…",
          "author_name": "Will Murphy",
          "author_login": "willmurphyscode",
          "committed_at": "2026-02-17T22:32:35Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "2fe5f9c7b897f44acc23c98531283c5862ba5198",
          "body": "---------\nSigned-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com>",
          "is_bot": false,
          "headline": "fix: bumps go mod version to 1.25; ci takes latest patch (#4628)",
          "author_name": "Christopher Angelo Phillips",
          "author_login": "spiffcs",
          "committed_at": "2026-02-17T17:04:51Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "f70631a7193f597c64820ba838c5566831241959",
          "body": "* chore(deps): update tools to latest versions\n\nSigned-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>\n\n* chore: ci rules revive\n\nSigned-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com>\n\n---------\n\nSigned-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>\nSigned-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com>\nCo-authored-by: spiffcs <32073428+spiffcs@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): update tools to latest versions (#4614)",
          "author_name": "anchore-actions-token-generator[bot]",
          "author_login": "anchore-actions-token-generator[bot]",
          "committed_at": "2026-02-17T16:19:37Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "0bb3741c87788be36cbeaa5b93212fc4db8ca5c2",
          "body": "…th 2 updates (#4622)\n\nBumps the actions-minor-patch group with 2 updates in the / directory: [anchore/sbom-action](https://github.com/anchore/sbom-action) and [zizmorcore/zizmor-action](https://github.com/zizmorcore/zizmor-action).\n\n\nUpdates `anchore/sbom-action` from 0.21.1 to 0.22.2\n- [Release no\n[…]\nupdate:semver-minor\n  dependency-group: actions-minor-patch\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump the actions-minor-patch group across 1 directory wi…",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-02-17T16:16:26Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "458ebbbff823dadf00d16fe5cf1412937765d707",
          "body": "Bumps the go-minor-patch group with 2 updates: [github.com/CycloneDX/cyclonedx-go](https://github.com/CycloneDX/cyclonedx-go) and [github.com/charmbracelet/bubbles](https://github.com/charmbracelet/bubbles).\n\n\nUpdates `github.com/CycloneDX/cyclonedx-go` from 0.9.3 to 0.10.0\n- [Release notes](https:/\n[…]\nsion-update:semver-patch\n  dependency-group: go-minor-patch\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump the go-minor-patch group with 2 updates (#4621)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-02-17T15:14:13Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "fb3f560e439192ae91fa6e2885868d3462673e10",
          "body": "Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>\nCo-authored-by: wagoodman <590471+wagoodman@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): update CPE dictionary index (#4623)",
          "author_name": "anchore-actions-token-generator[bot]",
          "author_login": "anchore-actions-token-generator[bot]",
          "committed_at": "2026-02-17T14:50:12Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "89b901b20ba8d1fc5406b837ef7cf9fe72c50a2d",
          "body": "The namespace value of `redhat` signifies this as an RPM package\nproduced and distributed by Red Hat.\n\nSigned-off-by: Scott Hebert <scoheb@gmail.com>",
          "is_bot": false,
          "headline": "Use redhat as namespace for hummingbird rpms (#4615)",
          "author_name": "Scott Hebert",
          "author_login": "scoheb",
          "committed_at": "2026-02-11T19:19:20Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "9872ff36ba5881f977b6e1b46c7bb33a1147f09e",
          "body": "Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>\nCo-authored-by: willmurphyscode <12529630+willmurphyscode@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): update anchore dependencies (#4613)",
          "author_name": "anchore-actions-token-generator[bot]",
          "author_login": "anchore-actions-token-generator[bot]",
          "committed_at": "2026-02-10T17:19:56Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "31c503124f148a35f9a7510642ad8eb370d33e2a",
          "body": "…#4612)\n\nBumps [github.com/go-git/go-git/v5](https://github.com/go-git/go-git) from 5.16.4 to 5.16.5.\n- [Release notes](https://github.com/go-git/go-git/releases)\n- [Commits](https://github.com/go-git/go-git/compare/v5.16.4...v5.16.5)\n\n---\nupdated-dependencies:\n- dependency-name: github.com/go-git/g\n[…]\nndency-version: 5.16.5\n  dependency-type: direct:production\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump github.com/go-git/go-git/v5 from 5.16.4 to 5.16.5 (…",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-02-10T13:25:31Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "2c5e193f7a27217a8a25d2063874fc396f907468",
          "body": "---------\nSigned-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com>\nSigned-off-by: Alex Goodman <wagoodman@users.noreply.github.com>\nCo-authored-by: Alex Goodman <wagoodman@users.noreply.github.com>",
          "is_bot": false,
          "headline": "feat: Add support for scanning GGUF models from OCI registries (#4335)",
          "author_name": "Christopher Angelo Phillips",
          "author_login": "spiffcs",
          "committed_at": "2026-02-09T21:05:52Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "3a23cfff1d13e662c55b6e2e8b9c411018e1c471",
          "body": "Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>\nCo-authored-by: wagoodman <590471+wagoodman@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): update CPE dictionary index (#4610)",
          "author_name": "anchore-actions-token-generator[bot]",
          "author_login": "anchore-actions-token-generator[bot]",
          "committed_at": "2026-02-09T03:02:34Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "443de210ca819ab1910aa0410eb2400a3409cb36",
          "body": "Bumps the go-minor-patch group with 1 update: [github.com/bmatcuk/doublestar/v4](https://github.com/bmatcuk/doublestar).\n\n\nUpdates `github.com/bmatcuk/doublestar/v4` from 4.9.2 to 4.10.0\n- [Release notes](https://github.com/bmatcuk/doublestar/releases)\n- [Commits](https://github.com/bmatcuk/doublest\n[…]\nsion-update:semver-minor\n  dependency-group: go-minor-patch\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump github.com/bmatcuk/doublestar/v4 (#4606)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-02-06T18:20:24Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "1af8b1acaabf4d0603fe9d1c15b1a5c54bce0e1c",
          "body": "…with 2 updates (#4607)\n\nBumps the actions-minor-patch group with 1 update in the / directory: [docker/login-action](https://github.com/docker/login-action).\nBumps the actions-minor-patch group with 1 update in the /.github/actions/bootstrap directory: [actions/cache](https://github.com/actions/cach\n[…]\nupdate:semver-patch\n  dependency-group: actions-minor-patch\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump the actions-minor-patch group across 2 directories …",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-02-06T18:20:12Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "c185657d71f1786ebf40bc89ec1f448c27bb5bde",
          "body": "---------\nSigned-off-by: Rez Moss <hi@rezmoss.com>\nSigned-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com>\nCo-authored-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com>",
          "is_bot": false,
          "headline": "feat: add yarn lock dev dep detection; fixed #4548",
          "author_name": "Rez Moss",
          "author_login": "rezmoss",
          "committed_at": "2026-02-05T22:27:17Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "48ee12be0c1d7c24d91ea808a65f3eb4ff5319e8",
          "body": "Otherwise sometimes the test that reads will run during the test that\nwrites and fail because the yaml file is in a partially written state.\n\nSigned-off-by: Will Murphy <willmurphyscode@users.noreply.github.com>",
          "is_bot": false,
          "headline": "ci(generate-capabilities): serialize writing and reading yaml (#4602)",
          "author_name": "Will Murphy",
          "author_login": "willmurphyscode",
          "committed_at": "2026-02-05T16:35:45Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "0b05f0ed69fb853a465fcc0b2b9de08bad96c752",
          "body": "Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>\nCo-authored-by: willmurphyscode <12529630+willmurphyscode@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): update CPE dictionary index (#4601)",
          "author_name": "anchore-actions-token-generator[bot]",
          "author_login": "anchore-actions-token-generator[bot]",
          "committed_at": "2026-02-05T15:29:00Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "138cb1be0ef8c352e4e721827c118e755baf158f",
          "body": "* fix(cpe-generation): set start and end date\n\nPreviously, the update job was silently failing because the NVD API\nreturns a 404 with no body if a start date is specified but not an end\ndate. Further, the API returns an error if more than 120 days are in\nrange of the start and end date.\n\nUpdate the \n[…]\nmperative code to page through the API results.\n\nSigned-off-by: Will Murphy <willmurphyscode@users.noreply.github.com>\n\n---------\n\nSigned-off-by: Will Murphy <willmurphyscode@users.noreply.github.com>",
          "is_bot": false,
          "headline": "fix(cpe-generation): set start and end date (#4600)",
          "author_name": "Will Murphy",
          "author_login": "willmurphyscode",
          "committed_at": "2026-02-05T14:54:24Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "6755377554b81879a9117abc1e006fd74177a3c8",
          "body": "NVD uses \"aomedia\" as the vendor for libavif CVEs. This change adds\nlibavif to the APK package CPE candidate additions with \"aomedia\" as\nan additional vendor, enabling Syft/Grype to match CVEs like\nCVE-2025-48174 and CVE-2025-48175.\n\nSigned-off-by: Peter Bücker <peter.buecker@gmail.com>",
          "is_bot": false,
          "headline": "fix: CPE detection for APK libavif to use aomedia vendor (#4597)",
          "author_name": "Peter Bücker",
          "author_login": "naag",
          "committed_at": "2026-02-05T09:11:44Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "540c08a41b60247fed21823569dc9f825d3bcd09",
          "body": "Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>\nCo-authored-by: spiffcs <32073428+spiffcs@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): update tools to latest versions (#4594)",
          "author_name": "anchore-actions-token-generator[bot]",
          "author_login": "anchore-actions-token-generator[bot]",
          "committed_at": "2026-02-04T14:26:09Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "add262944666021711374ab977fba837cff21ad6",
          "body": "Signed-off-by: Keith Zantow <kzantow@gmail.com>",
          "is_bot": false,
          "headline": "fix: further improve go binary classifier, including windows (#4593)",
          "author_name": "Keith Zantow",
          "author_login": "kzantow",
          "committed_at": "2026-02-03T15:29:00Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "d22139ef1a7fa2da4797347bb69421a0925c847e",
          "body": "Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>\nCo-authored-by: spiffcs <32073428+spiffcs@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): update tools to latest versions (#4589)",
          "author_name": "anchore-actions-token-generator[bot]",
          "author_login": "anchore-actions-token-generator[bot]",
          "committed_at": "2026-02-02T17:59:57Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "c94d1ccf1c6219da41cf1ad01c9c8473d62fdc12",
          "body": "---------\nSigned-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com>",
          "is_bot": false,
          "headline": "fix: lookup alternate scheme on url->licenseID (#4588)",
          "author_name": "Christopher Angelo Phillips",
          "author_login": "spiffcs",
          "committed_at": "2026-01-30T19:25:27Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "69d0898918c480c87f703e55d687095c2afe26f2",
          "body": "Bumps the go-minor-patch group with 2 updates: [github.com/olekukonko/tablewriter](https://github.com/olekukonko/tablewriter) and [modernc.org/sqlite](https://gitlab.com/cznic/sqlite).\n\n\nUpdates `github.com/olekukonko/tablewriter` from 1.1.2 to 1.1.3\n- [Release notes](https://github.com/olekukonko/t\n[…]\nsion-update:semver-patch\n  dependency-group: go-minor-patch\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump the go-minor-patch group with 2 updates (#4583)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-01-30T16:24:34Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "94c80885427218e91399cafd5b498342356033eb",
          "body": "---------\nSigned-off-by: Rez Moss <hi@rezmoss.com>\nSigned-off-by: Christopher Angelo Phillips <32073428+spiffcs@users.noreply.github.com>\nCo-authored-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com>",
          "is_bot": false,
          "headline": "feat: add Qt6 binary detection (#4550)",
          "author_name": "Rez Moss",
          "author_login": "rezmoss",
          "committed_at": "2026-01-30T15:35:33Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "e136ebc44fa5d2f5311fefce268334b8b8e3b8dc",
          "body": "…th 2 updates (#4584)\n\nBumps the actions-minor-patch group with 2 updates in the / directory: [peter-evans/create-pull-request](https://github.com/peter-evans/create-pull-request) and [zizmorcore/zizmor-action](https://github.com/zizmorcore/zizmor-action).\n\n\nUpdates `peter-evans/create-pull-request`\n[…]\nupdate:semver-minor\n  dependency-group: actions-minor-patch\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump the actions-minor-patch group across 1 directory wi…",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-01-30T15:33:32Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "0bca34f98656351d8b8bfc02064df06f7fb16c26",
          "body": "…age (#4500)\n\nSigned-off-by: Alan Pope <alan@popey.com>\nSigned-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com>\nCo-authored-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com>",
          "is_bot": false,
          "headline": "fix: snap cataloger incorrectly identifies snap container as deb pack…",
          "author_name": "Alan Pope",
          "author_login": null,
          "committed_at": "2026-01-30T15:19:26Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "8d836fb8b0b80f1702c9d1c57a8655307ac85b14",
          "body": "Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>\nCo-authored-by: spiffcs <32073428+spiffcs@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): update tools to latest versions (#4577)",
          "author_name": "anchore-actions-token-generator[bot]",
          "author_login": "anchore-actions-token-generator[bot]",
          "committed_at": "2026-01-27T20:18:18Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "9a250a4b4bec1660aef5a70b91d76e46f10f7fd0",
          "body": "---------\nSigned-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com>",
          "is_bot": false,
          "headline": "fix: update mixed case dependencies in python to be normalized (#4573)",
          "author_name": "Christopher Angelo Phillips",
          "author_login": "spiffcs",
          "committed_at": "2026-01-27T20:16:32Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "e8b4527bfbb7780cd70f2541fce4dca58803fb53",
          "body": "Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>\nCo-authored-by: willmurphyscode <12529630+willmurphyscode@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): update anchore dependencies (#4575)",
          "author_name": "anchore-actions-token-generator[bot]",
          "author_login": "anchore-actions-token-generator[bot]",
          "committed_at": "2026-01-27T10:14:26Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "d0bb042d7404c43f2aae2ce0bb8952d3362274dc",
          "body": "Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>\nCo-authored-by: spiffcs <32073428+spiffcs@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): update tools to latest versions (#4570)",
          "author_name": "anchore-actions-token-generator[bot]",
          "author_login": "anchore-actions-token-generator[bot]",
          "committed_at": "2026-01-26T17:25:31Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "c65d0236681800ee5ccf9b87ed99af40d2451d77",
          "body": "Signed-off-by: Keith Zantow <kzantow@gmail.com>",
          "is_bot": false,
          "headline": "feat: detect Debian version from /etc/debian_version (#4569)",
          "author_name": "Keith Zantow",
          "author_login": "kzantow",
          "committed_at": "2026-01-23T22:52:21Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "836f358cd4c413be291c5e4e15a96e93e1739e72",
          "body": "Signed-off-by: Keith Zantow <kzantow@gmail.com>",
          "is_bot": false,
          "headline": "fix: correctly report supporting evidence for binary packages (#4558)",
          "author_name": "Keith Zantow",
          "author_login": "kzantow",
          "committed_at": "2026-01-23T18:01:12Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "27b1219e9854bdb7ad0a39d5d21cce082c45e351",
          "body": "…with 3 updates (#4568)\n\nBumps the actions-minor-patch group with 3 updates in the / directory: [actions/checkout](https://github.com/actions/checkout), [actions/setup-go](https://github.com/actions/setup-go) and [github/codeql-action](https://github.com/github/codeql-action).\nBumps the actions-mino\n[…]\nupdate:semver-minor\n  dependency-group: actions-minor-patch\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump the actions-minor-patch group across 2 directories …",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-01-23T15:37:23Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "c0e0058c86c576a542bb93bea0874b4ae4def1c9",
          "body": "Bumps the go-minor-patch group with 6 updates:\n\n| Package | From | To |\n| --- | --- | --- |\n| [github.com/github/go-spdx/v2](https://github.com/github/go-spdx) | `2.3.5` | `2.3.6` |\n| [github.com/go-viper/mapstructure/v2](https://github.com/go-viper/mapstructure) | `2.4.0` | `2.5.0` |\n| [golang.org/\n[…]\nsion-update:semver-minor\n  dependency-group: go-minor-patch\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump the go-minor-patch group with 6 updates (#4567)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-01-23T15:37:10Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "a9fabb6c0f77b512c5712680bf52feb48f99a8ba",
          "body": "Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>\nCo-authored-by: spiffcs <32073428+spiffcs@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): update tools to latest versions (#4565)",
          "author_name": "anchore-actions-token-generator[bot]",
          "author_login": "anchore-actions-token-generator[bot]",
          "committed_at": "2026-01-22T18:04:45Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "795432441754b910d4456fa982eb7df64c98b432",
          "body": "Bumps the go-minor-patch group with 1 update in the / directory: [github.com/spdx/tools-golang](https://github.com/spdx/tools-golang).\n\n\nUpdates `github.com/spdx/tools-golang` from 0.5.6 to 0.5.7\n- [Release notes](https://github.com/spdx/tools-golang/releases)\n- [Changelog](https://github.com/spdx/t\n[…]\nsion-update:semver-patch\n  dependency-group: go-minor-patch\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump github.com/spdx/tools-golang (#4557)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-01-16T18:04:13Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "3e563d90d5025ec42719f2d0bdb355563a32577d",
          "body": "* ci: enable zizmor to fail PRs\n\nEnable zizmor (gh actions yaml linter) to fail builds in PRs. Fix any\noutstanding linting errors found by this tool.\n\nSigned-off-by: Will Murphy <willmurphyscode@users.noreply.github.com>\n\n* fix outdated version comments\n\nSigned-off-by: Will Murphy <willmurphyscode@users.noreply.github.com>\n\n---------\n\nSigned-off-by: Will Murphy <willmurphyscode@users.noreply.github.com>",
          "is_bot": false,
          "headline": "ci: enable zizmor to fail PRs (#4556)",
          "author_name": "Will Murphy",
          "author_login": "willmurphyscode",
          "committed_at": "2026-01-16T15:49:00Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "5987f463533aca5afc3625cff16090207a71b742",
          "body": "* chore: new slack action\n\nSigned-off-by: Will Murphy <willmurphyscode@users.noreply.github.com>\n\n* TEMP: exit 1 to test slack notify\n\nSigned-off-by: Will Murphy <willmurphyscode@users.noreply.github.com>\n\n* new slack integration everywhere\n\nSigned-off-by: Will Murphy <willmurphyscode@users.noreply.github.com>\n\n---------\n\nSigned-off-by: Will Murphy <willmurphyscode@users.noreply.github.com>",
          "is_bot": false,
          "headline": "Chore new slack action (#4553)",
          "author_name": "Will Murphy",
          "author_login": "willmurphyscode",
          "committed_at": "2026-01-16T11:26:40Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "63927ab49feea10a7fd88191acd615667227d338",
          "body": "Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>\nCo-authored-by: willmurphyscode <12529630+willmurphyscode@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): update anchore dependencies (#4552)",
          "author_name": "anchore-actions-token-generator[bot]",
          "author_login": "anchore-actions-token-generator[bot]",
          "committed_at": "2026-01-15T21:33:35Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "308b8030e78b2b64d862a6592a777d39a3ec647d",
          "body": "Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>\nCo-authored-by: spiffcs <32073428+spiffcs@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): update tools to latest versions (#4551)",
          "author_name": "anchore-actions-token-generator[bot]",
          "author_login": "anchore-actions-token-generator[bot]",
          "committed_at": "2026-01-15T12:30:10Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "6d8a03b3759ab3c74261fa0aeec127c8a3d3ce9f",
          "body": "Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>\nCo-authored-by: spiffcs <32073428+spiffcs@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): update tools to latest versions (#4545)",
          "author_name": "anchore-actions-token-generator[bot]",
          "author_login": "anchore-actions-token-generator[bot]",
          "committed_at": "2026-01-12T16:05:17Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "55a190aed1608103733d4f75c6454658fa69da22",
          "body": "Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>\nCo-authored-by: spiffcs <32073428+spiffcs@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): update tools to latest versions (#4542)",
          "author_name": "anchore-actions-token-generator[bot]",
          "author_login": "anchore-actions-token-generator[bot]",
          "committed_at": "2026-01-09T18:14:13Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "695bbcc4f9c686030f20a19ed8a8f7f64ffb816e",
          "body": "Bumps the go-minor-patch group with 4 updates: [github.com/vbatts/go-mtree](https://github.com/vbatts/go-mtree), [modernc.org/sqlite](https://gitlab.com/cznic/sqlite), [github.com/goccy/go-yaml](https://github.com/goccy/go-yaml) and [github.com/gpustack/gguf-parser-go](https://github.com/gpustack/gg\n[…]\nsion-update:semver-minor\n  dependency-group: go-minor-patch\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump the go-minor-patch group with 4 updates (#4543)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-01-09T18:13:56Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "6d206910f04b65cb47e1d89a82fddb8fb08bac97",
          "body": "Bumps the actions-minor-patch group with 1 update in the / directory: [anchore/sbom-action](https://github.com/anchore/sbom-action).\n\n\nUpdates `anchore/sbom-action` from 0.21.0 to 0.21.1\n- [Release notes](https://github.com/anchore/sbom-action/releases)\n- [Changelog](https://github.com/anchore/sbom-\n[…]\nupdate:semver-patch\n  dependency-group: actions-minor-patch\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump anchore/sbom-action (#4544)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-01-09T18:13:44Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "2f3a504acfba83982351fff32f78d19d5c31bbf4",
          "body": "* fixed #4550, catalog mongodb bin\n\nSigned-off-by: Rez Moss <hi@rezmoss.com>\n\n* fixed #4550, catalog mongodb bin\n\nSigned-off-by: Rez Moss <hi@rezmoss.com>\n\n---------\n\nSigned-off-by: Rez Moss <hi@rezmoss.com>",
          "is_bot": false,
          "headline": "Feat/catalog mongodb bin (#4541)",
          "author_name": "Rez Moss",
          "author_login": "rezmoss",
          "committed_at": "2026-01-08T17:18:51Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "d24e843c45c97c3ca4601ed6bdc2c9370900b452",
          "body": "Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>\nCo-authored-by: spiffcs <32073428+spiffcs@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): update tools to latest versions (#4537)",
          "author_name": "anchore-actions-token-generator[bot]",
          "author_login": "anchore-actions-token-generator[bot]",
          "committed_at": "2026-01-08T16:56:50Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "83a4528fff72da874958ba6d0ea7fe012552e408",
          "body": "A CI failure was observed where a generated file was only partly written\nwhen the CI job immediately tried to read it. Put in an fs.Sync call to\neliminate this flakiness.\n\nSigned-off-by: Will Murphy <willmurphyscode@users.noreply.github.com>",
          "is_bot": false,
          "headline": "chore: sync generated file immediately (#4538)",
          "author_name": "Will Murphy",
          "author_login": "willmurphyscode",
          "committed_at": "2026-01-08T14:01:17Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "11e871566b35765fe69da439fa3beaef123bc143",
          "body": "Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>\nCo-authored-by: willmurphyscode <12529630+willmurphyscode@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): update anchore dependencies (#4535)",
          "author_name": "anchore-actions-token-generator[bot]",
          "author_login": "anchore-actions-token-generator[bot]",
          "committed_at": "2026-01-08T12:16:49Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "cc1a7dfae896b46616d0885de4b93328aa5f0734",
          "body": "Signed-off-by: promalert <promalert@outlook.com>",
          "is_bot": false,
          "headline": "chore: fix some comments to improve readability (#4533)",
          "author_name": "promalert",
          "author_login": "promalert",
          "committed_at": "2026-01-07T15:48:40Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "3a3a86eb017bc3ccd290e38cfed2fa2ae8396830",
          "body": "* fixed #4430 exclude dev pnpm pkg\n\nSigned-off-by: Rez Moss <hi@rezmoss.com>\n\n* use existing dev deps option\n\nSigned-off-by: Alex Goodman <wagoodman@users.noreply.github.com>\n\n* fixed #4430 exclude dev pnpm pkg, add test\n\nSigned-off-by: Rez Moss <hi@rezmoss.com>\n\n* fixed #4430 exclude dev pnpm pkg, \n[…]\n<hi@rezmoss.com>\n\n---------\n\nSigned-off-by: Rez Moss <hi@rezmoss.com>\nSigned-off-by: Alex Goodman <wagoodman@users.noreply.github.com>\nCo-authored-by: Alex Goodman <wagoodman@users.noreply.github.com>",
          "is_bot": false,
          "headline": "fixed #4430 exclude dev pnpm pkg (#4487)",
          "author_name": "Rez Moss",
          "author_login": "rezmoss",
          "committed_at": "2026-01-07T15:39:16Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "6509b7079ee2ce7f2efc31ba35426c6d4ffb25b5",
          "body": "Signed-off-by: witchcraze <witchcraze@gmail.com>",
          "is_bot": false,
          "headline": "add istio classifier (#4521)",
          "author_name": "witchcraze",
          "author_login": "witchcraze",
          "committed_at": "2026-01-07T15:36:39Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "7f1d57d06fde14ec26566832dff44828ab5a4da9",
          "body": "Signed-off-by: Rez Moss <hi@rezmoss.com>",
          "is_bot": false,
          "headline": "feat: detect older bitnami img packages (#4532)",
          "author_name": "Rez Moss",
          "author_login": "rezmoss",
          "committed_at": "2026-01-07T15:07:33Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "ed339e4fed10912d7ed9b98c588ec38241fb020b",
          "body": "---------\nSigned-off-by: Alex Goodman <wagoodman@users.noreply.github.com>",
          "is_bot": false,
          "headline": "fix: ensure java image build failures stop the build (#4531)",
          "author_name": "Alex Goodman",
          "author_login": "wagoodman",
          "committed_at": "2026-01-06T16:43:51Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "3ea6a03cd060096fd67841759008bb2efc215371",
          "body": "* chore(deps): bump the go-minor-patch group with 3 updates\n\nBumps the go-minor-patch group with 3 updates: [github.com/BurntSushi/toml](https://github.com/BurntSushi/toml), [github.com/go-git/go-git/v5](https://github.com/go-git/go-git) and [github.com/invopop/jsonschema](https://github.com/invopop\n[…]\n Alex Goodman <wagoodman@users.noreply.github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>\nCo-authored-by: Alex Goodman <wagoodman@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump the go-minor-patch group with 3 updates (#4524)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-01-06T15:25:43Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "81dd9558714639a848d6a843988106c6ddb5d943",
          "body": "* add envoy classifier\nSigned-off-by: witchcraze <witchcraze@gmail.com>\n\n* add envoy classifier\nSigned-off-by: witchcraze <witchcraze@gmail.com>",
          "is_bot": false,
          "headline": "add envoy binary classifier (#4530)",
          "author_name": "witchcraze",
          "author_login": "witchcraze",
          "committed_at": "2026-01-06T13:45:01Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "48948ddb8fa886631fc920f4a66999e9eaba5634",
          "body": "Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>",
          "is_bot": false,
          "headline": "add container support for graalvm fixture (#4528)",
          "author_name": "Alex Goodman",
          "author_login": "wagoodman",
          "committed_at": "2026-01-05T19:18:12Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "63273b1b00da98af439be767505484ee61e5c5a5",
          "body": "…th 2 updates (#4525)\n\nBumps the actions-minor-patch group with 2 updates in the / directory: [docker/login-action](https://github.com/docker/login-action) and [zizmorcore/zizmor-action](https://github.com/zizmorcore/zizmor-action).\n\n\nUpdates `docker/login-action` from 3.5.0 to 3.6.0\n- [Release note\n[…]\nupdate:semver-minor\n  dependency-group: actions-minor-patch\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump the actions-minor-patch group across 1 directory wi…",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-01-05T17:48:30Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "92e523caa61d863bcb8d36205eb9ef90dd00f4c8",
          "body": "Bumps [actions/download-artifact](https://github.com/actions/download-artifact) from 6.0.0 to 7.0.0.\n- [Release notes](https://github.com/actions/download-artifact/releases)\n- [Commits](https://github.com/actions/download-artifact/compare/018cc2cf5baa6db3ef3c5f8a56943fffe632ef53...37930b1c2abaa49bbe\n[…]\nirect:production\n  update-type: version-update:semver-major\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump actions/download-artifact from 6.0.0 to 7.0.0 (#4526)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-01-05T17:48:20Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "9b33b8a3d61be74b65e6df790ab5199118f7b010",
          "body": "Bumps [actions/upload-artifact](https://github.com/actions/upload-artifact) from 4.4.3 to 6.0.0.\n- [Release notes](https://github.com/actions/upload-artifact/releases)\n- [Commits](https://github.com/actions/upload-artifact/compare/b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882...b7c566a772e6b6bfb58ed0dc25\n[…]\nirect:production\n  update-type: version-update:semver-major\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump actions/upload-artifact from 4.4.3 to 6.0.0 (#4527)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-01-05T17:48:13Z",
          "body_truncated": true,
          "is_coding_agent": false
        }
      ],
      "releases_count": 49,
      "commits_last_year": 375,
      "latest_release_at": "2021-09-27T22:31:59Z",
      "latest_release_tag": "v0.24.1",
      "releases_from_tags": true,
      "days_since_last_push": 116,
      "active_weeks_last_year": 34,
      "days_since_latest_release": 1761,
      "mean_days_between_releases": 11.1
    },
    "community": {
      "has_readme": false,
      "has_license": false,
      "has_description": false,
      "has_contributing": false,
      "health_percentage": null,
      "has_issue_template": false,
      "has_code_of_conduct": false,
      "has_pull_request_template": false
    },
    "ecosystem": {
      "packages": [
        {
          "name": "github.com/anchore/syft",
          "exists": true,
          "license": null,
          "keywords": [],
          "ecosystem": "go",
          "matches_repo": false,
          "registry_url": "https://pkg.go.dev/github.com/anchore/syft",
          "is_deprecated": false,
          "latest_version": "v1.49.0",
          "repository_url": "https://github.com/anchore/syft",
          "versions_count": 268,
          "total_downloads": null,
          "dependents_count": null,
          "deprecation_note": null,
          "maintainers_count": null,
          "monthly_downloads": null,
          "first_published_at": null,
          "latest_published_at": "2026-07-20T18:04:57Z",
          "latest_version_yanked": null,
          "days_since_latest_publish": 4
        }
      ]
    },
    "popularity": {
      "forks": 0,
      "stars": 0,
      "watchers": 0,
      "fork_history": {
        "days": [],
        "complete": true,
        "collected": 0,
        "total_forks": 0
      },
      "star_history": {
        "days": [],
        "complete": true,
        "collected": 0,
        "total_stars": 0,
        "collected_at": null
      },
      "open_issues_and_prs": 0
    },
    "ai_readiness": {
      "has_nix": false,
      "example_dirs": [
        "example",
        "examples",
        "sample"
      ],
      "has_llms_txt": false,
      "has_dockerfile": true,
      "has_mcp_signal": false,
      "bootstrap_files": [
        "Makefile",
        "Taskfile.yaml",
        "cmd/syft/internal/test/integration/testdata/Makefile",
        "schema/cyclonedx/Makefile",
        "syft/file/cataloger/executable/testdata/Makefile",
        "syft/file/cataloger/executable/testdata/elf/Makefile",
        "syft/file/cataloger/executable/testdata/elf/project/Makefile",
        "syft/file/cataloger/executable/testdata/shared-info/Makefile",
        "syft/file/cataloger/executable/testdata/shared-info/project/Makefile",
        "syft/file/cataloger/executable/testdata/shared-info/project/hello/Makefile",
        "syft/file/cataloger/executable/testdata/shared-info/project/libhello/Makefile",
        "syft/pkg/cataloger/binary/testdata/Makefile",
        "syft/pkg/cataloger/binary/testdata/elf-testdata/elfbinwithcorrupt/elfsrc/makefile",
        "syft/pkg/cataloger/binary/testdata/elf-testdata/elfbinwithcorrupt/makefile",
        "syft/pkg/cataloger/binary/testdata/elf-testdata/elfbinwithnestedlib/elfsrc/makefile",
        "syft/pkg/cataloger/binary/testdata/elf-testdata/elfbinwithnestedlib/makefile",
        "syft/pkg/cataloger/binary/testdata/elf-testdata/elfbinwithsisterlib/elfsrc1/makefile",
        "syft/pkg/cataloger/binary/testdata/elf-testdata/elfbinwithsisterlib/elfsrc2/makefile",
        "syft/pkg/cataloger/binary/testdata/elf-testdata/elfbinwithsisterlib/makefile",
        "syft/pkg/cataloger/dotnet/testdata/Makefile",
        "syft/pkg/cataloger/golang/testdata/Makefile",
        "syft/pkg/cataloger/golang/testdata/archs/Makefile",
        "syft/pkg/cataloger/internal/pe/testdata/Makefile",
        "syft/pkg/cataloger/java/testdata/Makefile",
        "syft/pkg/cataloger/java/testdata/jar-metadata/Makefile",
        "syft/pkg/cataloger/java/testdata/java-builds/Makefile",
        "syft/pkg/cataloger/kernel/testdata/Makefile",
        "syft/pkg/cataloger/redhat/testdata/Makefile",
        "test/cli/testdata/Makefile",
        "test/cli/testdata/image-java-spdx-tools/Makefile",
        "test/cli/testdata/registry/Makefile",
        "test/install/Makefile"
      ],
      "api_schema_files": [],
      "has_devcontainer": false,
      "typecheck_configs": [],
      "toolchain_manifests": [
        "cmd/syft/internal/test/integration/testdata/image-go-bin-arch-coverage/go.mod",
        "cmd/syft/internal/test/integration/testdata/image-pkg-coverage/pkgs/go/go.mod",
        "cmd/syft/internal/test/integration/testdata/image-pkg-coverage/pkgs/java/pom.xml",
        "cmd/syft/internal/test/integration/testdata/image-sbom-cataloger/go.mod",
        "go.mod",
        "syft/pkg/cataloger/dotnet/testdata/image-net2-app/src/helloworld.csproj",
        "syft/pkg/cataloger/dotnet/testdata/image-net6-asp-libman/src/LibManSample.csproj",
        "syft/pkg/cataloger/dotnet/testdata/image-net8-app-no-depjson/src/dotnetapp.csproj",
        "syft/pkg/cataloger/dotnet/testdata/image-net8-app-self-contained/src/dotnetapp.csproj",
        "syft/pkg/cataloger/dotnet/testdata/image-net8-app-single-file/src/dotnetapp.csproj",
        "syft/pkg/cataloger/dotnet/testdata/image-net8-app-with-runtime-nodepsjson/src/dotnetapp.csproj",
        "syft/pkg/cataloger/dotnet/testdata/image-net8-app-with-runtime/src/dotnetapp.csproj",
        "syft/pkg/cataloger/dotnet/testdata/image-net8-app/src/dotnetapp.csproj",
        "syft/pkg/cataloger/dotnet/testdata/image-net8-compile-target/src/helloworld.csproj",
        "syft/pkg/cataloger/dotnet/testdata/image-net8-ilrepack/src/dotnetapp.csproj",
        "syft/pkg/cataloger/dotnet/testdata/image-net8-privateassets/src/dotnetapp.csproj",
        "syft/pkg/cataloger/golang/internal/gotestdata/go-source/go.mod",
        "syft/pkg/cataloger/golang/testdata/archs/src/go.mod",
        "syft/pkg/cataloger/golang/testdata/corrupt/go.mod",
        "syft/pkg/cataloger/golang/testdata/glob-paths/src/go.mod",
        "syft/pkg/cataloger/golang/testdata/go-mod-fixtures/many-packages/go.mod",
        "syft/pkg/cataloger/golang/testdata/go-mod-fixtures/one-package/go.mod",
        "syft/pkg/cataloger/golang/testdata/go-mod-fixtures/relative-replace/go.mod",
        "syft/pkg/cataloger/golang/testdata/go-sum-hashes/go.mod",
        "syft/pkg/cataloger/golang/testdata/image-not-a-module/go.mod",
        "syft/pkg/cataloger/golang/testdata/image-small-upx/go.mod",
        "syft/pkg/cataloger/golang/testdata/image-small/go.mod",
        "syft/pkg/cataloger/internal/pe/testdata/image-dotnet31-single-file/src/hello.csproj",
        "syft/pkg/cataloger/internal/pe/testdata/image-dotnet5-single-file/src/hello.csproj",
        "syft/pkg/cataloger/internal/pe/testdata/image-dotnet6-single-file/src/hello.csproj",
        "syft/pkg/cataloger/java/internal/maven/testdata/local/child-1/pom.xml",
        "syft/pkg/cataloger/java/internal/maven/testdata/local/child-2/pom.xml",
        "syft/pkg/cataloger/java/internal/maven/testdata/local/child-3/pom.xml",
        "syft/pkg/cataloger/java/internal/maven/testdata/local/circular-1/pom.xml",
        "syft/pkg/cataloger/java/internal/maven/testdata/local/circular-2/pom.xml",
        "syft/pkg/cataloger/java/internal/maven/testdata/local/contains-child-1/pom.xml",
        "syft/pkg/cataloger/java/internal/maven/testdata/local/parent-1/pom.xml",
        "syft/pkg/cataloger/java/internal/maven/testdata/local/parent-2/pom.xml",
        "syft/pkg/cataloger/java/internal/maven/testdata/local/parent-3/pom.xml",
        "syft/pkg/cataloger/java/testdata/corrupt/pom.xml",
        "syft/pkg/cataloger/java/testdata/glob-paths/src/pom.xml",
        "syft/pkg/cataloger/java/testdata/gradle/build.gradle",
        "syft/pkg/cataloger/java/testdata/jar-metadata/api-all-2.0.0-sources/META-INF/maven/org.apache.directory.api/api-all/pom.xml",
        "syft/pkg/cataloger/java/testdata/jar-metadata/api-all-2.0.0-sources/META-INF/maven/org.apache.directory.api/api-asn1-api/pom.xml",
        "syft/pkg/cataloger/java/testdata/jar-metadata/com.fasterxml.jackson.core.jackson-core-2.15.2/META-INF/maven/com.fasterxml.jackson.core/jackson-core/pom.xml",
        "syft/pkg/cataloger/java/testdata/jar-metadata/commons-lang3-3.12.0/META-INF/maven/org.apache.commons-lang3/pom.xml",
        "syft/pkg/cataloger/java/testdata/jar-metadata/jackson-core-2.15.2/META-INF/maven/com.fasterxml.jackson.core/jackson-core/pom.xml",
        "syft/pkg/cataloger/java/testdata/jar-metadata/micronaut-aop-4.9.11/META-INF/maven/io.micronaut/micronaut-aop/pom.xml",
        "syft/pkg/cataloger/java/testdata/jar-metadata/multiple-matching-2.11.5/META-INF/maven/org.multiple/multiple-matching-1/pom.xml",
        "syft/pkg/cataloger/java/testdata/jar-metadata/multiple-matching-2.11.5/META-INF/maven/org.multiple/multiple-matching-2/pom.xml",
        "syft/pkg/cataloger/java/testdata/jar-metadata/multiple-matching-2.11.5/META-INF/maven/org.multiple/multiple-matching-3/pom.xml",
        "syft/pkg/cataloger/java/testdata/jar-metadata/opensaml-core-3.4.6/META-INF/maven/org.opensaml/opensaml-core/pom.xml",
        "syft/pkg/cataloger/java/testdata/jar-metadata/org.multiple-thename/META-INF/maven/com.multiple/thename/pom.xml",
        "syft/pkg/cataloger/java/testdata/jar-metadata/org.multiple-thename/META-INF/maven/org.multiple/thename/pom.xml",
        "syft/pkg/cataloger/java/testdata/java-builds/example-java-app/build.gradle",
        "syft/pkg/cataloger/java/testdata/java-builds/example-java-app/pom.xml",
        "syft/pkg/cataloger/java/testdata/java-builds/example-jenkins-plugin/pom.xml",
        "syft/pkg/cataloger/java/testdata/java-builds/example-sb-app/pom.xml",
        "syft/pkg/cataloger/java/testdata/pom/commons-text-1.10.0/pom.xml",
        "syft/pkg/cataloger/java/testdata/pom/example-java-app-maven/pom.xml",
        "syft/pkg/cataloger/java/testdata/pom/transitive-top-level/pom.xml",
        "syft/pkg/cataloger/rust/testdata/image-audit/Cargo.toml"
      ],
      "largest_source_bytes": 202860,
      "source_files_sampled": 1197,
      "oversized_source_files": 6,
      "agent_instruction_files": [],
      "agent_instruction_max_bytes": null
    },
    "dependencies": {
      "manifests": [
        "go.mod"
      ],
      "advisories": {
        "error": null,
        "scope": "repository_graph",
        "source": "osv",
        "findings": [
          {
            "name": "github.com/containerd/containerd/v2",
            "direct": false,
            "version": "v2.2.1",
            "severity": "critical",
            "ecosystem": "go",
            "cvss_score": 9.9,
            "advisory_ids": [
              "GHSA-33vj-92qq-66hc",
              "GHSA-cvxm-645q-p574",
              "GHSA-fqw6-gf59-qr4w",
              "GHSA-jpcc-p29g-p8mq",
              "GHSA-rgh6-rfwx-v388",
              "GHSA-xhf5-7wjv-pqxp",
              "GO-2026-5064",
              "GO-2026-5338",
              "GO-2026-5378",
              "GO-2026-5475"
            ],
            "fixed_version": "2.3.2",
            "advisory_count": 12,
            "oldest_advisory_days": 64
          },
          {
            "name": "golang.org/x/crypto",
            "direct": false,
            "version": "v0.49.0",
            "severity": "critical",
            "ecosystem": "go",
            "cvss_score": 10,
            "advisory_ids": [
              "GHSA-45gg-vh54-h5m9",
              "GHSA-5cgq-3rg8-m6cv",
              "GHSA-78mq-xcr3-xm33",
              "GHSA-89gr-r52h-f8rx",
              "GHSA-9m57-25v3-79x9",
              "GHSA-f5wc-c3c7-36mc",
              "GHSA-jppx-rxg9-jmrx",
              "GHSA-q4h4-gmj2-qvw2",
              "GHSA-qpw4-5x99-6vjp",
              "GHSA-rm3j-f69w-wqmq"
            ],
            "fixed_version": "0.52.0",
            "advisory_count": 27,
            "oldest_advisory_days": 64
          },
          {
            "name": "google.golang.org/grpc",
            "direct": false,
            "version": "v1.79.3",
            "severity": "critical",
            "ecosystem": "go",
            "cvss_score": 9.1,
            "advisory_ids": [
              "GHSA-hrxh-6v49-42gf"
            ],
            "fixed_version": "1.82.1",
            "advisory_count": 1,
            "oldest_advisory_days": 3
          },
          {
            "name": "github.com/go-git/go-billy/v5",
            "direct": true,
            "version": "v5.8.0",
            "severity": "high",
            "ecosystem": "go",
            "cvss_score": 8.1,
            "advisory_ids": [
              "GHSA-m3xc-h892-ggx6",
              "GHSA-qw64-3x98-g7q2",
              "GO-2026-5490",
              "GO-2026-5597"
            ],
            "fixed_version": "6.0.0-alpha.1",
            "advisory_count": 4,
            "oldest_advisory_days": 72
          },
          {
            "name": "github.com/hashicorp/go-getter",
            "direct": true,
            "version": "v1.8.5",
            "severity": "high",
            "ecosystem": "go",
            "cvss_score": 7.5,
            "advisory_ids": [
              "GHSA-92mm-2pjq-r785",
              "GO-2026-5058"
            ],
            "fixed_version": "1.8.6",
            "advisory_count": 2,
            "oldest_advisory_days": 106
          },
          {
            "name": "github.com/go-jose/go-jose/v4",
            "direct": false,
            "version": "v4.1.3",
            "severity": "high",
            "ecosystem": "go",
            "cvss_score": 7.5,
            "advisory_ids": [
              "GHSA-78h2-9frx-2jm8",
              "GO-2026-4945"
            ],
            "fixed_version": "4.1.4",
            "advisory_count": 2,
            "oldest_advisory_days": 113
          },
          {
            "name": "go.opentelemetry.io/otel",
            "direct": false,
            "version": "v1.40.0",
            "severity": "high",
            "ecosystem": "go",
            "cvss_score": 7.5,
            "advisory_ids": [
              "GHSA-mh2q-q3fh-2475",
              "GO-2026-5506"
            ],
            "fixed_version": "1.41.0",
            "advisory_count": 2,
            "oldest_advisory_days": 108
          },
          {
            "name": "go.opentelemetry.io/otel/sdk",
            "direct": false,
            "version": "v1.40.0",
            "severity": "high",
            "ecosystem": "go",
            "cvss_score": 7,
            "advisory_ids": [
              "GHSA-hfvc-g4fc-pqhx",
              "GO-2026-5426"
            ],
            "fixed_version": "1.43.0",
            "advisory_count": 2,
            "oldest_advisory_days": 107
          },
          {
            "name": "github.com/go-git/go-git/v5",
            "direct": true,
            "version": "v5.17.0",
            "severity": "moderate",
            "ecosystem": "go",
            "cvss_score": 6.5,
            "advisory_ids": [
              "GHSA-389r-gv7p-r3rp",
              "GHSA-3xc5-wrhm-f963",
              "GHSA-crhj-59gh-8x96",
              "GHSA-gm2x-2g9h-ccm8",
              "GHSA-jhf3-xxhw-2wpp",
              "GHSA-m7cr-m3pv-hgrp",
              "GHSA-w5pp-99ch-qj29",
              "GO-2026-4909",
              "GO-2026-4910",
              "GO-2026-5074"
            ],
            "fixed_version": "6.0.0-alpha.4",
            "advisory_count": 14,
            "oldest_advisory_days": 116
          },
          {
            "name": "github.com/go-viper/mapstructure/v2",
            "direct": true,
            "version": "v2.2.1",
            "severity": "moderate",
            "ecosystem": "go",
            "cvss_score": 5.3,
            "advisory_ids": [
              "GHSA-2464-8j7c-4cjm",
              "GHSA-fv92-fjc5-jj9h",
              "GO-2025-3787",
              "GO-2025-3900"
            ],
            "fixed_version": "2.4.0",
            "advisory_count": 4,
            "oldest_advisory_days": 392
          },
          {
            "name": "golang.org/x/net",
            "direct": true,
            "version": "v0.52.0",
            "severity": "moderate",
            "ecosystem": "go",
            "cvss_score": 6.5,
            "advisory_ids": [
              "GHSA-5cv4-jp36-h3mw",
              "GO-2026-4918",
              "GO-2026-5025",
              "GO-2026-5026",
              "GO-2026-5027",
              "GO-2026-5028",
              "GO-2026-5029",
              "GO-2026-5030",
              "GO-2026-5942"
            ],
            "fixed_version": "1.26.3",
            "advisory_count": 9,
            "oldest_advisory_days": 78
          },
          {
            "name": "github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream",
            "direct": false,
            "version": "v1.7.4",
            "severity": "moderate",
            "ecosystem": "go",
            "cvss_score": 5.9,
            "advisory_ids": [
              "GHSA-xmrv-pmrh-hhx2",
              "GO-2026-5764"
            ],
            "fixed_version": "1.97.3",
            "advisory_count": 2,
            "oldest_advisory_days": 108
          },
          {
            "name": "github.com/aws/aws-sdk-go-v2/service/s3",
            "direct": false,
            "version": "v1.96.0",
            "severity": "moderate",
            "ecosystem": "go",
            "cvss_score": 5.9,
            "advisory_ids": [
              "GHSA-xmrv-pmrh-hhx2",
              "GO-2026-5764"
            ],
            "fixed_version": "1.97.3",
            "advisory_count": 2,
            "oldest_advisory_days": 108
          },
          {
            "name": "golang.org/x/sys",
            "direct": false,
            "version": "v0.33.0",
            "severity": "unknown",
            "ecosystem": "go",
            "cvss_score": null,
            "advisory_ids": [
              "GO-2026-5024"
            ],
            "fixed_version": "0.44.0",
            "advisory_count": 1,
            "oldest_advisory_days": 63
          },
          {
            "name": "golang.org/x/sys",
            "direct": false,
            "version": "v0.42.0",
            "severity": "unknown",
            "ecosystem": "go",
            "cvss_score": null,
            "advisory_ids": [
              "GO-2026-5024"
            ],
            "fixed_version": "0.44.0",
            "advisory_count": 1,
            "oldest_advisory_days": 63
          },
          {
            "name": "golang.org/x/text",
            "direct": false,
            "version": "v0.21.0",
            "severity": "unknown",
            "ecosystem": "go",
            "cvss_score": null,
            "advisory_ids": [
              "GO-2026-5970"
            ],
            "fixed_version": "0.39.0",
            "advisory_count": 1,
            "oldest_advisory_days": 10
          },
          {
            "name": "golang.org/x/text",
            "direct": false,
            "version": "v0.35.0",
            "severity": "unknown",
            "ecosystem": "go",
            "cvss_score": null,
            "advisory_ids": [
              "GO-2026-5970"
            ],
            "fixed_version": "0.39.0",
            "advisory_count": 1,
            "oldest_advisory_days": 10
          }
        ],
        "collected": true,
        "malicious": [],
        "truncated": false,
        "by_severity": {
          "high": 5,
          "unknown": 4,
          "critical": 3,
          "moderate": 5
        },
        "advisory_count": 87,
        "affected_count": 17,
        "assessed_count": 333,
        "malicious_count": 0,
        "assessed_package": null,
        "unassessed_count": 0,
        "direct_affected_count": 5
      },
      "ecosystems": [
        "go"
      ],
      "dependencies": [
        {
          "name": "github.com/BurntSushi/toml",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.6.0"
        },
        {
          "name": "github.com/CycloneDX/cyclonedx-go",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.10.0"
        },
        {
          "name": "github.com/Masterminds/semver/v3",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v3.4.0"
        },
        {
          "name": "github.com/Masterminds/sprig/v3",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v3.3.0"
        },
        {
          "name": "github.com/OneOfOne/xxhash",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.2.8"
        },
        {
          "name": "github.com/acarl005/stripansi",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.0.0-20180116102854-5a71ef0e047d"
        },
        {
          "name": "github.com/adrg/xdg",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.5.3"
        },
        {
          "name": "github.com/anchore/bubbly",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.0.0-20231115134915-def0aba654a9"
        },
        {
          "name": "github.com/anchore/clio",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.0.0-20250319180342-2cfe4b0cb716"
        },
        {
          "name": "github.com/anchore/fangs",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.0.0-20250319222917-446a1e748ec2"
        },
        {
          "name": "github.com/anchore/go-collections",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.0.0-20251016125210-a3c352120e8c"
        },
        {
          "name": "github.com/anchore/go-homedir",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.0.0-20250319154043-c29668562e4d"
        },
        {
          "name": "github.com/anchore/go-logger",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.0.0-20250318195838-07ae343dd722"
        },
        {
          "name": "github.com/anchore/go-macholibre",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.0.0-20220308212642-53e6d0aaf6fb"
        },
        {
          "name": "github.com/anchore/go-rpmdb",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.0.0-20250516171929-f77691e1faec"
        },
        {
          "name": "github.com/anchore/go-sync",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.0.0-20250326131806-4eda43a485b6"
        },
        {
          "name": "github.com/anchore/go-version",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.2.2-0.20200701162849-18adb9c92b9b"
        },
        {
          "name": "github.com/anchore/packageurl-go",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.1.1-0.20250220190351-d62adb6e1115"
        },
        {
          "name": "github.com/anchore/stereoscope",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.1.22"
        },
        {
          "name": "github.com/aquasecurity/go-pep440-version",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.0.1"
        },
        {
          "name": "github.com/bitnami/go-version",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.0.0-20250131085805-b1f57a8634ef"
        },
        {
          "name": "github.com/blakesmith/ar",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.0.0-20190502131153-809d4375e1fb"
        },
        {
          "name": "github.com/bmatcuk/doublestar/v4",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v4.10.0"
        },
        {
          "name": "github.com/charmbracelet/bubbles",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.0.0"
        },
        {
          "name": "github.com/charmbracelet/bubbletea",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.3.10"
        },
        {
          "name": "github.com/charmbracelet/lipgloss",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.1.0"
        },
        {
          "name": "github.com/dave/jennifer",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.7.1"
        },
        {
          "name": "github.com/deitch/magic",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.0.0-20230404182410-1ff89d7342da"
        },
        {
          "name": "github.com/diskfs/go-diskfs",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.7.0"
        },
        {
          "name": "github.com/distribution/reference",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.6.0"
        },
        {
          "name": "github.com/dustin/go-humanize",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.0.1"
        },
        {
          "name": "github.com/elliotchance/phpserialize",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.4.0"
        },
        {
          "name": "github.com/facebookincubator/nvdtools",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.1.5"
        },
        {
          "name": "github.com/github/go-spdx/v2",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v2.4.0"
        },
        {
          "name": "github.com/gkampitakis/go-snaps",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.5.21"
        },
        {
          "name": "github.com/go-git/go-billy/v5",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v5.8.0"
        },
        {
          "name": "github.com/go-git/go-git/v5",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v5.17.0"
        },
        {
          "name": "github.com/go-test/deep",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.1.1"
        },
        {
          "name": "github.com/go-viper/mapstructure/v2",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v2.5.0"
        },
        {
          "name": "github.com/gohugoio/hashstructure",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.6.0"
        },
        {
          "name": "github.com/google/go-cmp",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.7.0"
        },
        {
          "name": "github.com/google/go-containerregistry",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.21.2"
        },
        {
          "name": "github.com/google/licensecheck",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.3.1"
        },
        {
          "name": "github.com/google/uuid",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.6.0"
        },
        {
          "name": "github.com/gookit/color",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.6.0"
        },
        {
          "name": "github.com/hashicorp/go-cleanhttp",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.5.2"
        },
        {
          "name": "github.com/hashicorp/go-getter",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.8.5"
        },
        {
          "name": "github.com/hashicorp/go-multierror",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.1.1"
        },
        {
          "name": "github.com/hashicorp/hcl/v2",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v2.24.0"
        },
        {
          "name": "github.com/iancoleman/strcase",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.3.0"
        },
        {
          "name": "github.com/invopop/jsonschema",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.13.0"
        },
        {
          "name": "github.com/jedib0t/go-pretty/v6",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v6.7.8"
        },
        {
          "name": "github.com/jinzhu/copier",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.4.0"
        },
        {
          "name": "github.com/kastenhq/goversion",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.0.0-20230811215019-93b2f8823953"
        },
        {
          "name": "github.com/magiconair/properties",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.8.10"
        },
        {
          "name": "github.com/mholt/archives",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.1.5"
        },
        {
          "name": "github.com/moby/sys/mountinfo",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.7.2"
        },
        {
          "name": "github.com/nix-community/go-nix",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.0.0-20250101154619-4bdde671e0a1"
        },
        {
          "name": "github.com/olekukonko/tablewriter",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.1.4"
        },
        {
          "name": "github.com/opencontainers/go-digest",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.0.0"
        },
        {
          "name": "github.com/pelletier/go-toml",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.9.5"
        },
        {
          "name": "github.com/quasilyte/go-ruleguard/dsl",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.3.23"
        },
        {
          "name": "github.com/rust-secure-code/go-rustaudit",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.0.0-20250226111315-e20ec32e963c"
        },
        {
          "name": "github.com/saintfish/chardet",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.0.0-20230101081208-5e3ef4b5456d"
        },
        {
          "name": "github.com/sanity-io/litter",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.5.8"
        },
        {
          "name": "github.com/sassoftware/go-rpmutils",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.4.0"
        },
        {
          "name": "github.com/scylladb/go-set",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.0.3-0.20200225121959-cc7b2070d91e"
        },
        {
          "name": "github.com/sergi/go-diff",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.4.0"
        },
        {
          "name": "github.com/spdx/gordf",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.0.0-20201111095634-7098f93598fb"
        },
        {
          "name": "github.com/spdx/tools-golang",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.5.7"
        },
        {
          "name": "github.com/spf13/afero",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.15.0"
        },
        {
          "name": "github.com/spf13/cobra",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.10.2"
        },
        {
          "name": "github.com/stretchr/testify",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.11.1"
        },
        {
          "name": "github.com/vbatts/go-mtree",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.7.0"
        },
        {
          "name": "github.com/vifraa/gopom",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.0.0"
        },
        {
          "name": "github.com/wagoodman/go-partybus",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.0.0-20230516145632-8ccac152c651"
        },
        {
          "name": "github.com/wagoodman/go-progress",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.0.0-20260303201901-10176f79b2c0"
        },
        {
          "name": "github.com/xeipuuv/gojsonschema",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.2.0"
        },
        {
          "name": "github.com/zyedidia/generic",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.2.2-0.20230320175451-4410d2372cb1"
        },
        {
          "name": "go.uber.org/goleak",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.3.0"
        },
        {
          "name": "go.yaml.in/yaml/v3",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v3.0.4"
        },
        {
          "name": "golang.org/x/exp",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.0.0-20251023183803-a4bb9ffd2546"
        },
        {
          "name": "golang.org/x/mod",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.34.0"
        },
        {
          "name": "golang.org/x/net",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.52.0"
        },
        {
          "name": "modernc.org/sqlite",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.46.2"
        },
        {
          "name": "github.com/goccy/go-yaml",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.19.2"
        },
        {
          "name": "github.com/ulikunitz/xz",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.5.15"
        },
        {
          "name": "golang.org/x/time",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.15.0"
        },
        {
          "name": "golang.org/x/tools",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.43.0"
        },
        {
          "name": "gopkg.in/yaml.v3",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v3.0.1"
        },
        {
          "name": "github.com/acobaugh/osrelease",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.1.0"
        },
        {
          "name": "github.com/anmitsu/go-shlex",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.0.0-20200514113438-38f4b401e2be"
        },
        {
          "name": "github.com/cespare/xxhash/v2",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v2.3.0"
        },
        {
          "name": "github.com/gpustack/gguf-parser-go",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.24.0"
        },
        {
          "name": "github.com/wk8/go-ordered-map/v2",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v2.1.8"
        }
      ],
      "all_dependencies": {
        "error": null,
        "source": "github-sbom",
        "packages": [
          {
            "name": "github.com/acarl005/stripansi",
            "direct": true,
            "version": "v0.0.0-20180116102854-5a71ef0e047d",
            "ecosystem": "go"
          },
          {
            "name": "github.com/acobaugh/osrelease",
            "direct": true,
            "version": "v0.1.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/adrg/xdg",
            "direct": true,
            "version": "v0.5.3",
            "ecosystem": "go"
          },
          {
            "name": "github.com/anchore/bubbly",
            "direct": true,
            "version": "v0.0.0-20231115134915-def0aba654a9",
            "ecosystem": "go"
          },
          {
            "name": "github.com/anchore/clio",
            "direct": true,
            "version": "v0.0.0-20250319180342-2cfe4b0cb716",
            "ecosystem": "go"
          },
          {
            "name": "github.com/anchore/fangs",
            "direct": true,
            "version": "v0.0.0-20250319222917-446a1e748ec2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/anchore/go-collections",
            "direct": true,
            "version": "v0.0.0-20251016125210-a3c352120e8c",
            "ecosystem": "go"
          },
          {
            "name": "github.com/anchore/go-homedir",
            "direct": true,
            "version": "v0.0.0-20250319154043-c29668562e4d",
            "ecosystem": "go"
          },
          {
            "name": "github.com/anchore/go-logger",
            "direct": true,
            "version": "v0.0.0-20250318195838-07ae343dd722",
            "ecosystem": "go"
          },
          {
            "name": "github.com/anchore/go-macholibre",
            "direct": true,
            "version": "v0.0.0-20220308212642-53e6d0aaf6fb",
            "ecosystem": "go"
          },
          {
            "name": "github.com/anchore/go-rpmdb",
            "direct": true,
            "version": "v0.0.0-20250516171929-f77691e1faec",
            "ecosystem": "go"
          },
          {
            "name": "github.com/anchore/go-sync",
            "direct": true,
            "version": "v0.0.0-20250326131806-4eda43a485b6",
            "ecosystem": "go"
          },
          {
            "name": "github.com/anchore/go-version",
            "direct": true,
            "version": "v1.2.2-0.20200701162849-18adb9c92b9b",
            "ecosystem": "go"
          },
          {
            "name": "github.com/anchore/packageurl-go",
            "direct": true,
            "version": "v0.1.1-0.20250220190351-d62adb6e1115",
            "ecosystem": "go"
          },
          {
            "name": "github.com/anchore/stereoscope",
            "direct": true,
            "version": "v0.1.22",
            "ecosystem": "go"
          },
          {
            "name": "github.com/anmitsu/go-shlex",
            "direct": true,
            "version": "v0.0.0-20200514113438-38f4b401e2be",
            "ecosystem": "go"
          },
          {
            "name": "github.com/aquasecurity/go-pep440-version",
            "direct": true,
            "version": "v0.0.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/bitnami/go-version",
            "direct": true,
            "version": "v0.0.0-20250131085805-b1f57a8634ef",
            "ecosystem": "go"
          },
          {
            "name": "github.com/blakesmith/ar",
            "direct": true,
            "version": "v0.0.0-20190502131153-809d4375e1fb",
            "ecosystem": "go"
          },
          {
            "name": "github.com/bmatcuk/doublestar/v4",
            "direct": true,
            "version": "v4.10.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/burntsushi/toml",
            "direct": true,
            "version": "v1.6.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/cespare/xxhash/v2",
            "direct": true,
            "version": "v2.3.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/charmbracelet/bubbles",
            "direct": true,
            "version": "v1.0.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/charmbracelet/bubbletea",
            "direct": true,
            "version": "v1.3.10",
            "ecosystem": "go"
          },
          {
            "name": "github.com/charmbracelet/lipgloss",
            "direct": true,
            "version": "v1.1.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/cyclonedx/cyclonedx-go",
            "direct": true,
            "version": "v0.10.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/dave/jennifer",
            "direct": true,
            "version": "v1.7.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/deitch/magic",
            "direct": true,
            "version": "v0.0.0-20230404182410-1ff89d7342da",
            "ecosystem": "go"
          },
          {
            "name": "github.com/diskfs/go-diskfs",
            "direct": true,
            "version": "v1.7.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/distribution/reference",
            "direct": true,
            "version": "v0.6.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/dustin/go-humanize",
            "direct": true,
            "version": "v1.0.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/elliotchance/phpserialize",
            "direct": true,
            "version": "v1.4.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/facebookincubator/nvdtools",
            "direct": true,
            "version": "v0.1.5",
            "ecosystem": "go"
          },
          {
            "name": "github.com/github/go-spdx/v2",
            "direct": true,
            "version": "v2.4.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/gkampitakis/go-snaps",
            "direct": true,
            "version": "v0.5.21",
            "ecosystem": "go"
          },
          {
            "name": "github.com/go-git/go-billy/v5",
            "direct": true,
            "version": "v5.8.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/go-git/go-git/v5",
            "direct": true,
            "version": "v5.17.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/go-test/deep",
            "direct": true,
            "version": "v1.1.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/go-viper/mapstructure/v2",
            "direct": true,
            "version": "v2.2.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/go-viper/mapstructure/v2",
            "direct": true,
            "version": "v2.5.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/goccy/go-yaml",
            "direct": true,
            "version": "v1.19.2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/gohugoio/hashstructure",
            "direct": true,
            "version": "v0.6.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/google/go-cmp",
            "direct": true,
            "version": "v0.7.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/google/go-containerregistry",
            "direct": true,
            "version": "v0.21.2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/google/licensecheck",
            "direct": true,
            "version": "v0.3.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/google/uuid",
            "direct": true,
            "version": "v1.6.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/gookit/color",
            "direct": true,
            "version": "v1.6.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/gpustack/gguf-parser-go",
            "direct": true,
            "version": "v0.24.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/hashicorp/go-cleanhttp",
            "direct": true,
            "version": "v0.5.2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/hashicorp/go-getter",
            "direct": true,
            "version": "v1.8.5",
            "ecosystem": "go"
          },
          {
            "name": "github.com/hashicorp/go-multierror",
            "direct": true,
            "version": "v1.1.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/hashicorp/hcl/v2",
            "direct": true,
            "version": "v2.24.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/iancoleman/strcase",
            "direct": true,
            "version": "v0.3.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/invopop/jsonschema",
            "direct": true,
            "version": "v0.13.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/jedib0t/go-pretty/v6",
            "direct": true,
            "version": "v6.7.8",
            "ecosystem": "go"
          },
          {
            "name": "github.com/jinzhu/copier",
            "direct": true,
            "version": "v0.4.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/kastenhq/goversion",
            "direct": true,
            "version": "v0.0.0-20230811215019-93b2f8823953",
            "ecosystem": "go"
          },
          {
            "name": "github.com/magiconair/properties",
            "direct": true,
            "version": "v1.8.10",
            "ecosystem": "go"
          },
          {
            "name": "github.com/masterminds/semver/v3",
            "direct": true,
            "version": "v3.4.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/masterminds/sprig/v3",
            "direct": true,
            "version": "v3.3.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/mholt/archives",
            "direct": true,
            "version": "v0.1.5",
            "ecosystem": "go"
          },
          {
            "name": "github.com/moby/sys/mountinfo",
            "direct": true,
            "version": "v0.7.2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/nix-community/go-nix",
            "direct": true,
            "version": "v0.0.0-20250101154619-4bdde671e0a1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/olekukonko/tablewriter",
            "direct": true,
            "version": "v1.1.4",
            "ecosystem": "go"
          },
          {
            "name": "github.com/oneofone/xxhash",
            "direct": true,
            "version": "v1.2.8",
            "ecosystem": "go"
          },
          {
            "name": "github.com/opencontainers/go-digest",
            "direct": true,
            "version": "v1.0.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/pelletier/go-toml",
            "direct": true,
            "version": "v1.9.5",
            "ecosystem": "go"
          },
          {
            "name": "github.com/quasilyte/go-ruleguard/dsl",
            "direct": true,
            "version": "v0.3.23",
            "ecosystem": "go"
          },
          {
            "name": "github.com/rust-secure-code/go-rustaudit",
            "direct": true,
            "version": "v0.0.0-20250226111315-e20ec32e963c",
            "ecosystem": "go"
          },
          {
            "name": "github.com/saintfish/chardet",
            "direct": true,
            "version": "v0.0.0-20230101081208-5e3ef4b5456d",
            "ecosystem": "go"
          },
          {
            "name": "github.com/sanity-io/litter",
            "direct": true,
            "version": "v1.5.8",
            "ecosystem": "go"
          },
          {
            "name": "github.com/sassoftware/go-rpmutils",
            "direct": true,
            "version": "v0.4.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/scylladb/go-set",
            "direct": true,
            "version": "v1.0.3-0.20200225121959-cc7b2070d91e",
            "ecosystem": "go"
          },
          {
            "name": "github.com/sergi/go-diff",
            "direct": true,
            "version": "v1.4.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/spdx/gordf",
            "direct": true,
            "version": "v0.0.0-20201111095634-7098f93598fb",
            "ecosystem": "go"
          },
          {
            "name": "github.com/spdx/tools-golang",
            "direct": true,
            "version": "v0.5.7",
            "ecosystem": "go"
          },
          {
            "name": "github.com/spf13/afero",
            "direct": true,
            "version": "v1.12.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/spf13/afero",
            "direct": true,
            "version": "v1.15.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/spf13/cobra",
            "direct": true,
            "version": "v1.10.2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/stretchr/testify",
            "direct": true,
            "version": "v1.10.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/stretchr/testify",
            "direct": true,
            "version": "v1.11.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/ulikunitz/xz",
            "direct": true,
            "version": "v0.5.15",
            "ecosystem": "go"
          },
          {
            "name": "github.com/vbatts/go-mtree",
            "direct": true,
            "version": "v0.7.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/vifraa/gopom",
            "direct": true,
            "version": "v1.0.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/wagoodman/go-partybus",
            "direct": true,
            "version": "v0.0.0-20230516145632-8ccac152c651",
            "ecosystem": "go"
          },
          {
            "name": "github.com/wagoodman/go-progress",
            "direct": true,
            "version": "v0.0.0-20260303201901-10176f79b2c0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/wk8/go-ordered-map/v2",
            "direct": true,
            "version": "v2.1.8",
            "ecosystem": "go"
          },
          {
            "name": "github.com/xeipuuv/gojsonschema",
            "direct": true,
            "version": "v1.2.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/zyedidia/generic",
            "direct": true,
            "version": "v1.2.2-0.20230320175451-4410d2372cb1",
            "ecosystem": "go"
          },
          {
            "name": "go.uber.org/goleak",
            "direct": true,
            "version": "v1.3.0",
            "ecosystem": "go"
          },
          {
            "name": "go.yaml.in/yaml/v3",
            "direct": true,
            "version": "v3.0.4",
            "ecosystem": "go"
          },
          {
            "name": "golang.org/x/exp",
            "direct": true,
            "version": "v0.0.0-20251023183803-a4bb9ffd2546",
            "ecosystem": "go"
          },
          {
            "name": "golang.org/x/mod",
            "direct": true,
            "version": "v0.34.0",
            "ecosystem": "go"
          },
          {
            "name": "golang.org/x/net",
            "direct": true,
            "version": "v0.52.0",
            "ecosystem": "go"
          },
          {
            "name": "golang.org/x/time",
            "direct": true,
            "version": "v0.15.0",
            "ecosystem": "go"
          },
          {
            "name": "golang.org/x/tools",
            "direct": true,
            "version": "v0.43.0",
            "ecosystem": "go"
          },
          {
            "name": "gopkg.in/yaml.v3",
            "direct": true,
            "version": "v3.0.1",
            "ecosystem": "go"
          },
          {
            "name": "modernc.org/sqlite",
            "direct": true,
            "version": "v1.46.2",
            "ecosystem": "go"
          },
          {
            "name": "cel.dev/expr",
            "direct": false,
            "version": "v0.25.1",
            "ecosystem": "go"
          },
          {
            "name": "cloud.google.com/go",
            "direct": false,
            "version": "v0.123.0",
            "ecosystem": "go"
          },
          {
            "name": "cloud.google.com/go/auth",
            "direct": false,
            "version": "v0.18.1",
            "ecosystem": "go"
          },
          {
            "name": "cloud.google.com/go/auth/oauth2adapt",
            "direct": false,
            "version": "v0.2.8",
            "ecosystem": "go"
          },
          {
            "name": "cloud.google.com/go/compute/metadata",
            "direct": false,
            "version": "v0.9.0",
            "ecosystem": "go"
          },
          {
            "name": "cloud.google.com/go/iam",
            "direct": false,
            "version": "v1.5.3",
            "ecosystem": "go"
          },
          {
            "name": "cloud.google.com/go/monitoring",
            "direct": false,
            "version": "v1.24.3",
            "ecosystem": "go"
          },
          {
            "name": "cloud.google.com/go/storage",
            "direct": false,
            "version": "v1.60.0",
            "ecosystem": "go"
          },
          {
            "name": "cyphar.com/go-pathrs",
            "direct": false,
            "version": "v0.2.1",
            "ecosystem": "go"
          },
          {
            "name": "dario.cat/mergo",
            "direct": false,
            "version": "v1.0.2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/agext/levenshtein",
            "direct": false,
            "version": "v1.2.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/anchore/go-lzo",
            "direct": false,
            "version": "v0.1.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/anchore/go-struct-converter",
            "direct": false,
            "version": "v0.1.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/andybalholm/brotli",
            "direct": false,
            "version": "v1.2.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/apparentlymart/go-textseg/v15",
            "direct": false,
            "version": "v15.0.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/aquasecurity/go-version",
            "direct": false,
            "version": "v0.0.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/atotto/clipboard",
            "direct": false,
            "version": "v0.1.4",
            "ecosystem": "go"
          },
          {
            "name": "github.com/aws/aws-sdk-go-v2",
            "direct": false,
            "version": "v1.41.2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream",
            "direct": false,
            "version": "v1.7.4",
            "ecosystem": "go"
          },
          {
            "name": "github.com/aws/aws-sdk-go-v2/config",
            "direct": false,
            "version": "v1.32.10",
            "ecosystem": "go"
          },
          {
            "name": "github.com/aws/aws-sdk-go-v2/credentials",
            "direct": false,
            "version": "v1.19.10",
            "ecosystem": "go"
          },
          {
            "name": "github.com/aws/aws-sdk-go-v2/feature/ec2/imds",
            "direct": false,
            "version": "v1.18.18",
            "ecosystem": "go"
          },
          {
            "name": "github.com/aws/aws-sdk-go-v2/internal/configsources",
            "direct": false,
            "version": "v1.4.18",
            "ecosystem": "go"
          },
          {
            "name": "github.com/aws/aws-sdk-go-v2/internal/endpoints/v2",
            "direct": false,
            "version": "v2.7.18",
            "ecosystem": "go"
          },
          {
            "name": "github.com/aws/aws-sdk-go-v2/internal/ini",
            "direct": false,
            "version": "v1.8.4",
            "ecosystem": "go"
          },
          {
            "name": "github.com/aws/aws-sdk-go-v2/internal/v4a",
            "direct": false,
            "version": "v1.4.17",
            "ecosystem": "go"
          },
          {
            "name": "github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding",
            "direct": false,
            "version": "v1.13.5",
            "ecosystem": "go"
          },
          {
            "name": "github.com/aws/aws-sdk-go-v2/service/internal/checksum",
            "direct": false,
            "version": "v1.9.8",
            "ecosystem": "go"
          },
          {
            "name": "github.com/aws/aws-sdk-go-v2/service/internal/presigned-url",
            "direct": false,
            "version": "v1.13.18",
            "ecosystem": "go"
          },
          {
            "name": "github.com/aws/aws-sdk-go-v2/service/internal/s3shared",
            "direct": false,
            "version": "v1.19.17",
            "ecosystem": "go"
          },
          {
            "name": "github.com/aws/aws-sdk-go-v2/service/s3",
            "direct": false,
            "version": "v1.96.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/aws/aws-sdk-go-v2/service/signin",
            "direct": false,
            "version": "v1.0.6",
            "ecosystem": "go"
          },
          {
            "name": "github.com/aws/aws-sdk-go-v2/service/sso",
            "direct": false,
            "version": "v1.30.11",
            "ecosystem": "go"
          },
          {
            "name": "github.com/aws/aws-sdk-go-v2/service/ssooidc",
            "direct": false,
            "version": "v1.35.15",
            "ecosystem": "go"
          },
          {
            "name": "github.com/aws/aws-sdk-go-v2/service/sts",
            "direct": false,
            "version": "v1.41.7",
            "ecosystem": "go"
          },
          {
            "name": "github.com/aws/smithy-go",
            "direct": false,
            "version": "v1.24.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/aymanbagabas/go-osc52/v2",
            "direct": false,
            "version": "v2.0.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/bahlo/generic-list-go",
            "direct": false,
            "version": "v0.2.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/becheran/wildmatch-go",
            "direct": false,
            "version": "v1.0.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/bgentry/go-netrc",
            "direct": false,
            "version": "v0.0.0-20140422174119-9fd32a8b3d3d",
            "ecosystem": "go"
          },
          {
            "name": "github.com/bodgit/plumbing",
            "direct": false,
            "version": "v1.3.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/bodgit/sevenzip",
            "direct": false,
            "version": "v1.6.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/bodgit/windows",
            "direct": false,
            "version": "v1.0.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/buger/jsonparser",
            "direct": false,
            "version": "v1.1.2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/charmbracelet/colorprofile",
            "direct": false,
            "version": "v0.4.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/charmbracelet/harmonica",
            "direct": false,
            "version": "v0.2.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/charmbracelet/x/ansi",
            "direct": false,
            "version": "v0.11.6",
            "ecosystem": "go"
          },
          {
            "name": "github.com/charmbracelet/x/cellbuf",
            "direct": false,
            "version": "v0.0.15",
            "ecosystem": "go"
          },
          {
            "name": "github.com/charmbracelet/x/term",
            "direct": false,
            "version": "v0.2.2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/clipperhouse/displaywidth",
            "direct": false,
            "version": "v0.10.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/clipperhouse/uax29/v2",
            "direct": false,
            "version": "v2.6.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/cloudflare/circl",
            "direct": false,
            "version": "v1.6.3",
            "ecosystem": "go"
          },
          {
            "name": "github.com/cncf/xds/go",
            "direct": false,
            "version": "v0.0.0-20251210132809-ee656c7534f5",
            "ecosystem": "go"
          },
          {
            "name": "github.com/containerd/cgroups/v3",
            "direct": false,
            "version": "v3.1.2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/containerd/containerd/api",
            "direct": false,
            "version": "v1.10.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/containerd/containerd/v2",
            "direct": false,
            "version": "v2.2.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/containerd/continuity",
            "direct": false,
            "version": "v0.4.5",
            "ecosystem": "go"
          },
          {
            "name": "github.com/containerd/errdefs",
            "direct": false,
            "version": "v1.0.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/containerd/errdefs/pkg",
            "direct": false,
            "version": "v0.3.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/containerd/fifo",
            "direct": false,
            "version": "v1.1.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/containerd/log",
            "direct": false,
            "version": "v0.1.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/containerd/platforms",
            "direct": false,
            "version": "v1.0.0-rc.2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/containerd/plugin",
            "direct": false,
            "version": "v1.0.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/containerd/stargz-snapshotter/estargz",
            "direct": false,
            "version": "v0.18.2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/containerd/ttrpc",
            "direct": false,
            "version": "v1.2.7",
            "ecosystem": "go"
          },
          {
            "name": "github.com/containerd/typeurl/v2",
            "direct": false,
            "version": "v2.2.3",
            "ecosystem": "go"
          },
          {
            "name": "github.com/cyphar/filepath-securejoin",
            "direct": false,
            "version": "v0.6.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/datadog/zstd",
            "direct": false,
            "version": "v1.5.5",
            "ecosystem": "go"
          },
          {
            "name": "github.com/davecgh/go-spew",
            "direct": false,
            "version": "v1.1.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/davecgh/go-spew",
            "direct": false,
            "version": "v1.1.2-0.20180830191138-d8f796af33cc",
            "ecosystem": "go"
          },
          {
            "name": "github.com/docker/cli",
            "direct": false,
            "version": "v29.3.0+incompatible",
            "ecosystem": "go"
          },
          {
            "name": "github.com/docker/distribution",
            "direct": false,
            "version": "v2.8.3+incompatible",
            "ecosystem": "go"
          },
          {
            "name": "github.com/docker/docker-credential-helpers",
            "direct": false,
            "version": "v0.9.5",
            "ecosystem": "go"
          },
          {
            "name": "github.com/docker/go-connections",
            "direct": false,
            "version": "v0.6.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/docker/go-units",
            "direct": false,
            "version": "v0.5.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/dsnet/compress",
            "direct": false,
            "version": "v0.0.2-0.20230904184137-39efe44ab707",
            "ecosystem": "go"
          },
          {
            "name": "github.com/emirpasic/gods",
            "direct": false,
            "version": "v1.18.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/envoyproxy/go-control-plane/envoy",
            "direct": false,
            "version": "v1.36.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/envoyproxy/protoc-gen-validate",
            "direct": false,
            "version": "v1.3.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/erikgeiser/coninput",
            "direct": false,
            "version": "v0.0.0-20211004153227-1c3628e74d0f",
            "ecosystem": "go"
          },
          {
            "name": "github.com/fatih/color",
            "direct": false,
            "version": "v1.18.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/felixge/fgprof",
            "direct": false,
            "version": "v0.9.5",
            "ecosystem": "go"
          },
          {
            "name": "github.com/felixge/httpsnoop",
            "direct": false,
            "version": "v1.0.4",
            "ecosystem": "go"
          },
          {
            "name": "github.com/fsnotify/fsnotify",
            "direct": false,
            "version": "v1.8.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/fsnotify/fsnotify",
            "direct": false,
            "version": "v1.9.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/gabriel-vasile/mimetype",
            "direct": false,
            "version": "v1.4.13",
            "ecosystem": "go"
          },
          {
            "name": "github.com/gkampitakis/ciinfo",
            "direct": false,
            "version": "v0.3.2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/go-git/gcfg",
            "direct": false,
            "version": "v1.5.1-0.20230307220236-3a3c6141e376",
            "ecosystem": "go"
          },
          {
            "name": "github.com/go-jose/go-jose/v4",
            "direct": false,
            "version": "v4.1.3",
            "ecosystem": "go"
          },
          {
            "name": "github.com/go-logr/logr",
            "direct": false,
            "version": "v1.4.3",
            "ecosystem": "go"
          },
          {
            "name": "github.com/go-logr/stdr",
            "direct": false,
            "version": "v1.2.2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/go-restruct/restruct",
            "direct": false,
            "version": "v1.2.0-alpha",
            "ecosystem": "go"
          },
          {
            "name": "github.com/gogo/protobuf",
            "direct": false,
            "version": "v1.3.2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/golang/groupcache",
            "direct": false,
            "version": "v0.0.0-20241129210726-2c02b8208cf8",
            "ecosystem": "go"
          },
          {
            "name": "github.com/google/pprof",
            "direct": false,
            "version": "v0.0.0-20250317173921-a4b03ec1a45e",
            "ecosystem": "go"
          },
          {
            "name": "github.com/google/s2a-go",
            "direct": false,
            "version": "v0.1.9",
            "ecosystem": "go"
          },
          {
            "name": "github.com/googleapis/enterprise-certificate-proxy",
            "direct": false,
            "version": "v0.3.11",
            "ecosystem": "go"
          },
          {
            "name": "github.com/googleapis/gax-go/v2",
            "direct": false,
            "version": "v2.17.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/googlecloudplatform/opentelemetry-operations-go/detectors/gcp",
            "direct": false,
            "version": "v1.30.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/googlecloudplatform/opentelemetry-operations-go/exporter/metric",
            "direct": false,
            "version": "v0.55.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/googlecloudplatform/opentelemetry-operations-go/internal/resourcemapping",
            "direct": false,
            "version": "v0.55.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/hashicorp/aws-sdk-go-base/v2",
            "direct": false,
            "version": "v2.0.0-beta.70",
            "ecosystem": "go"
          },
          {
            "name": "github.com/hashicorp/errwrap",
            "direct": false,
            "version": "v1.1.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/hashicorp/go-version",
            "direct": false,
            "version": "v1.8.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/hashicorp/golang-lru/v2",
            "direct": false,
            "version": "v2.0.7",
            "ecosystem": "go"
          },
          {
            "name": "github.com/henvic/httpretty",
            "direct": false,
            "version": "v0.1.4",
            "ecosystem": "go"
          },
          {
            "name": "github.com/huandu/xstrings",
            "direct": false,
            "version": "v1.5.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/inconshreveable/mousetrap",
            "direct": false,
            "version": "v1.1.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/jbenet/go-context",
            "direct": false,
            "version": "v0.0.0-20150711004518-d14ea06fba99",
            "ecosystem": "go"
          },
          {
            "name": "github.com/json-iterator/go",
            "direct": false,
            "version": "v1.1.12",
            "ecosystem": "go"
          },
          {
            "name": "github.com/kevinburke/ssh_config",
            "direct": false,
            "version": "v1.2.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/klauspost/compress",
            "direct": false,
            "version": "v1.18.4",
            "ecosystem": "go"
          },
          {
            "name": "github.com/klauspost/pgzip",
            "direct": false,
            "version": "v1.2.6",
            "ecosystem": "go"
          },
          {
            "name": "github.com/kr/pretty",
            "direct": false,
            "version": "v0.3.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/kr/text",
            "direct": false,
            "version": "v0.2.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/lucasb-eyer/go-colorful",
            "direct": false,
            "version": "v1.3.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/mailru/easyjson",
            "direct": false,
            "version": "v0.7.7",
            "ecosystem": "go"
          },
          {
            "name": "github.com/maruel/natural",
            "direct": false,
            "version": "v1.1.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/masterminds/goutils",
            "direct": false,
            "version": "v1.1.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/mattn/go-colorable",
            "direct": false,
            "version": "v0.1.14",
            "ecosystem": "go"
          },
          {
            "name": "github.com/mattn/go-isatty",
            "direct": false,
            "version": "v0.0.20",
            "ecosystem": "go"
          },
          {
            "name": "github.com/mattn/go-localereader",
            "direct": false,
            "version": "v0.0.2-0.20220822084749-2491eb6c1c75",
            "ecosystem": "go"
          },
          {
            "name": "github.com/mattn/go-runewidth",
            "direct": false,
            "version": "v0.0.19",
            "ecosystem": "go"
          },
          {
            "name": "github.com/mgutz/ansi",
            "direct": false,
            "version": "v0.0.0-20200706080929-d51e80ef957d",
            "ecosystem": "go"
          },
          {
            "name": "github.com/microsoft/go-winio",
            "direct": false,
            "version": "v0.6.2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/microsoft/hcsshim",
            "direct": false,
            "version": "v0.14.0-rc.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/mikelolasagasti/xz",
            "direct": false,
            "version": "v1.0.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/minio/minlz",
            "direct": false,
            "version": "v1.0.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/mitchellh/copystructure",
            "direct": false,
            "version": "v1.2.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/mitchellh/go-homedir",
            "direct": false,
            "version": "v1.1.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/mitchellh/go-wordwrap",
            "direct": false,
            "version": "v1.0.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/mitchellh/reflectwalk",
            "direct": false,
            "version": "v1.0.2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/moby/docker-image-spec",
            "direct": false,
            "version": "v1.3.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/moby/locker",
            "direct": false,
            "version": "v1.0.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/moby/moby/api",
            "direct": false,
            "version": "v1.54.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/moby/moby/client",
            "direct": false,
            "version": "v0.3.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/moby/sys/sequential",
            "direct": false,
            "version": "v0.6.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/moby/sys/signal",
            "direct": false,
            "version": "v0.7.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/moby/sys/user",
            "direct": false,
            "version": "v0.4.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/moby/sys/userns",
            "direct": false,
            "version": "v0.1.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/modern-go/concurrent",
            "direct": false,
            "version": "v0.0.0-20180306012644-bacd9c7ef1dd",
            "ecosystem": "go"
          },
          {
            "name": "github.com/modern-go/reflect2",
            "direct": false,
            "version": "v1.0.3-0.20250322232337-35a7c28c31ee",
            "ecosystem": "go"
          },
          {
            "name": "github.com/muesli/ansi",
            "direct": false,
            "version": "v0.0.0-20230316100256-276c6243b2f6",
            "ecosystem": "go"
          },
          {
            "name": "github.com/muesli/cancelreader",
            "direct": false,
            "version": "v0.2.2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/muesli/termenv",
            "direct": false,
            "version": "v0.16.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/ncruces/go-strftime",
            "direct": false,
            "version": "v1.0.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/nwaples/rardecode/v2",
            "direct": false,
            "version": "v2.2.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/olekukonko/cat",
            "direct": false,
            "version": "v0.0.0-20250911104152-50322a0618f6",
            "ecosystem": "go"
          },
          {
            "name": "github.com/olekukonko/errors",
            "direct": false,
            "version": "v1.2.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/olekukonko/ll",
            "direct": false,
            "version": "v0.1.6",
            "ecosystem": "go"
          },
          {
            "name": "github.com/opencontainers/image-spec",
            "direct": false,
            "version": "v1.1.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/opencontainers/runtime-spec",
            "direct": false,
            "version": "v1.3.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/opencontainers/selinux",
            "direct": false,
            "version": "v1.13.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/pborman/indent",
            "direct": false,
            "version": "v1.2.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/pelletier/go-toml/v2",
            "direct": false,
            "version": "v2.2.3",
            "ecosystem": "go"
          },
          {
            "name": "github.com/pelletier/go-toml/v2",
            "direct": false,
            "version": "v2.2.4",
            "ecosystem": "go"
          },
          {
            "name": "github.com/pierrec/lz4/v4",
            "direct": false,
            "version": "v4.1.22",
            "ecosystem": "go"
          },
          {
            "name": "github.com/pjbgf/sha1cd",
            "direct": false,
            "version": "v0.3.2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/pkg/errors",
            "direct": false,
            "version": "v0.9.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/pkg/profile",
            "direct": false,
            "version": "v1.7.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/pkg/xattr",
            "direct": false,
            "version": "v0.4.9",
            "ecosystem": "go"
          },
          {
            "name": "github.com/planetscale/vtprotobuf",
            "direct": false,
            "version": "v0.6.1-0.20240319094008-0393e58bdf10",
            "ecosystem": "go"
          },
          {
            "name": "github.com/pmezard/go-difflib",
            "direct": false,
            "version": "v1.0.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/pmezard/go-difflib",
            "direct": false,
            "version": "v1.0.1-0.20181226105442-5d4384ee4fb2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/protonmail/go-crypto",
            "direct": false,
            "version": "v1.4.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/remyoudompheng/bigfft",
            "direct": false,
            "version": "v0.0.0-20230129092748-24d4a6f8daec",
            "ecosystem": "go"
          },
          {
            "name": "github.com/rivo/uniseg",
            "direct": false,
            "version": "v0.4.7",
            "ecosystem": "go"
          },
          {
            "name": "github.com/rogpeppe/go-internal",
            "direct": false,
            "version": "v1.14.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/sagikazarmark/locafero",
            "direct": false,
            "version": "v0.7.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/sahilm/fuzzy",
            "direct": false,
            "version": "v0.1.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/shopspring/decimal",
            "direct": false,
            "version": "v1.4.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/sirupsen/logrus",
            "direct": false,
            "version": "v1.9.3",
            "ecosystem": "go"
          },
          {
            "name": "github.com/sirupsen/logrus",
            "direct": false,
            "version": "v1.9.4",
            "ecosystem": "go"
          },
          {
            "name": "github.com/skeema/knownhosts",
            "direct": false,
            "version": "v1.3.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/smallnest/ringbuffer",
            "direct": false,
            "version": "v0.0.0-20241116012123-461381446e3d",
            "ecosystem": "go"
          },
          {
            "name": "github.com/sorairolake/lzip-go",
            "direct": false,
            "version": "v0.3.8",
            "ecosystem": "go"
          },
          {
            "name": "github.com/sourcegraph/conc",
            "direct": false,
            "version": "v0.3.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/spf13/cast",
            "direct": false,
            "version": "v1.7.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/spf13/pflag",
            "direct": false,
            "version": "v1.0.10",
            "ecosystem": "go"
          },
          {
            "name": "github.com/spf13/pflag",
            "direct": false,
            "version": "v1.0.6",
            "ecosystem": "go"
          },
          {
            "name": "github.com/spf13/viper",
            "direct": false,
            "version": "v1.20.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/spf13/viper",
            "direct": false,
            "version": "v1.20.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/spiffe/go-spiffe/v2",
            "direct": false,
            "version": "v2.6.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/starry-s/zip",
            "direct": false,
            "version": "v0.2.3",
            "ecosystem": "go"
          },
          {
            "name": "github.com/stretchr/objx",
            "direct": false,
            "version": "v0.5.2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/subosito/gotenv",
            "direct": false,
            "version": "v1.6.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/sylabs/sif/v2",
            "direct": false,
            "version": "v2.24.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/sylabs/squashfs",
            "direct": false,
            "version": "v1.0.6",
            "ecosystem": "go"
          },
          {
            "name": "github.com/therootcompany/xz",
            "direct": false,
            "version": "v1.0.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/tidwall/gjson",
            "direct": false,
            "version": "v1.18.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/tidwall/match",
            "direct": false,
            "version": "v1.1.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/tidwall/pretty",
            "direct": false,
            "version": "v1.2.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/tidwall/sjson",
            "direct": false,
            "version": "v1.2.5",
            "ecosystem": "go"
          },
          {
            "name": "github.com/vbatts/tar-split",
            "direct": false,
            "version": "v0.12.2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/xanzy/ssh-agent",
            "direct": false,
            "version": "v0.3.3",
            "ecosystem": "go"
          },
          {
            "name": "github.com/xeipuuv/gojsonpointer",
            "direct": false,
            "version": "v0.0.0-20190905194746-02993c407bfb",
            "ecosystem": "go"
          },
          {
            "name": "github.com/xeipuuv/gojsonreference",
            "direct": false,
            "version": "v0.0.0-20180127040603-bd5ef7bd5415",
            "ecosystem": "go"
          },
          {
            "name": "github.com/xi2/xz",
            "direct": false,
            "version": "v0.0.0-20171230120015-48954b6210f8",
            "ecosystem": "go"
          },
          {
            "name": "github.com/xo/terminfo",
            "direct": false,
            "version": "v0.0.0-20220910002029-abceb7e1c41e",
            "ecosystem": "go"
          },
          {
            "name": "github.com/zclconf/go-cty",
            "direct": false,
            "version": "v1.16.3",
            "ecosystem": "go"
          },
          {
            "name": "go.opencensus.io",
            "direct": false,
            "version": "v0.24.0",
            "ecosystem": "go"
          },
          {
            "name": "go.opentelemetry.io/auto/sdk",
            "direct": false,
            "version": "v1.2.1",
            "ecosystem": "go"
          },
          {
            "name": "go.opentelemetry.io/contrib/detectors/gcp",
            "direct": false,
            "version": "v1.39.0",
            "ecosystem": "go"
          },
          {
            "name": "go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc",
            "direct": false,
            "version": "v0.63.0",
            "ecosystem": "go"
          },
          {
            "name": "go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp",
            "direct": false,
            "version": "v0.61.0",
            "ecosystem": "go"
          },
          {
            "name": "go.opentelemetry.io/otel",
            "direct": false,
            "version": "v1.40.0",
            "ecosystem": "go"
          },
          {
            "name": "go.opentelemetry.io/otel/metric",
            "direct": false,
            "version": "v1.40.0",
            "ecosystem": "go"
          },
          {
            "name": "go.opentelemetry.io/otel/sdk",
            "direct": false,
            "version": "v1.40.0",
            "ecosystem": "go"
          },
          {
            "name": "go.opentelemetry.io/otel/sdk/metric",
            "direct": false,
            "version": "v1.40.0",
            "ecosystem": "go"
          },
          {
            "name": "go.opentelemetry.io/otel/trace",
            "direct": false,
            "version": "v1.40.0",
            "ecosystem": "go"
          },
          {
            "name": "go.uber.org/atomic",
            "direct": false,
            "version": "v1.9.0",
            "ecosystem": "go"
          },
          {
            "name": "go.uber.org/multierr",
            "direct": false,
            "version": "v1.10.0",
            "ecosystem": "go"
          },
          {
            "name": "go.uber.org/multierr",
            "direct": false,
            "version": "v1.9.0",
            "ecosystem": "go"
          },
          {
            "name": "go.uber.org/zap",
            "direct": false,
            "version": "v1.27.0",
            "ecosystem": "go"
          },
          {
            "name": "go4.org",
            "direct": false,
            "version": "v0.0.0-20230225012048-214862532bf5",
            "ecosystem": "go"
          },
          {
            "name": "golang.org/x/crypto",
            "direct": false,
            "version": "v0.49.0",
            "ecosystem": "go"
          },
          {
            "name": "golang.org/x/oauth2",
            "direct": false,
            "version": "v0.36.0",
            "ecosystem": "go"
          },
          {
            "name": "golang.org/x/sync",
            "direct": false,
            "version": "v0.20.0",
            "ecosystem": "go"
          },
          {
            "name": "golang.org/x/sys",
            "direct": false,
            "version": "v0.33.0",
            "ecosystem": "go"
          },
          {
            "name": "golang.org/x/sys",
            "direct": false,
            "version": "v0.42.0",
            "ecosystem": "go"
          },
          {
            "name": "golang.org/x/term",
            "direct": false,
            "version": "v0.41.0",
            "ecosystem": "go"
          },
          {
            "name": "golang.org/x/text",
            "direct": false,
            "version": "v0.21.0",
            "ecosystem": "go"
          },
          {
            "name": "golang.org/x/text",
            "direct": false,
            "version": "v0.35.0",
            "ecosystem": "go"
          },
          {
            "name": "golang.org/x/xerrors",
            "direct": false,
            "version": "v0.0.0-20231012003039-104605ab7028",
            "ecosystem": "go"
          },
          {
            "name": "gonum.org/v1/gonum",
            "direct": false,
            "version": "v0.16.0",
            "ecosystem": "go"
          },
          {
            "name": "google.golang.org/api",
            "direct": false,
            "version": "v0.267.0",
            "ecosystem": "go"
          },
          {
            "name": "google.golang.org/genproto",
            "direct": false,
            "version": "v0.0.0-20260128011058-8636f8732409",
            "ecosystem": "go"
          },
          {
            "name": "google.golang.org/genproto/googleapis/api",
            "direct": false,
            "version": "v0.0.0-20260203192932-546029d2fa20",
            "ecosystem": "go"
          },
          {
            "name": "google.golang.org/genproto/googleapis/rpc",
            "direct": false,
            "version": "v0.0.0-20260203192932-546029d2fa20",
            "ecosystem": "go"
          },
          {
            "name": "google.golang.org/grpc",
            "direct": false,
            "version": "v1.79.3",
            "ecosystem": "go"
          },
          {
            "name": "google.golang.org/protobuf",
            "direct": false,
            "version": "v1.36.11",
            "ecosystem": "go"
          },
          {
            "name": "gopkg.in/warnings.v0",
            "direct": false,
            "version": "v0.1.2",
            "ecosystem": "go"
          },
          {
            "name": "modernc.org/libc",
            "direct": false,
            "version": "v1.70.0",
            "ecosystem": "go"
          },
          {
            "name": "modernc.org/mathutil",
            "direct": false,
            "version": "v1.7.1",
            "ecosystem": "go"
          },
          {
            "name": "modernc.org/memory",
            "direct": false,
            "version": "v1.11.0",
            "ecosystem": "go"
          }
        ],
        "collected": true,
        "truncated": false,
        "total_count": 333,
        "direct_count": 98,
        "indirect_count": 235
      }
    },
    "maintainership": {
      "issues": {
        "open_prs": 0,
        "merged_prs": 0,
        "open_issues": 0,
        "closed_ratio": null,
        "closed_issues": 0,
        "closed_unmerged_prs": 0
      },
      "bus_factor": 2,
      "bot_contributors": 2,
      "top_contributors": [
        {
          "type": "User",
          "login": "wagoodman",
          "commits": 795,
          "avatar_url": "https://avatars.githubusercontent.com/u/590471?v=4"
        },
        {
          "type": "User",
          "login": "spiffcs",
          "commits": 210,
          "avatar_url": "https://avatars.githubusercontent.com/u/32073428?v=4"
        },
        {
          "type": "User",
          "login": "kzantow",
          "commits": 189,
          "avatar_url": "https://avatars.githubusercontent.com/u/3009477?v=4"
        },
        {
          "type": "User",
          "login": "luhring",
          "commits": 113,
          "avatar_url": "https://avatars.githubusercontent.com/u/5199289?v=4"
        },
        {
          "type": "User",
          "login": "westonsteimel",
          "commits": 85,
          "avatar_url": "https://avatars.githubusercontent.com/u/1593939?v=4"
        },
        {
          "type": "User",
          "login": "willmurphyscode",
          "commits": 76,
          "avatar_url": "https://avatars.githubusercontent.com/u/12529630?v=4"
        },
        {
          "type": "User",
          "login": "LaurentGoderre",
          "commits": 37,
          "avatar_url": "https://avatars.githubusercontent.com/u/1090826?v=4"
        },
        {
          "type": "User",
          "login": "jonasagx",
          "commits": 28,
          "avatar_url": "https://avatars.githubusercontent.com/u/774704?v=4"
        },
        {
          "type": "User",
          "login": "witchcraze",
          "commits": 24,
          "avatar_url": "https://avatars.githubusercontent.com/u/67056980?v=4"
        },
        {
          "type": "User",
          "login": "coheigea",
          "commits": 20,
          "avatar_url": "https://avatars.githubusercontent.com/u/472162?v=4"
        }
      ],
      "contributors_sampled": 98,
      "top_contributor_share": 0.435
    },
    "quality_signals": {
      "has_ci": true,
      "has_tests": true,
      "ci_workflows": [
        "codeql-analysis.yml",
        "dependabot-automation.yaml",
        "detect-schema-changes.yaml",
        "oss-project-board-add.yaml",
        "release.yaml",
        "remove-awaiting-response-label.yaml",
        "test-fixture-cache-publish.yaml",
        "update-anchore-dependencies.yml",
        "update-bootstrap-tools.yml",
        "update-cpe-dictionary-index.yml",
        "update-spdx-license-list.yaml",
        "validate-github-actions.yaml",
        "validations.yaml"
      ],
      "has_docs_dir": false,
      "linter_configs": [
        ".golangci.yaml"
      ],
      "has_editorconfig": false,
      "has_linter_config": true,
      "has_precommit_config": false
    },
    "security_signals": {
      "lockfiles": [
        "Cargo.lock",
        "Gemfile.lock",
        "Pipfile.lock",
        "composer.lock",
        "go.sum",
        "mix.lock",
        "package-lock.json",
        "packages.lock.json",
        "pdm.lock",
        "pnpm-lock.yaml",
        "poetry.lock",
        "uv.lock",
        "yarn.lock"
      ],
      "scorecard": {
        "checks": [
          {
            "name": "Binary-Artifacts",
            "score": 10,
            "reason": "no binaries found in the repo",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#binary-artifacts"
          },
          {
            "name": "Branch-Protection",
            "score": 0,
            "reason": "branch protection not enabled on development/release branches",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#branch-protection"
          },
          {
            "name": "CI-Tests",
            "score": null,
            "reason": "no pull request found",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#ci-tests"
          },
          {
            "name": "CII-Best-Practices",
            "score": 0,
            "reason": "no effort to earn an OpenSSF best practices badge detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#cii-best-practices"
          },
          {
            "name": "Code-Review",
            "score": 0,
            "reason": "Found 0/30 approved changesets -- score normalized to 0",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#code-review"
          },
          {
            "name": "Contributors",
            "score": 10,
            "reason": "project has 35 contributing companies or organizations",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#contributors"
          },
          {
            "name": "Dangerous-Workflow",
            "score": 10,
            "reason": "no dangerous workflow patterns detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dangerous-workflow"
          },
          {
            "name": "Dependency-Update-Tool",
            "score": 10,
            "reason": "update tool detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dependency-update-tool"
          },
          {
            "name": "Fuzzing",
            "score": 0,
            "reason": "project is not fuzzed",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#fuzzing"
          },
          {
            "name": "License",
            "score": 10,
            "reason": "license file detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#license"
          },
          {
            "name": "Maintained",
            "score": 0,
            "reason": "0 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 0",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#maintained"
          },
          {
            "name": "Packaging",
            "score": null,
            "reason": "packaging workflow not detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#packaging"
          },
          {
            "name": "Pinned-Dependencies",
            "score": 7,
            "reason": "dependency not pinned by hash detected -- score normalized to 7",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#pinned-dependencies"
          },
          {
            "name": "SAST",
            "score": 10,
            "reason": "SAST tool detected: CodeQL",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#sast"
          },
          {
            "name": "Security-Policy",
            "score": 10,
            "reason": "security policy file detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#security-policy"
          },
          {
            "name": "Signed-Releases",
            "score": null,
            "reason": "no releases found",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#signed-releases"
          },
          {
            "name": "Token-Permissions",
            "score": 9,
            "reason": "detected GitHub workflow tokens with excessive permissions",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#token-permissions"
          },
          {
            "name": "Vulnerabilities",
            "score": 0,
            "reason": "337 existing vulnerabilities detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#vulnerabilities"
          }
        ],
        "commit": "d71b747cd1600ce4eefbfc2d449496c89e07aaef",
        "ran_at": "2026-07-25T10:34:16Z",
        "aggregate_score": 5.6,
        "scorecard_version": "v5.5.0"
      },
      "has_codeql_workflow": true,
      "has_security_policy": true,
      "has_dependabot_config": true
    },
    "contribution_flow": {
      "collected": true,
      "ci_last_run_at": "2026-06-03T04:12:32Z",
      "oldest_open_prs": [],
      "last_merged_pr_at": null,
      "ci_last_conclusion": "SKIPPED",
      "oldest_open_issues": []
    }
  },
  "config": {
    "disabled_metrics": [],
    "disabled_categories": [],
    "disabled_components": {}
  },
  "source": {
    "url": "https://github.com/joshbressers/syft",
    "host": "github.com",
    "name": "syft",
    "owner": "joshbressers"
  },
  "metrics": {
    "overall": {
      "key": "overall",
      "band": "at_risk",
      "name": "Overall health",
      "note": null,
      "notes": [],
      "value": 43,
      "inputs": {
        "security": 54,
        "vitality": 50,
        "community": 12,
        "governance": 43,
        "engineering": 52
      },
      "components": []
    },
    "categories": [
      {
        "key": "vitality",
        "band": "moderate",
        "name": "Vitality",
        "value": 50,
        "weight": 0.22,
        "metrics": [
          {
            "key": "development_activity",
            "band": "moderate",
            "name": "Development activity",
            "note": null,
            "notes": [],
            "value": 51,
            "inputs": {
              "commits_last_year": 375,
              "human_commit_share": 0.38,
              "days_since_last_push": 116,
              "active_weeks_last_year": 34
            },
            "components": [
              {
                "key": "push_recency",
                "name": "Push recency",
                "detail": "last push 116 days ago",
                "points": 9.9,
                "status": "partial",
                "details": [
                  {
                    "code": "push_recency",
                    "params": {
                      "days": 116
                    }
                  }
                ],
                "max_points": 36
              },
              {
                "key": "commit_cadence",
                "name": "Commit cadence",
                "detail": "34/52 weeks with commits",
                "points": 23.5,
                "status": "partial",
                "details": [
                  {
                    "code": "commit_cadence_weeks",
                    "params": {
                      "weeks": 34
                    }
                  }
                ],
                "max_points": 36
              },
              {
                "key": "commit_volume",
                "name": "Commit volume",
                "detail": "375 commits in the last year",
                "points": 18,
                "status": "met",
                "details": [
                  {
                    "code": "commits_last_year",
                    "params": {
                      "count": 375
                    }
                  }
                ],
                "max_points": 18
              },
              {
                "key": "openssf_scorecard_maintained",
                "name": "OpenSSF Scorecard: Maintained",
                "detail": "0 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 0",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 10
              }
            ]
          },
          {
            "key": "release_discipline",
            "band": "at_risk",
            "name": "Release discipline",
            "note": "Excluded from scoring (no data or not applicable): OpenSSF Scorecard: Signed-Releases. Remaining weights renormalized.",
            "notes": [
              {
                "code": "excluded_no_data",
                "params": {
                  "components": [
                    "openssf_scorecard_signed_releases"
                  ]
                }
              },
              {
                "code": "weights_renormalized",
                "params": {}
              }
            ],
            "value": 48,
            "inputs": {
              "releases_count": 49,
              "latest_release_tag": "v0.24.1",
              "releases_from_tags": true,
              "days_since_latest_release": 1761,
              "mean_days_between_releases": 11.1
            },
            "components": [
              {
                "key": "ships_releases",
                "name": "Ships releases",
                "detail": "49 version tags (no GitHub releases)",
                "points": 16.2,
                "status": "partial",
                "details": [
                  {
                    "code": "version_tags_no_releases",
                    "params": {
                      "count": 49
                    }
                  }
                ],
                "max_points": 27
              },
              {
                "key": "release_recency",
                "name": "Release recency",
                "detail": "latest release 1761 days ago",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "release_recency",
                    "params": {
                      "days": 1761
                    }
                  }
                ],
                "max_points": 36
              },
              {
                "key": "release_cadence",
                "name": "Release cadence",
                "detail": "a release every ~11.1 days",
                "points": 27,
                "status": "met",
                "details": [
                  {
                    "code": "release_cadence",
                    "params": {
                      "gap": 11.1
                    }
                  }
                ],
                "max_points": 27
              },
              {
                "key": "openssf_scorecard_signed_releases",
                "name": "OpenSSF Scorecard: Signed-Releases",
                "detail": "no releases found",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "no_data",
                    "params": {}
                  }
                ],
                "max_points": 10
              }
            ]
          },
          {
            "key": "abandonment",
            "band": "excellent",
            "name": "Abandonment",
            "note": null,
            "notes": [],
            "value": 100,
            "inputs": {
              "cap": null,
              "state": "maintained",
              "guards": [],
              "signals": [],
              "red_flag": false,
              "multiplier_pct": 100,
              "declared_reason": null,
              "unverified_reason": null,
              "unanswered_open_prs": null,
              "unanswered_open_issues": null,
              "days_since_last_merged_pr": null,
              "days_since_last_human_commit": 122,
              "days_since_last_human_commit_is_floor": false
            },
            "components": [
              {
                "key": "project_is_still_maintained",
                "name": "Project is still maintained",
                "detail": "last human commit 122 days ago",
                "points": 100,
                "status": "met",
                "details": [
                  {
                    "code": "abandonment_maintained",
                    "params": {
                      "days": 122
                    }
                  }
                ],
                "max_points": 100
              }
            ]
          }
        ],
        "description": "Is the project alive — is code being written and are releases shipping?"
      },
      {
        "key": "community",
        "band": "critical",
        "name": "Community & Adoption",
        "value": 12,
        "weight": 0.18,
        "metrics": [
          {
            "key": "popularity",
            "band": "critical",
            "name": "Popularity & adoption",
            "note": null,
            "notes": [],
            "value": 1,
            "inputs": {
              "forks": 0,
              "stars": 0,
              "watchers": 0,
              "growth_state": "unverified",
              "growth_factor_pct": 100,
              "growth_unverified_reason": "no_history"
            },
            "components": [
              {
                "key": "stars",
                "name": "Stars",
                "detail": "0 stars",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "stars",
                    "params": {
                      "count": 0
                    }
                  }
                ],
                "max_points": 60
              },
              {
                "key": "forks",
                "name": "Forks",
                "detail": "0 forks",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "forks",
                    "params": {
                      "count": 0
                    }
                  }
                ],
                "max_points": 25
              },
              {
                "key": "watchers",
                "name": "Watchers",
                "detail": "0 watchers",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "watchers",
                    "params": {
                      "count": 0
                    }
                  }
                ],
                "max_points": 15
              }
            ]
          },
          {
            "key": "community_health",
            "band": "critical",
            "name": "Community health",
            "note": null,
            "notes": [],
            "value": 25,
            "inputs": {
              "has_readme": false,
              "has_license": false,
              "has_contributing": false,
              "has_issue_template": false,
              "has_code_of_conduct": false,
              "has_pull_request_template": false
            },
            "components": [
              {
                "key": "readme",
                "name": "README",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 22.5
              },
              {
                "key": "license",
                "name": "License",
                "detail": "recognized license (Apache-2.0)",
                "points": 22.5,
                "status": "met",
                "details": [
                  {
                    "code": "license_standard",
                    "params": {}
                  },
                  {
                    "code": "license_spdx",
                    "params": {
                      "spdx": "Apache-2.0"
                    }
                  }
                ],
                "max_points": 22.5
              },
              {
                "key": "contributing_guide",
                "name": "CONTRIBUTING guide",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 18
              },
              {
                "key": "code_of_conduct",
                "name": "Code of conduct",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 13.5
              },
              {
                "key": "issue_template",
                "name": "Issue template",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.2
              },
              {
                "key": "pr_template",
                "name": "PR template",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 6.3
              }
            ]
          }
        ],
        "description": "Does the project have users, downloads, attention, and a welcoming setup for contributors?"
      },
      {
        "key": "governance",
        "band": "at_risk",
        "name": "Sustainability & Governance",
        "value": 43,
        "weight": 0.24,
        "metrics": [
          {
            "key": "maintainer_resilience",
            "band": "moderate",
            "name": "Maintainer resilience (bus factor)",
            "note": null,
            "notes": [],
            "value": 61,
            "inputs": {
              "bus_factor": 2,
              "contributors_sampled": 98,
              "top_contributor_share": 0.435
            },
            "components": [
              {
                "key": "bus_factor",
                "name": "Bus factor",
                "detail": "2 contributor(s) cover half of all commits",
                "points": 25.2,
                "status": "partial",
                "details": [
                  {
                    "code": "bus_factor",
                    "params": {
                      "count": 2
                    }
                  }
                ],
                "max_points": 54
              },
              {
                "key": "commit_distribution",
                "name": "Commit distribution",
                "detail": "top contributor authored 44% of commits",
                "points": 12.7,
                "status": "partial",
                "details": [
                  {
                    "code": "top_contributor_share",
                    "params": {
                      "share": 44
                    }
                  }
                ],
                "max_points": 22.5
              },
              {
                "key": "contributor_breadth",
                "name": "Contributor breadth",
                "detail": "98 contributors",
                "points": 13.5,
                "status": "met",
                "details": [
                  {
                    "code": "contributors_sampled",
                    "params": {
                      "count": 98
                    }
                  }
                ],
                "max_points": 13.5
              },
              {
                "key": "openssf_scorecard_contributors",
                "name": "OpenSSF Scorecard: Contributors",
                "detail": "project has 35 contributing companies or organizations",
                "points": 10,
                "status": "met",
                "details": [],
                "max_points": 10
              }
            ]
          },
          {
            "key": "responsiveness",
            "band": "critical",
            "name": "Issue & PR responsiveness",
            "note": "Excluded from scoring (no data or not applicable): Issue resolution, PR acceptance. Remaining weights renormalized.",
            "notes": [
              {
                "code": "excluded_no_data",
                "params": {
                  "components": [
                    "issue_resolution",
                    "pr_acceptance"
                  ]
                }
              },
              {
                "code": "weights_renormalized",
                "params": {}
              }
            ],
            "value": 1,
            "inputs": {
              "merged_prs": 0,
              "open_issues": 0,
              "closed_issues": 0,
              "issue_closed_ratio": null,
              "closed_unmerged_prs": 0
            },
            "components": [
              {
                "key": "issue_resolution",
                "name": "Issue resolution",
                "detail": "no issues or no data",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "no_issues_or_data",
                    "params": {}
                  }
                ],
                "max_points": 46.75
              },
              {
                "key": "pr_acceptance",
                "name": "PR acceptance",
                "detail": "no decided pull requests or no data",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "no_decided_prs_or_data",
                    "params": {}
                  }
                ],
                "max_points": 38.25
              },
              {
                "key": "openssf_scorecard_code_review",
                "name": "OpenSSF Scorecard: Code-Review",
                "detail": "Found 0/30 approved changesets -- score normalized to 0",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 15
              }
            ]
          },
          {
            "key": "stewardship",
            "band": "moderate",
            "name": "Ownership & stewardship",
            "note": "Excluded from scoring (no data or not applicable): Verified domain. Remaining weights renormalized.",
            "notes": [
              {
                "code": "excluded_no_data",
                "params": {
                  "components": [
                    "verified_domain"
                  ]
                }
              },
              {
                "code": "weights_renormalized",
                "params": {}
              }
            ],
            "value": 62,
            "inputs": {
              "followers": 111,
              "owner_type": "User",
              "is_verified": null,
              "owner_login": "joshbressers",
              "public_repos": 109,
              "account_age_days": 5198
            },
            "components": [
              {
                "key": "ownership_backing",
                "name": "Ownership backing",
                "detail": "personal (user) account",
                "points": 10,
                "status": "partial",
                "details": [
                  {
                    "code": "owner_personal",
                    "params": {}
                  }
                ],
                "max_points": 30
              },
              {
                "key": "verified_domain",
                "name": "Verified domain",
                "detail": "not applicable to user accounts",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "not_applicable_to_user_accounts",
                    "params": {}
                  }
                ],
                "max_points": 20
              },
              {
                "key": "owner_reach",
                "name": "Owner reach",
                "detail": "111 followers of joshbressers",
                "points": 14.7,
                "status": "partial",
                "details": [
                  {
                    "code": "owner_followers",
                    "params": {
                      "count": 111,
                      "login": "joshbressers"
                    }
                  }
                ],
                "max_points": 25
              },
              {
                "key": "track_record",
                "name": "Track record",
                "detail": "109 public repos, account ~14 yr old",
                "points": 25,
                "status": "met",
                "details": [
                  {
                    "code": "public_repos",
                    "params": {
                      "count": 109
                    }
                  },
                  {
                    "code": "account_age_years",
                    "params": {
                      "years": 14
                    }
                  }
                ],
                "max_points": 25
              }
            ]
          }
        ],
        "description": "Will the project survive its people — bus factor, responsiveness, who backs it, and package upkeep?"
      },
      {
        "key": "engineering",
        "band": "moderate",
        "name": "Engineering Quality",
        "value": 52,
        "weight": 0.2,
        "metrics": [
          {
            "key": "engineering_practices",
            "band": "good",
            "name": "Engineering practices",
            "note": "Excluded from scoring (no data or not applicable): OpenSSF Scorecard: CI-Tests. Remaining weights renormalized.",
            "notes": [
              {
                "code": "excluded_no_data",
                "params": {
                  "components": [
                    "openssf_scorecard_ci_tests"
                  ]
                }
              },
              {
                "code": "weights_renormalized",
                "params": {}
              }
            ],
            "value": 80,
            "inputs": {
              "has_ci": true,
              "has_tests": true,
              "has_editorconfig": false,
              "has_linter_config": true,
              "has_precommit_config": false
            },
            "components": [
              {
                "key": "ci_workflows",
                "name": "CI workflows",
                "detail": "13 workflow(s)",
                "points": 24,
                "status": "met",
                "details": [
                  {
                    "code": "ci_workflows",
                    "params": {
                      "count": 13
                    }
                  }
                ],
                "max_points": 24
              },
              {
                "key": "tests_present",
                "name": "Tests present",
                "detail": null,
                "points": 24,
                "status": "met",
                "details": [],
                "max_points": 24
              },
              {
                "key": "linter_config",
                "name": "Linter config",
                "detail": ".golangci.yaml",
                "points": 16,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": ".golangci.yaml"
                    }
                  }
                ],
                "max_points": 16
              },
              {
                "key": "pre_commit_hooks",
                "name": "Pre-commit hooks",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 9.6
              },
              {
                "key": "editorconfig",
                "name": ".editorconfig",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 6.4
              },
              {
                "key": "openssf_scorecard_ci_tests",
                "name": "OpenSSF Scorecard: CI-Tests",
                "detail": "no pull request found",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "no_data",
                    "params": {}
                  }
                ],
                "max_points": 20
              }
            ]
          },
          {
            "key": "documentation",
            "band": "critical",
            "name": "Documentation",
            "note": null,
            "notes": [],
            "value": 10,
            "inputs": {
              "topics": [],
              "has_wiki": true,
              "homepage": null,
              "has_readme": false,
              "has_docs_dir": false,
              "has_description": false
            },
            "components": [
              {
                "key": "readme",
                "name": "README",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 30
              },
              {
                "key": "documentation_directory",
                "name": "Documentation directory",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 25
              },
              {
                "key": "documentation_homepage_site",
                "name": "Documentation / homepage site",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 15
              },
              {
                "key": "repository_description",
                "name": "Repository description",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 10
              },
              {
                "key": "topics",
                "name": "Topics",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 10
              },
              {
                "key": "wiki",
                "name": "Wiki",
                "detail": null,
                "points": 10,
                "status": "met",
                "details": [],
                "max_points": 10
              }
            ]
          }
        ],
        "description": "Are baseline engineering and documentation practices in place?"
      },
      {
        "key": "security",
        "band": "moderate",
        "name": "Security",
        "value": 54,
        "weight": 0.16,
        "metrics": [
          {
            "key": "security_posture",
            "band": "moderate",
            "name": "Security posture",
            "note": "Excluded from scoring (no data or not applicable): CI-Tests, Packaging, Signed-Releases. Remaining weights renormalized.",
            "notes": [
              {
                "code": "excluded_no_data",
                "params": {
                  "components": [
                    "ci_tests",
                    "packaging",
                    "signed_releases"
                  ]
                }
              },
              {
                "code": "weights_renormalized",
                "params": {}
              }
            ],
            "value": 56,
            "inputs": {
              "source": "openssf_scorecard",
              "checks_evaluated": 15,
              "scorecard_version": "v5.5.0",
              "checks_inconclusive": 3,
              "scorecard_aggregate": 5.6
            },
            "components": [
              {
                "key": "binary_artifacts",
                "name": "Binary-Artifacts",
                "detail": "no binaries found in the repo",
                "points": 7.5,
                "status": "met",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "branch_protection",
                "name": "Branch-Protection",
                "detail": "branch protection not enabled on development/release branches",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "ci_tests",
                "name": "CI-Tests",
                "detail": "no pull request found",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "no_data",
                    "params": {}
                  }
                ],
                "max_points": 2.5
              },
              {
                "key": "cii_best_practices",
                "name": "CII-Best-Practices",
                "detail": "no effort to earn an OpenSSF best practices badge detected",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 2.5
              },
              {
                "key": "code_review",
                "name": "Code-Review",
                "detail": "Found 0/30 approved changesets -- score normalized to 0",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "contributors",
                "name": "Contributors",
                "detail": "project has 35 contributing companies or organizations",
                "points": 2.5,
                "status": "met",
                "details": [],
                "max_points": 2.5
              },
              {
                "key": "dangerous_workflow",
                "name": "Dangerous-Workflow",
                "detail": "no dangerous workflow patterns detected",
                "points": 10,
                "status": "met",
                "details": [],
                "max_points": 10
              },
              {
                "key": "dependency_update_tool",
                "name": "Dependency-Update-Tool",
                "detail": "update tool detected",
                "points": 7.5,
                "status": "met",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "fuzzing",
                "name": "Fuzzing",
                "detail": "project is not fuzzed",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 5
              },
              {
                "key": "license",
                "name": "License",
                "detail": "license file detected",
                "points": 2.5,
                "status": "met",
                "details": [],
                "max_points": 2.5
              },
              {
                "key": "maintained",
                "name": "Maintained",
                "detail": "0 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 0",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "packaging",
                "name": "Packaging",
                "detail": "packaging workflow not detected",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "no_data",
                    "params": {}
                  }
                ],
                "max_points": 5
              },
              {
                "key": "pinned_dependencies",
                "name": "Pinned-Dependencies",
                "detail": "dependency not pinned by hash detected -- score normalized to 7",
                "points": 3.5,
                "status": "partial",
                "details": [],
                "max_points": 5
              },
              {
                "key": "sast",
                "name": "SAST",
                "detail": "SAST tool detected: CodeQL",
                "points": 5,
                "status": "met",
                "details": [],
                "max_points": 5
              },
              {
                "key": "security_policy",
                "name": "Security-Policy",
                "detail": "security policy file detected",
                "points": 5,
                "status": "met",
                "details": [],
                "max_points": 5
              },
              {
                "key": "signed_releases",
                "name": "Signed-Releases",
                "detail": "no releases found",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "no_data",
                    "params": {}
                  }
                ],
                "max_points": 7.5
              },
              {
                "key": "token_permissions",
                "name": "Token-Permissions",
                "detail": "detected GitHub workflow tokens with excessive permissions",
                "points": 6.8,
                "status": "partial",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "vulnerabilities",
                "name": "Vulnerabilities",
                "detail": "337 existing vulnerabilities detected",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.5
              }
            ]
          },
          {
            "key": "dependency_advisories",
            "band": "at_risk",
            "name": "Dependency advisories",
            "note": "Excluded from scoring (no data or not applicable): Indirect dependencies free of known advisories. Remaining weights renormalized. Matched 333 resolved dependencies against OSV. This repository publishes no package the index resolves, so the repository dependency graph was assessed instead. That graph mixes development and test pins with shipped dependencies, so only the declared runtime dependencies are scored; transitive findings are reported as context and excluded from the score. Reachability is not analyzed.",
            "notes": [
              {
                "code": "excluded_no_data",
                "params": {
                  "components": [
                    "indirect_dependencies_free_of_known_advisories"
                  ]
                }
              },
              {
                "code": "weights_renormalized",
                "params": {}
              },
              {
                "code": "advisories_scope_repository",
                "params": {
                  "assessed": 333
                }
              },
              {
                "code": "advisories_repo_graph_caveat",
                "params": {}
              },
              {
                "code": "advisories_reachability",
                "params": {}
              }
            ],
            "value": 46,
            "inputs": {
              "source": "osv",
              "advisories": 87,
              "affected_packages": 17,
              "assessed_packages": 333,
              "unassessed_packages": 0,
              "affected_by_severity": "critical 3, high 5, moderate 5, unknown 4",
              "direct_affected_packages": 5
            },
            "components": [
              {
                "key": "direct_dependencies_free_of_known_advisories",
                "name": "Direct dependencies free of known advisories",
                "detail": "5 affected: github.com/go-git/go-billy/v5 v5.8.0 (high 8.1), github.com/hashicorp/go-getter v1.8.5 (high 7.5), github.com/go-git/go-git/v5 v5.17.0 (moderate 6.5), +2 more",
                "points": 7.5,
                "status": "partial",
                "details": [
                  {
                    "code": "advisories_affected",
                    "params": {
                      "count": 5,
                      "packages": "github.com/go-git/go-billy/v5 v5.8.0 (high 8.1), github.com/hashicorp/go-getter v1.8.5 (high 7.5), github.com/go-git/go-git/v5 v5.17.0 (moderate 6.5)"
                    }
                  },
                  {
                    "code": "advisories_affected_more",
                    "params": {
                      "count": 2
                    }
                  }
                ],
                "max_points": 35
              },
              {
                "key": "indirect_dependencies_free_of_known_advisories",
                "name": "Indirect dependencies free of known advisories",
                "detail": "transitive set not separable from development and test dependencies in this scope",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "advisories_scope_not_separable",
                    "params": {}
                  }
                ],
                "max_points": 25
              },
              {
                "key": "no_advisories_left_outstanding",
                "name": "No advisories left outstanding",
                "detail": "3 advisory-carrying package(s) unaddressed past 90 days; oldest published 392 days ago",
                "points": 27,
                "status": "partial",
                "details": [
                  {
                    "code": "advisories_stale",
                    "params": {
                      "days": 90,
                      "count": 3,
                      "oldest": 392
                    }
                  }
                ],
                "max_points": 40
              }
            ]
          },
          {
            "key": "malicious_dependencies",
            "band": "excellent",
            "name": "Malicious dependencies",
            "note": null,
            "notes": [],
            "value": 100,
            "inputs": {
              "source": "osv",
              "meaning": "reported as a malicious package by the OpenSSF corpus; the remedy is removal or moving off the compromised name, never an upgrade of the same artifact. Versions the registry has since pulled are listed but not scored",
              "packages": [],
              "red_flag": false,
              "assessed_packages": 333,
              "malicious_packages": 0,
              "direct_malicious_packages": 0,
              "withdrawn_malicious_packages": 0,
              "installable_malicious_packages": 0
            },
            "components": [
              {
                "key": "no_dependency_reported_as_a_malicious_package",
                "name": "No dependency reported as a malicious package",
                "detail": "no dependency is reported as a malicious package",
                "points": 100,
                "status": "met",
                "details": [
                  {
                    "code": "no_malicious_dependencies",
                    "params": {}
                  }
                ],
                "max_points": 100
              }
            ]
          },
          {
            "key": "high_risk_jurisdiction_exposure",
            "band": "excellent",
            "name": "High-Risk Jurisdiction Exposure",
            "note": "Only high-confidence self-published location evidence affects this multiplier. Ambiguous matches are review-only; country evidence is not proof of nationality, citizenship, legal registration, malicious intent, or sanctions status.",
            "notes": [
              {
                "code": "jurisdiction_evidence_limits",
                "params": {}
              }
            ],
            "value": 100,
            "inputs": {
              "meaning": "self-published location evidence; not nationality or citizenship",
              "red_flag": false,
              "exposures": [],
              "policy_countries": [
                "Russia",
                "Iran",
                "North Korea"
              ],
              "review_only_matches": 0,
              "assessed_self_published_locations": 11
            },
            "components": [
              {
                "key": "policy_exposure_multiplier",
                "name": "Policy exposure multiplier",
                "detail": "no confirmed policy-scope location match",
                "points": 100,
                "status": "met",
                "details": [
                  {
                    "code": "jurisdiction_no_match",
                    "params": {}
                  }
                ],
                "max_points": 100
              }
            ]
          }
        ],
        "description": "Are visible security and supply-chain practices strong, with no malicious dependency and no unresolved high-risk jurisdiction exposure?"
      },
      {
        "key": "ai_readiness",
        "band": "moderate",
        "name": "AI Readiness",
        "value": 68,
        "weight": 0,
        "metrics": [
          {
            "key": "ai_agent_context",
            "band": "at_risk",
            "name": "Agent context & guidance",
            "note": null,
            "notes": [],
            "value": 40,
            "inputs": {
              "has_llms_txt": false,
              "legible_history_share": 1,
              "agent_instruction_files": [],
              "agent_instruction_max_bytes": null
            },
            "components": [
              {
                "key": "agent_instructions",
                "name": "Agent instructions",
                "detail": "no CLAUDE.md / AGENTS.md / editor rules",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "no_agent_instructions",
                    "params": {}
                  }
                ],
                "max_points": 45
              },
              {
                "key": "machine_readable_docs_llms_txt",
                "name": "Machine-readable docs (llms.txt)",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 15
              },
              {
                "key": "legible_commit_history",
                "name": "Legible commit history",
                "detail": "38 of 38 human commits state their intent (structured subject or explanatory body)",
                "points": 40,
                "status": "met",
                "details": [
                  {
                    "code": "legible_history",
                    "params": {
                      "legible": 38,
                      "sampled": 38
                    }
                  }
                ],
                "max_points": 40
              }
            ]
          },
          {
            "key": "ai_verify_loop",
            "band": "excellent",
            "name": "Verify loop (build / test / typecheck)",
            "note": null,
            "notes": [],
            "value": 87,
            "inputs": {
              "has_nix": false,
              "has_tests": true,
              "lockfiles": [
                "Cargo.lock",
                "Gemfile.lock",
                "Pipfile.lock",
                "composer.lock",
                "go.sum",
                "mix.lock",
                "package-lock.json",
                "packages.lock.json",
                "pdm.lock",
                "pnpm-lock.yaml",
                "poetry.lock",
                "uv.lock",
                "yarn.lock"
              ],
              "has_dockerfile": true,
              "typed_language": true,
              "bootstrap_files": [
                "Makefile",
                "Taskfile.yaml",
                "cmd/syft/internal/test/integration/testdata/Makefile",
                "schema/cyclonedx/Makefile",
                "syft/file/cataloger/executable/testdata/Makefile",
                "syft/file/cataloger/executable/testdata/elf/Makefile",
                "syft/file/cataloger/executable/testdata/elf/project/Makefile",
                "syft/file/cataloger/executable/testdata/shared-info/Makefile",
                "syft/file/cataloger/executable/testdata/shared-info/project/Makefile",
                "syft/file/cataloger/executable/testdata/shared-info/project/hello/Makefile",
                "syft/file/cataloger/executable/testdata/shared-info/project/libhello/Makefile",
                "syft/pkg/cataloger/binary/testdata/Makefile",
                "syft/pkg/cataloger/binary/testdata/elf-testdata/elfbinwithcorrupt/elfsrc/makefile",
                "syft/pkg/cataloger/binary/testdata/elf-testdata/elfbinwithcorrupt/makefile",
                "syft/pkg/cataloger/binary/testdata/elf-testdata/elfbinwithnestedlib/elfsrc/makefile",
                "syft/pkg/cataloger/binary/testdata/elf-testdata/elfbinwithnestedlib/makefile",
                "syft/pkg/cataloger/binary/testdata/elf-testdata/elfbinwithsisterlib/elfsrc1/makefile",
                "syft/pkg/cataloger/binary/testdata/elf-testdata/elfbinwithsisterlib/elfsrc2/makefile",
                "syft/pkg/cataloger/binary/testdata/elf-testdata/elfbinwithsisterlib/makefile",
                "syft/pkg/cataloger/dotnet/testdata/Makefile",
                "syft/pkg/cataloger/golang/testdata/Makefile",
                "syft/pkg/cataloger/golang/testdata/archs/Makefile",
                "syft/pkg/cataloger/internal/pe/testdata/Makefile",
                "syft/pkg/cataloger/java/testdata/Makefile",
                "syft/pkg/cataloger/java/testdata/jar-metadata/Makefile",
                "syft/pkg/cataloger/java/testdata/java-builds/Makefile",
                "syft/pkg/cataloger/kernel/testdata/Makefile",
                "syft/pkg/cataloger/redhat/testdata/Makefile",
                "test/cli/testdata/Makefile",
                "test/cli/testdata/image-java-spdx-tools/Makefile",
                "test/cli/testdata/registry/Makefile",
                "test/install/Makefile"
              ],
              "has_devcontainer": false,
              "has_linter_config": true,
              "typecheck_configs": [],
              "agent_commit_share": 0,
              "toolchain_manifests": [
                "cmd/syft/internal/test/integration/testdata/image-go-bin-arch-coverage/go.mod",
                "cmd/syft/internal/test/integration/testdata/image-pkg-coverage/pkgs/go/go.mod",
                "cmd/syft/internal/test/integration/testdata/image-pkg-coverage/pkgs/java/pom.xml",
                "cmd/syft/internal/test/integration/testdata/image-sbom-cataloger/go.mod",
                "go.mod",
                "syft/pkg/cataloger/dotnet/testdata/image-net2-app/src/helloworld.csproj",
                "syft/pkg/cataloger/dotnet/testdata/image-net6-asp-libman/src/LibManSample.csproj",
                "syft/pkg/cataloger/dotnet/testdata/image-net8-app-no-depjson/src/dotnetapp.csproj",
                "syft/pkg/cataloger/dotnet/testdata/image-net8-app-self-contained/src/dotnetapp.csproj",
                "syft/pkg/cataloger/dotnet/testdata/image-net8-app-single-file/src/dotnetapp.csproj",
                "syft/pkg/cataloger/dotnet/testdata/image-net8-app-with-runtime-nodepsjson/src/dotnetapp.csproj",
                "syft/pkg/cataloger/dotnet/testdata/image-net8-app-with-runtime/src/dotnetapp.csproj",
                "syft/pkg/cataloger/dotnet/testdata/image-net8-app/src/dotnetapp.csproj",
                "syft/pkg/cataloger/dotnet/testdata/image-net8-compile-target/src/helloworld.csproj",
                "syft/pkg/cataloger/dotnet/testdata/image-net8-ilrepack/src/dotnetapp.csproj",
                "syft/pkg/cataloger/dotnet/testdata/image-net8-privateassets/src/dotnetapp.csproj",
                "syft/pkg/cataloger/golang/internal/gotestdata/go-source/go.mod",
                "syft/pkg/cataloger/golang/testdata/archs/src/go.mod",
                "syft/pkg/cataloger/golang/testdata/corrupt/go.mod",
                "syft/pkg/cataloger/golang/testdata/glob-paths/src/go.mod",
                "syft/pkg/cataloger/golang/testdata/go-mod-fixtures/many-packages/go.mod",
                "syft/pkg/cataloger/golang/testdata/go-mod-fixtures/one-package/go.mod",
                "syft/pkg/cataloger/golang/testdata/go-mod-fixtures/relative-replace/go.mod",
                "syft/pkg/cataloger/golang/testdata/go-sum-hashes/go.mod",
                "syft/pkg/cataloger/golang/testdata/image-not-a-module/go.mod",
                "syft/pkg/cataloger/golang/testdata/image-small-upx/go.mod",
                "syft/pkg/cataloger/golang/testdata/image-small/go.mod",
                "syft/pkg/cataloger/internal/pe/testdata/image-dotnet31-single-file/src/hello.csproj",
                "syft/pkg/cataloger/internal/pe/testdata/image-dotnet5-single-file/src/hello.csproj",
                "syft/pkg/cataloger/internal/pe/testdata/image-dotnet6-single-file/src/hello.csproj",
                "syft/pkg/cataloger/java/internal/maven/testdata/local/child-1/pom.xml",
                "syft/pkg/cataloger/java/internal/maven/testdata/local/child-2/pom.xml",
                "syft/pkg/cataloger/java/internal/maven/testdata/local/child-3/pom.xml",
                "syft/pkg/cataloger/java/internal/maven/testdata/local/circular-1/pom.xml",
                "syft/pkg/cataloger/java/internal/maven/testdata/local/circular-2/pom.xml",
                "syft/pkg/cataloger/java/internal/maven/testdata/local/contains-child-1/pom.xml",
                "syft/pkg/cataloger/java/internal/maven/testdata/local/parent-1/pom.xml",
                "syft/pkg/cataloger/java/internal/maven/testdata/local/parent-2/pom.xml",
                "syft/pkg/cataloger/java/internal/maven/testdata/local/parent-3/pom.xml",
                "syft/pkg/cataloger/java/testdata/corrupt/pom.xml",
                "syft/pkg/cataloger/java/testdata/glob-paths/src/pom.xml",
                "syft/pkg/cataloger/java/testdata/gradle/build.gradle",
                "syft/pkg/cataloger/java/testdata/jar-metadata/api-all-2.0.0-sources/META-INF/maven/org.apache.directory.api/api-all/pom.xml",
                "syft/pkg/cataloger/java/testdata/jar-metadata/api-all-2.0.0-sources/META-INF/maven/org.apache.directory.api/api-asn1-api/pom.xml",
                "syft/pkg/cataloger/java/testdata/jar-metadata/com.fasterxml.jackson.core.jackson-core-2.15.2/META-INF/maven/com.fasterxml.jackson.core/jackson-core/pom.xml",
                "syft/pkg/cataloger/java/testdata/jar-metadata/commons-lang3-3.12.0/META-INF/maven/org.apache.commons-lang3/pom.xml",
                "syft/pkg/cataloger/java/testdata/jar-metadata/jackson-core-2.15.2/META-INF/maven/com.fasterxml.jackson.core/jackson-core/pom.xml",
                "syft/pkg/cataloger/java/testdata/jar-metadata/micronaut-aop-4.9.11/META-INF/maven/io.micronaut/micronaut-aop/pom.xml",
                "syft/pkg/cataloger/java/testdata/jar-metadata/multiple-matching-2.11.5/META-INF/maven/org.multiple/multiple-matching-1/pom.xml",
                "syft/pkg/cataloger/java/testdata/jar-metadata/multiple-matching-2.11.5/META-INF/maven/org.multiple/multiple-matching-2/pom.xml",
                "syft/pkg/cataloger/java/testdata/jar-metadata/multiple-matching-2.11.5/META-INF/maven/org.multiple/multiple-matching-3/pom.xml",
                "syft/pkg/cataloger/java/testdata/jar-metadata/opensaml-core-3.4.6/META-INF/maven/org.opensaml/opensaml-core/pom.xml",
                "syft/pkg/cataloger/java/testdata/jar-metadata/org.multiple-thename/META-INF/maven/com.multiple/thename/pom.xml",
                "syft/pkg/cataloger/java/testdata/jar-metadata/org.multiple-thename/META-INF/maven/org.multiple/thename/pom.xml",
                "syft/pkg/cataloger/java/testdata/java-builds/example-java-app/build.gradle",
                "syft/pkg/cataloger/java/testdata/java-builds/example-java-app/pom.xml",
                "syft/pkg/cataloger/java/testdata/java-builds/example-jenkins-plugin/pom.xml",
                "syft/pkg/cataloger/java/testdata/java-builds/example-sb-app/pom.xml",
                "syft/pkg/cataloger/java/testdata/pom/commons-text-1.10.0/pom.xml",
                "syft/pkg/cataloger/java/testdata/pom/example-java-app-maven/pom.xml",
                "syft/pkg/cataloger/java/testdata/pom/transitive-top-level/pom.xml",
                "syft/pkg/cataloger/rust/testdata/image-audit/Cargo.toml"
              ],
              "dependency_bot_commit_share": 0.35
            },
            "components": [
              {
                "key": "one_command_bootstrap",
                "name": "One-command bootstrap",
                "detail": "Makefile, Taskfile.yaml, cmd/syft/internal/test/integration/testdata/Makefile, schema/cyclonedx/Makefile, syft/file/cataloger/executable/testdata/Makefile, syft/file/cataloger/executable/testdata/elf/Makefile, syft/file/cataloger/executable/testdata/elf/project/Makefile, syft/file/cataloger/executable/testdata/shared-info/Makefile, syft/file/cataloger/executable/testdata/shared-info/project/Makefile, syft/file/cataloger/executable/testdata/shared-info/project/hello/Makefile, syft/file/cataloger/executable/testdata/shared-info/project/libhello/Makefile, syft/pkg/cataloger/binary/testdata/Makefile, syft/pkg/cataloger/binary/testdata/elf-testdata/elfbinwithcorrupt/elfsrc/makefile, syft/pkg/cataloger/binary/testdata/elf-testdata/elfbinwithcorrupt/makefile, syft/pkg/cataloger/binary/testdata/elf-testdata/elfbinwithnestedlib/elfsrc/makefile, syft/pkg/cataloger/binary/testdata/elf-testdata/elfbinwithnestedlib/makefile, syft/pkg/cataloger/binary/testdata/elf-testdata/elfbinwithsisterlib/elfsrc1/makefile, syft/pkg/cataloger/binary/testdata/elf-testdata/elfbinwithsisterlib/elfsrc2/makefile, syft/pkg/cataloger/binary/testdata/elf-testdata/elfbinwithsisterlib/makefile, syft/pkg/cataloger/dotnet/testdata/Makefile, syft/pkg/cataloger/golang/testdata/Makefile, syft/pkg/cataloger/golang/testdata/archs/Makefile, syft/pkg/cataloger/internal/pe/testdata/Makefile, syft/pkg/cataloger/java/testdata/Makefile, syft/pkg/cataloger/java/testdata/jar-metadata/Makefile, syft/pkg/cataloger/java/testdata/java-builds/Makefile, syft/pkg/cataloger/kernel/testdata/Makefile, syft/pkg/cataloger/redhat/testdata/Makefile, test/cli/testdata/Makefile, test/cli/testdata/image-java-spdx-tools/Makefile, test/cli/testdata/registry/Makefile, test/install/Makefile",
                "points": 18,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": "Makefile, Taskfile.yaml, cmd/syft/internal/test/integration/testdata/Makefile, schema/cyclonedx/Makefile, syft/file/cataloger/executable/testdata/Makefile, syft/file/cataloger/executable/testdata/elf/Makefile, syft/file/cataloger/executable/testdata/elf/project/Makefile, syft/file/cataloger/executable/testdata/shared-info/Makefile, syft/file/cataloger/executable/testdata/shared-info/project/Makefile, syft/file/cataloger/executable/testdata/shared-info/project/hello/Makefile, syft/file/cataloger/executable/testdata/shared-info/project/libhello/Makefile, syft/pkg/cataloger/binary/testdata/Makefile, syft/pkg/cataloger/binary/testdata/elf-testdata/elfbinwithcorrupt/elfsrc/makefile, syft/pkg/cataloger/binary/testdata/elf-testdata/elfbinwithcorrupt/makefile, syft/pkg/cataloger/binary/testdata/elf-testdata/elfbinwithnestedlib/elfsrc/makefile, syft/pkg/cataloger/binary/testdata/elf-testdata/elfbinwithnestedlib/makefile, syft/pkg/cataloger/binary/testdata/elf-testdata/elfbinwithsisterlib/elfsrc1/makefile, syft/pkg/cataloger/binary/testdata/elf-testdata/elfbinwithsisterlib/elfsrc2/makefile, syft/pkg/cataloger/binary/testdata/elf-testdata/elfbinwithsisterlib/makefile, syft/pkg/cataloger/dotnet/testdata/Makefile, syft/pkg/cataloger/golang/testdata/Makefile, syft/pkg/cataloger/golang/testdata/archs/Makefile, syft/pkg/cataloger/internal/pe/testdata/Makefile, syft/pkg/cataloger/java/testdata/Makefile, syft/pkg/cataloger/java/testdata/jar-metadata/Makefile, syft/pkg/cataloger/java/testdata/java-builds/Makefile, syft/pkg/cataloger/kernel/testdata/Makefile, syft/pkg/cataloger/redhat/testdata/Makefile, test/cli/testdata/Makefile, test/cli/testdata/image-java-spdx-tools/Makefile, test/cli/testdata/registry/Makefile, test/install/Makefile"
                    }
                  }
                ],
                "max_points": 18
              },
              {
                "key": "automated_tests",
                "name": "Automated tests",
                "detail": null,
                "points": 22,
                "status": "met",
                "details": [],
                "max_points": 22
              },
              {
                "key": "lint_format_config",
                "name": "Lint / format config",
                "detail": ".golangci.yaml",
                "points": 11,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": ".golangci.yaml"
                    }
                  }
                ],
                "max_points": 11
              },
              {
                "key": "static_type_checking",
                "name": "Static type checking",
                "detail": "Go (statically typed)",
                "points": 11,
                "status": "met",
                "details": [
                  {
                    "code": "statically_typed_language",
                    "params": {
                      "language": "Go"
                    }
                  }
                ],
                "max_points": 11
              },
              {
                "key": "reproducible_environment",
                "name": "Reproducible environment",
                "detail": "Dockerfile, lockfile",
                "points": 10,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": "Dockerfile, lockfile"
                    }
                  }
                ],
                "max_points": 10
              },
              {
                "key": "demonstrated_agent_practice",
                "name": "Demonstrated agent practice",
                "detail": "no agent-authored commits among the last 100",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "no_agent_authored_commits",
                    "params": {
                      "sampled": 100
                    }
                  }
                ],
                "max_points": 10
              },
              {
                "key": "automated_maintenance",
                "name": "Automated maintenance",
                "detail": "35 of the last 100 commits are automated dependency updates",
                "points": 8,
                "status": "met",
                "details": [
                  {
                    "code": "dependency_bot_commits",
                    "params": {
                      "count": 35,
                      "sampled": 100
                    }
                  }
                ],
                "max_points": 8
              },
              {
                "key": "openssf_scorecard_pinned_dependencies",
                "name": "OpenSSF Scorecard: Pinned-Dependencies",
                "detail": "dependency not pinned by hash detected -- score normalized to 7",
                "points": 7,
                "status": "partial",
                "details": [],
                "max_points": 10
              }
            ]
          },
          {
            "key": "ai_code_legibility",
            "band": "excellent",
            "name": "Code legibility for models",
            "note": null,
            "notes": [],
            "value": 100,
            "inputs": {
              "primary_language": "Go",
              "largest_source_bytes": 202860,
              "source_files_sampled": 1197,
              "oversized_source_files": 6
            },
            "components": [
              {
                "key": "type_checkable_code",
                "name": "Type-checkable code",
                "detail": "Go (statically typed)",
                "points": 45,
                "status": "met",
                "details": [
                  {
                    "code": "statically_typed_language",
                    "params": {
                      "language": "Go"
                    }
                  }
                ],
                "max_points": 45
              },
              {
                "key": "manageable_file_sizes",
                "name": "Manageable file sizes",
                "detail": "6/1197 source files over 60KB",
                "points": 54.7,
                "status": "partial",
                "details": [
                  {
                    "code": "oversized_source_files",
                    "params": {
                      "kb": 60,
                      "sampled": 1197,
                      "oversized": 6
                    }
                  }
                ],
                "max_points": 55
              }
            ]
          },
          {
            "key": "ai_interfaces",
            "band": "at_risk",
            "name": "Machine-readable interfaces",
            "note": null,
            "notes": [],
            "value": 40,
            "inputs": {
              "example_dirs": [
                "example",
                "examples",
                "sample"
              ],
              "has_mcp_signal": false,
              "api_schema_files": []
            },
            "components": [
              {
                "key": "api_schema_openapi_graphql_proto",
                "name": "API schema (OpenAPI/GraphQL/proto)",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 40
              },
              {
                "key": "mcp_server",
                "name": "MCP server",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 20
              },
              {
                "key": "runnable_examples",
                "name": "Runnable examples",
                "detail": "example, examples, sample",
                "points": 40,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": "example, examples, sample"
                    }
                  }
                ],
                "max_points": 40
              }
            ]
          }
        ],
        "description": "How well is the repo equipped to be developed and maintained with AI coding agents? An independent, experimental badge — weight 0.0, so it is surfaced on its own and does not affect the overall health score."
      }
    ],
    "metrics_version": "1.13.0"
  },
  "warnings": [
    "Community profile unavailable",
    "go package 'github.com/anchore/syft' points at a different repository (https://github.com/anchore/syft); excluded from ecosystem scoring"
  ],
  "report_type": "repository",
  "generated_at": "2026-07-25T10:34:35.126456Z",
  "schema_version": "0.27.0",
  "badge_url": "https://raw.githubusercontent.com/inspect-software/badges/main/v1/j/joshbressers/syft.svg",
  "full_name": "joshbressers/syft",
  "license_state": "standard",
  "license_spdx": "Apache-2.0"
}

Registros relacionados

Repositorios inspeccionados que comparten etiquetas de catálogo o ecosistemas con joshbressers/syft. Leer en paralelo →

94wandb/wandbThe AI developer platform. Use Weights & Biases to train and fine-tune models, and manage models from experimentation to production.Excelente93apache/airflowApache Airflow - A platform to programmatically author, schedule, and monitor workflowsExcelente92envoyproxy/envoyCloud-native high-performance edge/middle/service proxyExcelente91prometheus/prometheusThe Prometheus monitoring system and time series database.Excelente91authelia/autheliaThe Single Sign-On Multi-Factor portal for web apps, now OpenID Certified™Excelente91coder/coderSecure environments for developers and their agentsExcelente

Las puntuaciones son señales, no garantías. Reflejan prácticas públicamente visibles en GitHub; no son una auditoría de código ni una garantía de seguridad.

Los datos ausentes se excluyen y los pesos se renormalizan; nunca se puntúan como cero. La metodología es versionada y abierta: métricas v1.13.0, esquema v0.27.0 — metodología completa · wiki de métricas.

Cómo se sitúa un resultado dentro del registro general: estadísticas agregadas — Go.