Registro público
Informe de salud del softwareesquema 0.27.0 · métricas 1.13.0 · 2026-07-25 10:11 UTC

wagoodman / syft

CLI tool and library for generating a Software Bill of Materials from container images and filesystems

GoApache-2.0★ 3 estrellas⑂ 1 forkdesde dic 2021forkVer en GitHub ↗

wagoodman/syft tiene un índice de salud de 40 sobre 100, lo que lo sitúa en la banda En riesgo. Su puntuación más alta es AI Readiness (67/100) y la más baja, Community & Adoption (14/100). Se actualizó por última vez hace 196 días. 2 personas concentran la mayor parte del trabajo reciente.

40
global / 100
En riesgo

Índice de salud del software

Las métricas se agrupan en categorías ponderadas sobre una escala de 1 a 100. El resultado global parte de su media; cuando la evidencia pública activa la Política de Jurisdicciones de Alto Riesgo, la calificación se ajusta y recibe el límite 49 (En riesgo). Preparación para IA queda fuera.

40
Excelente85-100Ejemplar; cumple prácticamente todos los criterios evaluados
Bueno70-84Saludable; carencias menores
Moderado50-69Aceptable con carencias notables; se recomienda revisión
En riesgo30-49Debilidades significativas; su adopción exige cautela
Crítico1-29Problemas graves (proyecto abandonado, un solo mantenedor, sin higiene)
VitalidadComunidad yAdopciónSostenibilidady GobernanzaCalidad deIngenieríaSeguridadPreparaciónpara IA

Perfil de puntuación

Cada eje es una categoría. La forma importa más que la media: un proyecto sano llena toda la figura, mientras que un perfil de picos y cráteres indica que la fortaleza en una dimensión enmascara el riesgo en otra.

Titularidad

Alex GoodmanCuenta personal
1675 seguidores110 repositorios públicosdesde ene 2011@anchore

Este repositorio pertenece a una cuenta personal. Un proyecto con un único propietario conlleva más riesgo de continuidad que uno respaldado por una organización.

Ecosistemas de paquetes

RegistroPaqueteVersiónDescargas / mesVersionesÚltima publicación
Gogithub.com/anchore/syftapunta a otro repositorio; no se puntúav1.49.0-268hace 4 días

Métricas por categoría

Vitalidad

¿Está vivo el proyecto: se escribe código y se publican versiones?

42En riesgo · 22% del índice global

Actividad de desarrollo

38En riesgo
Cómo se puntúa
3.6/36Recencia de push — último push hace 196 días
15.9/36Cadencia de commits — 23/52 semanas con commits
18/18Volumen de commits — 293 commits en el último año
0/10OpenSSF Scorecard: Maintained — 0 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 0
Datos de entrada utilizados
commits_last_year293
human_commit_share0,4
days_since_last_push196
active_weeks_last_year23

Disciplina de publicación

47En riesgo
Cómo se puntúa
27/27Publica versiones — 1 versiones publicadas
7.2/36Recencia de las versiones — última versión hace 611 días
12.6/27Cadencia de publicación — cadencia desconocida (una sola versión)
0/10OpenSSF Scorecard: Signed-Releases — Project has not signed or included provenance with any releases.
Datos de entrada utilizados
releases_count1
latest_release_tagv0.0.0
releases_from_tagsno
days_since_latest_release611
mean_days_between_releases—

Comunidad y Adopción

¿Tiene el proyecto usuarios, descargas, atención y unas condiciones acogedoras para quienes contribuyen?

14Crítico · 18% del índice global

Popularidad y adopción

5Crítico
Cómo se puntúa
4.9/60Estrellas — 3 estrellas
0/25Forks — 1 forks
0/15Observadores — 0 observadores
Datos de entrada utilizados
forks1
stars3
watchers0
growth_stateunverified
growth_factor_pct100
growth_unverified_reasonno_history

Salud de la comunidad

25Crítico
Cómo se puntúa
0/22.5README
22.5/22.5Licencia — licencia reconocida (Apache-2.0)
0/18Guía CONTRIBUTING
0/13.5Código de conducta
0/7.2Plantilla de issues
0/6.3Plantilla de PR
Datos de entrada utilizados
has_readmeno
has_licenseno
has_contributingno
has_issue_templateno
has_code_of_conductno
has_pull_request_templateno

Sostenibilidad y Gobernanza

¿Sobrevivirá el proyecto a sus personas: factor bus, capacidad de respuesta, quién lo respalda y mantenimiento del paquete?

46En riesgo · 24% del índice global

Resiliencia de mantenedores (factor bus)

61Moderado
Cómo se puntúa
25.2/54Factor bus — la mitad de los commits recae en 2 contribuyente(s)
12.6/22.5Distribución de commits — el principal contribuyente firma el 44% de los commits
13.5/13.5Amplitud de contribuyentes — 98 contribuyentes
10/10OpenSSF Scorecard: Contributors — project has 35 contributing companies or organizations
Datos de entrada utilizados
bus_factor2
contributors_sampled98
top_contributor_share0,44

Capacidad de respuesta a issues y PR

1Crítico
Cómo se puntúa
0/46.8Resolución de issues — sin issues o sin datos
0/38.3Aceptación de PR — 0/4 PR decididos fusionados
0/15OpenSSF Scorecard: Code-Review — Found 0/30 approved changesets -- score normalized to 0
Datos de entrada utilizados
merged_prs0
open_issues0
closed_issues0
issue_closed_ratio—
closed_unmerged_prs4
Excluidos de la puntuación (sin datos o no aplicable): Resolución de issues. Los pesos restantes se han renormalizado.

Propiedad y custodia

73Bueno
Cómo se puntúa
10/30Respaldo de la propiedad — cuenta personal (usuario)
0/20Dominio verificado — no aplicable a cuentas de usuario
23.2/25Alcance del propietario — 1675 seguidores de wagoodman
25/25Trayectoria — 110 repos públicos, cuenta de ~15 años
Datos de entrada utilizados
followers1675
owner_typeUser
is_verified—
owner_loginwagoodman
public_repos110
account_age_days5655
Excluidos de la puntuación (sin datos o no aplicable): Dominio verificado. Los pesos restantes se han renormalizado.

Calidad de Ingeniería

¿Existen unas prácticas mínimas de ingeniería y documentación?

52Moderado · 20% del índice global

Prácticas de ingeniería

80Bueno
Cómo se puntúa
24/24Flujos de trabajo de CI — 13 flujo(s) de trabajo
24/24Pruebas presentes
16/16Configuración de linter — .golangci.yaml
0/9.6Hooks de pre-commit
0/6.4.editorconfig
0/20OpenSSF Scorecard: CI-Tests — sin datos
Datos de entrada utilizados
has_cisí
has_testssí
has_editorconfigno
has_linter_configsí
has_precommit_configno
Excluidos de la puntuación (sin datos o no aplicable): OpenSSF Scorecard: CI-Tests. Los pesos restantes se han renormalizado.

Documentación

10Crítico
Cómo se puntúa
0/30README
0/25Directorio de documentación
0/15Sitio de documentación / página del proyecto
0/10Descripción del repositorio
0/10Topics
10/10Wiki
Datos de entrada utilizados
topics—
has_wikisí
homepage—
has_readmeno
has_docs_dirno
has_descriptionno

Seguridad

¿Son sólidas las prácticas visibles de seguridad y de cadena de suministro, sin exposición jurisdiccional de alto riesgo sin resolver?

42En riesgo · 16% del índice global

Postura de seguridad

43En riesgo
Cómo se puntúa
0/7.5Binary-Artifacts — binaries present in source code
0/7.5Branch-Protection — branch protection not enabled on development/release branches
0/2.5CI-Tests — sin datos
0/2.5CII-Best-Practices — no effort to earn an OpenSSF best practices badge detected
0/7.5Code-Review — Found 0/30 approved changesets -- score normalized to 0
2.5/2.5Contributors — project has 35 contributing companies or organizations
10/10Dangerous-Workflow — no dangerous workflow patterns detected
7.5/7.5Dependency-Update-Tool — update tool detected
0/5Fuzzing — project is not fuzzed
2.5/2.5Licencia — license file detected
0/7.5Maintained — 0 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 0
0/5Packaging — sin datos
3/5Pinned-Dependencies — dependency not pinned by hash detected -- score normalized to 6
5/5SAST — SAST tool detected: CodeQL
5/5Security-Policy — security policy file detected
0/7.5Signed-Releases — Project has not signed or included provenance with any releases.
6.8/7.5Token-Permissions — detected GitHub workflow tokens with excessive permissions
0/7.5Vulnerabilities — 319 existing vulnerabilities detected
Datos de entrada utilizados
sourceopenssf_scorecard
checks_evaluated16
scorecard_versionv5.5.0
checks_inconclusive2
scorecard_aggregate4,3
Excluidos de la puntuación (sin datos o no aplicable): ci_tests, packaging. Los pesos restantes se han renormalizado.

Avisos de dependencias

39En riesgo
Cómo se puntúa
6.5/35Dependencias directas libres de avisos conocidos — 7 afectados: github.com/go-git/go-billy/v5 v5.7.0 (high 8.1), github.com/hashicorp/go-getter v1.8.4 (high 7.5), github.com/anchore/stereoscope v0.0.0-20200706164556-7cf39d7f4639 (moderate 5.3), +4 más
0/25Dependencias indirectas libres de avisos conocidos — el conjunto transitivo no es separable de las dependencias de desarrollo y prueba en este alcance
22.9/40Sin avisos pendientes — 5 paquete(s) con avisos sin atender más allá de 90 días; el más antiguo publicado hace 905 días
Datos de entrada utilizados
sourceosv
advisories195
affected_packages43
assessed_packages428
unassessed_packages1
affected_by_severitycritical 4, high 18, moderate 14, low 3, unknown 4
direct_affected_packages7
Excluidos de la puntuación (sin datos o no aplicable): Dependencias indirectas libres de avisos conocidos. Los pesos restantes se han renormalizado. Se cotejaron 428 dependencias resueltas con OSV. 1 no pudieron evaluarse: sin versión resuelta, ecosistema no admitido o fuera de la lista de paquetes informada. Este repositorio no publica ningún paquete que el índice resuelva, por lo que se evaluó en su lugar el grafo de dependencias del repositorio. Ese grafo mezcla fijaciones de desarrollo y prueba con las dependencias distribuidas, de modo que solo se puntúan las dependencias declaradas en tiempo de ejecución; los hallazgos transitivos se informan como contexto y quedan excluidos de la puntuación. No se analiza la alcanzabilidad.

Preparación para IA

¿Hasta qué punto está el repositorio preparado para desarrollarse y mantenerse con agentes de codificación de IA? Es una insignia independiente y experimental — peso 0,0, de modo que se presenta por separado y no afecta a la puntuación de salud global.

67Moderado · 0% del índice global

Contexto y guía para agentes

40En riesgo
Cómo se puntúa
0/45Instrucciones para agentes — sin CLAUDE.md / AGENTS.md / reglas de editor
0/15Documentación legible por máquinas (llms.txt)
40/40Historial de commits legible — 40 de 40 commits humanos declaran su intención (asunto estructurado o cuerpo explicativo)
Datos de entrada utilizados
has_llms_txtno
legible_history_share1
agent_instruction_files—
agent_instruction_max_bytes—

Bucle de verificación (compilación / pruebas / verificación de tipos)

86Excelente
Cómo se puntúa
18/18Arranque con un solo comando — Makefile, Taskfile.yaml, cmd/syft/internal/test/integration/test-fixtures/Makefile, schema/cyclonedx/Makefile, syft/file/cataloger/executable/test-fixtures/Makefile, syft/file/cataloger/executable/test-fixtures/elf/Makefile, syft/file/cataloger/executable/test-fixtures/elf/project/Makefile, syft/file/cataloger/executable/test-fixtures/shared-info/Makefile, syft/file/cataloger/executable/test-fixtures/shared-info/project/Makefile, syft/file/cataloger/executable/test-fixtures/shared-info/project/hello/Makefile, syft/file/cataloger/executable/test-fixtures/shared-info/project/libhello/Makefile, syft/pkg/cataloger/binary/test-fixtures/Makefile, syft/pkg/cataloger/binary/test-fixtures/elf-test-fixtures/elfbinwithcorrupt/elfsrc/makefile, syft/pkg/cataloger/binary/test-fixtures/elf-test-fixtures/elfbinwithcorrupt/makefile, syft/pkg/cataloger/binary/test-fixtures/elf-test-fixtures/elfbinwithnestedlib/elfsrc/makefile, syft/pkg/cataloger/binary/test-fixtures/elf-test-fixtures/elfbinwithnestedlib/makefile, syft/pkg/cataloger/binary/test-fixtures/elf-test-fixtures/elfbinwithsisterlib/elfsrc1/makefile, syft/pkg/cataloger/binary/test-fixtures/elf-test-fixtures/elfbinwithsisterlib/elfsrc2/makefile, syft/pkg/cataloger/binary/test-fixtures/elf-test-fixtures/elfbinwithsisterlib/makefile, syft/pkg/cataloger/dotnet/test-fixtures/Makefile, syft/pkg/cataloger/golang/test-fixtures/Makefile, syft/pkg/cataloger/golang/test-fixtures/archs/Makefile, syft/pkg/cataloger/internal/pe/test-fixtures/Makefile, syft/pkg/cataloger/java/test-fixtures/Makefile, syft/pkg/cataloger/java/test-fixtures/jar-metadata/Makefile, syft/pkg/cataloger/java/test-fixtures/java-builds/Makefile, syft/pkg/cataloger/kernel/test-fixtures/Makefile, syft/pkg/cataloger/redhat/test-fixtures/Makefile, test/cli/test-fixtures/Makefile, test/cli/test-fixtures/image-java-spdx-tools/Makefile, test/cli/test-fixtures/registry/Makefile, test/install/Makefile
22/22Pruebas automatizadas
11/11Configuración de lint / formato — .golangci.yaml
11/11Verificación estática de tipos — Go (tipado estático)
10/10Entorno reproducible — Dockerfile, lockfile
0/10Práctica demostrada con agentes — ningún commit con autoría de agente entre los últimos 100
8/8Mantenimiento automatizado — 47 de los últimos 100 commits son actualizaciones automáticas de dependencias
6/10OpenSSF Scorecard: Pinned-Dependencies — dependency not pinned by hash detected -- score normalized to 6
Datos de entrada utilizados
has_nixno
has_testssí
lockfilesCargo.lock, Gemfile.lock, Pipfile.lock, composer.lock, go.sum, mix.lock, package-lock.json, packages.lock.json, pdm.lock, pnpm-lock.yaml, poetry.lock, uv.lock, yarn.lock
has_dockerfilesí
typed_languagesí
bootstrap_filesMakefile, Taskfile.yaml, cmd/syft/internal/test/integration/test-fixtures/Makefile, schema/cyclonedx/Makefile, syft/file/cataloger/executable/test-fixtures/Makefile, syft/file/cataloger/executable/test-fixtures/elf/Makefile, syft/file/cataloger/executable/test-fixtures/elf/project/Makefile, syft/file/cataloger/executable/test-fixtures/shared-info/Makefile, syft/file/cataloger/executable/test-fixtures/shared-info/project/Makefile, syft/file/cataloger/executable/test-fixtures/shared-info/project/hello/Makefile, syft/file/cataloger/executable/test-fixtures/shared-info/project/libhello/Makefile, syft/pkg/cataloger/binary/test-fixtures/Makefile, syft/pkg/cataloger/binary/test-fixtures/elf-test-fixtures/elfbinwithcorrupt/elfsrc/makefile, syft/pkg/cataloger/binary/test-fixtures/elf-test-fixtures/elfbinwithcorrupt/makefile, syft/pkg/cataloger/binary/test-fixtures/elf-test-fixtures/elfbinwithnestedlib/elfsrc/makefile, syft/pkg/cataloger/binary/test-fixtures/elf-test-fixtures/elfbinwithnestedlib/makefile, syft/pkg/cataloger/binary/test-fixtures/elf-test-fixtures/elfbinwithsisterlib/elfsrc1/makefile, syft/pkg/cataloger/binary/test-fixtures/elf-test-fixtures/elfbinwithsisterlib/elfsrc2/makefile, syft/pkg/cataloger/binary/test-fixtures/elf-test-fixtures/elfbinwithsisterlib/makefile, syft/pkg/cataloger/dotnet/test-fixtures/Makefile, syft/pkg/cataloger/golang/test-fixtures/Makefile, syft/pkg/cataloger/golang/test-fixtures/archs/Makefile, syft/pkg/cataloger/internal/pe/test-fixtures/Makefile, syft/pkg/cataloger/java/test-fixtures/Makefile, syft/pkg/cataloger/java/test-fixtures/jar-metadata/Makefile, syft/pkg/cataloger/java/test-fixtures/java-builds/Makefile, syft/pkg/cataloger/kernel/test-fixtures/Makefile, syft/pkg/cataloger/redhat/test-fixtures/Makefile, test/cli/test-fixtures/Makefile, test/cli/test-fixtures/image-java-spdx-tools/Makefile, test/cli/test-fixtures/registry/Makefile, test/install/Makefile
has_devcontainerno
has_linter_configsí
typecheck_configs—
agent_commit_share0
toolchain_manifestscmd/syft/internal/test/integration/test-fixtures/image-go-bin-arch-coverage/go.mod, cmd/syft/internal/test/integration/test-fixtures/image-pkg-coverage/pkgs/go/go.mod, cmd/syft/internal/test/integration/test-fixtures/image-pkg-coverage/pkgs/java/pom.xml, cmd/syft/internal/test/integration/test-fixtures/image-sbom-cataloger/go.mod, go.mod, syft/pkg/cataloger/dotnet/test-fixtures/image-net2-app/src/helloworld.csproj, syft/pkg/cataloger/dotnet/test-fixtures/image-net6-asp-libman/src/LibManSample.csproj, syft/pkg/cataloger/dotnet/test-fixtures/image-net8-app-no-depjson/src/dotnetapp.csproj, syft/pkg/cataloger/dotnet/test-fixtures/image-net8-app-self-contained/src/dotnetapp.csproj, syft/pkg/cataloger/dotnet/test-fixtures/image-net8-app-single-file/src/dotnetapp.csproj, syft/pkg/cataloger/dotnet/test-fixtures/image-net8-app-with-runtime-nodepsjson/src/dotnetapp.csproj, syft/pkg/cataloger/dotnet/test-fixtures/image-net8-app-with-runtime/src/dotnetapp.csproj, syft/pkg/cataloger/dotnet/test-fixtures/image-net8-app/src/dotnetapp.csproj, syft/pkg/cataloger/dotnet/test-fixtures/image-net8-compile-target/src/helloworld.csproj, syft/pkg/cataloger/dotnet/test-fixtures/image-net8-ilrepack/src/dotnetapp.csproj, syft/pkg/cataloger/dotnet/test-fixtures/image-net8-privateassets/src/dotnetapp.csproj, syft/pkg/cataloger/golang/test-fixtures/archs/src/go.mod, syft/pkg/cataloger/golang/test-fixtures/corrupt/go.mod, syft/pkg/cataloger/golang/test-fixtures/glob-paths/src/go.mod, syft/pkg/cataloger/golang/test-fixtures/go-mod-fixtures/many-packages/go.mod, syft/pkg/cataloger/golang/test-fixtures/go-mod-fixtures/one-package/go.mod, syft/pkg/cataloger/golang/test-fixtures/go-mod-fixtures/relative-replace/go.mod, syft/pkg/cataloger/golang/test-fixtures/go-source/go.mod, syft/pkg/cataloger/golang/test-fixtures/go-sum-hashes/go.mod, syft/pkg/cataloger/golang/test-fixtures/image-not-a-module/go.mod, syft/pkg/cataloger/golang/test-fixtures/image-small-upx/go.mod, syft/pkg/cataloger/golang/test-fixtures/image-small/go.mod, syft/pkg/cataloger/internal/pe/test-fixtures/image-dotnet31-single-file/src/hello.csproj, syft/pkg/cataloger/internal/pe/test-fixtures/image-dotnet5-single-file/src/hello.csproj, syft/pkg/cataloger/internal/pe/test-fixtures/image-dotnet6-single-file/src/hello.csproj, syft/pkg/cataloger/java/internal/maven/test-fixtures/local/child-1/pom.xml, syft/pkg/cataloger/java/internal/maven/test-fixtures/local/child-2/pom.xml, syft/pkg/cataloger/java/internal/maven/test-fixtures/local/child-3/pom.xml, syft/pkg/cataloger/java/internal/maven/test-fixtures/local/circular-1/pom.xml, syft/pkg/cataloger/java/internal/maven/test-fixtures/local/circular-2/pom.xml, syft/pkg/cataloger/java/internal/maven/test-fixtures/local/contains-child-1/pom.xml, syft/pkg/cataloger/java/internal/maven/test-fixtures/local/parent-1/pom.xml, syft/pkg/cataloger/java/internal/maven/test-fixtures/local/parent-2/pom.xml, syft/pkg/cataloger/java/internal/maven/test-fixtures/local/parent-3/pom.xml, syft/pkg/cataloger/java/test-fixtures/corrupt/pom.xml, syft/pkg/cataloger/java/test-fixtures/glob-paths/src/pom.xml, syft/pkg/cataloger/java/test-fixtures/gradle/build.gradle, syft/pkg/cataloger/java/test-fixtures/jar-metadata/api-all-2.0.0-sources/META-INF/maven/org.apache.directory.api/api-all/pom.xml, syft/pkg/cataloger/java/test-fixtures/jar-metadata/api-all-2.0.0-sources/META-INF/maven/org.apache.directory.api/api-asn1-api/pom.xml, syft/pkg/cataloger/java/test-fixtures/jar-metadata/com.fasterxml.jackson.core.jackson-core-2.15.2/META-INF/maven/com.fasterxml.jackson.core/jackson-core/pom.xml, syft/pkg/cataloger/java/test-fixtures/jar-metadata/commons-lang3-3.12.0/META-INF/maven/org.apache.commons-lang3/pom.xml, syft/pkg/cataloger/java/test-fixtures/jar-metadata/jackson-core-2.15.2/META-INF/maven/com.fasterxml.jackson.core/jackson-core/pom.xml, syft/pkg/cataloger/java/test-fixtures/jar-metadata/micronaut-aop-4.9.11/META-INF/maven/io.micronaut/micronaut-aop/pom.xml, syft/pkg/cataloger/java/test-fixtures/jar-metadata/multiple-matching-2.11.5/META-INF/maven/org.multiple/multiple-matching-1/pom.xml, syft/pkg/cataloger/java/test-fixtures/jar-metadata/multiple-matching-2.11.5/META-INF/maven/org.multiple/multiple-matching-2/pom.xml, syft/pkg/cataloger/java/test-fixtures/jar-metadata/multiple-matching-2.11.5/META-INF/maven/org.multiple/multiple-matching-3/pom.xml, syft/pkg/cataloger/java/test-fixtures/jar-metadata/opensaml-core-3.4.6/META-INF/maven/org.opensaml/opensaml-core/pom.xml, syft/pkg/cataloger/java/test-fixtures/jar-metadata/org.multiple-thename/META-INF/maven/com.multiple/thename/pom.xml, syft/pkg/cataloger/java/test-fixtures/jar-metadata/org.multiple-thename/META-INF/maven/org.multiple/thename/pom.xml, syft/pkg/cataloger/java/test-fixtures/java-builds/example-java-app/build.gradle, syft/pkg/cataloger/java/test-fixtures/java-builds/example-java-app/pom.xml, syft/pkg/cataloger/java/test-fixtures/java-builds/example-jenkins-plugin/pom.xml, syft/pkg/cataloger/java/test-fixtures/java-builds/example-sb-app/pom.xml, syft/pkg/cataloger/java/test-fixtures/pom/commons-text-1.10.0/pom.xml, syft/pkg/cataloger/java/test-fixtures/pom/example-java-app-maven/pom.xml, syft/pkg/cataloger/java/test-fixtures/pom/transitive-top-level/pom.xml, syft/pkg/cataloger/rust/test-fixtures/image-audit/Cargo.toml
dependency_bot_commit_share0,47

Legibilidad del código para modelos

100Excelente
Cómo se puntúa
45/45Código verificable por tipos — Go (tipado estático)
54.7/55Tamaños de archivo manejables — 6/1181 archivos fuente de más de 60 KB
Datos de entrada utilizados
primary_languageGo
largest_source_bytes212.636
source_files_sampled1181
oversized_source_files6

Interfaces legibles por máquina

40En riesgo
Cómo se puntúa
0/40Esquema de API (OpenAPI/GraphQL/proto)
0/20Servidor MCP
40/40Ejemplos ejecutables — example, examples, sample
Datos de entrada utilizados
example_dirsexample, examples, sample
has_mcp_signalno
api_schema_files—

Datos clave

3estrellas de GitHub
98contribuidores
293commits en los últimos 12 meses
196días desde el último push
1versiones publicadas
2factor bus
0issues abiertas
Goecosistemas de paquetes

Advertencias de recopilación de datos

  • Star history unavailable: GitHub GraphQL error: Resource not accessible by personal access token
  • Community profile unavailable
  • go package 'github.com/anchore/syft' points at a different repository (https://github.com/anchore/syft); excluded from ecosystem scoring

Más detalle

OpenSSF Scorecard 4.3 / 10
4.3agregado

Evaluación de seguridad independiente y agnóstica en cuanto a herramientas, procedente del proyecto de código abierto OpenSSF Scorecard. Cada comprobación premia una práctica de seguridad, no la herramienta de un proveedor concreto. Las comprobaciones que Scorecard no pudo determinar se marcan como n/d y se excluyen de la puntuación de seguridad (nunca se cuentan como cero).Scorecard v5.5.0 · 2026-07-25 10:11 UTC

0Binary-Artifactsbinaries present in source code
0Branch-Protectionbranch protection not enabled on development/release branches
n/dCI-Testsno pull request found
0CII-Best-Practicesno effort to earn an OpenSSF best practices badge detected
0Code-ReviewFound 0/30 approved changesets -- score normalized to 0
10Contributorsproject has 35 contributing companies or organizations
10Dangerous-Workflowno dangerous workflow patterns detected
10Dependency-Update-Toolupdate tool detected
0Fuzzingproject is not fuzzed
10Licenselicense file detected
0Maintained0 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 0
n/dPackagingpackaging workflow not detected
6Pinned-Dependenciesdependency not pinned by hash detected -- score normalized to 6
10SASTSAST tool detected: CodeQL
10Security-Policysecurity policy file detected
0Signed-ReleasesProject has not signed or included provenance with any releases.
9Token-Permissionsdetected GitHub workflow tokens with excessive permissions
0Vulnerabilities319 existing vulnerabilities detected
Dependencias directas 96
RegistroPaqueteRestricción de versiónManifiesto
Gogithub.com/BurntSushi/tomlv1.6.0go.mod
Gogithub.com/CycloneDX/cyclonedx-gov0.9.3go.mod
Gogithub.com/Masterminds/semver/v3v3.4.0go.mod
Gogithub.com/Masterminds/sprig/v3v3.3.0go.mod
Gogithub.com/OneOfOne/xxhashv1.2.8go.mod
Gogithub.com/acarl005/stripansiv0.0.0-20180116102854-5a71ef0e047dgo.mod
Gogithub.com/acobaugh/osreleasev0.1.0go.mod
Gogithub.com/adrg/xdgv0.5.3go.mod
Gogithub.com/anchore/bubblyv0.0.0-20231115134915-def0aba654a9go.mod
Gogithub.com/anchore/cliov0.0.0-20250319180342-2cfe4b0cb716go.mod
Gogithub.com/anchore/fangsv0.0.0-20250319222917-446a1e748ec2go.mod
Gogithub.com/anchore/go-collectionsv0.0.0-20251016125210-a3c352120e8cgo.mod
Gogithub.com/anchore/go-homedirv0.0.0-20250319154043-c29668562e4dgo.mod
Gogithub.com/anchore/go-loggerv0.0.0-20250318195838-07ae343dd722go.mod
Gogithub.com/anchore/go-macholibrev0.0.0-20220308212642-53e6d0aaf6fbgo.mod
Gogithub.com/anchore/go-rpmdbv0.0.0-20250516171929-f77691e1faecgo.mod
Gogithub.com/anchore/go-syncv0.0.0-20250326131806-4eda43a485b6go.mod
Gogithub.com/anchore/go-testutilsv0.0.0-20200925183923-d5f45b0d3c04go.mod
Gogithub.com/anchore/go-versionv1.2.2-0.20200701162849-18adb9c92b9bgo.mod
Gogithub.com/anchore/packageurl-gov0.1.1-0.20250220190351-d62adb6e1115go.mod
Gogithub.com/anchore/stereoscopev0.1.17go.mod
Gogithub.com/anmitsu/go-shlexv0.0.0-20200514113438-38f4b401e2bego.mod
Gogithub.com/aquasecurity/go-pep440-versionv0.0.1go.mod
Gogithub.com/bitnami/go-versionv0.0.0-20250131085805-b1f57a8634efgo.mod
Gogithub.com/blakesmith/arv0.0.0-20190502131153-809d4375e1fbgo.mod
Gogithub.com/bmatcuk/doublestar/v4v4.9.1go.mod
Gogithub.com/charmbracelet/bubblesv0.21.0go.mod
Gogithub.com/charmbracelet/bubbleteav1.3.10go.mod
Gogithub.com/charmbracelet/lipglossv1.1.0go.mod
Gogithub.com/dave/jenniferv1.7.1go.mod
Gogithub.com/deitch/magicv0.0.0-20230404182410-1ff89d7342dago.mod
Gogithub.com/diskfs/go-diskfsv1.7.0go.mod
Gogithub.com/distribution/referencev0.6.0go.mod
Gogithub.com/dustin/go-humanizev1.0.1go.mod
Gogithub.com/elliotchance/phpserializev1.4.0go.mod
Gogithub.com/facebookincubator/nvdtoolsv0.1.5go.mod
Gogithub.com/github/go-spdx/v2v2.3.5go.mod
Gogithub.com/gkampitakis/go-snapsv0.5.19go.mod
Gogithub.com/go-git/go-billy/v5v5.7.0go.mod
Gogithub.com/go-git/go-git/v5v5.16.4go.mod
Gogithub.com/go-test/deepv1.1.1go.mod
Gogithub.com/go-viper/mapstructure/v2v2.4.0go.mod
Gogithub.com/gohugoio/hashstructurev0.6.0go.mod
Gogithub.com/google/go-cmpv0.7.0go.mod
Gogithub.com/google/go-containerregistryv0.20.7go.mod
Gogithub.com/google/licensecheckv0.3.1go.mod
Gogithub.com/google/uuidv1.6.0go.mod
Gogithub.com/gookit/colorv1.6.0go.mod
Gogithub.com/hashicorp/go-cleanhttpv0.5.2go.mod
Gogithub.com/hashicorp/go-getterv1.8.4go.mod
Gogithub.com/hashicorp/go-multierrorv1.1.1go.mod
Gogithub.com/hashicorp/hcl/v2v2.24.0go.mod
Gogithub.com/iancoleman/strcasev0.3.0go.mod
Gogithub.com/invopop/jsonschemav0.13.0go.mod
Gogithub.com/jedib0t/go-pretty/v6v6.7.8go.mod
Gogithub.com/jinzhu/copierv0.4.0go.mod
Gogithub.com/kastenhq/goversionv0.0.0-20230811215019-93b2f8823953go.mod
Gogithub.com/magiconair/propertiesv1.8.10go.mod
Gogithub.com/mholt/archivesv0.1.5go.mod
Gogithub.com/moby/sys/mountinfov0.7.2go.mod
Gogithub.com/nix-community/go-nixv0.0.0-20250101154619-4bdde671e0a1go.mod
Gogithub.com/olekukonko/tablewriterv1.1.2go.mod
Gogithub.com/opencontainers/go-digestv1.0.0go.mod
Gogithub.com/pelletier/go-tomlv1.9.5go.mod
Gogithub.com/quasilyte/go-ruleguard/dslv0.3.23go.mod
Gogithub.com/rust-secure-code/go-rustauditv0.0.0-20250226111315-e20ec32e963cgo.mod
Gogithub.com/saintfish/chardetv0.0.0-20230101081208-5e3ef4b5456dgo.mod
Gogithub.com/sanity-io/litterv1.5.8go.mod
Gogithub.com/sassoftware/go-rpmutilsv0.4.0go.mod
Gogithub.com/scylladb/go-setv1.0.3-0.20200225121959-cc7b2070d91ego.mod
Gogithub.com/sergi/go-diffv1.4.0go.mod
Gogithub.com/spdx/gordfv0.0.0-20201111095634-7098f93598fbgo.mod
Gogithub.com/spdx/tools-golangv0.5.6go.mod
Gogithub.com/spf13/aferov1.15.0go.mod
Gogithub.com/spf13/cobrav1.10.2go.mod
Gogithub.com/stretchr/testifyv1.11.1go.mod
Gogithub.com/vbatts/go-mtreev0.7.0go.mod
Gogithub.com/vifraa/gopomv1.0.0go.mod
Gogithub.com/wagoodman/go-partybusv0.0.0-20230516145632-8ccac152c651go.mod
Gogithub.com/wagoodman/go-progressv0.0.0-20230925121702-07e42b3cdba0go.mod
Gogithub.com/xeipuuv/gojsonschemav1.2.0go.mod
Gogithub.com/zyedidia/genericv1.2.2-0.20230320175451-4410d2372cb1go.mod
Gogo.uber.org/goleakv1.3.0go.mod
Gogo.yaml.in/yaml/v3v3.0.4go.mod
Gogolang.org/x/expv0.0.0-20250620022241-b7579e27df2bgo.mod
Gogolang.org/x/modv0.31.0go.mod
Gogolang.org/x/netv0.48.0go.mod
Gomodernc.org/sqlitev1.43.0go.mod
Gogithub.com/goccy/go-yamlv1.19.2go.mod
Gogithub.com/ulikunitz/xzv0.5.15go.mod
Gogolang.org/x/timev0.14.0go.mod
Gogolang.org/x/toolsv0.40.0go.mod
Gogopkg.in/yaml.v3v3.0.1go.mod
Gogithub.com/cespare/xxhash/v2v2.3.0go.mod
Gogithub.com/gpustack/gguf-parser-gov0.23.1go.mod
Gogithub.com/wk8/go-ordered-map/v2v2.1.8go.mod
Todas las dependencias 429

Conjunto completo de dependencias resueltas según el grafo de dependencias de GitHub: 104 paquetes directos y 325 indirectos (transitivos). El cierre transitivo es completo cuando el repositorio incluye un lockfile.

RegistroPaqueteVersiónRelación
Gogithub.com/acarl005/stripansiv0.0.0-20180116102854-5a71ef0e047ddirecta
Gogithub.com/acobaugh/osreleasev0.1.0directa
Gogithub.com/adrg/xdgv0.2.1directa
Gogithub.com/adrg/xdgv0.5.3directa
Gogithub.com/anchore/bubblyv0.0.0-20231115134915-def0aba654a9directa
Gogithub.com/anchore/cliov0.0.0-20250319180342-2cfe4b0cb716directa
Gogithub.com/anchore/fangsv0.0.0-20250319222917-446a1e748ec2directa
Gogithub.com/anchore/go-collectionsv0.0.0-20251016125210-a3c352120e8cdirecta
Gogithub.com/anchore/go-homedirv0.0.0-20250319154043-c29668562e4ddirecta
Gogithub.com/anchore/go-loggerv0.0.0-20250318195838-07ae343dd722directa
Gogithub.com/anchore/go-macholibrev0.0.0-20220308212642-53e6d0aaf6fbdirecta
Gogithub.com/anchore/go-rpmdbv0.0.0-20250516171929-f77691e1faecdirecta
Gogithub.com/anchore/go-syncv0.0.0-20250326131806-4eda43a485b6directa
Gogithub.com/anchore/go-testutilsv0.0.0-20200624184116-66aa578126dbdirecta
Gogithub.com/anchore/go-testutilsv0.0.0-20200925183923-d5f45b0d3c04directa
Gogithub.com/anchore/go-versionv1.2.2-0.20200701162849-18adb9c92b9bdirecta
Gogithub.com/anchore/packageurl-gov0.1.1-0.20250220190351-d62adb6e1115directa
Gogithub.com/anchore/stereoscopev0.0.0-20200706164556-7cf39d7f4639directa
Gogithub.com/anchore/stereoscopev0.1.17directa
Gogithub.com/anmitsu/go-shlexv0.0.0-20200514113438-38f4b401e2bedirecta
Gogithub.com/aquasecurity/go-pep440-versionv0.0.1directa
Gogithub.com/bitnami/go-versionv0.0.0-20250131085805-b1f57a8634efdirecta
Gogithub.com/blakesmith/arv0.0.0-20190502131153-809d4375e1fbdirecta
Gogithub.com/bmatcuk/doublestar/v4v4.9.1directa
Gogithub.com/burntsushi/tomlv1.6.0directa
Gogithub.com/cespare/xxhash/v2v2.3.0directa
Gogithub.com/charmbracelet/bubblesv0.21.0directa
Gogithub.com/charmbracelet/bubbleteav1.3.10directa
Gogithub.com/charmbracelet/lipglossv1.1.0directa
Gogithub.com/cyclonedx/cyclonedx-gov0.9.3directa
Gogithub.com/dave/jenniferv1.7.1directa
Gogithub.com/deitch/magicv0.0.0-20230404182410-1ff89d7342dadirecta
Gogithub.com/diskfs/go-diskfsv1.7.0directa
Gogithub.com/distribution/referencev0.6.0directa
Gogithub.com/dustin/go-humanizev1.0.1directa
Gogithub.com/elliotchance/phpserializev1.4.0directa
Gogithub.com/facebookincubator/nvdtoolsv0.1.5directa
Gogithub.com/github/go-spdx/v2v2.3.5directa
Gogithub.com/gkampitakis/go-snapsv0.5.19directa
Gogithub.com/go-git/go-billy/v5v5.7.0directa
Gogithub.com/go-git/go-git/v5v5.16.4directa
Gogithub.com/go-test/deepv1.0.6directa
Gogithub.com/go-test/deepv1.1.1directa
Gogithub.com/go-viper/mapstructure/v2v2.2.1directa
Gogithub.com/go-viper/mapstructure/v2v2.4.0directa
Gogithub.com/goccy/go-yamlv1.19.2directa
Gogithub.com/gohugoio/hashstructurev0.6.0directa
Gogithub.com/google/go-cmpv0.7.0directa
Gogithub.com/google/go-containerregistryv0.20.7directa
Gogithub.com/google/licensecheckv0.3.1directa
Gogithub.com/google/uuidv1.6.0directa
Gogithub.com/gookit/colorv1.6.0directa
Gogithub.com/gpustack/gguf-parser-gov0.23.1directa
Gogithub.com/hashicorp/go-cleanhttpv0.5.2directa
Gogithub.com/hashicorp/go-getterv1.8.4directa
Gogithub.com/hashicorp/go-multierrorv1.1.1directa
Gogithub.com/hashicorp/hcl/v2v2.24.0directa
Gogithub.com/iancoleman/strcasev0.3.0directa
Gogithub.com/invopop/jsonschemav0.13.0directa
Gogithub.com/jedib0t/go-pretty/v6v6.7.8directa
Gogithub.com/jinzhu/copierv0.4.0directa
Gogithub.com/kastenhq/goversionv0.0.0-20230811215019-93b2f8823953directa
Gogithub.com/magiconair/propertiesv1.8.10directa
Gogithub.com/masterminds/semver/v3v3.4.0directa
Gogithub.com/masterminds/sprig/v3v3.3.0directa
Gogithub.com/mholt/archivesv0.1.5directa
Gogithub.com/moby/sys/mountinfov0.7.2directa
Gogithub.com/nix-community/go-nixv0.0.0-20250101154619-4bdde671e0a1directa
Gogithub.com/olekukonko/tablewriterv1.1.2directa
Gogithub.com/oneofone/xxhashv1.2.8directa
Gogithub.com/opencontainers/go-digestv1.0.0directa
Gogithub.com/pelletier/go-tomlv1.9.5directa
Gogithub.com/quasilyte/go-ruleguard/dslv0.3.23directa
Gogithub.com/rust-secure-code/go-rustauditv0.0.0-20250226111315-e20ec32e963cdirecta
Gogithub.com/saintfish/chardetv0.0.0-20230101081208-5e3ef4b5456ddirecta
Gogithub.com/sanity-io/litterv1.5.8directa
Gogithub.com/sassoftware/go-rpmutilsv0.4.0directa
Gogithub.com/scylladb/go-setv1.0.3-0.20200225121959-cc7b2070d91edirecta
Gogithub.com/sergi/go-diffv1.4.0directa
Gogithub.com/spdx/gordfv0.0.0-20201111095634-7098f93598fbdirecta
Gogithub.com/spdx/tools-golangv0.5.6directa
Gogithub.com/spf13/aferov1.12.0directa
Gogithub.com/spf13/aferov1.15.0directa
Gogithub.com/spf13/cobrav1.10.2directa
Gogithub.com/stretchr/testifyv1.10.0directa
Gogithub.com/stretchr/testifyv1.11.1directa
Gogithub.com/ulikunitz/xzv0.5.12directa
Gogithub.com/ulikunitz/xzv0.5.15directa
Gogithub.com/vbatts/go-mtreev0.7.0directa
Gogithub.com/vifraa/gopomv1.0.0directa
Gogithub.com/wagoodman/go-partybusv0.0.0-20230516145632-8ccac152c651directa
Gogithub.com/wagoodman/go-progressv0.0.0-20230925121702-07e42b3cdba0directa
Gogithub.com/wk8/go-ordered-map/v2v2.1.8directa
Gogithub.com/xeipuuv/gojsonschemav1.2.0directa
Gogithub.com/zyedidia/genericv1.2.2-0.20230320175451-4410d2372cb1directa
Gogo.uber.org/goleakv1.3.0directa
Gogo.yaml.in/yaml/v3v3.0.4directa
Gogolang.org/x/expv0.0.0-20250620022241-b7579e27df2bdirecta
Gogolang.org/x/modv0.31.0directa
Gogolang.org/x/netv0.48.0directa
Gogolang.org/x/timev0.14.0directa
Gogolang.org/x/toolsv0.40.0directa
Gogopkg.in/yaml.v3v3.0.1directa
Gomodernc.org/sqlitev1.43.0directa
Gocel.dev/exprv0.24.0indirecta
Gocloud.google.com/gov0.123.0indirecta
Gocloud.google.com/go/authv0.17.0indirecta
Gocloud.google.com/go/auth/oauth2adaptv0.2.8indirecta
Gocloud.google.com/go/compute/metadatav0.9.0indirecta
Gocloud.google.com/go/iamv1.5.3indirecta
Gocloud.google.com/go/monitoringv1.24.2indirecta
Gocloud.google.com/go/storagev1.58.0indirecta
Gocyphar.com/go-pathrsv0.2.1indirecta
Godario.cat/mergov1.0.1indirecta
Gogithub.com/adalogics/go-fuzz-headersv0.0.0-20230811130428-ced1acdcaa24indirecta
Gogithub.com/adamkorcz/go-118-fuzz-buildv0.0.0-20230306123547-8075edf89bb0indirecta
Gogithub.com/agext/levenshteinv1.2.1indirecta
Gogithub.com/anchore/archiver/v3v3.5.3-0.20241210171143-5b1d8d1c7c51indirecta
Gogithub.com/anchore/go-lzov0.1.0indirecta
Gogithub.com/anchore/go-struct-converterv0.1.0indirecta
Gogithub.com/andybalholm/brotliv1.1.1indirecta
Gogithub.com/andybalholm/brotliv1.2.0indirecta
Gogithub.com/apparentlymart/go-textseg/v15v15.0.0indirecta
Gogithub.com/aquasecurity/go-versionv0.0.1indirecta
Gogithub.com/atotto/clipboardv0.1.4indirecta
Gogithub.com/aws/aws-sdk-go-v2v1.41.0indirecta
Gogithub.com/aws/aws-sdk-go-v2/aws/protocol/eventstreamv1.7.4indirecta
Gogithub.com/aws/aws-sdk-go-v2/configv1.32.6indirecta
Gogithub.com/aws/aws-sdk-go-v2/credentialsv1.19.6indirecta
Gogithub.com/aws/aws-sdk-go-v2/feature/ec2/imdsv1.18.16indirecta
Gogithub.com/aws/aws-sdk-go-v2/internal/configsourcesv1.4.16indirecta
Gogithub.com/aws/aws-sdk-go-v2/internal/endpoints/v2v2.7.16indirecta
Gogithub.com/aws/aws-sdk-go-v2/internal/iniv1.8.4indirecta
Gogithub.com/aws/aws-sdk-go-v2/internal/v4av1.4.16indirecta
Gogithub.com/aws/aws-sdk-go-v2/service/internal/accept-encodingv1.13.4indirecta
Gogithub.com/aws/aws-sdk-go-v2/service/internal/checksumv1.9.7indirecta
Gogithub.com/aws/aws-sdk-go-v2/service/internal/presigned-urlv1.13.16indirecta
Gogithub.com/aws/aws-sdk-go-v2/service/internal/s3sharedv1.19.16indirecta
Gogithub.com/aws/aws-sdk-go-v2/service/s3v1.95.0indirecta
Gogithub.com/aws/aws-sdk-go-v2/service/signinv1.0.4indirecta
Gogithub.com/aws/aws-sdk-go-v2/service/ssov1.30.8indirecta
Gogithub.com/aws/aws-sdk-go-v2/service/ssooidcv1.35.12indirecta
Gogithub.com/aws/aws-sdk-go-v2/service/stsv1.41.5indirecta
Gogithub.com/aws/smithy-gov1.24.0indirecta
Gogithub.com/aymanbagabas/go-osc52/v2v2.0.1indirecta
Gogithub.com/bahlo/generic-list-gov0.2.0indirecta
Gogithub.com/becheran/wildmatch-gov1.0.0indirecta
Gogithub.com/bgentry/go-netrcv0.0.0-20140422174119-9fd32a8b3d3dindirecta
Gogithub.com/bmatcuk/doublestarv1.3.1indirecta
Gogithub.com/bodgit/plumbingv1.3.0indirecta
Gogithub.com/bodgit/sevenzipv1.6.1indirecta
Gogithub.com/bodgit/windowsv1.0.1indirecta
Gogithub.com/buger/jsonparserv1.1.1indirecta
Gogithub.com/charmbracelet/colorprofilev0.2.3-0.20250311203215-f60798e515dcindirecta
Gogithub.com/charmbracelet/harmonicav0.2.0indirecta
Gogithub.com/charmbracelet/x/ansiv0.10.1indirecta
Gogithub.com/charmbracelet/x/cellbufv0.0.13-0.20250311204145-2c3ea96c31ddindirecta
Gogithub.com/charmbracelet/x/termv0.2.1indirecta
Gogithub.com/clipperhouse/displaywidthv0.6.0indirecta
Gogithub.com/clipperhouse/stringishv0.1.1indirecta
Gogithub.com/clipperhouse/uax29/v2v2.3.0indirecta
Gogithub.com/cloudflare/circlv1.6.1indirecta
Gogithub.com/cncf/xds/gov0.0.0-20250501225837-2ac532fd4443indirecta
Gogithub.com/containerd/cgroupsv1.1.0indirecta
Gogithub.com/containerd/containerdv1.7.30indirecta
Gogithub.com/containerd/containerd/apiv1.8.0indirecta
Gogithub.com/containerd/continuityv0.4.4indirecta
Gogithub.com/containerd/errdefsv1.0.0indirecta
Gogithub.com/containerd/errdefs/pkgv0.3.0indirecta
Gogithub.com/containerd/fifov1.1.0indirecta
Gogithub.com/containerd/logv0.1.0indirecta
Gogithub.com/containerd/platformsv0.2.1indirecta
Gogithub.com/containerd/stargz-snapshotter/estargzv0.18.1indirecta
Gogithub.com/containerd/ttrpcv1.2.7indirecta
Gogithub.com/containerd/typeurl/v2v2.2.0indirecta
Gogithub.com/cyphar/filepath-securejoinv0.6.0indirecta
Gogithub.com/datadog/zstdv1.5.5indirecta
Gogithub.com/davecgh/go-spewv1.1.1indirecta
Gogithub.com/davecgh/go-spewv1.1.2-0.20180830191138-d8f796af33ccindirecta
Gogithub.com/docker/cliv29.1.3+incompatibleindirecta
Gogithub.com/docker/distributionv2.8.3+incompatibleindirecta
Gogithub.com/docker/dockerv28.5.2+incompatibleindirecta
Gogithub.com/docker/docker-credential-helpersv0.9.4indirecta
Gogithub.com/docker/go-connectionsv0.6.0indirecta
Gogithub.com/docker/go-eventsv0.0.0-20190806004212-e31b211e4f1cindirecta
Gogithub.com/docker/go-unitsv0.5.0indirecta
Gogithub.com/dsnet/compressv0.0.2-0.20210315054119-f66993602bf5indirecta
Gogithub.com/dsnet/compressv0.0.2-0.20230904184137-39efe44ab707indirecta
Gogithub.com/emirpasic/godsv1.18.1indirecta
Gogithub.com/envoyproxy/go-control-plane/envoyv1.32.4indirecta
Gogithub.com/envoyproxy/protoc-gen-validatev1.2.1indirecta
Gogithub.com/erikgeiser/coninputv0.0.0-20211004153227-1c3628e74d0findirecta
Gogithub.com/fatih/colorv1.18.0indirecta
Gogithub.com/felixge/fgprofv0.9.5indirecta
Gogithub.com/felixge/httpsnoopv1.0.4indirecta
Gogithub.com/fsnotify/fsnotifyv1.8.0indirecta
Gogithub.com/gabriel-vasile/mimetypev1.4.12indirecta
Gogithub.com/gkampitakis/ciinfov0.3.2indirecta
Gogithub.com/go-git/gcfgv1.5.1-0.20230307220236-3a3c6141e376indirecta
Gogithub.com/go-jose/go-jose/v4v4.1.2indirecta
Gogithub.com/go-logr/logrv1.4.3indirecta
Gogithub.com/go-logr/stdrv1.2.2indirecta
Gogithub.com/go-restruct/restructv1.2.0-alphaindirecta
Gogithub.com/gogo/protobufv1.3.2indirecta
Gogithub.com/golang/groupcachev0.0.0-20241129210726-2c02b8208cf8indirecta
Gogithub.com/golang/snappyv0.0.4indirecta
Gogithub.com/google/pprofv0.0.0-20250317173921-a4b03ec1a45eindirecta
Gogithub.com/google/s2a-gov0.1.9indirecta
Gogithub.com/googleapis/enterprise-certificate-proxyv0.3.7indirecta
Gogithub.com/googleapis/gax-go/v2v2.15.0indirecta
Gogithub.com/googlecloudplatform/opentelemetry-operations-go/detectors/gcpv1.29.0indirecta
Gogithub.com/googlecloudplatform/opentelemetry-operations-go/exporter/metricv0.54.0indirecta
Gogithub.com/googlecloudplatform/opentelemetry-operations-go/internal/resourcemappingv0.54.0indirecta
Gogithub.com/hashicorp/aws-sdk-go-base/v2v2.0.0-beta.70indirecta
Gogithub.com/hashicorp/errwrapv1.1.0indirecta
Gogithub.com/hashicorp/go-versionv1.8.0indirecta
Gogithub.com/hashicorp/golang-lru/v2v2.0.7indirecta
Gogithub.com/henvic/httprettyv0.1.4indirecta
Gogithub.com/huandu/xstringsv1.5.0indirecta
Gogithub.com/inconshreveable/mousetrapv1.1.0indirecta
Gogithub.com/jbenet/go-contextv0.0.0-20150711004518-d14ea06fba99indirecta
Gogithub.com/json-iterator/gov1.1.12indirecta
Gogithub.com/kevinburke/ssh_configv1.2.0indirecta
Gogithub.com/klauspost/compressv1.17.11indirecta
Gogithub.com/klauspost/compressv1.18.2indirecta
Gogithub.com/klauspost/pgzipv1.2.6indirecta
Gogithub.com/kr/prettyv0.3.1indirecta
Gogithub.com/kr/textv0.2.0indirecta
Gogithub.com/logrusorgru/aurorav2.0.3+incompatibleindirecta
Gogithub.com/lucasb-eyer/go-colorfulv1.2.0indirecta
Gogithub.com/mailru/easyjsonv0.7.7indirecta
Gogithub.com/maruel/naturalv1.1.1indirecta
Gogithub.com/masterminds/goutilsv1.1.1indirecta
Gogithub.com/mattn/go-colorablev0.1.14indirecta
Gogithub.com/mattn/go-isattyv0.0.20indirecta
Gogithub.com/mattn/go-localereaderv0.0.2-0.20220822084749-2491eb6c1c75indirecta
Gogithub.com/mattn/go-runewidthv0.0.19indirecta
Gogithub.com/mgutz/ansiv0.0.0-20200706080929-d51e80ef957dindirecta
Gogithub.com/microsoft/go-winiov0.6.2indirecta
Gogithub.com/microsoft/hcsshimv0.11.7indirecta
Gogithub.com/mikelolasagasti/xzv1.0.1indirecta
Gogithub.com/minio/minlzv1.0.1indirecta
Gogithub.com/mitchellh/copystructurev1.2.0indirecta
Gogithub.com/mitchellh/go-homedirv1.1.0indirecta
Gogithub.com/mitchellh/go-wordwrapv1.0.1indirecta
Gogithub.com/mitchellh/reflectwalkv1.0.2indirecta
Gogithub.com/moby/docker-image-specv1.3.1indirecta
Gogithub.com/moby/lockerv1.0.1indirecta
Gogithub.com/moby/sys/sequentialv0.6.0indirecta
Gogithub.com/moby/sys/signalv0.7.0indirecta
Gogithub.com/moby/sys/userv0.3.0indirecta
Gogithub.com/moby/sys/usernsv0.1.0indirecta
Gogithub.com/modern-go/concurrentv0.0.0-20180306012644-bacd9c7ef1ddindirecta
Gogithub.com/modern-go/reflect2v1.0.2indirecta
Gogithub.com/muesli/ansiv0.0.0-20230316100256-276c6243b2f6indirecta
Gogithub.com/muesli/cancelreaderv0.2.2indirecta
Gogithub.com/muesli/termenvv0.16.0indirecta
Gogithub.com/ncruces/go-strftimev0.1.9indirecta
Gogithub.com/nwaples/rardecodev1.1.3indirecta
Gogithub.com/nwaples/rardecode/v2v2.2.0indirecta
Gogithub.com/olekukonko/catv0.0.0-20250911104152-50322a0618f6indirecta
Gogithub.com/olekukonko/errorsv1.1.0indirecta
Gogithub.com/olekukonko/llv0.1.3indirecta
Gogithub.com/opencontainers/image-specv1.1.1indirecta
Gogithub.com/opencontainers/runtime-specv1.1.0indirecta
Gogithub.com/opencontainers/selinuxv1.13.1indirecta
Gogithub.com/pborman/indentv1.2.1indirecta
Gogithub.com/pelletier/go-toml/v2v2.2.3indirecta
Gogithub.com/pierrec/lz4/v4v4.1.21indirecta
Gogithub.com/pierrec/lz4/v4v4.1.22indirecta
Gogithub.com/pjbgf/sha1cdv0.3.2indirecta
Gogithub.com/pkg/errorsv0.9.1indirecta
Gogithub.com/pkg/profilev1.7.0indirecta
Gogithub.com/pkg/xattrv0.4.9indirecta
Gogithub.com/planetscale/vtprotobufv0.6.1-0.20240319094008-0393e58bdf10indirecta
Gogithub.com/pmezard/go-difflibv1.0.0indirecta
Gogithub.com/pmezard/go-difflibv1.0.1-0.20181226105442-5d4384ee4fb2indirecta
Gogithub.com/protonmail/go-cryptov1.3.0indirecta
Gogithub.com/remyoudompheng/bigfftv0.0.0-20230129092748-24d4a6f8daecindirecta
Gogithub.com/rivo/unisegv0.4.7indirecta
Gogithub.com/rogpeppe/go-internalv1.14.1indirecta
Gogithub.com/sagikazarmark/locaferov0.7.0indirecta
Gogithub.com/sahilm/fuzzyv0.1.1indirecta
Gogithub.com/shopspring/decimalv1.4.0indirecta
Gogithub.com/sirupsen/logrusv1.9.3indirecta
Gogithub.com/sirupsen/logrusv1.9.4-0.20230606125235-dd1b4c2e81afindirecta
Gogithub.com/skeema/knownhostsv1.3.1indirecta
Gogithub.com/smallnest/ringbufferv0.0.0-20241116012123-461381446e3dindirecta
Gogithub.com/sorairolake/lzip-gov0.3.8indirecta
Gogithub.com/sourcegraph/concv0.3.0indirecta
Gogithub.com/spf13/castv1.7.1indirecta
Gogithub.com/spf13/pflagv1.0.6indirecta
Gogithub.com/spf13/pflagv1.0.9indirecta
Gogithub.com/spf13/viperv1.20.0indirecta
Gogithub.com/spf13/viperv1.20.1indirecta
Gogithub.com/spiffe/go-spiffe/v2v2.5.0indirecta
Gogithub.com/starry-s/zipv0.2.3indirecta
Gogithub.com/stretchr/objxv0.5.2indirecta
Gogithub.com/subosito/gotenvv1.6.0indirecta
Gogithub.com/sylabs/sif/v2v2.22.0indirecta
Gogithub.com/sylabs/squashfsv1.0.6indirecta
Gogithub.com/therootcompany/xzv1.0.1indirecta
Gogithub.com/tidwall/gjsonv1.18.0indirecta
Gogithub.com/tidwall/matchv1.1.1indirecta
Gogithub.com/tidwall/prettyv1.2.1indirecta
Gogithub.com/tidwall/sjsonv1.2.5indirecta
Gogithub.com/vbatts/tar-splitv0.12.2indirecta
Gogithub.com/xanzy/ssh-agentv0.3.3indirecta
Gogithub.com/xeipuuv/gojsonpointerv0.0.0-20190905194746-02993c407bfbindirecta
Gogithub.com/xeipuuv/gojsonreferencev0.0.0-20180127040603-bd5ef7bd5415indirecta
Gogithub.com/xi2/xzv0.0.0-20171230120015-48954b6210f8indirecta
Gogithub.com/xo/terminfov0.0.0-20220910002029-abceb7e1c41eindirecta
Gogithub.com/zclconf/go-ctyv1.16.3indirecta
Gogithub.com/zeebo/errsv1.4.0indirecta
Gogo.opencensus.iov0.24.0indirecta
Gogo.opentelemetry.io/auto/sdkv1.2.1indirecta
Gogo.opentelemetry.io/contrib/detectors/gcpv1.36.0indirecta
Gogo.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpcv0.63.0indirecta
Gogo.opentelemetry.io/contrib/instrumentation/net/http/otelhttpv0.61.0indirecta
Gogo.opentelemetry.io/otelv1.39.0indirecta
Gogo.opentelemetry.io/otel/metricv1.39.0indirecta
Gogo.opentelemetry.io/otel/sdkv1.39.0indirecta
Gogo.opentelemetry.io/otel/sdk/metricv1.39.0indirecta
Gogo.opentelemetry.io/otel/tracev1.39.0indirecta
Gogo.uber.org/atomicv1.9.0indirecta
Gogo.uber.org/multierrv1.10.0indirecta
Gogo.uber.org/multierrv1.9.0indirecta
Gogo.uber.org/zapv1.27.0indirecta
Gogo4.orgv0.0.0-20230225012048-214862532bf5indirecta
Gogolang.org/x/cryptov0.46.0indirecta
Gogolang.org/x/oauth2v0.33.0indirecta
Gogolang.org/x/syncv0.19.0indirecta
Gogolang.org/x/sysv0.33.0indirecta
Gogolang.org/x/sysv0.39.0indirecta
Gogolang.org/x/termv0.38.0indirecta
Gogolang.org/x/textv0.21.0indirecta
Gogolang.org/x/textv0.32.0indirecta
Gogolang.org/x/xerrorsv0.0.0-20231012003039-104605ab7028indirecta
Gogonum.org/v1/gonumv0.16.0indirecta
Gogoogle.golang.org/apiv0.256.0indirecta
Gogoogle.golang.org/genprotov0.0.0-20250922171735-9219d122eba9indirecta
Gogoogle.golang.org/genproto/googleapis/apiv0.0.0-20251111163417-95abcf5c77baindirecta
Gogoogle.golang.org/genproto/googleapis/rpcv0.0.0-20251111163417-95abcf5c77baindirecta
Gogoogle.golang.org/grpcv1.76.0indirecta
Gogoogle.golang.org/protobufv1.36.10indirecta
Gogopkg.in/warnings.v0v0.1.2indirecta
Gomodernc.org/libcv1.66.10indirecta
Gomodernc.org/mathutilv1.7.1indirecta
Gomodernc.org/memoryv1.11.0indirecta
Mavenorg.junit.vintage:junit-vintage-engine—indirecta
npm@babel/code-frame7.10.4indirecta
npm@types/minimatch3.0.3indirecta
npm@types/qs6.9.4indirecta
npmajv6.12.3indirecta
npmasn1.js4.10.1indirecta
npmasync0.9.2indirecta
npmasync3.2.3indirecta
npmatob2.1.2indirecta
npmaws-sdk2.706.0indirecta
npmc0n-fab_u.laTION7.7.7indirecta
npmcross-spawn7.0.6indirecta
npmisexe2.0.0indirecta
npmjhipster-core7.3.4indirecta
npmmerge-objects1.0.5indirecta
npmnanoid3.3.4indirecta
npmpath-key3.1.1indirecta
npmresize-observer-polyfill1.5.2indirecta
npmshebang-command2.0.0indirecta
npmshebang-regex3.0.0indirecta
npmwhich2.0.2indirecta
PyPIannotated-types0.7.0indirecta
PyPIanyio4.6.2.post1indirecta
PyPIanyio4.9.0indirecta
PyPIbrotli1.1.0indirecta
PyPIbrotlicffi1.1.0.0indirecta
PyPIcertifi2025.1.31indirecta
PyPIcertifi2025.10.5indirecta
PyPIcffi1.17.1indirecta
PyPIcharset-normalizer3.4.1indirecta
PyPIclick7.1.2indirecta
PyPIclick8.1.8indirecta
PyPIcolorama0.4.6indirecta
PyPIdnspython2.7.0indirecta
PyPIemail-validator2.2.0indirecta
PyPIfastapi0.111.1indirecta
PyPIfastapi-cli0.0.7indirecta
PyPIh110.14.0indirecta
PyPIh24.2.0indirecta
PyPIhpack4.1.0indirecta
PyPIhttpcore1.0.7indirecta
PyPIhttptools0.6.4indirecta
PyPIhttpx0.28.1indirecta
PyPIhyperframe6.1.0indirecta
PyPIidna3.10indirecta
PyPIitsdangerous2.2.0indirecta
PyPIjinja23.1.6indirecta
PyPImarkdown-it-py3.0.0indirecta
PyPImarkupsafe3.0.2indirecta
PyPImdurl0.1.2indirecta
PyPIorjson3.10.16indirecta
PyPIpprintpp0.4.0indirecta
PyPIpycparser2.22indirecta
PyPIpydantic2.11.0indirecta
PyPIpydantic-core2.33.0indirecta
PyPIpydantic-extra-types2.10.3indirecta
PyPIpydantic-settings2.8.1indirecta
PyPIpygments1.6indirecta
PyPIpygments2.19.1indirecta
PyPIpython-dotenv1.1.0indirecta
PyPIpython-multipart0.0.20indirecta
PyPIpyyaml6.0.2indirecta
PyPIrequests2.32.3indirecta
PyPIrich0.3.3indirecta
PyPIrich13.9.4indirecta
PyPIrich-toolkit0.14.0indirecta
PyPIshellingham1.5.4indirecta
PyPIsniffio1.3.1indirecta
PyPIsocksio1.0.0indirecta
PyPIstarlette0.37.2indirecta
PyPItyper0.15.2indirecta
PyPItyping-extensions3.10.0.2indirecta
PyPItyping-extensions4.13.0indirecta
PyPItyping-inspection0.4.0indirecta
PyPIujson5.10.0indirecta
PyPIurllib32.3.0indirecta
PyPIuvicorn0.34.0indirecta
PyPIuvloop0.21.0indirecta
PyPIwatchfiles1.0.4indirecta
PyPIwebsockets15.0.1indirecta
Avisos de dependencias 43

Este repositorio no publica ningún paquete que el índice resuelva, así que se evaluó su propio grafo de dependencias — 428 paquetes, que incluyen también fijaciones de desarrollo y prueba que nunca se distribuyen: 43 tienen avisos conocidos, de los cuales 7 son directas. 1 no pudieron evaluarse: sin versión resuelta, ecosistema no admitido, o fuera de la lista de paquetes informada.

PaqueteVersiónRelaciónGravedadAvisosCorregido en
golang.org/x/cryptov0.46.0indirectacrítica270.52.0
google.golang.org/grpcv1.76.0indirectacrítica31.82.1
h110.14.0indirectacrítica20.16.0
pygments1.6indirectacrítica102.20.0
github.com/go-git/go-billy/v5v5.7.0directaalta46.0.0-alpha.1
github.com/hashicorp/go-getterv1.8.4directaalta21.8.6
aws-sdk2.706.0indirectaalta22.814.0
brotli1.1.0indirectaalta22.13.4
click7.1.2indirectaalta18.3.3
click8.1.8indirectaalta18.3.3
github.com/buger/jsonparserv1.1.1indirectaalta21.1.2
github.com/containerd/containerdv1.7.30indirectaalta92.3.2
github.com/docker/cliv29.1.3+incompatibleindirectaalta229.2.0+incompatible
github.com/docker/dockerv28.5.2+incompatibleindirectaalta1029.3.1
github.com/go-jose/go-jose/v4v4.1.2indirectaalta24.1.4
go.opentelemetry.io/otelv1.39.0indirectaalta21.41.0
go.opentelemetry.io/otel/sdkv1.39.0indirectaalta41.43.0
orjson3.10.16indirectaalta23.11.6
python-multipart0.0.20indirectaalta140.0.31
starlette0.37.2indirectaalta141.3.1
ujson5.10.0indirectaalta85.13.0
urllib32.3.0indirectaalta122.7.0
github.com/anchore/stereoscopev0.0.0-20200706164556-7cf39d7f4639directamoderada20.0.1
github.com/go-git/go-git/v5v5.16.4directamoderada166.0.0-alpha.4
github.com/go-viper/mapstructure/v2v2.2.1directamoderada42.4.0
github.com/ulikunitz/xzv0.5.12directamoderada20.5.15
golang.org/x/netv0.48.0directamoderada91.26.3
ajv6.12.3indirectamoderada18.18.0
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstreamv1.7.4indirectamoderada21.97.3
github.com/aws/aws-sdk-go-v2/service/s3v1.95.0indirectamoderada21.97.3
github.com/cloudflare/circlv1.6.1indirectamoderada21.6.3
github.com/nwaples/rardecodev1.1.3indirectamoderada22.2.0
idna3.10indirectamoderada23.15
nanoid3.3.4indirectamoderada15.0.9
python-dotenv1.1.0indirectamoderada21.2.2
requests2.32.3indirectamoderada42.33.0
h24.2.0indirectabaja24.3.0
merge-objects1.0.5indirectabaja1—
pygments2.19.1indirectabaja22.20.0
golang.org/x/sysv0.33.0indirectadesconocida10.44.0
golang.org/x/sysv0.39.0indirectadesconocida10.44.0
golang.org/x/textv0.21.0indirectadesconocida10.39.0
golang.org/x/textv0.32.0indirectadesconocida10.39.0

Un aviso significa que la versión registrada en el grafo de dependencias cae dentro del rango afectado de un aviso. No se analiza la alcanzabilidad, y el grafo incluye fijaciones de desarrollo y prueba: un hallazgo puede referirse al utillaje y no al software distribuido.

Informe JSON sin procesar legible por máquina
{
  "data": {
    "repo": {
      "topics": [],
      "is_fork": true,
      "size_kb": 19491,
      "has_wiki": true,
      "homepage": null,
      "languages": {
        "C": 4597,
        "C#": 13279,
        "Go": 5396743,
        "C++": 1017,
        "Lua": 82633,
        "PHP": 1637,
        "HTML": 132,
        "Java": 6170,
        "Perl": 5,
        "Roff": 360,
        "Ruby": 31370,
        "Rust": 281,
        "Shell": 63334,
        "Elixir": 9158,
        "Erlang": 5893,
        "Prolog": 764,
        "Python": 41585,
        "Makefile": 37896,
        "Dockerfile": 45421,
        "Vim Script": 89
      },
      "pushed_at": "2026-01-09T21:17:09Z",
      "created_at": "2021-12-12T12:13:05Z",
      "owner_type": "User",
      "updated_at": "2026-01-09T20:44:47Z",
      "description": "CLI tool and library for generating a Software Bill of Materials from container images and filesystems",
      "is_archived": false,
      "is_disabled": false,
      "license_spdx": "Apache-2.0",
      "default_branch": "main",
      "license_spdx_raw": "Apache-2.0",
      "primary_language": "Go",
      "significant_languages": [
        "Go"
      ]
    },
    "owner": {
      "blog": null,
      "name": "Alex Goodman",
      "type": "User",
      "login": "wagoodman",
      "company": "@anchore ",
      "location": "Alexandria, VA",
      "followers": 1675,
      "avatar_url": "https://avatars.githubusercontent.com/u/590471?v=4",
      "created_at": "2011-01-29T22:06:39Z",
      "is_verified": null,
      "public_repos": 110,
      "account_age_days": 5655
    },
    "license": {
      "state": "standard",
      "spdx_id": "Apache-2.0",
      "raw_spdx": "Apache-2.0",
      "file_present": true,
      "scorecard_found": true,
      "profile_has_license": false
    },
    "activity": {
      "releases": [
        {
          "tag": "v0.0.0",
          "kind": "major",
          "published_at": "2024-11-20T14:13:53Z"
        }
      ],
      "recent_commits": [
        {
          "oid": "55a190aed1608103733d4f75c6454658fa69da22",
          "body": "Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>\nCo-authored-by: spiffcs <32073428+spiffcs@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): update tools to latest versions (#4542)",
          "author_name": "anchore-actions-token-generator[bot]",
          "author_login": "anchore-actions-token-generator[bot]",
          "committed_at": "2026-01-09T18:14:13Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "695bbcc4f9c686030f20a19ed8a8f7f64ffb816e",
          "body": "Bumps the go-minor-patch group with 4 updates: [github.com/vbatts/go-mtree](https://github.com/vbatts/go-mtree), [modernc.org/sqlite](https://gitlab.com/cznic/sqlite), [github.com/goccy/go-yaml](https://github.com/goccy/go-yaml) and [github.com/gpustack/gguf-parser-go](https://github.com/gpustack/gg\n[…]\nsion-update:semver-minor\n  dependency-group: go-minor-patch\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump the go-minor-patch group with 4 updates (#4543)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-01-09T18:13:56Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "6d206910f04b65cb47e1d89a82fddb8fb08bac97",
          "body": "Bumps the actions-minor-patch group with 1 update in the / directory: [anchore/sbom-action](https://github.com/anchore/sbom-action).\n\n\nUpdates `anchore/sbom-action` from 0.21.0 to 0.21.1\n- [Release notes](https://github.com/anchore/sbom-action/releases)\n- [Changelog](https://github.com/anchore/sbom-\n[…]\nupdate:semver-patch\n  dependency-group: actions-minor-patch\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump anchore/sbom-action (#4544)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-01-09T18:13:44Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "2f3a504acfba83982351fff32f78d19d5c31bbf4",
          "body": "* fixed #4550, catalog mongodb bin\n\nSigned-off-by: Rez Moss <hi@rezmoss.com>\n\n* fixed #4550, catalog mongodb bin\n\nSigned-off-by: Rez Moss <hi@rezmoss.com>\n\n---------\n\nSigned-off-by: Rez Moss <hi@rezmoss.com>",
          "is_bot": false,
          "headline": "Feat/catalog mongodb bin (#4541)",
          "author_name": "Rez Moss",
          "author_login": "rezmoss",
          "committed_at": "2026-01-08T17:18:51Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "d24e843c45c97c3ca4601ed6bdc2c9370900b452",
          "body": "Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>\nCo-authored-by: spiffcs <32073428+spiffcs@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): update tools to latest versions (#4537)",
          "author_name": "anchore-actions-token-generator[bot]",
          "author_login": "anchore-actions-token-generator[bot]",
          "committed_at": "2026-01-08T16:56:50Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "83a4528fff72da874958ba6d0ea7fe012552e408",
          "body": "A CI failure was observed where a generated file was only partly written\nwhen the CI job immediately tried to read it. Put in an fs.Sync call to\neliminate this flakiness.\n\nSigned-off-by: Will Murphy <willmurphyscode@users.noreply.github.com>",
          "is_bot": false,
          "headline": "chore: sync generated file immediately (#4538)",
          "author_name": "Will Murphy",
          "author_login": "willmurphyscode",
          "committed_at": "2026-01-08T14:01:17Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "11e871566b35765fe69da439fa3beaef123bc143",
          "body": "Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>\nCo-authored-by: willmurphyscode <12529630+willmurphyscode@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): update anchore dependencies (#4535)",
          "author_name": "anchore-actions-token-generator[bot]",
          "author_login": "anchore-actions-token-generator[bot]",
          "committed_at": "2026-01-08T12:16:49Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "cc1a7dfae896b46616d0885de4b93328aa5f0734",
          "body": "Signed-off-by: promalert <promalert@outlook.com>",
          "is_bot": false,
          "headline": "chore: fix some comments to improve readability (#4533)",
          "author_name": "promalert",
          "author_login": "promalert",
          "committed_at": "2026-01-07T15:48:40Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "3a3a86eb017bc3ccd290e38cfed2fa2ae8396830",
          "body": "* fixed #4430 exclude dev pnpm pkg\n\nSigned-off-by: Rez Moss <hi@rezmoss.com>\n\n* use existing dev deps option\n\nSigned-off-by: Alex Goodman <wagoodman@users.noreply.github.com>\n\n* fixed #4430 exclude dev pnpm pkg, add test\n\nSigned-off-by: Rez Moss <hi@rezmoss.com>\n\n* fixed #4430 exclude dev pnpm pkg, \n[…]\n<hi@rezmoss.com>\n\n---------\n\nSigned-off-by: Rez Moss <hi@rezmoss.com>\nSigned-off-by: Alex Goodman <wagoodman@users.noreply.github.com>\nCo-authored-by: Alex Goodman <wagoodman@users.noreply.github.com>",
          "is_bot": false,
          "headline": "fixed #4430 exclude dev pnpm pkg (#4487)",
          "author_name": "Rez Moss",
          "author_login": "rezmoss",
          "committed_at": "2026-01-07T15:39:16Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "6509b7079ee2ce7f2efc31ba35426c6d4ffb25b5",
          "body": "Signed-off-by: witchcraze <witchcraze@gmail.com>",
          "is_bot": false,
          "headline": "add istio classifier (#4521)",
          "author_name": "witchcraze",
          "author_login": "witchcraze",
          "committed_at": "2026-01-07T15:36:39Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "7f1d57d06fde14ec26566832dff44828ab5a4da9",
          "body": "Signed-off-by: Rez Moss <hi@rezmoss.com>",
          "is_bot": false,
          "headline": "feat: detect older bitnami img packages (#4532)",
          "author_name": "Rez Moss",
          "author_login": "rezmoss",
          "committed_at": "2026-01-07T15:07:33Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "ed339e4fed10912d7ed9b98c588ec38241fb020b",
          "body": "---------\nSigned-off-by: Alex Goodman <wagoodman@users.noreply.github.com>",
          "is_bot": false,
          "headline": "fix: ensure java image build failures stop the build (#4531)",
          "author_name": "Alex Goodman",
          "author_login": "wagoodman",
          "committed_at": "2026-01-06T16:43:51Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "3ea6a03cd060096fd67841759008bb2efc215371",
          "body": "* chore(deps): bump the go-minor-patch group with 3 updates\n\nBumps the go-minor-patch group with 3 updates: [github.com/BurntSushi/toml](https://github.com/BurntSushi/toml), [github.com/go-git/go-git/v5](https://github.com/go-git/go-git) and [github.com/invopop/jsonschema](https://github.com/invopop\n[…]\n Alex Goodman <wagoodman@users.noreply.github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>\nCo-authored-by: Alex Goodman <wagoodman@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump the go-minor-patch group with 3 updates (#4524)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-01-06T15:25:43Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "81dd9558714639a848d6a843988106c6ddb5d943",
          "body": "* add envoy classifier\nSigned-off-by: witchcraze <witchcraze@gmail.com>\n\n* add envoy classifier\nSigned-off-by: witchcraze <witchcraze@gmail.com>",
          "is_bot": false,
          "headline": "add envoy binary classifier (#4530)",
          "author_name": "witchcraze",
          "author_login": "witchcraze",
          "committed_at": "2026-01-06T13:45:01Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "48948ddb8fa886631fc920f4a66999e9eaba5634",
          "body": "Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>",
          "is_bot": false,
          "headline": "add container support for graalvm fixture (#4528)",
          "author_name": "Alex Goodman",
          "author_login": "wagoodman",
          "committed_at": "2026-01-05T19:18:12Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "63273b1b00da98af439be767505484ee61e5c5a5",
          "body": "…th 2 updates (#4525)\n\nBumps the actions-minor-patch group with 2 updates in the / directory: [docker/login-action](https://github.com/docker/login-action) and [zizmorcore/zizmor-action](https://github.com/zizmorcore/zizmor-action).\n\n\nUpdates `docker/login-action` from 3.5.0 to 3.6.0\n- [Release note\n[…]\nupdate:semver-minor\n  dependency-group: actions-minor-patch\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump the actions-minor-patch group across 1 directory wi…",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-01-05T17:48:30Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "92e523caa61d863bcb8d36205eb9ef90dd00f4c8",
          "body": "Bumps [actions/download-artifact](https://github.com/actions/download-artifact) from 6.0.0 to 7.0.0.\n- [Release notes](https://github.com/actions/download-artifact/releases)\n- [Commits](https://github.com/actions/download-artifact/compare/018cc2cf5baa6db3ef3c5f8a56943fffe632ef53...37930b1c2abaa49bbe\n[…]\nirect:production\n  update-type: version-update:semver-major\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump actions/download-artifact from 6.0.0 to 7.0.0 (#4526)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-01-05T17:48:20Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "9b33b8a3d61be74b65e6df790ab5199118f7b010",
          "body": "Bumps [actions/upload-artifact](https://github.com/actions/upload-artifact) from 4.4.3 to 6.0.0.\n- [Release notes](https://github.com/actions/upload-artifact/releases)\n- [Commits](https://github.com/actions/upload-artifact/compare/b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882...b7c566a772e6b6bfb58ed0dc25\n[…]\nirect:production\n  update-type: version-update:semver-major\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump actions/upload-artifact from 4.4.3 to 6.0.0 (#4527)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-01-05T17:48:13Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "29a0b19a213778fe2cbed6f007fdd3f012adb347",
          "body": "* group dependabot updates\n\nSigned-off-by: Alex Goodman <wagoodman@users.noreply.github.com>\n\n* use directories key\n\nSigned-off-by: Alex Goodman <wagoodman@users.noreply.github.com>\n\n---------\n\nSigned-off-by: Alex Goodman <wagoodman@users.noreply.github.com>",
          "is_bot": false,
          "headline": "Group dependabot updates (#4522)",
          "author_name": "Alex Goodman",
          "author_login": "wagoodman",
          "committed_at": "2026-01-05T16:57:38Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "ea4350619651ab5ad10c2aabca142c6d8089e8e9",
          "body": "---------\nSigned-off-by: Luis M. Santos <luis.santos2@nih.gov>\nCo-authored-by: Luis M. Santos <luis.santos2@nih.gov>",
          "is_bot": false,
          "headline": "fix: corrects handling of UNC root paths in windows.",
          "author_name": "Luis Miguel Santos",
          "author_login": "luissantosHCIT",
          "committed_at": "2026-01-05T16:32:07Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "2c96279df99fb3ba9c9d38cce3fe0e1f74eabb4a",
          "body": "Signed-off-by: Rez Moss <hi@rezmoss.com>",
          "is_bot": false,
          "headline": "fix: traefik binary classifier (#4499)",
          "author_name": "Rez Moss",
          "author_login": "rezmoss",
          "committed_at": "2026-01-05T16:14:00Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "488511f69dd16a6d29e34855a181ddd631fde40f",
          "body": "Bumps [modernc.org/sqlite](https://gitlab.com/cznic/sqlite) from 1.41.0 to 1.42.2.\n- [Commits](https://gitlab.com/cznic/sqlite/compare/v1.41.0...v1.42.2)\n\n---\nupdated-dependencies:\n- dependency-name: modernc.org/sqlite\n  dependency-version: 1.42.2\n  dependency-type: direct:production\n  update-type: version-update:semver-minor\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump modernc.org/sqlite from 1.41.0 to 1.42.2 (#4513)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-01-05T15:46:39Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "11fed9007561ad4f3f1d72fbaaa2810e20846181",
          "body": "* migrate to runs-on runners\n\nSigned-off-by: Alex Goodman <wagoodman@users.noreply.github.com>\n\n* keep validations on x64\n\nSigned-off-by: Alex Goodman <wagoodman@users.noreply.github.com>\n\n* correct ubuntu arm refs\n\nSigned-off-by: Alex Goodman <wagoodman@users.noreply.github.com>\n\n* bust cache\n\nSign\n[…]\nwagoodman@users.noreply.github.com>\n\n* remove parallelism\n\nSigned-off-by: Alex Goodman <wagoodman@users.noreply.github.com>\n\n---------\n\nSigned-off-by: Alex Goodman <wagoodman@users.noreply.github.com>",
          "is_bot": false,
          "headline": "Migrate CI to runs-on (#4351)",
          "author_name": "Alex Goodman",
          "author_login": "wagoodman",
          "committed_at": "2026-01-05T14:53:06Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "c8184bdb4c3e9f800c8ffa6dd4f37145893cae4a",
          "body": "Signed-off-by: witchcraze <witchcraze@gmail.com>",
          "is_bot": false,
          "headline": "add grafana classifier (#4516)",
          "author_name": "witchcraze",
          "author_login": "witchcraze",
          "committed_at": "2026-01-05T14:51:41Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "15af992225b8f046de9459a019de7e39f5525fbb",
          "body": "* add valkey classifier\nSigned-off-by: witchcraze <witchcraze@gmail.com>\n\n* fix test path\nSigned-off-by: witchcraze <witchcraze@gmail.com>\n\n* Run 'go generate ./internal/capabilities'\nSigned-off-by: witchcraze <witchcraze@gmail.com>",
          "is_bot": false,
          "headline": "add valkey classifier (#4509)",
          "author_name": "witchcraze",
          "author_login": "witchcraze",
          "committed_at": "2026-01-05T14:40:35Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "1e15428c6f6271bae148388d1fec5b7cd11f041a",
          "body": "Bumps [anchore/sbom-action](https://github.com/anchore/sbom-action) from 0.20.11 to 0.21.0.\n- [Release notes](https://github.com/anchore/sbom-action/releases)\n- [Changelog](https://github.com/anchore/sbom-action/blob/main/RELEASE.md)\n- [Commits](https://github.com/anchore/sbom-action/compare/43a17d6\n[…]\nirect:production\n  update-type: version-update:semver-minor\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump anchore/sbom-action from 0.20.11 to 0.21.0 (#4501)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-01-05T14:19:40Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "d1adfdc3a6fee4011eb00554e0542bcbc8d826ea",
          "body": "… (#4502)\n\nBumps [github.com/jedib0t/go-pretty/v6](https://github.com/jedib0t/go-pretty) from 6.7.7 to 6.7.8.\n- [Release notes](https://github.com/jedib0t/go-pretty/releases)\n- [Commits](https://github.com/jedib0t/go-pretty/compare/v6.7.7...v6.7.8)\n\n---\nupdated-dependencies:\n- dependency-name: githu\n[…]\nirect:production\n  update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump github.com/jedib0t/go-pretty/v6 from 6.7.7 to 6.7.8…",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-01-05T14:19:34Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "00281650627c9357a2807815c89d0ff6a3240316",
          "body": "…4503)\n\nBumps [github.com/spdx/tools-golang](https://github.com/spdx/tools-golang) from 0.5.5 to 0.5.6.\n- [Release notes](https://github.com/spdx/tools-golang/releases)\n- [Changelog](https://github.com/spdx/tools-golang/blob/main/RELEASE-NOTES.md)\n- [Commits](https://github.com/spdx/tools-golang/com\n[…]\nirect:production\n  update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump github.com/spdx/tools-golang from 0.5.5 to 0.5.6 (#…",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-01-05T14:19:29Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "997a76712ff6c1a89c9a9e42dcc312ee4e878c1f",
          "body": "Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>\nCo-authored-by: spiffcs <32073428+spiffcs@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): update tools to latest versions (#4504)",
          "author_name": "anchore-actions-token-generator[bot]",
          "author_login": "anchore-actions-token-generator[bot]",
          "committed_at": "2026-01-05T14:19:24Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "e44ef53489f04917605428c0e0051ddfdfb0edec",
          "body": "…(#4518)\n\nBumps [github.com/hashicorp/go-getter](https://github.com/hashicorp/go-getter) from 1.8.3 to 1.8.4.\n- [Release notes](https://github.com/hashicorp/go-getter/releases)\n- [Commits](https://github.com/hashicorp/go-getter/compare/v1.8.3...v1.8.4)\n\n---\nupdated-dependencies:\n- dependency-name: g\n[…]\nirect:production\n  update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump github.com/hashicorp/go-getter from 1.8.3 to 1.8.4 …",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-01-05T14:17:46Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "e0708e725f9544535e72de76011d47f9ebcb49b5",
          "body": "…19 (#4520)\n\nBumps [github.com/gkampitakis/go-snaps](https://github.com/gkampitakis/go-snaps) from 0.5.18 to 0.5.19.\n- [Release notes](https://github.com/gkampitakis/go-snaps/releases)\n- [Commits](https://github.com/gkampitakis/go-snaps/compare/0.5.18...v0.5.19)\n\n---\nupdated-dependencies:\n- dependen\n[…]\nirect:production\n  update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump github.com/gkampitakis/go-snaps from 0.5.18 to 0.5.…",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-01-05T14:17:39Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "e9e34948534ab945c7e750376235cfe0c442f532",
          "body": "Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>",
          "is_bot": false,
          "headline": "remove debug output (#4496)",
          "author_name": "Alex Goodman",
          "author_login": "wagoodman",
          "committed_at": "2025-12-22T19:51:39Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "b3c70da3ea0aec25829d7ddb55c19881c3c7168f",
          "body": "* add info command from generated capabilities\n\nSigned-off-by: Alex Goodman <wagoodman@users.noreply.github.com>\n\n* correct gentoo and arch ecosystems\n\nSigned-off-by: Alex Goodman <wagoodman@users.noreply.github.com>\n\n* rename os pkg types\n\nSigned-off-by: Alex Goodman <wagoodman@users.noreply.github\n[…]\ngmail.com>\nSigned-off-by: Will Murphy <willmurphyscode@users.noreply.github.com>\nCo-authored-by: Keith Zantow <kzantow@gmail.com>\nCo-authored-by: Will Murphy <willmurphyscode@users.noreply.github.com>",
          "is_bot": false,
          "headline": "Add experimental cataloger capabilities command (#4317)",
          "author_name": "Alex Goodman",
          "author_login": "wagoodman",
          "committed_at": "2025-12-22T19:34:10Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "ae1a247f3de7ad222a4d2946de685aff96d73125",
          "body": "* unpin dependencies for package dedup case\n\nSigned-off-by: Alex Goodman <wagoodman@users.noreply.github.com>\n\n* prevent make from blocking tests\n\nSigned-off-by: Alex Goodman <wagoodman@users.noreply.github.com>\n\n* add check\n\nSigned-off-by: Alex Goodman <wagoodman@users.noreply.github.com>\n\n---------\n\nSigned-off-by: Alex Goodman <wagoodman@users.noreply.github.com>",
          "is_bot": false,
          "headline": "Unpin fixture dependencies that will always float (#4495)",
          "author_name": "Alex Goodman",
          "author_login": "wagoodman",
          "committed_at": "2025-12-22T19:17:58Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "0ea920ba6db187f84f95f0a74c26eb3db11719dc",
          "body": "…atted binaries with lzma method only) (#4480)\n\n* decompress upx packed binaries\n\nSigned-off-by: Alex Goodman <wagoodman@users.noreply.github.com>\n\n* fix linting and remove dead code\n\nSigned-off-by: Alex Goodman <wagoodman@users.noreply.github.com>\n\n---------\n\nSigned-off-by: Alex Goodman <wagoodman@users.noreply.github.com>",
          "is_bot": false,
          "headline": "Decompress UPX packed binaries to extract golang build info (ELF form…",
          "author_name": "Alex Goodman",
          "author_login": "wagoodman",
          "committed_at": "2025-12-22T14:17:38Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "7ef4703454abc809eec52a80ff58a9c49f8bb9a5",
          "body": "Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>\nCo-authored-by: spiffcs <32073428+spiffcs@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): update tools to latest versions (#4491)",
          "author_name": "anchore-actions-token-generator[bot]",
          "author_login": "anchore-actions-token-generator[bot]",
          "committed_at": "2025-12-22T14:15:51Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "8334fb04eccdf5314cc2c9dbf64566fe4112f0bd",
          "body": "Bumps [modernc.org/sqlite](https://gitlab.com/cznic/sqlite) from 1.40.1 to 1.41.0.\n- [Commits](https://gitlab.com/cznic/sqlite/compare/v1.40.1...v1.41.0)\n\n---\nupdated-dependencies:\n- dependency-name: modernc.org/sqlite\n  dependency-version: 1.41.0\n  dependency-type: direct:production\n  update-type: version-update:semver-minor\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump modernc.org/sqlite from 1.40.1 to 1.41.0 (#4489)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2025-12-19T16:00:31Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "c9760d234164a3a51a0102ed3f0ff9ab5d73b956",
          "body": "…439)\n\n---------\nSigned-off-by: Yuntao Hu <victorhu493@gmail.com>",
          "is_bot": false,
          "headline": "feat: snap can be queried by revision and ```track/risk/branch``` (#4…",
          "author_name": "VictorHuu",
          "author_login": "VictorHuu",
          "committed_at": "2025-12-18T20:41:36Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "74c9380248c63bad87d1c3d54151eb2b49c206a9",
          "body": "---------\nSigned-off-by: Rez Moss <hi@rezmoss.com>\nSigned-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com>\nSigned-off-by: Christopher Angelo Phillips <32073428+spiffcs@users.noreply.github.com>\nCo-authored-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com>",
          "is_bot": false,
          "headline": "fix: 4423 dotnet-deps cataloger skips project type by def",
          "author_name": "Rez Moss",
          "author_login": "rezmoss",
          "committed_at": "2025-12-18T18:38:47Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "7ed733c3fbd9bab33ec59171a1170db1553e8a52",
          "body": "Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>",
          "is_bot": false,
          "headline": "signpost to docs site (#4483)",
          "author_name": "Alex Goodman",
          "author_login": "wagoodman",
          "committed_at": "2025-12-17T18:00:38Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "a39c60091357ff0d566db30e92d2a1ce3faa7759",
          "body": "Bumps [github/codeql-action](https://github.com/github/codeql-action) from 4.31.8 to 4.31.9.\n- [Release notes](https://github.com/github/codeql-action/releases)\n- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)\n- [Commits](https://github.com/github/codeql-action/compare/1\n[…]\nirect:production\n  update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump github/codeql-action from 4.31.8 to 4.31.9 (#4481)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2025-12-17T15:20:52Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "a2020fe1c7bc6f37e78cc1f34060cae1bbec701a",
          "body": "Bumps [github.com/goccy/go-yaml](https://github.com/goccy/go-yaml) from 1.19.0 to 1.19.1.\n- [Release notes](https://github.com/goccy/go-yaml/releases)\n- [Changelog](https://github.com/goccy/go-yaml/blob/master/CHANGELOG.md)\n- [Commits](https://github.com/goccy/go-yaml/compare/v1.19.0...v1.19.1)\n\n---\n[…]\nirect:production\n  update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump github.com/goccy/go-yaml from 1.19.0 to 1.19.1 (#4482)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2025-12-17T15:20:43Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "c79a57b6a1e00c413bfd02269bbcd46133ecf7f7",
          "body": "* syft detect embedded deps.json,dotnet , fixed #4344\n\nSigned-off-by: Rez Moss <hi@rezmoss.com>\n\n* [wip] have pe utils process embedded dep.json\n\nSigned-off-by: Alex Goodman <wagoodman@users.noreply.github.com>\n\n* [wip] add PoC bundler processing\n\nSigned-off-by: Alex Goodman <wagoodman@users.noreply\n[…]\neply.github.com>\n\n---------\n\nSigned-off-by: Rez Moss <hi@rezmoss.com>\nSigned-off-by: Alex Goodman <wagoodman@users.noreply.github.com>\nCo-authored-by: Alex Goodman <wagoodman@users.noreply.github.com>",
          "is_bot": false,
          "headline": "Detect embedded deps.json in .NET binaries (#4375)",
          "author_name": "Rez Moss",
          "author_login": "rezmoss",
          "committed_at": "2025-12-16T13:35:19Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "2c97ff1b2448049a9b75bb19b1f425a774bbfcb4",
          "body": "Bumps [actions/cache](https://github.com/actions/cache) from 5.0.0 to 5.0.1.\n- [Release notes](https://github.com/actions/cache/releases)\n- [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md)\n- [Commits](https://github.com/actions/cache/compare/a7833574556fa59680c1b7cb190c1735db73ebf\n[…]\nirect:production\n  update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump actions/cache from 5.0.0 to 5.0.1 (#4476)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2025-12-16T13:28:51Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "e760a7cad494b33e8c6a42920b58d61c78ac640a",
          "body": "Bumps [actions/cache](https://github.com/actions/cache) from 5.0.0 to 5.0.1.\n- [Release notes](https://github.com/actions/cache/releases)\n- [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md)\n- [Commits](https://github.com/actions/cache/compare/a7833574556fa59680c1b7cb190c1735db73ebf\n[…]\nirect:production\n  update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump actions/cache in /.github/actions/bootstrap (#4477)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2025-12-16T13:28:48Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "e1ae4e1112fed981025646698fa484999d49b756",
          "body": "Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>\nCo-authored-by: spiffcs <32073428+spiffcs@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): update tools to latest versions (#4473)",
          "author_name": "anchore-actions-token-generator[bot]",
          "author_login": "anchore-actions-token-generator[bot]",
          "committed_at": "2025-12-16T13:28:44Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "beb70891e5599f1175b90027fdaaf8ffdfb9a584",
          "body": "Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>",
          "is_bot": false,
          "headline": "unapply base path for resolver inbound requests (#4478)",
          "author_name": "Alex Goodman",
          "author_login": "wagoodman",
          "committed_at": "2025-12-16T13:28:12Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "e0b61a3ae34ed93e017b7db90e2b05f8556738c5",
          "body": "* fixed #4316 go mod with ver purl\n\nSigned-off-by: Rez Moss <hi@rezmoss.com>\n\n* go mod purl fixed, added func to handle go.mod\n\nSigned-off-by: Rez Moss <hi@rezmoss.com>\n\n* fix: use module name in PURL string everywhere\n\nSigned-off-by: Keith Zantow <kzantow@gmail.com>\n\n---------\n\nSigned-off-by: Rez Moss <hi@rezmoss.com>\nSigned-off-by: Keith Zantow <kzantow@gmail.com>\nCo-authored-by: Keith Zantow <kzantow@gmail.com>",
          "is_bot": false,
          "headline": "fix: golang PURL should include full module (#4395)",
          "author_name": "Rez Moss",
          "author_login": "rezmoss",
          "committed_at": "2025-12-12T19:19:26Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "4c38ee1932b9d4892ab69c5034393d84f9450026",
          "body": "* fix:the os of an elf binary should be detected even when the os version is empty\n\nSigned-off-by: Yuntao Hu <victorhu493@gmail.com>\n\n* chore:revoke the update of appCpe\n\nSigned-off-by: Yuntao Hu <victorhu493@gmail.com>\n\n* chore:resume the testcase\n\nSigned-off-by: Yuntao Hu <victorhu493@gmail.com>\n\n\n[…]\nhub.com>\n\n---------\n\nSigned-off-by: Yuntao Hu <victorhu493@gmail.com>\nSigned-off-by: Alex Goodman <wagoodman@users.noreply.github.com>\nCo-authored-by: Alex Goodman <wagoodman@users.noreply.github.com>",
          "is_bot": false,
          "headline": "fix:best effort to get the os info of an ELF binary (#4438)",
          "author_name": "VictorHuu",
          "author_login": "VictorHuu",
          "committed_at": "2025-12-12T19:13:59Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "6be0a9abc42646429f0ff98dd826e9db4443685c",
          "body": "* improve pr template\n\nSigned-off-by: Alex Goodman <wagoodman@users.noreply.github.com>\n\n* incorporate feedback\n\nSigned-off-by: Alex Goodman <wagoodman@users.noreply.github.com>\n\n---------\n\nSigned-off-by: Alex Goodman <wagoodman@users.noreply.github.com>",
          "is_bot": false,
          "headline": "Improve PR template (#4472)",
          "author_name": "Alex Goodman",
          "author_login": "wagoodman",
          "committed_at": "2025-12-12T15:45:29Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "ea1f4cba389ec86ea7f7d9ed0463ecaa991d1a08",
          "body": "Signed-off-by: Alexandre Steppé <alexandre.steppe@gmail.com>",
          "is_bot": false,
          "headline": "feat: add support for Gemfile.next.lock (#4457)",
          "author_name": "Alexandre Steppé",
          "author_login": "HatiCode",
          "committed_at": "2025-12-12T15:20:53Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "c8982b887dab6f9653e9611b6958ca3aec694503",
          "body": "Signed-off-by: VictorHuu <victorhu493@gmail.com>",
          "is_bot": false,
          "headline": "chore:cancel in-progress workflows for new commits on same PR (#4465)",
          "author_name": "VictorHuu",
          "author_login": "VictorHuu",
          "committed_at": "2025-12-12T15:20:20Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "6ad4873a33536f8cf226823eeb6255af50d2f1d1",
          "body": "Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>\nCo-authored-by: spiffcs <32073428+spiffcs@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): update tools to latest versions (#4466)",
          "author_name": "anchore-actions-token-generator[bot]",
          "author_login": "anchore-actions-token-generator[bot]",
          "committed_at": "2025-12-12T13:49:02Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "052e4ca9a3200c7087b66c7ce9ff5afc331341a0",
          "body": "Bumps [github/codeql-action](https://github.com/github/codeql-action) from 4.31.7 to 4.31.8.\n- [Release notes](https://github.com/github/codeql-action/releases)\n- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)\n- [Commits](https://github.com/github/codeql-action/compare/c\n[…]\nirect:production\n  update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump github/codeql-action from 4.31.7 to 4.31.8 (#4468)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2025-12-12T13:48:36Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "41e133e2cf660b06536c0109bd95d88dbe503a81",
          "body": "Bumps [actions/cache](https://github.com/actions/cache) from 4.3.0 to 5.0.0.\n- [Release notes](https://github.com/actions/cache/releases)\n- [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md)\n- [Commits](https://github.com/actions/cache/compare/0057852bfaa89a56745cba8c7296529d2fc3983\n[…]\nirect:production\n  update-type: version-update:semver-major\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump actions/cache from 4.3.0 to 5.0.0 (#4469)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2025-12-12T13:48:32Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "a85e034afc22cb76ecdd0e1e0e8020f4b25415fb",
          "body": "…6 (#4470)\n\nBumps [github.com/anchore/stereoscope](https://github.com/anchore/stereoscope) from 0.1.14 to 0.1.16.\n- [Release notes](https://github.com/anchore/stereoscope/releases)\n- [Changelog](https://github.com/anchore/stereoscope/blob/main/RELEASE.md)\n- [Commits](https://github.com/anchore/stere\n[…]\nirect:production\n  update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump github.com/anchore/stereoscope from 0.1.14 to 0.1.1…",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2025-12-12T13:48:28Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "d5380013ae73d34376277e8fa1b3a2beca7794ba",
          "body": "Bumps [actions/cache](https://github.com/actions/cache) from 4.3.0 to 5.0.0.\n- [Release notes](https://github.com/actions/cache/releases)\n- [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md)\n- [Commits](https://github.com/actions/cache/compare/0057852bfaa89a56745cba8c7296529d2fc3983\n[…]\nirect:production\n  update-type: version-update:semver-major\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump actions/cache in /.github/actions/bootstrap (#4471)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2025-12-12T13:48:22Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "5ea3387cbc3515d3f246deb880459e25be32c11c",
          "body": "Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>\nCo-authored-by: spiffcs <32073428+spiffcs@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): update tools to latest versions (#4462)",
          "author_name": "anchore-actions-token-generator[bot]",
          "author_login": "anchore-actions-token-generator[bot]",
          "committed_at": "2025-12-11T14:55:34Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "568b7601bb4c1845be548e29074b1d0d81f0d90c",
          "body": "…4412)\n\nRemoves an accidental `fmt.Println(\"error\", err)` that was left in\nthe javascript dependency parser. This causes noisy output to stdout\nwhen parsing npm package-lock.json files that contain dependency\nspecifiers that aren't valid PURLs.\n\nSigned-off-by: Chris Greeno <chris@fresha.com>",
          "is_bot": false,
          "headline": "fix(javascript): remove debug print statement in dependency parser (#…",
          "author_name": "Chris Greeno",
          "author_login": "cgreeno",
          "committed_at": "2025-12-10T18:42:09Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "7fdb08c0b61134ab7d85337de69a96dc3e72cd6f",
          "body": "…ssary  (#4390)\n\n* Adding a second function to validate/correct urls that are just github repositories\n\nSigned-off-by: Kendrick <kmartinix@gmail.com>\n\n* Adding test case to capture github repositories\n\nSigned-off-by: Kendrick <kmartinix@gmail.com>\n\n---------\n\nSigned-off-by: Kendrick <kmartinix@gmail.com>",
          "is_bot": false,
          "headline": "Validating download_url for github repositories, and updating if nece…",
          "author_name": "Kendrick",
          "author_login": "kendrickm",
          "committed_at": "2025-12-10T18:41:00Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "47e1cee5a55b5d0ea63dc13a26b3d1acab2181e3",
          "body": "Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>\nCo-authored-by: spiffcs <32073428+spiffcs@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): update tools to latest versions (#4456)",
          "author_name": "anchore-actions-token-generator[bot]",
          "author_login": "anchore-actions-token-generator[bot]",
          "committed_at": "2025-12-10T18:34:42Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "a0c5b8aa8daf5a3c47bfcd53a2284e90f610e081",
          "body": "… (#4460)\n\nBumps [github.com/jedib0t/go-pretty/v6](https://github.com/jedib0t/go-pretty) from 6.7.5 to 6.7.7.\n- [Release notes](https://github.com/jedib0t/go-pretty/releases)\n- [Commits](https://github.com/jedib0t/go-pretty/compare/v6.7.5...v6.7.7)\n\n---\nupdated-dependencies:\n- dependency-name: githu\n[…]\nirect:production\n  update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump github.com/jedib0t/go-pretty/v6 from 6.7.5 to 6.7.7…",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2025-12-10T18:32:56Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "ab5fa0a664280cd1234cb1acccbfd9ffe1111f56",
          "body": "…0 (#4459)\n\nBumps [peter-evans/create-pull-request](https://github.com/peter-evans/create-pull-request) from 7.0.11 to 8.0.0.\n- [Release notes](https://github.com/peter-evans/create-pull-request/releases)\n- [Commits](https://github.com/peter-evans/create-pull-request/compare/22a9089034f40e5a961c8808\n[…]\nirect:production\n  update-type: version-update:semver-major\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump peter-evans/create-pull-request from 7.0.11 to 8.0.…",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2025-12-10T18:32:51Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "07ad8a55734e047d5c870e27c412153a6c9ae268",
          "body": "Bumps [anchore/sbom-action](https://github.com/anchore/sbom-action) from 0.20.10 to 0.20.11.\n- [Release notes](https://github.com/anchore/sbom-action/releases)\n- [Changelog](https://github.com/anchore/sbom-action/blob/main/RELEASE.md)\n- [Commits](https://github.com/anchore/sbom-action/compare/fbfd9c\n[…]\nirect:production\n  update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump anchore/sbom-action from 0.20.10 to 0.20.11 (#4458)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2025-12-10T18:32:47Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "bfe63f83dbaea88e22a5cfcd7d704c034c953730",
          "body": "Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>\nCo-authored-by: willmurphyscode <12529630+willmurphyscode@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): update anchore dependencies (#4440)",
          "author_name": "anchore-actions-token-generator[bot]",
          "author_login": "anchore-actions-token-generator[bot]",
          "committed_at": "2025-12-09T20:56:03Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "f01056d111b66978d0de23762cf77130953e3c18",
          "body": "* chore(deps): update tools to latest versions\n\nSigned-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>\n\n* chore: suppress revive on internal/os package name\n\ngolangci-lint has started flagging internal/os package name for\nshadowing the stdlib package named \"os\". S\n[…]\nff-by: Will Murphy <willmurphyscode@users.noreply.github.com>\nCo-authored-by: spiffcs <32073428+spiffcs@users.noreply.github.com>\nCo-authored-by: Will Murphy <willmurphyscode@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): update tools to latest versions (#4442)",
          "author_name": "anchore-actions-token-generator[bot]",
          "author_login": "anchore-actions-token-generator[bot]",
          "committed_at": "2025-12-09T16:00:08Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "09b24bdb471eebd345c0d1cd4f43eaa2a0ca74fe",
          "body": "…1 (#4447)\n\nBumps [peter-evans/create-pull-request](https://github.com/peter-evans/create-pull-request) from 7.0.8 to 7.0.11.\n- [Release notes](https://github.com/peter-evans/create-pull-request/releases)\n- [Commits](https://github.com/peter-evans/create-pull-request/compare/271a8d0340265f705b14b6d3\n[…]\nirect:production\n  update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump peter-evans/create-pull-request from 7.0.8 to 7.0.1…",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2025-12-09T14:59:32Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "ae1fa09e02e5f845b52b8994beb008b387892879",
          "body": "… (#4445)\n\nBumps [actions/create-github-app-token](https://github.com/actions/create-github-app-token) from 2.1.4 to 2.2.1.\n- [Release notes](https://github.com/actions/create-github-app-token/releases)\n- [Commits](https://github.com/actions/create-github-app-token/compare/67018539274d69449ef7c02e8e\n[…]\nirect:production\n  update-type: version-update:semver-minor\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump actions/create-github-app-token from 2.1.4 to 2.2.1…",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2025-12-09T14:57:48Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "6b0f9244261ee03cda016e6a20f196f529e7792d",
          "body": "…#4448)\n\nBumps [github.com/go-git/go-billy/v5](https://github.com/go-git/go-billy) from 5.6.2 to 5.7.0.\n- [Release notes](https://github.com/go-git/go-billy/releases)\n- [Commits](https://github.com/go-git/go-billy/compare/v5.6.2...v5.7.0)\n\n---\nupdated-dependencies:\n- dependency-name: github.com/go-g\n[…]\nirect:production\n  update-type: version-update:semver-minor\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump github.com/go-git/go-billy/v5 from 5.6.2 to 5.7.0 (…",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2025-12-09T14:56:00Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "6d56087289bd614a74677dd5263b9108fc2b5f5a",
          "body": "Bumps [github/codeql-action](https://github.com/github/codeql-action) from 4.31.6 to 4.31.7.\n- [Release notes](https://github.com/github/codeql-action/releases)\n- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)\n- [Commits](https://github.com/github/codeql-action/compare/f\n[…]\nirect:production\n  update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump github/codeql-action from 4.31.6 to 4.31.7 (#4446)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2025-12-09T14:47:52Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "1d718f3311b38d721661d2e678811f5935bff249",
          "body": "Bumps [golang.org/x/tools](https://github.com/golang/tools) from 0.39.0 to 0.40.0.\n- [Release notes](https://github.com/golang/tools/releases)\n- [Commits](https://github.com/golang/tools/compare/v0.39.0...v0.40.0)\n\n---\nupdated-dependencies:\n- dependency-name: golang.org/x/tools\n  dependency-version:\n[…]\nirect:production\n  update-type: version-update:semver-minor\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump golang.org/x/tools from 0.39.0 to 0.40.0 (#4453)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2025-12-09T14:46:52Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "9e3150b7ee5a7d1ae0a15d6d12c0f3ab410be447",
          "body": "…449)\n\nSigned-off-by: Keith Zantow <kzantow@gmail.com>",
          "is_bot": false,
          "headline": "fix: java archives excluded due to incorrect license glob results (#4…",
          "author_name": "Keith Zantow",
          "author_login": "kzantow",
          "committed_at": "2025-12-08T20:58:13Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "d950ac1fae22f86fc777a47ac9300369333a0c65",
          "body": "The recent react / next CVE uses \"vercel\" as the vendor, see\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-55182\n\nSigned-off-by: Will Murphy <willmurphyscode@users.noreply.github.com>",
          "is_bot": false,
          "headline": "fix: use vercel for vendor in nextjs CPE (#4450)",
          "author_name": "Will Murphy",
          "author_login": "willmurphyscode",
          "committed_at": "2025-12-08T20:23:36Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "baca32f04ae767d0829c6a3bab47cd6d7edc644c",
          "body": "… one should be omitted  (#4419)\n\n---------\nSigned-off-by: Yuntao Hu <victorhu493@gmail.com>",
          "is_bot": false,
          "headline": "fix:after compliance applied,the relationship concerning the original…",
          "author_name": "VictorHuu",
          "author_login": "VictorHuu",
          "committed_at": "2025-12-04T20:30:16Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "155738aba72e4f169ce7b5dd24bb0a610c68e565",
          "body": "…4434)\n\nBumps [github.com/github/go-spdx/v2](https://github.com/github/go-spdx) from 2.3.4 to 2.3.5.\n- [Release notes](https://github.com/github/go-spdx/releases)\n- [Commits](https://github.com/github/go-spdx/compare/v2.3.4...v2.3.5)\n\n---\nupdated-dependencies:\n- dependency-name: github.com/github/go\n[…]\nirect:production\n  update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump github.com/github/go-spdx/v2 from 2.3.4 to 2.3.5 (#…",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2025-12-04T18:42:59Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "2b72158b0b333f341db2cca33a415f2ed6a5ce79",
          "body": "Bumps [github.com/spf13/cobra](https://github.com/spf13/cobra) from 1.10.1 to 1.10.2.\n- [Release notes](https://github.com/spf13/cobra/releases)\n- [Commits](https://github.com/spf13/cobra/compare/v1.10.1...v1.10.2)\n\n---\nupdated-dependencies:\n- dependency-name: github.com/spf13/cobra\n  dependency-ver\n[…]\nirect:production\n  update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump github.com/spf13/cobra from 1.10.1 to 1.10.2 (#4435)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2025-12-04T18:42:50Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "a80679beba595ed9f454c9c20bfef2ff4900eb12",
          "body": "Bumps [actions/checkout](https://github.com/actions/checkout) from 6.0.0 to 6.0.1.\n- [Release notes](https://github.com/actions/checkout/releases)\n- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)\n- [Commits](https://github.com/actions/checkout/compare/1af3b93b6815bc44a9784bd\n[…]\nirect:production\n  update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump actions/checkout from 6.0.0 to 6.0.1 (#4431)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2025-12-04T01:18:45Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "b0c74d4104c76dafa25c3494910ed6b743fb54b1",
          "body": "…18 (#4432)\n\nBumps [github.com/gkampitakis/go-snaps](https://github.com/gkampitakis/go-snaps) from 0.5.17 to 0.5.18.\n- [Release notes](https://github.com/gkampitakis/go-snaps/releases)\n- [Commits](https://github.com/gkampitakis/go-snaps/compare/0.5.17...0.5.18)\n\n---\nupdated-dependencies:\n- dependenc\n[…]\nirect:production\n  update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump github.com/gkampitakis/go-snaps from 0.5.17 to 0.5.…",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2025-12-03T18:20:11Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "afe28a2fc0198abe83c350d4de3647d8b73ab318",
          "body": "…(#4421)\n\n---------\nSigned-off-by: Yuntao Hu <victorhu493@gmail.com>\nSigned-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com>\nCo-authored-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com>",
          "is_bot": false,
          "headline": "fix:handle compound aliases like ```.tgz``` when cataloging archives …",
          "author_name": "VictorHuu",
          "author_login": "VictorHuu",
          "committed_at": "2025-12-02T21:55:32Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "d37ed567a821483a00fa414bb46cab038a5bd4ab",
          "body": "Signed-off-by: Will Murphy <willmurphyscode@users.noreply.github.com>",
          "is_bot": false,
          "headline": "chore: use git ls-files instead of find to list files (#4425)",
          "author_name": "Will Murphy",
          "author_login": "willmurphyscode",
          "committed_at": "2025-12-01T21:46:42Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "e556ceb4a8324b2ac143535b19c73ffdc995ae8e",
          "body": "…17 (#4413)\n\nBumps [github.com/gkampitakis/go-snaps](https://github.com/gkampitakis/go-snaps) from 0.5.15 to 0.5.17.\n- [Release notes](https://github.com/gkampitakis/go-snaps/releases)\n- [Commits](https://github.com/gkampitakis/go-snaps/compare/v0.5.15...0.5.17)\n\n---\nupdated-dependencies:\n- dependen\n[…]\nirect:production\n  update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump github.com/gkampitakis/go-snaps from 0.5.15 to 0.5.…",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2025-12-01T21:34:38Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "d8538e7d8b21bc59db417e4dc2753e9e97586418",
          "body": "Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>\nCo-authored-by: spiffcs <32073428+spiffcs@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): update tools to latest versions (#4420)",
          "author_name": "anchore-actions-token-generator[bot]",
          "author_login": "anchore-actions-token-generator[bot]",
          "committed_at": "2025-12-01T21:34:18Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "cd19ac956cc524c32d8637c67b0fe95289d73d74",
          "body": "….2 (#4427)\n\nBumps [github.com/olekukonko/tablewriter](https://github.com/olekukonko/tablewriter) from 1.1.1 to 1.1.2.\n- [Commits](https://github.com/olekukonko/tablewriter/compare/v1.1.1...v1.1.2)\n\n---\nupdated-dependencies:\n- dependency-name: github.com/olekukonko/tablewriter\n  dependency-version: \n[…]\nirect:production\n  update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump github.com/olekukonko/tablewriter from 1.1.1 to 1.1…",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2025-12-01T21:34:07Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "d1a523fef52dbde71b2c0570471becab26daed48",
          "body": "Bumps [github/codeql-action](https://github.com/github/codeql-action) from 4.31.4 to 4.31.6.\n- [Release notes](https://github.com/github/codeql-action/releases)\n- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)\n- [Commits](https://github.com/github/codeql-action/compare/e\n[…]\nirect:production\n  update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump github/codeql-action from 4.31.4 to 4.31.6 (#4424)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2025-12-01T21:34:03Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "e1e3d002bcc5b758e37f1b922bf91e6938c0d255",
          "body": "Bumps [github.com/goccy/go-yaml](https://github.com/goccy/go-yaml) from 1.18.0 to 1.19.0.\n- [Release notes](https://github.com/goccy/go-yaml/releases)\n- [Changelog](https://github.com/goccy/go-yaml/blob/master/CHANGELOG.md)\n- [Commits](https://github.com/goccy/go-yaml/compare/v1.18.0...v1.19.0)\n\n---\n[…]\nirect:production\n  update-type: version-update:semver-minor\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump github.com/goccy/go-yaml from 1.18.0 to 1.19.0 (#4426)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2025-12-01T21:33:48Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "a0f71486080af21fe537096f9b90a954805aec47",
          "body": "Otherwise, we get test failures on macOS if macOS has decided to put\n.DS_Store entries in the test fixtures.\n\nSigned-off-by: Will Murphy <willmurphyscode@users.noreply.github.com>",
          "is_bot": false,
          "headline": "chore: ignore .DS_Store in test fixtures (#4422)",
          "author_name": "Will Murphy",
          "author_login": "willmurphyscode",
          "committed_at": "2025-12-01T15:15:35Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "5b96d1d69d76098778be0f8556d1a63d1050239f",
          "body": "Signed-off-by: Adam Chovanec <git@adamchovanec.cz>\nCo-authored-by: Adam Chovanec <git@adamchovanec.cz>",
          "is_bot": false,
          "headline": "chore: rename test func for CPE decoder (#4379)",
          "author_name": "Adam Chovanec",
          "author_login": "chovanecadam",
          "committed_at": "2025-11-26T04:05:31Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "6c666383e7ee605ef606d96bc7e18fca35876588",
          "body": "Bumps [anchore/sbom-action](https://github.com/anchore/sbom-action) from 0.20.9 to 0.20.10.\n- [Release notes](https://github.com/anchore/sbom-action/releases)\n- [Changelog](https://github.com/anchore/sbom-action/blob/main/RELEASE.md)\n- [Commits](https://github.com/anchore/sbom-action/compare/8e94d75\n[…]\nirect:production\n  update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump anchore/sbom-action from 0.20.9 to 0.20.10 (#4381)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2025-11-26T04:05:05Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "b9710a1e79c73562d64f4f8da703a69e06541c8f",
          "body": "Bumps [modernc.org/sqlite](https://gitlab.com/cznic/sqlite) from 1.40.0 to 1.40.1.\n- [Commits](https://gitlab.com/cznic/sqlite/compare/v1.40.0...v1.40.1)\n\n---\nupdated-dependencies:\n- dependency-name: modernc.org/sqlite\n  dependency-version: 1.40.1\n  dependency-type: direct:production\n  update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump modernc.org/sqlite from 1.40.0 to 1.40.1 (#4382)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2025-11-26T04:04:56Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "023a14f869a97d44d0148e2de5fcacbdbf40e133",
          "body": "Bumps [actions/checkout](https://github.com/actions/checkout) from 5.0.0 to 6.0.0.\n- [Release notes](https://github.com/actions/checkout/releases)\n- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)\n- [Commits](https://github.com/actions/checkout/compare/08c6903cd8c0fde910a37f8\n[…]\nirect:production\n  update-type: version-update:semver-major\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump actions/checkout from 5.0.0 to 6.0.0 (#4396)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2025-11-26T04:03:02Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "439a063d08c7b6bb6d82ffa8a46f7cb93167843f",
          "body": "… (#4397)\n\nBumps [github.com/jedib0t/go-pretty/v6](https://github.com/jedib0t/go-pretty) from 6.7.3 to 6.7.5.\n- [Release notes](https://github.com/jedib0t/go-pretty/releases)\n- [Commits](https://github.com/jedib0t/go-pretty/compare/v6.7.3...v6.7.5)\n\n---\nupdated-dependencies:\n- dependency-name: githu\n[…]\nirect:production\n  update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump github.com/jedib0t/go-pretty/v6 from 6.7.3 to 6.7.5…",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2025-11-25T15:20:59Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "c95893209d7870bcbc7015cc96b840400162db1a",
          "body": "Because package names in METADATA files may have upper case like\nWerkzeug or Jinja2, but Syft artifacts have normalized names and are\nlower case, like werkzeug or jinja2, Syft would miss emitting dependency\nrelationships. Therefore, normalize dependency names before comparing\nwith existing artifacts.\n\nSigned-off-by: Will Murphy <willmurphyscode@users.noreply.github.com>",
          "is_bot": false,
          "headline": "fix: normalize python package names from dependency lists (#4408)",
          "author_name": "Will Murphy",
          "author_login": "willmurphyscode",
          "committed_at": "2025-11-25T15:20:21Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "7e02bdfe45a4418a3842adc32a73537565df7aeb",
          "body": "Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>\nCo-authored-by: spiffcs <32073428+spiffcs@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): update tools to latest versions (#4398)",
          "author_name": "anchore-actions-token-generator[bot]",
          "author_login": "anchore-actions-token-generator[bot]",
          "committed_at": "2025-11-25T15:17:33Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "479cf5aff23b8b13ddd480d0e8082f09c10a3aec",
          "body": "Bumps [github.com/google/go-containerregistry](https://github.com/google/go-containerregistry) from 0.20.6 to 0.20.7.\n- [Release notes](https://github.com/google/go-containerregistry/releases)\n- [Changelog](https://github.com/google/go-containerregistry/blob/main/.goreleaser.yml)\n- [Commits](https:/\n[…]\nirect:production\n  update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump github.com/google/go-containerregistry (#4409)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2025-11-25T15:16:54Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "f12788da786ab83ee383722c8cbc6cdbc753a565",
          "body": "Bumps [github/codeql-action](https://github.com/github/codeql-action) from 4.31.3 to 4.31.4.\n- [Release notes](https://github.com/github/codeql-action/releases)\n- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)\n- [Commits](https://github.com/github/codeql-action/compare/0\n[…]\nirect:production\n  update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump github/codeql-action from 4.31.3 to 4.31.4 (#4386)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2025-11-20T17:40:21Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "67709362b686a08c798ca7caee36792831b0855a",
          "body": "… (#4387)\n\nBumps [github.com/jedib0t/go-pretty/v6](https://github.com/jedib0t/go-pretty) from 6.7.2 to 6.7.3.\n- [Release notes](https://github.com/jedib0t/go-pretty/releases)\n- [Commits](https://github.com/jedib0t/go-pretty/compare/v6.7.2...v6.7.3)\n\n---\nupdated-dependencies:\n- dependency-name: githu\n[…]\nirect:production\n  update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump github.com/jedib0t/go-pretty/v6 from 6.7.2 to 6.7.3…",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2025-11-20T17:01:21Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "55526dbde0a420e418f6c3809b0f10d48fbc331c",
          "body": "Bumps [golang.org/x/crypto](https://github.com/golang/crypto) from 0.44.0 to 0.45.0.\n- [Commits](https://github.com/golang/crypto/compare/v0.44.0...v0.45.0)\n\n---\nupdated-dependencies:\n- dependency-name: golang.org/x/crypto\n  dependency-version: 0.45.0\n  dependency-type: indirect\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump golang.org/x/crypto from 0.44.0 to 0.45.0 (#4391)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2025-11-20T17:01:05Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "af167ba0c127459dfefa6e83779ed6ddd5604ee4",
          "body": "Bumps [actions/setup-go](https://github.com/actions/setup-go) from 6.0.0 to 6.1.0.\n- [Release notes](https://github.com/actions/setup-go/releases)\n- [Commits](https://github.com/actions/setup-go/compare/44694675825211faa026b3c33043df3e48a5fa00...4dc6199c7b1a012772edbd06daecab0f50c9053c)\n\n---\nupdated\n[…]\nirect:production\n  update-type: version-update:semver-minor\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump actions/setup-go from 6.0.0 to 6.1.0 (#4392)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2025-11-20T17:00:56Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "00e1329bd1e47c818fc71c5bbfa936d52f5dfe3f",
          "body": "Bumps [actions/setup-go](https://github.com/actions/setup-go) from 6.0.0 to 6.1.0.\n- [Release notes](https://github.com/actions/setup-go/releases)\n- [Commits](https://github.com/actions/setup-go/compare/44694675825211faa026b3c33043df3e48a5fa00...4dc6199c7b1a012772edbd06daecab0f50c9053c)\n\n---\nupdated\n[…]\nirect:production\n  update-type: version-update:semver-minor\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump actions/setup-go in /.github/actions/bootstrap (#4393)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2025-11-20T17:00:44Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "9aca8167b8530bc951e9570c9f4bb53955dda225",
          "body": "---------\nSigned-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com>",
          "is_bot": false,
          "headline": "chore: drop cpe from gguf (#4383)",
          "author_name": "Christopher Angelo Phillips",
          "author_login": "spiffcs",
          "committed_at": "2025-11-19T10:37:40Z",
          "body_truncated": false,
          "is_coding_agent": false
        }
      ],
      "releases_count": 1,
      "commits_last_year": 293,
      "latest_release_at": "2024-11-20T14:13:53Z",
      "latest_release_tag": "v0.0.0",
      "releases_from_tags": false,
      "days_since_last_push": 196,
      "active_weeks_last_year": 23,
      "days_since_latest_release": 611,
      "mean_days_between_releases": null
    },
    "community": {
      "has_readme": false,
      "has_license": false,
      "has_description": false,
      "has_contributing": false,
      "health_percentage": null,
      "has_issue_template": false,
      "has_code_of_conduct": false,
      "has_pull_request_template": false
    },
    "ecosystem": {
      "packages": [
        {
          "name": "github.com/anchore/syft",
          "exists": true,
          "license": null,
          "keywords": [],
          "ecosystem": "go",
          "matches_repo": false,
          "registry_url": "https://pkg.go.dev/github.com/anchore/syft",
          "is_deprecated": false,
          "latest_version": "v1.49.0",
          "repository_url": "https://github.com/anchore/syft",
          "versions_count": 268,
          "total_downloads": null,
          "dependents_count": null,
          "deprecation_note": null,
          "maintainers_count": null,
          "monthly_downloads": null,
          "first_published_at": null,
          "latest_published_at": "2026-07-20T18:04:57Z",
          "latest_version_yanked": null,
          "days_since_latest_publish": 4
        }
      ]
    },
    "popularity": {
      "forks": 1,
      "stars": 3,
      "watchers": 0,
      "fork_history": {
        "days": [
          {
            "date": "2021-12-13",
            "count": 1
          }
        ],
        "complete": true,
        "collected": 1,
        "total_forks": 1
      },
      "star_history": null,
      "open_issues_and_prs": 0
    },
    "ai_readiness": {
      "has_nix": false,
      "example_dirs": [
        "example",
        "examples",
        "sample"
      ],
      "has_llms_txt": false,
      "has_dockerfile": true,
      "has_mcp_signal": false,
      "bootstrap_files": [
        "Makefile",
        "Taskfile.yaml",
        "cmd/syft/internal/test/integration/test-fixtures/Makefile",
        "schema/cyclonedx/Makefile",
        "syft/file/cataloger/executable/test-fixtures/Makefile",
        "syft/file/cataloger/executable/test-fixtures/elf/Makefile",
        "syft/file/cataloger/executable/test-fixtures/elf/project/Makefile",
        "syft/file/cataloger/executable/test-fixtures/shared-info/Makefile",
        "syft/file/cataloger/executable/test-fixtures/shared-info/project/Makefile",
        "syft/file/cataloger/executable/test-fixtures/shared-info/project/hello/Makefile",
        "syft/file/cataloger/executable/test-fixtures/shared-info/project/libhello/Makefile",
        "syft/pkg/cataloger/binary/test-fixtures/Makefile",
        "syft/pkg/cataloger/binary/test-fixtures/elf-test-fixtures/elfbinwithcorrupt/elfsrc/makefile",
        "syft/pkg/cataloger/binary/test-fixtures/elf-test-fixtures/elfbinwithcorrupt/makefile",
        "syft/pkg/cataloger/binary/test-fixtures/elf-test-fixtures/elfbinwithnestedlib/elfsrc/makefile",
        "syft/pkg/cataloger/binary/test-fixtures/elf-test-fixtures/elfbinwithnestedlib/makefile",
        "syft/pkg/cataloger/binary/test-fixtures/elf-test-fixtures/elfbinwithsisterlib/elfsrc1/makefile",
        "syft/pkg/cataloger/binary/test-fixtures/elf-test-fixtures/elfbinwithsisterlib/elfsrc2/makefile",
        "syft/pkg/cataloger/binary/test-fixtures/elf-test-fixtures/elfbinwithsisterlib/makefile",
        "syft/pkg/cataloger/dotnet/test-fixtures/Makefile",
        "syft/pkg/cataloger/golang/test-fixtures/Makefile",
        "syft/pkg/cataloger/golang/test-fixtures/archs/Makefile",
        "syft/pkg/cataloger/internal/pe/test-fixtures/Makefile",
        "syft/pkg/cataloger/java/test-fixtures/Makefile",
        "syft/pkg/cataloger/java/test-fixtures/jar-metadata/Makefile",
        "syft/pkg/cataloger/java/test-fixtures/java-builds/Makefile",
        "syft/pkg/cataloger/kernel/test-fixtures/Makefile",
        "syft/pkg/cataloger/redhat/test-fixtures/Makefile",
        "test/cli/test-fixtures/Makefile",
        "test/cli/test-fixtures/image-java-spdx-tools/Makefile",
        "test/cli/test-fixtures/registry/Makefile",
        "test/install/Makefile"
      ],
      "api_schema_files": [],
      "has_devcontainer": false,
      "typecheck_configs": [],
      "toolchain_manifests": [
        "cmd/syft/internal/test/integration/test-fixtures/image-go-bin-arch-coverage/go.mod",
        "cmd/syft/internal/test/integration/test-fixtures/image-pkg-coverage/pkgs/go/go.mod",
        "cmd/syft/internal/test/integration/test-fixtures/image-pkg-coverage/pkgs/java/pom.xml",
        "cmd/syft/internal/test/integration/test-fixtures/image-sbom-cataloger/go.mod",
        "go.mod",
        "syft/pkg/cataloger/dotnet/test-fixtures/image-net2-app/src/helloworld.csproj",
        "syft/pkg/cataloger/dotnet/test-fixtures/image-net6-asp-libman/src/LibManSample.csproj",
        "syft/pkg/cataloger/dotnet/test-fixtures/image-net8-app-no-depjson/src/dotnetapp.csproj",
        "syft/pkg/cataloger/dotnet/test-fixtures/image-net8-app-self-contained/src/dotnetapp.csproj",
        "syft/pkg/cataloger/dotnet/test-fixtures/image-net8-app-single-file/src/dotnetapp.csproj",
        "syft/pkg/cataloger/dotnet/test-fixtures/image-net8-app-with-runtime-nodepsjson/src/dotnetapp.csproj",
        "syft/pkg/cataloger/dotnet/test-fixtures/image-net8-app-with-runtime/src/dotnetapp.csproj",
        "syft/pkg/cataloger/dotnet/test-fixtures/image-net8-app/src/dotnetapp.csproj",
        "syft/pkg/cataloger/dotnet/test-fixtures/image-net8-compile-target/src/helloworld.csproj",
        "syft/pkg/cataloger/dotnet/test-fixtures/image-net8-ilrepack/src/dotnetapp.csproj",
        "syft/pkg/cataloger/dotnet/test-fixtures/image-net8-privateassets/src/dotnetapp.csproj",
        "syft/pkg/cataloger/golang/test-fixtures/archs/src/go.mod",
        "syft/pkg/cataloger/golang/test-fixtures/corrupt/go.mod",
        "syft/pkg/cataloger/golang/test-fixtures/glob-paths/src/go.mod",
        "syft/pkg/cataloger/golang/test-fixtures/go-mod-fixtures/many-packages/go.mod",
        "syft/pkg/cataloger/golang/test-fixtures/go-mod-fixtures/one-package/go.mod",
        "syft/pkg/cataloger/golang/test-fixtures/go-mod-fixtures/relative-replace/go.mod",
        "syft/pkg/cataloger/golang/test-fixtures/go-source/go.mod",
        "syft/pkg/cataloger/golang/test-fixtures/go-sum-hashes/go.mod",
        "syft/pkg/cataloger/golang/test-fixtures/image-not-a-module/go.mod",
        "syft/pkg/cataloger/golang/test-fixtures/image-small-upx/go.mod",
        "syft/pkg/cataloger/golang/test-fixtures/image-small/go.mod",
        "syft/pkg/cataloger/internal/pe/test-fixtures/image-dotnet31-single-file/src/hello.csproj",
        "syft/pkg/cataloger/internal/pe/test-fixtures/image-dotnet5-single-file/src/hello.csproj",
        "syft/pkg/cataloger/internal/pe/test-fixtures/image-dotnet6-single-file/src/hello.csproj",
        "syft/pkg/cataloger/java/internal/maven/test-fixtures/local/child-1/pom.xml",
        "syft/pkg/cataloger/java/internal/maven/test-fixtures/local/child-2/pom.xml",
        "syft/pkg/cataloger/java/internal/maven/test-fixtures/local/child-3/pom.xml",
        "syft/pkg/cataloger/java/internal/maven/test-fixtures/local/circular-1/pom.xml",
        "syft/pkg/cataloger/java/internal/maven/test-fixtures/local/circular-2/pom.xml",
        "syft/pkg/cataloger/java/internal/maven/test-fixtures/local/contains-child-1/pom.xml",
        "syft/pkg/cataloger/java/internal/maven/test-fixtures/local/parent-1/pom.xml",
        "syft/pkg/cataloger/java/internal/maven/test-fixtures/local/parent-2/pom.xml",
        "syft/pkg/cataloger/java/internal/maven/test-fixtures/local/parent-3/pom.xml",
        "syft/pkg/cataloger/java/test-fixtures/corrupt/pom.xml",
        "syft/pkg/cataloger/java/test-fixtures/glob-paths/src/pom.xml",
        "syft/pkg/cataloger/java/test-fixtures/gradle/build.gradle",
        "syft/pkg/cataloger/java/test-fixtures/jar-metadata/api-all-2.0.0-sources/META-INF/maven/org.apache.directory.api/api-all/pom.xml",
        "syft/pkg/cataloger/java/test-fixtures/jar-metadata/api-all-2.0.0-sources/META-INF/maven/org.apache.directory.api/api-asn1-api/pom.xml",
        "syft/pkg/cataloger/java/test-fixtures/jar-metadata/com.fasterxml.jackson.core.jackson-core-2.15.2/META-INF/maven/com.fasterxml.jackson.core/jackson-core/pom.xml",
        "syft/pkg/cataloger/java/test-fixtures/jar-metadata/commons-lang3-3.12.0/META-INF/maven/org.apache.commons-lang3/pom.xml",
        "syft/pkg/cataloger/java/test-fixtures/jar-metadata/jackson-core-2.15.2/META-INF/maven/com.fasterxml.jackson.core/jackson-core/pom.xml",
        "syft/pkg/cataloger/java/test-fixtures/jar-metadata/micronaut-aop-4.9.11/META-INF/maven/io.micronaut/micronaut-aop/pom.xml",
        "syft/pkg/cataloger/java/test-fixtures/jar-metadata/multiple-matching-2.11.5/META-INF/maven/org.multiple/multiple-matching-1/pom.xml",
        "syft/pkg/cataloger/java/test-fixtures/jar-metadata/multiple-matching-2.11.5/META-INF/maven/org.multiple/multiple-matching-2/pom.xml",
        "syft/pkg/cataloger/java/test-fixtures/jar-metadata/multiple-matching-2.11.5/META-INF/maven/org.multiple/multiple-matching-3/pom.xml",
        "syft/pkg/cataloger/java/test-fixtures/jar-metadata/opensaml-core-3.4.6/META-INF/maven/org.opensaml/opensaml-core/pom.xml",
        "syft/pkg/cataloger/java/test-fixtures/jar-metadata/org.multiple-thename/META-INF/maven/com.multiple/thename/pom.xml",
        "syft/pkg/cataloger/java/test-fixtures/jar-metadata/org.multiple-thename/META-INF/maven/org.multiple/thename/pom.xml",
        "syft/pkg/cataloger/java/test-fixtures/java-builds/example-java-app/build.gradle",
        "syft/pkg/cataloger/java/test-fixtures/java-builds/example-java-app/pom.xml",
        "syft/pkg/cataloger/java/test-fixtures/java-builds/example-jenkins-plugin/pom.xml",
        "syft/pkg/cataloger/java/test-fixtures/java-builds/example-sb-app/pom.xml",
        "syft/pkg/cataloger/java/test-fixtures/pom/commons-text-1.10.0/pom.xml",
        "syft/pkg/cataloger/java/test-fixtures/pom/example-java-app-maven/pom.xml",
        "syft/pkg/cataloger/java/test-fixtures/pom/transitive-top-level/pom.xml",
        "syft/pkg/cataloger/rust/test-fixtures/image-audit/Cargo.toml"
      ],
      "largest_source_bytes": 212636,
      "source_files_sampled": 1181,
      "oversized_source_files": 6,
      "agent_instruction_files": [],
      "agent_instruction_max_bytes": null
    },
    "dependencies": {
      "manifests": [
        "go.mod"
      ],
      "advisories": {
        "error": null,
        "scope": "repository_graph",
        "source": "osv",
        "findings": [
          {
            "name": "golang.org/x/crypto",
            "direct": false,
            "version": "v0.46.0",
            "severity": "critical",
            "ecosystem": "go",
            "cvss_score": 10,
            "advisory_ids": [
              "GHSA-45gg-vh54-h5m9",
              "GHSA-5cgq-3rg8-m6cv",
              "GHSA-78mq-xcr3-xm33",
              "GHSA-89gr-r52h-f8rx",
              "GHSA-9m57-25v3-79x9",
              "GHSA-f5wc-c3c7-36mc",
              "GHSA-jppx-rxg9-jmrx",
              "GHSA-q4h4-gmj2-qvw2",
              "GHSA-qpw4-5x99-6vjp",
              "GHSA-rm3j-f69w-wqmq"
            ],
            "fixed_version": "0.52.0",
            "advisory_count": 27,
            "oldest_advisory_days": 64
          },
          {
            "name": "google.golang.org/grpc",
            "direct": false,
            "version": "v1.76.0",
            "severity": "critical",
            "ecosystem": "go",
            "cvss_score": 9.1,
            "advisory_ids": [
              "GHSA-hrxh-6v49-42gf",
              "GHSA-p77j-4mvh-x3m3",
              "GO-2026-4762"
            ],
            "fixed_version": "1.82.1",
            "advisory_count": 3,
            "oldest_advisory_days": 128
          },
          {
            "name": "h11",
            "direct": false,
            "version": "0.14.0",
            "severity": "critical",
            "ecosystem": "pypi",
            "cvss_score": 9.1,
            "advisory_ids": [
              "GHSA-vqfr-h8mv-ghfj",
              "PYSEC-2026-348"
            ],
            "fixed_version": "0.16.0",
            "advisory_count": 2,
            "oldest_advisory_days": 456
          },
          {
            "name": "pygments",
            "direct": false,
            "version": "1.6",
            "severity": "critical",
            "ecosystem": "pypi",
            "cvss_score": 9.8,
            "advisory_ids": [
              "GHSA-5239-wwwm-4pmq",
              "GHSA-9w8r-397f-prfh",
              "GHSA-fff8-4w9p-7v76",
              "GHSA-mrwq-x4v8-fh7p",
              "GHSA-pq64-v7f5-gqh8",
              "PYSEC-2016-32",
              "PYSEC-2021-140",
              "PYSEC-2021-141",
              "PYSEC-2023-117",
              "PYSEC-2026-2987"
            ],
            "fixed_version": "2.20.0",
            "advisory_count": 10,
            "oldest_advisory_days": 3850
          },
          {
            "name": "github.com/go-git/go-billy/v5",
            "direct": true,
            "version": "v5.7.0",
            "severity": "high",
            "ecosystem": "go",
            "cvss_score": 8.1,
            "advisory_ids": [
              "GHSA-m3xc-h892-ggx6",
              "GHSA-qw64-3x98-g7q2",
              "GO-2026-5490",
              "GO-2026-5597"
            ],
            "fixed_version": "6.0.0-alpha.1",
            "advisory_count": 4,
            "oldest_advisory_days": 72
          },
          {
            "name": "github.com/hashicorp/go-getter",
            "direct": true,
            "version": "v1.8.4",
            "severity": "high",
            "ecosystem": "go",
            "cvss_score": 7.5,
            "advisory_ids": [
              "GHSA-92mm-2pjq-r785",
              "GO-2026-5058"
            ],
            "fixed_version": "1.8.6",
            "advisory_count": 2,
            "oldest_advisory_days": 106
          },
          {
            "name": "aws-sdk",
            "direct": false,
            "version": "2.706.0",
            "severity": "high",
            "ecosystem": "npm",
            "cvss_score": 7.3,
            "advisory_ids": [
              "GHSA-j965-2qgj-vjmq",
              "GHSA-rrc9-gqf8-8rwg"
            ],
            "fixed_version": "2.814.0",
            "advisory_count": 2,
            "oldest_advisory_days": 1711
          },
          {
            "name": "brotli",
            "direct": false,
            "version": "1.1.0",
            "severity": "high",
            "ecosystem": "pypi",
            "cvss_score": 7.5,
            "advisory_ids": [
              "GHSA-2qfp-q593-8484",
              "PYSEC-2026-2401"
            ],
            "fixed_version": "2.13.4",
            "advisory_count": 2,
            "oldest_advisory_days": 267
          },
          {
            "name": "click",
            "direct": false,
            "version": "7.1.2",
            "severity": "high",
            "ecosystem": "pypi",
            "cvss_score": 7.2,
            "advisory_ids": [
              "PYSEC-2026-2132"
            ],
            "fixed_version": "8.3.3",
            "advisory_count": 1,
            "oldest_advisory_days": 85
          },
          {
            "name": "click",
            "direct": false,
            "version": "8.1.8",
            "severity": "high",
            "ecosystem": "pypi",
            "cvss_score": 7.2,
            "advisory_ids": [
              "PYSEC-2026-2132"
            ],
            "fixed_version": "8.3.3",
            "advisory_count": 1,
            "oldest_advisory_days": 85
          },
          {
            "name": "github.com/buger/jsonparser",
            "direct": false,
            "version": "v1.1.1",
            "severity": "high",
            "ecosystem": "go",
            "cvss_score": 7.5,
            "advisory_ids": [
              "GHSA-6g7g-w4f8-9c9x",
              "GO-2026-4514"
            ],
            "fixed_version": "1.1.2",
            "advisory_count": 2,
            "oldest_advisory_days": 130
          },
          {
            "name": "github.com/containerd/containerd",
            "direct": false,
            "version": "v1.7.30",
            "severity": "high",
            "ecosystem": "go",
            "cvss_score": 8.8,
            "advisory_ids": [
              "GHSA-fqw6-gf59-qr4w",
              "GHSA-jpcc-p29g-p8mq",
              "GHSA-xhf5-7wjv-pqxp",
              "GO-2026-5064",
              "GO-2026-5338",
              "GO-2026-5378",
              "GO-2026-5475",
              "GO-2026-5622",
              "GO-2026-5758"
            ],
            "fixed_version": "2.3.2",
            "advisory_count": 9,
            "oldest_advisory_days": 64
          },
          {
            "name": "github.com/docker/cli",
            "direct": false,
            "version": "v29.1.3+incompatible",
            "severity": "high",
            "ecosystem": "go",
            "cvss_score": null,
            "advisory_ids": [
              "GHSA-p436-gjf2-799p",
              "GO-2026-4610"
            ],
            "fixed_version": "29.2.0+incompatible",
            "advisory_count": 2,
            "oldest_advisory_days": 142
          },
          {
            "name": "github.com/docker/docker",
            "direct": false,
            "version": "v28.5.2+incompatible",
            "severity": "high",
            "ecosystem": "go",
            "cvss_score": 8.8,
            "advisory_ids": [
              "GHSA-pxq6-2prw-chj9",
              "GHSA-rg2x-37c3-w2rh",
              "GHSA-vp62-88p7-qqf5",
              "GHSA-x744-4wpc-v9h2",
              "GHSA-x86f-5xw2-fm2r",
              "GO-2026-4883",
              "GO-2026-4887",
              "GO-2026-5617",
              "GO-2026-5668",
              "GO-2026-5746"
            ],
            "fixed_version": "29.3.1",
            "advisory_count": 10,
            "oldest_advisory_days": 119
          },
          {
            "name": "github.com/go-jose/go-jose/v4",
            "direct": false,
            "version": "v4.1.2",
            "severity": "high",
            "ecosystem": "go",
            "cvss_score": 7.5,
            "advisory_ids": [
              "GHSA-78h2-9frx-2jm8",
              "GO-2026-4945"
            ],
            "fixed_version": "4.1.4",
            "advisory_count": 2,
            "oldest_advisory_days": 113
          },
          {
            "name": "go.opentelemetry.io/otel",
            "direct": false,
            "version": "v1.39.0",
            "severity": "high",
            "ecosystem": "go",
            "cvss_score": 7.5,
            "advisory_ids": [
              "GHSA-mh2q-q3fh-2475",
              "GO-2026-5506"
            ],
            "fixed_version": "1.41.0",
            "advisory_count": 2,
            "oldest_advisory_days": 108
          },
          {
            "name": "go.opentelemetry.io/otel/sdk",
            "direct": false,
            "version": "v1.39.0",
            "severity": "high",
            "ecosystem": "go",
            "cvss_score": 7,
            "advisory_ids": [
              "GHSA-9h8m-3fm2-qjrq",
              "GHSA-hfvc-g4fc-pqhx",
              "GO-2026-4394",
              "GO-2026-5426"
            ],
            "fixed_version": "1.43.0",
            "advisory_count": 4,
            "oldest_advisory_days": 172
          },
          {
            "name": "orjson",
            "direct": false,
            "version": "3.10.16",
            "severity": "high",
            "ecosystem": "pypi",
            "cvss_score": 7.5,
            "advisory_ids": [
              "GHSA-hx9q-6w63-j58v",
              "PYSEC-2026-107"
            ],
            "fixed_version": "3.11.6",
            "advisory_count": 2,
            "oldest_advisory_days": 183
          },
          {
            "name": "python-multipart",
            "direct": false,
            "version": "0.0.20",
            "severity": "high",
            "ecosystem": "pypi",
            "cvss_score": 8.6,
            "advisory_ids": [
              "GHSA-5rvq-cxj2-64vf",
              "GHSA-6jv3-5f52-599m",
              "GHSA-mj87-hwqh-73pj",
              "GHSA-pp6c-gr5w-3c5g",
              "GHSA-v9pg-7xvm-68hf",
              "GHSA-vffw-93wf-4j4q",
              "GHSA-wp53-j4wj-2cfg",
              "PYSEC-2026-1852",
              "PYSEC-2026-3036",
              "PYSEC-2026-3037"
            ],
            "fixed_version": "0.0.31",
            "advisory_count": 14,
            "oldest_advisory_days": 179
          },
          {
            "name": "starlette",
            "direct": false,
            "version": "0.37.2",
            "severity": "high",
            "ecosystem": "pypi",
            "cvss_score": 7.5,
            "advisory_ids": [
              "GHSA-2c2j-9gv5-cj73",
              "GHSA-82w8-qh3p-5jfq",
              "GHSA-86qp-5c8j-p5mr",
              "GHSA-f96h-pmfr-66vw",
              "GHSA-jp82-jpqv-5vv3",
              "GHSA-wqp7-x3pw-xc5r",
              "GHSA-x746-7m8f-x49c",
              "PYSEC-2026-161",
              "PYSEC-2026-1941",
              "PYSEC-2026-1943"
            ],
            "fixed_version": "1.3.1",
            "advisory_count": 14,
            "oldest_advisory_days": 647
          },
          {
            "name": "ujson",
            "direct": false,
            "version": "5.10.0",
            "severity": "high",
            "ecosystem": "pypi",
            "cvss_score": 7.5,
            "advisory_ids": [
              "GHSA-3j69-69wj-xqx2",
              "GHSA-c38f-wx89-p2xg",
              "GHSA-c8rr-9gxc-jprv",
              "GHSA-wgvc-ghv9-3pmm",
              "PYSEC-2026-2291",
              "PYSEC-2026-2292",
              "PYSEC-2026-2293",
              "PYSEC-2026-2294"
            ],
            "fixed_version": "5.13.0",
            "advisory_count": 8,
            "oldest_advisory_days": 128
          },
          {
            "name": "urllib3",
            "direct": false,
            "version": "2.3.0",
            "severity": "high",
            "ecosystem": "pypi",
            "cvss_score": 7.5,
            "advisory_ids": [
              "GHSA-2xpw-w6gg-jr37",
              "GHSA-38jv-5279-wg99",
              "GHSA-48p4-8xcf-vxj5",
              "GHSA-gm62-xv2j-4w53",
              "GHSA-pq67-6m6q-mj2v",
              "GHSA-qccp-gfcp-xxvc",
              "PYSEC-2026-141",
              "PYSEC-2026-1994",
              "PYSEC-2026-1996",
              "PYSEC-2026-1997"
            ],
            "fixed_version": "2.7.0",
            "advisory_count": 12,
            "oldest_advisory_days": 401
          },
          {
            "name": "github.com/anchore/stereoscope",
            "direct": true,
            "version": "v0.0.0-20200706164556-7cf39d7f4639",
            "severity": "moderate",
            "ecosystem": "go",
            "cvss_score": 5.3,
            "advisory_ids": [
              "GHSA-hpxr-w9w7-g4gv",
              "GO-2024-2490"
            ],
            "fixed_version": "0.0.1",
            "advisory_count": 2,
            "oldest_advisory_days": 905
          },
          {
            "name": "github.com/go-git/go-git/v5",
            "direct": true,
            "version": "v5.16.4",
            "severity": "moderate",
            "ecosystem": "go",
            "cvss_score": 6.5,
            "advisory_ids": [
              "GHSA-37cx-329c-33x3",
              "GHSA-389r-gv7p-r3rp",
              "GHSA-3xc5-wrhm-f963",
              "GHSA-crhj-59gh-8x96",
              "GHSA-gm2x-2g9h-ccm8",
              "GHSA-jhf3-xxhw-2wpp",
              "GHSA-m7cr-m3pv-hgrp",
              "GHSA-w5pp-99ch-qj29",
              "GO-2026-4473",
              "GO-2026-4909"
            ],
            "fixed_version": "6.0.0-alpha.4",
            "advisory_count": 16,
            "oldest_advisory_days": 165
          },
          {
            "name": "github.com/go-viper/mapstructure/v2",
            "direct": true,
            "version": "v2.2.1",
            "severity": "moderate",
            "ecosystem": "go",
            "cvss_score": 5.3,
            "advisory_ids": [
              "GHSA-2464-8j7c-4cjm",
              "GHSA-fv92-fjc5-jj9h",
              "GO-2025-3787",
              "GO-2025-3900"
            ],
            "fixed_version": "2.4.0",
            "advisory_count": 4,
            "oldest_advisory_days": 392
          },
          {
            "name": "github.com/ulikunitz/xz",
            "direct": true,
            "version": "v0.5.12",
            "severity": "moderate",
            "ecosystem": "go",
            "cvss_score": 5.3,
            "advisory_ids": [
              "GHSA-jc7w-c686-c4v9",
              "GO-2025-3922"
            ],
            "fixed_version": "0.5.15",
            "advisory_count": 2,
            "oldest_advisory_days": 330
          },
          {
            "name": "golang.org/x/net",
            "direct": true,
            "version": "v0.48.0",
            "severity": "moderate",
            "ecosystem": "go",
            "cvss_score": 6.5,
            "advisory_ids": [
              "GHSA-5cv4-jp36-h3mw",
              "GO-2026-4918",
              "GO-2026-5025",
              "GO-2026-5026",
              "GO-2026-5027",
              "GO-2026-5028",
              "GO-2026-5029",
              "GO-2026-5030",
              "GO-2026-5942"
            ],
            "fixed_version": "1.26.3",
            "advisory_count": 9,
            "oldest_advisory_days": 78
          },
          {
            "name": "ajv",
            "direct": false,
            "version": "6.12.3",
            "severity": "moderate",
            "ecosystem": "npm",
            "cvss_score": 5.3,
            "advisory_ids": [
              "GHSA-2g4f-4pwh-qvx6"
            ],
            "fixed_version": "8.18.0",
            "advisory_count": 1,
            "oldest_advisory_days": 163
          },
          {
            "name": "github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream",
            "direct": false,
            "version": "v1.7.4",
            "severity": "moderate",
            "ecosystem": "go",
            "cvss_score": 5.9,
            "advisory_ids": [
              "GHSA-xmrv-pmrh-hhx2",
              "GO-2026-5764"
            ],
            "fixed_version": "1.97.3",
            "advisory_count": 2,
            "oldest_advisory_days": 108
          },
          {
            "name": "github.com/aws/aws-sdk-go-v2/service/s3",
            "direct": false,
            "version": "v1.95.0",
            "severity": "moderate",
            "ecosystem": "go",
            "cvss_score": 5.9,
            "advisory_ids": [
              "GHSA-xmrv-pmrh-hhx2",
              "GO-2026-5764"
            ],
            "fixed_version": "1.97.3",
            "advisory_count": 2,
            "oldest_advisory_days": 108
          },
          {
            "name": "github.com/cloudflare/circl",
            "direct": false,
            "version": "v1.6.1",
            "severity": "moderate",
            "ecosystem": "go",
            "cvss_score": 5.6,
            "advisory_ids": [
              "GHSA-q9hv-hpm4-hj6x",
              "GO-2026-4550"
            ],
            "fixed_version": "1.6.3",
            "advisory_count": 2,
            "oldest_advisory_days": 149
          },
          {
            "name": "github.com/nwaples/rardecode",
            "direct": false,
            "version": "v1.1.3",
            "severity": "moderate",
            "ecosystem": "go",
            "cvss_score": 5.3,
            "advisory_ids": [
              "GHSA-rwvp-r38j-9rgg",
              "GO-2025-4020"
            ],
            "fixed_version": "2.2.0",
            "advisory_count": 2,
            "oldest_advisory_days": 287
          },
          {
            "name": "idna",
            "direct": false,
            "version": "3.10",
            "severity": "moderate",
            "ecosystem": "pypi",
            "cvss_score": 5.3,
            "advisory_ids": [
              "GHSA-65pc-fj4g-8rjx",
              "PYSEC-2026-215"
            ],
            "fixed_version": "3.15",
            "advisory_count": 2,
            "oldest_advisory_days": 66
          },
          {
            "name": "nanoid",
            "direct": false,
            "version": "3.3.4",
            "severity": "moderate",
            "ecosystem": "npm",
            "cvss_score": 4.3,
            "advisory_ids": [
              "GHSA-mwcw-c2x4-8c55"
            ],
            "fixed_version": "5.0.9",
            "advisory_count": 1,
            "oldest_advisory_days": 593
          },
          {
            "name": "python-dotenv",
            "direct": false,
            "version": "1.1.0",
            "severity": "moderate",
            "ecosystem": "pypi",
            "cvss_score": 6.6,
            "advisory_ids": [
              "GHSA-mf9w-mj56-hr94",
              "PYSEC-2026-2270"
            ],
            "fixed_version": "1.2.2",
            "advisory_count": 2,
            "oldest_advisory_days": 95
          },
          {
            "name": "requests",
            "direct": false,
            "version": "2.32.3",
            "severity": "moderate",
            "ecosystem": "pypi",
            "cvss_score": 5.5,
            "advisory_ids": [
              "GHSA-9hjg-9r4m-mvj7",
              "GHSA-gc5v-m9x4-r6x2",
              "PYSEC-2026-1872",
              "PYSEC-2026-2275"
            ],
            "fixed_version": "2.33.0",
            "advisory_count": 4,
            "oldest_advisory_days": 410
          },
          {
            "name": "h2",
            "direct": false,
            "version": "4.2.0",
            "severity": "low",
            "ecosystem": "pypi",
            "cvss_score": 0,
            "advisory_ids": [
              "GHSA-847f-9342-265h",
              "PYSEC-2026-1435"
            ],
            "fixed_version": "4.3.0",
            "advisory_count": 2,
            "oldest_advisory_days": 333
          },
          {
            "name": "merge-objects",
            "direct": false,
            "version": "1.0.5",
            "severity": "low",
            "ecosystem": "npm",
            "cvss_score": null,
            "advisory_ids": [
              "GHSA-992f-wf4w-x36v"
            ],
            "fixed_version": null,
            "advisory_count": 1,
            "oldest_advisory_days": 2152
          },
          {
            "name": "pygments",
            "direct": false,
            "version": "2.19.1",
            "severity": "low",
            "ecosystem": "pypi",
            "cvss_score": 3.3,
            "advisory_ids": [
              "GHSA-5239-wwwm-4pmq",
              "PYSEC-2026-2987"
            ],
            "fixed_version": "2.20.0",
            "advisory_count": 2,
            "oldest_advisory_days": 125
          },
          {
            "name": "golang.org/x/sys",
            "direct": false,
            "version": "v0.33.0",
            "severity": "unknown",
            "ecosystem": "go",
            "cvss_score": null,
            "advisory_ids": [
              "GO-2026-5024"
            ],
            "fixed_version": "0.44.0",
            "advisory_count": 1,
            "oldest_advisory_days": 63
          },
          {
            "name": "golang.org/x/sys",
            "direct": false,
            "version": "v0.39.0",
            "severity": "unknown",
            "ecosystem": "go",
            "cvss_score": null,
            "advisory_ids": [
              "GO-2026-5024"
            ],
            "fixed_version": "0.44.0",
            "advisory_count": 1,
            "oldest_advisory_days": 63
          },
          {
            "name": "golang.org/x/text",
            "direct": false,
            "version": "v0.21.0",
            "severity": "unknown",
            "ecosystem": "go",
            "cvss_score": null,
            "advisory_ids": [
              "GO-2026-5970"
            ],
            "fixed_version": "0.39.0",
            "advisory_count": 1,
            "oldest_advisory_days": 10
          },
          {
            "name": "golang.org/x/text",
            "direct": false,
            "version": "v0.32.0",
            "severity": "unknown",
            "ecosystem": "go",
            "cvss_score": null,
            "advisory_ids": [
              "GO-2026-5970"
            ],
            "fixed_version": "0.39.0",
            "advisory_count": 1,
            "oldest_advisory_days": 10
          }
        ],
        "collected": true,
        "malicious": [],
        "truncated": false,
        "by_severity": {
          "low": 3,
          "high": 18,
          "unknown": 4,
          "critical": 4,
          "moderate": 14
        },
        "advisory_count": 195,
        "affected_count": 43,
        "assessed_count": 428,
        "malicious_count": 0,
        "assessed_package": null,
        "unassessed_count": 1,
        "direct_affected_count": 7
      },
      "ecosystems": [
        "go"
      ],
      "dependencies": [
        {
          "name": "github.com/BurntSushi/toml",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.6.0"
        },
        {
          "name": "github.com/CycloneDX/cyclonedx-go",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.9.3"
        },
        {
          "name": "github.com/Masterminds/semver/v3",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v3.4.0"
        },
        {
          "name": "github.com/Masterminds/sprig/v3",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v3.3.0"
        },
        {
          "name": "github.com/OneOfOne/xxhash",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.2.8"
        },
        {
          "name": "github.com/acarl005/stripansi",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.0.0-20180116102854-5a71ef0e047d"
        },
        {
          "name": "github.com/acobaugh/osrelease",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.1.0"
        },
        {
          "name": "github.com/adrg/xdg",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.5.3"
        },
        {
          "name": "github.com/anchore/bubbly",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.0.0-20231115134915-def0aba654a9"
        },
        {
          "name": "github.com/anchore/clio",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.0.0-20250319180342-2cfe4b0cb716"
        },
        {
          "name": "github.com/anchore/fangs",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.0.0-20250319222917-446a1e748ec2"
        },
        {
          "name": "github.com/anchore/go-collections",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.0.0-20251016125210-a3c352120e8c"
        },
        {
          "name": "github.com/anchore/go-homedir",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.0.0-20250319154043-c29668562e4d"
        },
        {
          "name": "github.com/anchore/go-logger",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.0.0-20250318195838-07ae343dd722"
        },
        {
          "name": "github.com/anchore/go-macholibre",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.0.0-20220308212642-53e6d0aaf6fb"
        },
        {
          "name": "github.com/anchore/go-rpmdb",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.0.0-20250516171929-f77691e1faec"
        },
        {
          "name": "github.com/anchore/go-sync",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.0.0-20250326131806-4eda43a485b6"
        },
        {
          "name": "github.com/anchore/go-testutils",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.0.0-20200925183923-d5f45b0d3c04"
        },
        {
          "name": "github.com/anchore/go-version",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.2.2-0.20200701162849-18adb9c92b9b"
        },
        {
          "name": "github.com/anchore/packageurl-go",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.1.1-0.20250220190351-d62adb6e1115"
        },
        {
          "name": "github.com/anchore/stereoscope",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.1.17"
        },
        {
          "name": "github.com/anmitsu/go-shlex",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.0.0-20200514113438-38f4b401e2be"
        },
        {
          "name": "github.com/aquasecurity/go-pep440-version",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.0.1"
        },
        {
          "name": "github.com/bitnami/go-version",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.0.0-20250131085805-b1f57a8634ef"
        },
        {
          "name": "github.com/blakesmith/ar",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.0.0-20190502131153-809d4375e1fb"
        },
        {
          "name": "github.com/bmatcuk/doublestar/v4",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v4.9.1"
        },
        {
          "name": "github.com/charmbracelet/bubbles",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.21.0"
        },
        {
          "name": "github.com/charmbracelet/bubbletea",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.3.10"
        },
        {
          "name": "github.com/charmbracelet/lipgloss",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.1.0"
        },
        {
          "name": "github.com/dave/jennifer",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.7.1"
        },
        {
          "name": "github.com/deitch/magic",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.0.0-20230404182410-1ff89d7342da"
        },
        {
          "name": "github.com/diskfs/go-diskfs",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.7.0"
        },
        {
          "name": "github.com/distribution/reference",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.6.0"
        },
        {
          "name": "github.com/dustin/go-humanize",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.0.1"
        },
        {
          "name": "github.com/elliotchance/phpserialize",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.4.0"
        },
        {
          "name": "github.com/facebookincubator/nvdtools",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.1.5"
        },
        {
          "name": "github.com/github/go-spdx/v2",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v2.3.5"
        },
        {
          "name": "github.com/gkampitakis/go-snaps",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.5.19"
        },
        {
          "name": "github.com/go-git/go-billy/v5",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v5.7.0"
        },
        {
          "name": "github.com/go-git/go-git/v5",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v5.16.4"
        },
        {
          "name": "github.com/go-test/deep",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.1.1"
        },
        {
          "name": "github.com/go-viper/mapstructure/v2",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v2.4.0"
        },
        {
          "name": "github.com/gohugoio/hashstructure",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.6.0"
        },
        {
          "name": "github.com/google/go-cmp",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.7.0"
        },
        {
          "name": "github.com/google/go-containerregistry",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.20.7"
        },
        {
          "name": "github.com/google/licensecheck",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.3.1"
        },
        {
          "name": "github.com/google/uuid",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.6.0"
        },
        {
          "name": "github.com/gookit/color",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.6.0"
        },
        {
          "name": "github.com/hashicorp/go-cleanhttp",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.5.2"
        },
        {
          "name": "github.com/hashicorp/go-getter",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.8.4"
        },
        {
          "name": "github.com/hashicorp/go-multierror",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.1.1"
        },
        {
          "name": "github.com/hashicorp/hcl/v2",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v2.24.0"
        },
        {
          "name": "github.com/iancoleman/strcase",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.3.0"
        },
        {
          "name": "github.com/invopop/jsonschema",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.13.0"
        },
        {
          "name": "github.com/jedib0t/go-pretty/v6",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v6.7.8"
        },
        {
          "name": "github.com/jinzhu/copier",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.4.0"
        },
        {
          "name": "github.com/kastenhq/goversion",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.0.0-20230811215019-93b2f8823953"
        },
        {
          "name": "github.com/magiconair/properties",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.8.10"
        },
        {
          "name": "github.com/mholt/archives",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.1.5"
        },
        {
          "name": "github.com/moby/sys/mountinfo",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.7.2"
        },
        {
          "name": "github.com/nix-community/go-nix",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.0.0-20250101154619-4bdde671e0a1"
        },
        {
          "name": "github.com/olekukonko/tablewriter",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.1.2"
        },
        {
          "name": "github.com/opencontainers/go-digest",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.0.0"
        },
        {
          "name": "github.com/pelletier/go-toml",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.9.5"
        },
        {
          "name": "github.com/quasilyte/go-ruleguard/dsl",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.3.23"
        },
        {
          "name": "github.com/rust-secure-code/go-rustaudit",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.0.0-20250226111315-e20ec32e963c"
        },
        {
          "name": "github.com/saintfish/chardet",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.0.0-20230101081208-5e3ef4b5456d"
        },
        {
          "name": "github.com/sanity-io/litter",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.5.8"
        },
        {
          "name": "github.com/sassoftware/go-rpmutils",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.4.0"
        },
        {
          "name": "github.com/scylladb/go-set",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.0.3-0.20200225121959-cc7b2070d91e"
        },
        {
          "name": "github.com/sergi/go-diff",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.4.0"
        },
        {
          "name": "github.com/spdx/gordf",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.0.0-20201111095634-7098f93598fb"
        },
        {
          "name": "github.com/spdx/tools-golang",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.5.6"
        },
        {
          "name": "github.com/spf13/afero",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.15.0"
        },
        {
          "name": "github.com/spf13/cobra",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.10.2"
        },
        {
          "name": "github.com/stretchr/testify",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.11.1"
        },
        {
          "name": "github.com/vbatts/go-mtree",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.7.0"
        },
        {
          "name": "github.com/vifraa/gopom",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.0.0"
        },
        {
          "name": "github.com/wagoodman/go-partybus",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.0.0-20230516145632-8ccac152c651"
        },
        {
          "name": "github.com/wagoodman/go-progress",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.0.0-20230925121702-07e42b3cdba0"
        },
        {
          "name": "github.com/xeipuuv/gojsonschema",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.2.0"
        },
        {
          "name": "github.com/zyedidia/generic",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.2.2-0.20230320175451-4410d2372cb1"
        },
        {
          "name": "go.uber.org/goleak",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.3.0"
        },
        {
          "name": "go.yaml.in/yaml/v3",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v3.0.4"
        },
        {
          "name": "golang.org/x/exp",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.0.0-20250620022241-b7579e27df2b"
        },
        {
          "name": "golang.org/x/mod",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.31.0"
        },
        {
          "name": "golang.org/x/net",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.48.0"
        },
        {
          "name": "modernc.org/sqlite",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.43.0"
        },
        {
          "name": "github.com/goccy/go-yaml",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.19.2"
        },
        {
          "name": "github.com/ulikunitz/xz",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.5.15"
        },
        {
          "name": "golang.org/x/time",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.14.0"
        },
        {
          "name": "golang.org/x/tools",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.40.0"
        },
        {
          "name": "gopkg.in/yaml.v3",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v3.0.1"
        },
        {
          "name": "github.com/cespare/xxhash/v2",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v2.3.0"
        },
        {
          "name": "github.com/gpustack/gguf-parser-go",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.23.1"
        },
        {
          "name": "github.com/wk8/go-ordered-map/v2",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v2.1.8"
        }
      ],
      "all_dependencies": {
        "error": null,
        "source": "github-sbom",
        "packages": [
          {
            "name": "github.com/acarl005/stripansi",
            "direct": true,
            "version": "v0.0.0-20180116102854-5a71ef0e047d",
            "ecosystem": "go"
          },
          {
            "name": "github.com/acobaugh/osrelease",
            "direct": true,
            "version": "v0.1.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/adrg/xdg",
            "direct": true,
            "version": "v0.2.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/adrg/xdg",
            "direct": true,
            "version": "v0.5.3",
            "ecosystem": "go"
          },
          {
            "name": "github.com/anchore/bubbly",
            "direct": true,
            "version": "v0.0.0-20231115134915-def0aba654a9",
            "ecosystem": "go"
          },
          {
            "name": "github.com/anchore/clio",
            "direct": true,
            "version": "v0.0.0-20250319180342-2cfe4b0cb716",
            "ecosystem": "go"
          },
          {
            "name": "github.com/anchore/fangs",
            "direct": true,
            "version": "v0.0.0-20250319222917-446a1e748ec2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/anchore/go-collections",
            "direct": true,
            "version": "v0.0.0-20251016125210-a3c352120e8c",
            "ecosystem": "go"
          },
          {
            "name": "github.com/anchore/go-homedir",
            "direct": true,
            "version": "v0.0.0-20250319154043-c29668562e4d",
            "ecosystem": "go"
          },
          {
            "name": "github.com/anchore/go-logger",
            "direct": true,
            "version": "v0.0.0-20250318195838-07ae343dd722",
            "ecosystem": "go"
          },
          {
            "name": "github.com/anchore/go-macholibre",
            "direct": true,
            "version": "v0.0.0-20220308212642-53e6d0aaf6fb",
            "ecosystem": "go"
          },
          {
            "name": "github.com/anchore/go-rpmdb",
            "direct": true,
            "version": "v0.0.0-20250516171929-f77691e1faec",
            "ecosystem": "go"
          },
          {
            "name": "github.com/anchore/go-sync",
            "direct": true,
            "version": "v0.0.0-20250326131806-4eda43a485b6",
            "ecosystem": "go"
          },
          {
            "name": "github.com/anchore/go-testutils",
            "direct": true,
            "version": "v0.0.0-20200624184116-66aa578126db",
            "ecosystem": "go"
          },
          {
            "name": "github.com/anchore/go-testutils",
            "direct": true,
            "version": "v0.0.0-20200925183923-d5f45b0d3c04",
            "ecosystem": "go"
          },
          {
            "name": "github.com/anchore/go-version",
            "direct": true,
            "version": "v1.2.2-0.20200701162849-18adb9c92b9b",
            "ecosystem": "go"
          },
          {
            "name": "github.com/anchore/packageurl-go",
            "direct": true,
            "version": "v0.1.1-0.20250220190351-d62adb6e1115",
            "ecosystem": "go"
          },
          {
            "name": "github.com/anchore/stereoscope",
            "direct": true,
            "version": "v0.0.0-20200706164556-7cf39d7f4639",
            "ecosystem": "go"
          },
          {
            "name": "github.com/anchore/stereoscope",
            "direct": true,
            "version": "v0.1.17",
            "ecosystem": "go"
          },
          {
            "name": "github.com/anmitsu/go-shlex",
            "direct": true,
            "version": "v0.0.0-20200514113438-38f4b401e2be",
            "ecosystem": "go"
          },
          {
            "name": "github.com/aquasecurity/go-pep440-version",
            "direct": true,
            "version": "v0.0.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/bitnami/go-version",
            "direct": true,
            "version": "v0.0.0-20250131085805-b1f57a8634ef",
            "ecosystem": "go"
          },
          {
            "name": "github.com/blakesmith/ar",
            "direct": true,
            "version": "v0.0.0-20190502131153-809d4375e1fb",
            "ecosystem": "go"
          },
          {
            "name": "github.com/bmatcuk/doublestar/v4",
            "direct": true,
            "version": "v4.9.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/burntsushi/toml",
            "direct": true,
            "version": "v1.6.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/cespare/xxhash/v2",
            "direct": true,
            "version": "v2.3.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/charmbracelet/bubbles",
            "direct": true,
            "version": "v0.21.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/charmbracelet/bubbletea",
            "direct": true,
            "version": "v1.3.10",
            "ecosystem": "go"
          },
          {
            "name": "github.com/charmbracelet/lipgloss",
            "direct": true,
            "version": "v1.1.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/cyclonedx/cyclonedx-go",
            "direct": true,
            "version": "v0.9.3",
            "ecosystem": "go"
          },
          {
            "name": "github.com/dave/jennifer",
            "direct": true,
            "version": "v1.7.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/deitch/magic",
            "direct": true,
            "version": "v0.0.0-20230404182410-1ff89d7342da",
            "ecosystem": "go"
          },
          {
            "name": "github.com/diskfs/go-diskfs",
            "direct": true,
            "version": "v1.7.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/distribution/reference",
            "direct": true,
            "version": "v0.6.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/dustin/go-humanize",
            "direct": true,
            "version": "v1.0.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/elliotchance/phpserialize",
            "direct": true,
            "version": "v1.4.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/facebookincubator/nvdtools",
            "direct": true,
            "version": "v0.1.5",
            "ecosystem": "go"
          },
          {
            "name": "github.com/github/go-spdx/v2",
            "direct": true,
            "version": "v2.3.5",
            "ecosystem": "go"
          },
          {
            "name": "github.com/gkampitakis/go-snaps",
            "direct": true,
            "version": "v0.5.19",
            "ecosystem": "go"
          },
          {
            "name": "github.com/go-git/go-billy/v5",
            "direct": true,
            "version": "v5.7.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/go-git/go-git/v5",
            "direct": true,
            "version": "v5.16.4",
            "ecosystem": "go"
          },
          {
            "name": "github.com/go-test/deep",
            "direct": true,
            "version": "v1.0.6",
            "ecosystem": "go"
          },
          {
            "name": "github.com/go-test/deep",
            "direct": true,
            "version": "v1.1.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/go-viper/mapstructure/v2",
            "direct": true,
            "version": "v2.2.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/go-viper/mapstructure/v2",
            "direct": true,
            "version": "v2.4.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/goccy/go-yaml",
            "direct": true,
            "version": "v1.19.2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/gohugoio/hashstructure",
            "direct": true,
            "version": "v0.6.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/google/go-cmp",
            "direct": true,
            "version": "v0.7.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/google/go-containerregistry",
            "direct": true,
            "version": "v0.20.7",
            "ecosystem": "go"
          },
          {
            "name": "github.com/google/licensecheck",
            "direct": true,
            "version": "v0.3.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/google/uuid",
            "direct": true,
            "version": "v1.6.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/gookit/color",
            "direct": true,
            "version": "v1.6.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/gpustack/gguf-parser-go",
            "direct": true,
            "version": "v0.23.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/hashicorp/go-cleanhttp",
            "direct": true,
            "version": "v0.5.2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/hashicorp/go-getter",
            "direct": true,
            "version": "v1.8.4",
            "ecosystem": "go"
          },
          {
            "name": "github.com/hashicorp/go-multierror",
            "direct": true,
            "version": "v1.1.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/hashicorp/hcl/v2",
            "direct": true,
            "version": "v2.24.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/iancoleman/strcase",
            "direct": true,
            "version": "v0.3.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/invopop/jsonschema",
            "direct": true,
            "version": "v0.13.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/jedib0t/go-pretty/v6",
            "direct": true,
            "version": "v6.7.8",
            "ecosystem": "go"
          },
          {
            "name": "github.com/jinzhu/copier",
            "direct": true,
            "version": "v0.4.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/kastenhq/goversion",
            "direct": true,
            "version": "v0.0.0-20230811215019-93b2f8823953",
            "ecosystem": "go"
          },
          {
            "name": "github.com/magiconair/properties",
            "direct": true,
            "version": "v1.8.10",
            "ecosystem": "go"
          },
          {
            "name": "github.com/masterminds/semver/v3",
            "direct": true,
            "version": "v3.4.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/masterminds/sprig/v3",
            "direct": true,
            "version": "v3.3.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/mholt/archives",
            "direct": true,
            "version": "v0.1.5",
            "ecosystem": "go"
          },
          {
            "name": "github.com/moby/sys/mountinfo",
            "direct": true,
            "version": "v0.7.2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/nix-community/go-nix",
            "direct": true,
            "version": "v0.0.0-20250101154619-4bdde671e0a1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/olekukonko/tablewriter",
            "direct": true,
            "version": "v1.1.2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/oneofone/xxhash",
            "direct": true,
            "version": "v1.2.8",
            "ecosystem": "go"
          },
          {
            "name": "github.com/opencontainers/go-digest",
            "direct": true,
            "version": "v1.0.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/pelletier/go-toml",
            "direct": true,
            "version": "v1.9.5",
            "ecosystem": "go"
          },
          {
            "name": "github.com/quasilyte/go-ruleguard/dsl",
            "direct": true,
            "version": "v0.3.23",
            "ecosystem": "go"
          },
          {
            "name": "github.com/rust-secure-code/go-rustaudit",
            "direct": true,
            "version": "v0.0.0-20250226111315-e20ec32e963c",
            "ecosystem": "go"
          },
          {
            "name": "github.com/saintfish/chardet",
            "direct": true,
            "version": "v0.0.0-20230101081208-5e3ef4b5456d",
            "ecosystem": "go"
          },
          {
            "name": "github.com/sanity-io/litter",
            "direct": true,
            "version": "v1.5.8",
            "ecosystem": "go"
          },
          {
            "name": "github.com/sassoftware/go-rpmutils",
            "direct": true,
            "version": "v0.4.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/scylladb/go-set",
            "direct": true,
            "version": "v1.0.3-0.20200225121959-cc7b2070d91e",
            "ecosystem": "go"
          },
          {
            "name": "github.com/sergi/go-diff",
            "direct": true,
            "version": "v1.4.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/spdx/gordf",
            "direct": true,
            "version": "v0.0.0-20201111095634-7098f93598fb",
            "ecosystem": "go"
          },
          {
            "name": "github.com/spdx/tools-golang",
            "direct": true,
            "version": "v0.5.6",
            "ecosystem": "go"
          },
          {
            "name": "github.com/spf13/afero",
            "direct": true,
            "version": "v1.12.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/spf13/afero",
            "direct": true,
            "version": "v1.15.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/spf13/cobra",
            "direct": true,
            "version": "v1.10.2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/stretchr/testify",
            "direct": true,
            "version": "v1.10.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/stretchr/testify",
            "direct": true,
            "version": "v1.11.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/ulikunitz/xz",
            "direct": true,
            "version": "v0.5.12",
            "ecosystem": "go"
          },
          {
            "name": "github.com/ulikunitz/xz",
            "direct": true,
            "version": "v0.5.15",
            "ecosystem": "go"
          },
          {
            "name": "github.com/vbatts/go-mtree",
            "direct": true,
            "version": "v0.7.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/vifraa/gopom",
            "direct": true,
            "version": "v1.0.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/wagoodman/go-partybus",
            "direct": true,
            "version": "v0.0.0-20230516145632-8ccac152c651",
            "ecosystem": "go"
          },
          {
            "name": "github.com/wagoodman/go-progress",
            "direct": true,
            "version": "v0.0.0-20230925121702-07e42b3cdba0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/wk8/go-ordered-map/v2",
            "direct": true,
            "version": "v2.1.8",
            "ecosystem": "go"
          },
          {
            "name": "github.com/xeipuuv/gojsonschema",
            "direct": true,
            "version": "v1.2.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/zyedidia/generic",
            "direct": true,
            "version": "v1.2.2-0.20230320175451-4410d2372cb1",
            "ecosystem": "go"
          },
          {
            "name": "go.uber.org/goleak",
            "direct": true,
            "version": "v1.3.0",
            "ecosystem": "go"
          },
          {
            "name": "go.yaml.in/yaml/v3",
            "direct": true,
            "version": "v3.0.4",
            "ecosystem": "go"
          },
          {
            "name": "golang.org/x/exp",
            "direct": true,
            "version": "v0.0.0-20250620022241-b7579e27df2b",
            "ecosystem": "go"
          },
          {
            "name": "golang.org/x/mod",
            "direct": true,
            "version": "v0.31.0",
            "ecosystem": "go"
          },
          {
            "name": "golang.org/x/net",
            "direct": true,
            "version": "v0.48.0",
            "ecosystem": "go"
          },
          {
            "name": "golang.org/x/time",
            "direct": true,
            "version": "v0.14.0",
            "ecosystem": "go"
          },
          {
            "name": "golang.org/x/tools",
            "direct": true,
            "version": "v0.40.0",
            "ecosystem": "go"
          },
          {
            "name": "gopkg.in/yaml.v3",
            "direct": true,
            "version": "v3.0.1",
            "ecosystem": "go"
          },
          {
            "name": "modernc.org/sqlite",
            "direct": true,
            "version": "v1.43.0",
            "ecosystem": "go"
          },
          {
            "name": "cel.dev/expr",
            "direct": false,
            "version": "v0.24.0",
            "ecosystem": "go"
          },
          {
            "name": "cloud.google.com/go",
            "direct": false,
            "version": "v0.123.0",
            "ecosystem": "go"
          },
          {
            "name": "cloud.google.com/go/auth",
            "direct": false,
            "version": "v0.17.0",
            "ecosystem": "go"
          },
          {
            "name": "cloud.google.com/go/auth/oauth2adapt",
            "direct": false,
            "version": "v0.2.8",
            "ecosystem": "go"
          },
          {
            "name": "cloud.google.com/go/compute/metadata",
            "direct": false,
            "version": "v0.9.0",
            "ecosystem": "go"
          },
          {
            "name": "cloud.google.com/go/iam",
            "direct": false,
            "version": "v1.5.3",
            "ecosystem": "go"
          },
          {
            "name": "cloud.google.com/go/monitoring",
            "direct": false,
            "version": "v1.24.2",
            "ecosystem": "go"
          },
          {
            "name": "cloud.google.com/go/storage",
            "direct": false,
            "version": "v1.58.0",
            "ecosystem": "go"
          },
          {
            "name": "cyphar.com/go-pathrs",
            "direct": false,
            "version": "v0.2.1",
            "ecosystem": "go"
          },
          {
            "name": "dario.cat/mergo",
            "direct": false,
            "version": "v1.0.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/adalogics/go-fuzz-headers",
            "direct": false,
            "version": "v0.0.0-20230811130428-ced1acdcaa24",
            "ecosystem": "go"
          },
          {
            "name": "github.com/adamkorcz/go-118-fuzz-build",
            "direct": false,
            "version": "v0.0.0-20230306123547-8075edf89bb0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/agext/levenshtein",
            "direct": false,
            "version": "v1.2.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/anchore/archiver/v3",
            "direct": false,
            "version": "v3.5.3-0.20241210171143-5b1d8d1c7c51",
            "ecosystem": "go"
          },
          {
            "name": "github.com/anchore/go-lzo",
            "direct": false,
            "version": "v0.1.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/anchore/go-struct-converter",
            "direct": false,
            "version": "v0.1.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/andybalholm/brotli",
            "direct": false,
            "version": "v1.1.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/andybalholm/brotli",
            "direct": false,
            "version": "v1.2.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/apparentlymart/go-textseg/v15",
            "direct": false,
            "version": "v15.0.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/aquasecurity/go-version",
            "direct": false,
            "version": "v0.0.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/atotto/clipboard",
            "direct": false,
            "version": "v0.1.4",
            "ecosystem": "go"
          },
          {
            "name": "github.com/aws/aws-sdk-go-v2",
            "direct": false,
            "version": "v1.41.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream",
            "direct": false,
            "version": "v1.7.4",
            "ecosystem": "go"
          },
          {
            "name": "github.com/aws/aws-sdk-go-v2/config",
            "direct": false,
            "version": "v1.32.6",
            "ecosystem": "go"
          },
          {
            "name": "github.com/aws/aws-sdk-go-v2/credentials",
            "direct": false,
            "version": "v1.19.6",
            "ecosystem": "go"
          },
          {
            "name": "github.com/aws/aws-sdk-go-v2/feature/ec2/imds",
            "direct": false,
            "version": "v1.18.16",
            "ecosystem": "go"
          },
          {
            "name": "github.com/aws/aws-sdk-go-v2/internal/configsources",
            "direct": false,
            "version": "v1.4.16",
            "ecosystem": "go"
          },
          {
            "name": "github.com/aws/aws-sdk-go-v2/internal/endpoints/v2",
            "direct": false,
            "version": "v2.7.16",
            "ecosystem": "go"
          },
          {
            "name": "github.com/aws/aws-sdk-go-v2/internal/ini",
            "direct": false,
            "version": "v1.8.4",
            "ecosystem": "go"
          },
          {
            "name": "github.com/aws/aws-sdk-go-v2/internal/v4a",
            "direct": false,
            "version": "v1.4.16",
            "ecosystem": "go"
          },
          {
            "name": "github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding",
            "direct": false,
            "version": "v1.13.4",
            "ecosystem": "go"
          },
          {
            "name": "github.com/aws/aws-sdk-go-v2/service/internal/checksum",
            "direct": false,
            "version": "v1.9.7",
            "ecosystem": "go"
          },
          {
            "name": "github.com/aws/aws-sdk-go-v2/service/internal/presigned-url",
            "direct": false,
            "version": "v1.13.16",
            "ecosystem": "go"
          },
          {
            "name": "github.com/aws/aws-sdk-go-v2/service/internal/s3shared",
            "direct": false,
            "version": "v1.19.16",
            "ecosystem": "go"
          },
          {
            "name": "github.com/aws/aws-sdk-go-v2/service/s3",
            "direct": false,
            "version": "v1.95.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/aws/aws-sdk-go-v2/service/signin",
            "direct": false,
            "version": "v1.0.4",
            "ecosystem": "go"
          },
          {
            "name": "github.com/aws/aws-sdk-go-v2/service/sso",
            "direct": false,
            "version": "v1.30.8",
            "ecosystem": "go"
          },
          {
            "name": "github.com/aws/aws-sdk-go-v2/service/ssooidc",
            "direct": false,
            "version": "v1.35.12",
            "ecosystem": "go"
          },
          {
            "name": "github.com/aws/aws-sdk-go-v2/service/sts",
            "direct": false,
            "version": "v1.41.5",
            "ecosystem": "go"
          },
          {
            "name": "github.com/aws/smithy-go",
            "direct": false,
            "version": "v1.24.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/aymanbagabas/go-osc52/v2",
            "direct": false,
            "version": "v2.0.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/bahlo/generic-list-go",
            "direct": false,
            "version": "v0.2.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/becheran/wildmatch-go",
            "direct": false,
            "version": "v1.0.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/bgentry/go-netrc",
            "direct": false,
            "version": "v0.0.0-20140422174119-9fd32a8b3d3d",
            "ecosystem": "go"
          },
          {
            "name": "github.com/bmatcuk/doublestar",
            "direct": false,
            "version": "v1.3.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/bodgit/plumbing",
            "direct": false,
            "version": "v1.3.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/bodgit/sevenzip",
            "direct": false,
            "version": "v1.6.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/bodgit/windows",
            "direct": false,
            "version": "v1.0.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/buger/jsonparser",
            "direct": false,
            "version": "v1.1.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/charmbracelet/colorprofile",
            "direct": false,
            "version": "v0.2.3-0.20250311203215-f60798e515dc",
            "ecosystem": "go"
          },
          {
            "name": "github.com/charmbracelet/harmonica",
            "direct": false,
            "version": "v0.2.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/charmbracelet/x/ansi",
            "direct": false,
            "version": "v0.10.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/charmbracelet/x/cellbuf",
            "direct": false,
            "version": "v0.0.13-0.20250311204145-2c3ea96c31dd",
            "ecosystem": "go"
          },
          {
            "name": "github.com/charmbracelet/x/term",
            "direct": false,
            "version": "v0.2.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/clipperhouse/displaywidth",
            "direct": false,
            "version": "v0.6.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/clipperhouse/stringish",
            "direct": false,
            "version": "v0.1.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/clipperhouse/uax29/v2",
            "direct": false,
            "version": "v2.3.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/cloudflare/circl",
            "direct": false,
            "version": "v1.6.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/cncf/xds/go",
            "direct": false,
            "version": "v0.0.0-20250501225837-2ac532fd4443",
            "ecosystem": "go"
          },
          {
            "name": "github.com/containerd/cgroups",
            "direct": false,
            "version": "v1.1.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/containerd/containerd",
            "direct": false,
            "version": "v1.7.30",
            "ecosystem": "go"
          },
          {
            "name": "github.com/containerd/containerd/api",
            "direct": false,
            "version": "v1.8.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/containerd/continuity",
            "direct": false,
            "version": "v0.4.4",
            "ecosystem": "go"
          },
          {
            "name": "github.com/containerd/errdefs",
            "direct": false,
            "version": "v1.0.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/containerd/errdefs/pkg",
            "direct": false,
            "version": "v0.3.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/containerd/fifo",
            "direct": false,
            "version": "v1.1.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/containerd/log",
            "direct": false,
            "version": "v0.1.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/containerd/platforms",
            "direct": false,
            "version": "v0.2.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/containerd/stargz-snapshotter/estargz",
            "direct": false,
            "version": "v0.18.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/containerd/ttrpc",
            "direct": false,
            "version": "v1.2.7",
            "ecosystem": "go"
          },
          {
            "name": "github.com/containerd/typeurl/v2",
            "direct": false,
            "version": "v2.2.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/cyphar/filepath-securejoin",
            "direct": false,
            "version": "v0.6.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/datadog/zstd",
            "direct": false,
            "version": "v1.5.5",
            "ecosystem": "go"
          },
          {
            "name": "github.com/davecgh/go-spew",
            "direct": false,
            "version": "v1.1.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/davecgh/go-spew",
            "direct": false,
            "version": "v1.1.2-0.20180830191138-d8f796af33cc",
            "ecosystem": "go"
          },
          {
            "name": "github.com/docker/cli",
            "direct": false,
            "version": "v29.1.3+incompatible",
            "ecosystem": "go"
          },
          {
            "name": "github.com/docker/distribution",
            "direct": false,
            "version": "v2.8.3+incompatible",
            "ecosystem": "go"
          },
          {
            "name": "github.com/docker/docker",
            "direct": false,
            "version": "v28.5.2+incompatible",
            "ecosystem": "go"
          },
          {
            "name": "github.com/docker/docker-credential-helpers",
            "direct": false,
            "version": "v0.9.4",
            "ecosystem": "go"
          },
          {
            "name": "github.com/docker/go-connections",
            "direct": false,
            "version": "v0.6.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/docker/go-events",
            "direct": false,
            "version": "v0.0.0-20190806004212-e31b211e4f1c",
            "ecosystem": "go"
          },
          {
            "name": "github.com/docker/go-units",
            "direct": false,
            "version": "v0.5.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/dsnet/compress",
            "direct": false,
            "version": "v0.0.2-0.20210315054119-f66993602bf5",
            "ecosystem": "go"
          },
          {
            "name": "github.com/dsnet/compress",
            "direct": false,
            "version": "v0.0.2-0.20230904184137-39efe44ab707",
            "ecosystem": "go"
          },
          {
            "name": "github.com/emirpasic/gods",
            "direct": false,
            "version": "v1.18.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/envoyproxy/go-control-plane/envoy",
            "direct": false,
            "version": "v1.32.4",
            "ecosystem": "go"
          },
          {
            "name": "github.com/envoyproxy/protoc-gen-validate",
            "direct": false,
            "version": "v1.2.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/erikgeiser/coninput",
            "direct": false,
            "version": "v0.0.0-20211004153227-1c3628e74d0f",
            "ecosystem": "go"
          },
          {
            "name": "github.com/fatih/color",
            "direct": false,
            "version": "v1.18.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/felixge/fgprof",
            "direct": false,
            "version": "v0.9.5",
            "ecosystem": "go"
          },
          {
            "name": "github.com/felixge/httpsnoop",
            "direct": false,
            "version": "v1.0.4",
            "ecosystem": "go"
          },
          {
            "name": "github.com/fsnotify/fsnotify",
            "direct": false,
            "version": "v1.8.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/gabriel-vasile/mimetype",
            "direct": false,
            "version": "v1.4.12",
            "ecosystem": "go"
          },
          {
            "name": "github.com/gkampitakis/ciinfo",
            "direct": false,
            "version": "v0.3.2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/go-git/gcfg",
            "direct": false,
            "version": "v1.5.1-0.20230307220236-3a3c6141e376",
            "ecosystem": "go"
          },
          {
            "name": "github.com/go-jose/go-jose/v4",
            "direct": false,
            "version": "v4.1.2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/go-logr/logr",
            "direct": false,
            "version": "v1.4.3",
            "ecosystem": "go"
          },
          {
            "name": "github.com/go-logr/stdr",
            "direct": false,
            "version": "v1.2.2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/go-restruct/restruct",
            "direct": false,
            "version": "v1.2.0-alpha",
            "ecosystem": "go"
          },
          {
            "name": "github.com/gogo/protobuf",
            "direct": false,
            "version": "v1.3.2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/golang/groupcache",
            "direct": false,
            "version": "v0.0.0-20241129210726-2c02b8208cf8",
            "ecosystem": "go"
          },
          {
            "name": "github.com/golang/snappy",
            "direct": false,
            "version": "v0.0.4",
            "ecosystem": "go"
          },
          {
            "name": "github.com/google/pprof",
            "direct": false,
            "version": "v0.0.0-20250317173921-a4b03ec1a45e",
            "ecosystem": "go"
          },
          {
            "name": "github.com/google/s2a-go",
            "direct": false,
            "version": "v0.1.9",
            "ecosystem": "go"
          },
          {
            "name": "github.com/googleapis/enterprise-certificate-proxy",
            "direct": false,
            "version": "v0.3.7",
            "ecosystem": "go"
          },
          {
            "name": "github.com/googleapis/gax-go/v2",
            "direct": false,
            "version": "v2.15.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/googlecloudplatform/opentelemetry-operations-go/detectors/gcp",
            "direct": false,
            "version": "v1.29.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/googlecloudplatform/opentelemetry-operations-go/exporter/metric",
            "direct": false,
            "version": "v0.54.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/googlecloudplatform/opentelemetry-operations-go/internal/resourcemapping",
            "direct": false,
            "version": "v0.54.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/hashicorp/aws-sdk-go-base/v2",
            "direct": false,
            "version": "v2.0.0-beta.70",
            "ecosystem": "go"
          },
          {
            "name": "github.com/hashicorp/errwrap",
            "direct": false,
            "version": "v1.1.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/hashicorp/go-version",
            "direct": false,
            "version": "v1.8.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/hashicorp/golang-lru/v2",
            "direct": false,
            "version": "v2.0.7",
            "ecosystem": "go"
          },
          {
            "name": "github.com/henvic/httpretty",
            "direct": false,
            "version": "v0.1.4",
            "ecosystem": "go"
          },
          {
            "name": "github.com/huandu/xstrings",
            "direct": false,
            "version": "v1.5.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/inconshreveable/mousetrap",
            "direct": false,
            "version": "v1.1.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/jbenet/go-context",
            "direct": false,
            "version": "v0.0.0-20150711004518-d14ea06fba99",
            "ecosystem": "go"
          },
          {
            "name": "github.com/json-iterator/go",
            "direct": false,
            "version": "v1.1.12",
            "ecosystem": "go"
          },
          {
            "name": "github.com/kevinburke/ssh_config",
            "direct": false,
            "version": "v1.2.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/klauspost/compress",
            "direct": false,
            "version": "v1.17.11",
            "ecosystem": "go"
          },
          {
            "name": "github.com/klauspost/compress",
            "direct": false,
            "version": "v1.18.2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/klauspost/pgzip",
            "direct": false,
            "version": "v1.2.6",
            "ecosystem": "go"
          },
          {
            "name": "github.com/kr/pretty",
            "direct": false,
            "version": "v0.3.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/kr/text",
            "direct": false,
            "version": "v0.2.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/logrusorgru/aurora",
            "direct": false,
            "version": "v2.0.3+incompatible",
            "ecosystem": "go"
          },
          {
            "name": "github.com/lucasb-eyer/go-colorful",
            "direct": false,
            "version": "v1.2.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/mailru/easyjson",
            "direct": false,
            "version": "v0.7.7",
            "ecosystem": "go"
          },
          {
            "name": "github.com/maruel/natural",
            "direct": false,
            "version": "v1.1.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/masterminds/goutils",
            "direct": false,
            "version": "v1.1.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/mattn/go-colorable",
            "direct": false,
            "version": "v0.1.14",
            "ecosystem": "go"
          },
          {
            "name": "github.com/mattn/go-isatty",
            "direct": false,
            "version": "v0.0.20",
            "ecosystem": "go"
          },
          {
            "name": "github.com/mattn/go-localereader",
            "direct": false,
            "version": "v0.0.2-0.20220822084749-2491eb6c1c75",
            "ecosystem": "go"
          },
          {
            "name": "github.com/mattn/go-runewidth",
            "direct": false,
            "version": "v0.0.19",
            "ecosystem": "go"
          },
          {
            "name": "github.com/mgutz/ansi",
            "direct": false,
            "version": "v0.0.0-20200706080929-d51e80ef957d",
            "ecosystem": "go"
          },
          {
            "name": "github.com/microsoft/go-winio",
            "direct": false,
            "version": "v0.6.2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/microsoft/hcsshim",
            "direct": false,
            "version": "v0.11.7",
            "ecosystem": "go"
          },
          {
            "name": "github.com/mikelolasagasti/xz",
            "direct": false,
            "version": "v1.0.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/minio/minlz",
            "direct": false,
            "version": "v1.0.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/mitchellh/copystructure",
            "direct": false,
            "version": "v1.2.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/mitchellh/go-homedir",
            "direct": false,
            "version": "v1.1.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/mitchellh/go-wordwrap",
            "direct": false,
            "version": "v1.0.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/mitchellh/reflectwalk",
            "direct": false,
            "version": "v1.0.2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/moby/docker-image-spec",
            "direct": false,
            "version": "v1.3.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/moby/locker",
            "direct": false,
            "version": "v1.0.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/moby/sys/sequential",
            "direct": false,
            "version": "v0.6.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/moby/sys/signal",
            "direct": false,
            "version": "v0.7.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/moby/sys/user",
            "direct": false,
            "version": "v0.3.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/moby/sys/userns",
            "direct": false,
            "version": "v0.1.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/modern-go/concurrent",
            "direct": false,
            "version": "v0.0.0-20180306012644-bacd9c7ef1dd",
            "ecosystem": "go"
          },
          {
            "name": "github.com/modern-go/reflect2",
            "direct": false,
            "version": "v1.0.2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/muesli/ansi",
            "direct": false,
            "version": "v0.0.0-20230316100256-276c6243b2f6",
            "ecosystem": "go"
          },
          {
            "name": "github.com/muesli/cancelreader",
            "direct": false,
            "version": "v0.2.2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/muesli/termenv",
            "direct": false,
            "version": "v0.16.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/ncruces/go-strftime",
            "direct": false,
            "version": "v0.1.9",
            "ecosystem": "go"
          },
          {
            "name": "github.com/nwaples/rardecode",
            "direct": false,
            "version": "v1.1.3",
            "ecosystem": "go"
          },
          {
            "name": "github.com/nwaples/rardecode/v2",
            "direct": false,
            "version": "v2.2.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/olekukonko/cat",
            "direct": false,
            "version": "v0.0.0-20250911104152-50322a0618f6",
            "ecosystem": "go"
          },
          {
            "name": "github.com/olekukonko/errors",
            "direct": false,
            "version": "v1.1.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/olekukonko/ll",
            "direct": false,
            "version": "v0.1.3",
            "ecosystem": "go"
          },
          {
            "name": "github.com/opencontainers/image-spec",
            "direct": false,
            "version": "v1.1.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/opencontainers/runtime-spec",
            "direct": false,
            "version": "v1.1.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/opencontainers/selinux",
            "direct": false,
            "version": "v1.13.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/pborman/indent",
            "direct": false,
            "version": "v1.2.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/pelletier/go-toml/v2",
            "direct": false,
            "version": "v2.2.3",
            "ecosystem": "go"
          },
          {
            "name": "github.com/pierrec/lz4/v4",
            "direct": false,
            "version": "v4.1.21",
            "ecosystem": "go"
          },
          {
            "name": "github.com/pierrec/lz4/v4",
            "direct": false,
            "version": "v4.1.22",
            "ecosystem": "go"
          },
          {
            "name": "github.com/pjbgf/sha1cd",
            "direct": false,
            "version": "v0.3.2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/pkg/errors",
            "direct": false,
            "version": "v0.9.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/pkg/profile",
            "direct": false,
            "version": "v1.7.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/pkg/xattr",
            "direct": false,
            "version": "v0.4.9",
            "ecosystem": "go"
          },
          {
            "name": "github.com/planetscale/vtprotobuf",
            "direct": false,
            "version": "v0.6.1-0.20240319094008-0393e58bdf10",
            "ecosystem": "go"
          },
          {
            "name": "github.com/pmezard/go-difflib",
            "direct": false,
            "version": "v1.0.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/pmezard/go-difflib",
            "direct": false,
            "version": "v1.0.1-0.20181226105442-5d4384ee4fb2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/protonmail/go-crypto",
            "direct": false,
            "version": "v1.3.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/remyoudompheng/bigfft",
            "direct": false,
            "version": "v0.0.0-20230129092748-24d4a6f8daec",
            "ecosystem": "go"
          },
          {
            "name": "github.com/rivo/uniseg",
            "direct": false,
            "version": "v0.4.7",
            "ecosystem": "go"
          },
          {
            "name": "github.com/rogpeppe/go-internal",
            "direct": false,
            "version": "v1.14.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/sagikazarmark/locafero",
            "direct": false,
            "version": "v0.7.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/sahilm/fuzzy",
            "direct": false,
            "version": "v0.1.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/shopspring/decimal",
            "direct": false,
            "version": "v1.4.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/sirupsen/logrus",
            "direct": false,
            "version": "v1.9.3",
            "ecosystem": "go"
          },
          {
            "name": "github.com/sirupsen/logrus",
            "direct": false,
            "version": "v1.9.4-0.20230606125235-dd1b4c2e81af",
            "ecosystem": "go"
          },
          {
            "name": "github.com/skeema/knownhosts",
            "direct": false,
            "version": "v1.3.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/smallnest/ringbuffer",
            "direct": false,
            "version": "v0.0.0-20241116012123-461381446e3d",
            "ecosystem": "go"
          },
          {
            "name": "github.com/sorairolake/lzip-go",
            "direct": false,
            "version": "v0.3.8",
            "ecosystem": "go"
          },
          {
            "name": "github.com/sourcegraph/conc",
            "direct": false,
            "version": "v0.3.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/spf13/cast",
            "direct": false,
            "version": "v1.7.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/spf13/pflag",
            "direct": false,
            "version": "v1.0.6",
            "ecosystem": "go"
          },
          {
            "name": "github.com/spf13/pflag",
            "direct": false,
            "version": "v1.0.9",
            "ecosystem": "go"
          },
          {
            "name": "github.com/spf13/viper",
            "direct": false,
            "version": "v1.20.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/spf13/viper",
            "direct": false,
            "version": "v1.20.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/spiffe/go-spiffe/v2",
            "direct": false,
            "version": "v2.5.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/starry-s/zip",
            "direct": false,
            "version": "v0.2.3",
            "ecosystem": "go"
          },
          {
            "name": "github.com/stretchr/objx",
            "direct": false,
            "version": "v0.5.2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/subosito/gotenv",
            "direct": false,
            "version": "v1.6.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/sylabs/sif/v2",
            "direct": false,
            "version": "v2.22.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/sylabs/squashfs",
            "direct": false,
            "version": "v1.0.6",
            "ecosystem": "go"
          },
          {
            "name": "github.com/therootcompany/xz",
            "direct": false,
            "version": "v1.0.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/tidwall/gjson",
            "direct": false,
            "version": "v1.18.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/tidwall/match",
            "direct": false,
            "version": "v1.1.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/tidwall/pretty",
            "direct": false,
            "version": "v1.2.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/tidwall/sjson",
            "direct": false,
            "version": "v1.2.5",
            "ecosystem": "go"
          },
          {
            "name": "github.com/vbatts/tar-split",
            "direct": false,
            "version": "v0.12.2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/xanzy/ssh-agent",
            "direct": false,
            "version": "v0.3.3",
            "ecosystem": "go"
          },
          {
            "name": "github.com/xeipuuv/gojsonpointer",
            "direct": false,
            "version": "v0.0.0-20190905194746-02993c407bfb",
            "ecosystem": "go"
          },
          {
            "name": "github.com/xeipuuv/gojsonreference",
            "direct": false,
            "version": "v0.0.0-20180127040603-bd5ef7bd5415",
            "ecosystem": "go"
          },
          {
            "name": "github.com/xi2/xz",
            "direct": false,
            "version": "v0.0.0-20171230120015-48954b6210f8",
            "ecosystem": "go"
          },
          {
            "name": "github.com/xo/terminfo",
            "direct": false,
            "version": "v0.0.0-20220910002029-abceb7e1c41e",
            "ecosystem": "go"
          },
          {
            "name": "github.com/zclconf/go-cty",
            "direct": false,
            "version": "v1.16.3",
            "ecosystem": "go"
          },
          {
            "name": "github.com/zeebo/errs",
            "direct": false,
            "version": "v1.4.0",
            "ecosystem": "go"
          },
          {
            "name": "go.opencensus.io",
            "direct": false,
            "version": "v0.24.0",
            "ecosystem": "go"
          },
          {
            "name": "go.opentelemetry.io/auto/sdk",
            "direct": false,
            "version": "v1.2.1",
            "ecosystem": "go"
          },
          {
            "name": "go.opentelemetry.io/contrib/detectors/gcp",
            "direct": false,
            "version": "v1.36.0",
            "ecosystem": "go"
          },
          {
            "name": "go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc",
            "direct": false,
            "version": "v0.63.0",
            "ecosystem": "go"
          },
          {
            "name": "go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp",
            "direct": false,
            "version": "v0.61.0",
            "ecosystem": "go"
          },
          {
            "name": "go.opentelemetry.io/otel",
            "direct": false,
            "version": "v1.39.0",
            "ecosystem": "go"
          },
          {
            "name": "go.opentelemetry.io/otel/metric",
            "direct": false,
            "version": "v1.39.0",
            "ecosystem": "go"
          },
          {
            "name": "go.opentelemetry.io/otel/sdk",
            "direct": false,
            "version": "v1.39.0",
            "ecosystem": "go"
          },
          {
            "name": "go.opentelemetry.io/otel/sdk/metric",
            "direct": false,
            "version": "v1.39.0",
            "ecosystem": "go"
          },
          {
            "name": "go.opentelemetry.io/otel/trace",
            "direct": false,
            "version": "v1.39.0",
            "ecosystem": "go"
          },
          {
            "name": "go.uber.org/atomic",
            "direct": false,
            "version": "v1.9.0",
            "ecosystem": "go"
          },
          {
            "name": "go.uber.org/multierr",
            "direct": false,
            "version": "v1.10.0",
            "ecosystem": "go"
          },
          {
            "name": "go.uber.org/multierr",
            "direct": false,
            "version": "v1.9.0",
            "ecosystem": "go"
          },
          {
            "name": "go.uber.org/zap",
            "direct": false,
            "version": "v1.27.0",
            "ecosystem": "go"
          },
          {
            "name": "go4.org",
            "direct": false,
            "version": "v0.0.0-20230225012048-214862532bf5",
            "ecosystem": "go"
          },
          {
            "name": "golang.org/x/crypto",
            "direct": false,
            "version": "v0.46.0",
            "ecosystem": "go"
          },
          {
            "name": "golang.org/x/oauth2",
            "direct": false,
            "version": "v0.33.0",
            "ecosystem": "go"
          },
          {
            "name": "golang.org/x/sync",
            "direct": false,
            "version": "v0.19.0",
            "ecosystem": "go"
          },
          {
            "name": "golang.org/x/sys",
            "direct": false,
            "version": "v0.33.0",
            "ecosystem": "go"
          },
          {
            "name": "golang.org/x/sys",
            "direct": false,
            "version": "v0.39.0",
            "ecosystem": "go"
          },
          {
            "name": "golang.org/x/term",
            "direct": false,
            "version": "v0.38.0",
            "ecosystem": "go"
          },
          {
            "name": "golang.org/x/text",
            "direct": false,
            "version": "v0.21.0",
            "ecosystem": "go"
          },
          {
            "name": "golang.org/x/text",
            "direct": false,
            "version": "v0.32.0",
            "ecosystem": "go"
          },
          {
            "name": "golang.org/x/xerrors",
            "direct": false,
            "version": "v0.0.0-20231012003039-104605ab7028",
            "ecosystem": "go"
          },
          {
            "name": "gonum.org/v1/gonum",
            "direct": false,
            "version": "v0.16.0",
            "ecosystem": "go"
          },
          {
            "name": "google.golang.org/api",
            "direct": false,
            "version": "v0.256.0",
            "ecosystem": "go"
          },
          {
            "name": "google.golang.org/genproto",
            "direct": false,
            "version": "v0.0.0-20250922171735-9219d122eba9",
            "ecosystem": "go"
          },
          {
            "name": "google.golang.org/genproto/googleapis/api",
            "direct": false,
            "version": "v0.0.0-20251111163417-95abcf5c77ba",
            "ecosystem": "go"
          },
          {
            "name": "google.golang.org/genproto/googleapis/rpc",
            "direct": false,
            "version": "v0.0.0-20251111163417-95abcf5c77ba",
            "ecosystem": "go"
          },
          {
            "name": "google.golang.org/grpc",
            "direct": false,
            "version": "v1.76.0",
            "ecosystem": "go"
          },
          {
            "name": "google.golang.org/protobuf",
            "direct": false,
            "version": "v1.36.10",
            "ecosystem": "go"
          },
          {
            "name": "gopkg.in/warnings.v0",
            "direct": false,
            "version": "v0.1.2",
            "ecosystem": "go"
          },
          {
            "name": "modernc.org/libc",
            "direct": false,
            "version": "v1.66.10",
            "ecosystem": "go"
          },
          {
            "name": "modernc.org/mathutil",
            "direct": false,
            "version": "v1.7.1",
            "ecosystem": "go"
          },
          {
            "name": "modernc.org/memory",
            "direct": false,
            "version": "v1.11.0",
            "ecosystem": "go"
          },
          {
            "name": "org.junit.vintage:junit-vintage-engine",
            "direct": false,
            "version": null,
            "ecosystem": "maven"
          },
          {
            "name": "@babel/code-frame",
            "direct": false,
            "version": "7.10.4",
            "ecosystem": "npm"
          },
          {
            "name": "@types/minimatch",
            "direct": false,
            "version": "3.0.3",
            "ecosystem": "npm"
          },
          {
            "name": "@types/qs",
            "direct": false,
            "version": "6.9.4",
            "ecosystem": "npm"
          },
          {
            "name": "ajv",
            "direct": false,
            "version": "6.12.3",
            "ecosystem": "npm"
          },
          {
            "name": "asn1.js",
            "direct": false,
            "version": "4.10.1",
            "ecosystem": "npm"
          },
          {
            "name": "async",
            "direct": false,
            "version": "0.9.2",
            "ecosystem": "npm"
          },
          {
            "name": "async",
            "direct": false,
            "version": "3.2.3",
            "ecosystem": "npm"
          },
          {
            "name": "atob",
            "direct": false,
            "version": "2.1.2",
            "ecosystem": "npm"
          },
          {
            "name": "aws-sdk",
            "direct": false,
            "version": "2.706.0",
            "ecosystem": "npm"
          },
          {
            "name": "c0n-fab_u.laTION",
            "direct": false,
            "version": "7.7.7",
            "ecosystem": "npm"
          },
          {
            "name": "cross-spawn",
            "direct": false,
            "version": "7.0.6",
            "ecosystem": "npm"
          },
          {
            "name": "isexe",
            "direct": false,
            "version": "2.0.0",
            "ecosystem": "npm"
          },
          {
            "name": "jhipster-core",
            "direct": false,
            "version": "7.3.4",
            "ecosystem": "npm"
          },
          {
            "name": "merge-objects",
            "direct": false,
            "version": "1.0.5",
            "ecosystem": "npm"
          },
          {
            "name": "nanoid",
            "direct": false,
            "version": "3.3.4",
            "ecosystem": "npm"
          },
          {
            "name": "path-key",
            "direct": false,
            "version": "3.1.1",
            "ecosystem": "npm"
          },
          {
            "name": "resize-observer-polyfill",
            "direct": false,
            "version": "1.5.2",
            "ecosystem": "npm"
          },
          {
            "name": "shebang-command",
            "direct": false,
            "version": "2.0.0",
            "ecosystem": "npm"
          },
          {
            "name": "shebang-regex",
            "direct": false,
            "version": "3.0.0",
            "ecosystem": "npm"
          },
          {
            "name": "which",
            "direct": false,
            "version": "2.0.2",
            "ecosystem": "npm"
          },
          {
            "name": "annotated-types",
            "direct": false,
            "version": "0.7.0",
            "ecosystem": "pypi"
          },
          {
            "name": "anyio",
            "direct": false,
            "version": "4.6.2.post1",
            "ecosystem": "pypi"
          },
          {
            "name": "anyio",
            "direct": false,
            "version": "4.9.0",
            "ecosystem": "pypi"
          },
          {
            "name": "brotli",
            "direct": false,
            "version": "1.1.0",
            "ecosystem": "pypi"
          },
          {
            "name": "brotlicffi",
            "direct": false,
            "version": "1.1.0.0",
            "ecosystem": "pypi"
          },
          {
            "name": "certifi",
            "direct": false,
            "version": "2025.1.31",
            "ecosystem": "pypi"
          },
          {
            "name": "certifi",
            "direct": false,
            "version": "2025.10.5",
            "ecosystem": "pypi"
          },
          {
            "name": "cffi",
            "direct": false,
            "version": "1.17.1",
            "ecosystem": "pypi"
          },
          {
            "name": "charset-normalizer",
            "direct": false,
            "version": "3.4.1",
            "ecosystem": "pypi"
          },
          {
            "name": "click",
            "direct": false,
            "version": "7.1.2",
            "ecosystem": "pypi"
          },
          {
            "name": "click",
            "direct": false,
            "version": "8.1.8",
            "ecosystem": "pypi"
          },
          {
            "name": "colorama",
            "direct": false,
            "version": "0.4.6",
            "ecosystem": "pypi"
          },
          {
            "name": "dnspython",
            "direct": false,
            "version": "2.7.0",
            "ecosystem": "pypi"
          },
          {
            "name": "email-validator",
            "direct": false,
            "version": "2.2.0",
            "ecosystem": "pypi"
          },
          {
            "name": "fastapi",
            "direct": false,
            "version": "0.111.1",
            "ecosystem": "pypi"
          },
          {
            "name": "fastapi-cli",
            "direct": false,
            "version": "0.0.7",
            "ecosystem": "pypi"
          },
          {
            "name": "h11",
            "direct": false,
            "version": "0.14.0",
            "ecosystem": "pypi"
          },
          {
            "name": "h2",
            "direct": false,
            "version": "4.2.0",
            "ecosystem": "pypi"
          },
          {
            "name": "hpack",
            "direct": false,
            "version": "4.1.0",
            "ecosystem": "pypi"
          },
          {
            "name": "httpcore",
            "direct": false,
            "version": "1.0.7",
            "ecosystem": "pypi"
          },
          {
            "name": "httptools",
            "direct": false,
            "version": "0.6.4",
            "ecosystem": "pypi"
          },
          {
            "name": "httpx",
            "direct": false,
            "version": "0.28.1",
            "ecosystem": "pypi"
          },
          {
            "name": "hyperframe",
            "direct": false,
            "version": "6.1.0",
            "ecosystem": "pypi"
          },
          {
            "name": "idna",
            "direct": false,
            "version": "3.10",
            "ecosystem": "pypi"
          },
          {
            "name": "itsdangerous",
            "direct": false,
            "version": "2.2.0",
            "ecosystem": "pypi"
          },
          {
            "name": "jinja2",
            "direct": false,
            "version": "3.1.6",
            "ecosystem": "pypi"
          },
          {
            "name": "markdown-it-py",
            "direct": false,
            "version": "3.0.0",
            "ecosystem": "pypi"
          },
          {
            "name": "markupsafe",
            "direct": false,
            "version": "3.0.2",
            "ecosystem": "pypi"
          },
          {
            "name": "mdurl",
            "direct": false,
            "version": "0.1.2",
            "ecosystem": "pypi"
          },
          {
            "name": "orjson",
            "direct": false,
            "version": "3.10.16",
            "ecosystem": "pypi"
          },
          {
            "name": "pprintpp",
            "direct": false,
            "version": "0.4.0",
            "ecosystem": "pypi"
          },
          {
            "name": "pycparser",
            "direct": false,
            "version": "2.22",
            "ecosystem": "pypi"
          },
          {
            "name": "pydantic",
            "direct": false,
            "version": "2.11.0",
            "ecosystem": "pypi"
          },
          {
            "name": "pydantic-core",
            "direct": false,
            "version": "2.33.0",
            "ecosystem": "pypi"
          },
          {
            "name": "pydantic-extra-types",
            "direct": false,
            "version": "2.10.3",
            "ecosystem": "pypi"
          },
          {
            "name": "pydantic-settings",
            "direct": false,
            "version": "2.8.1",
            "ecosystem": "pypi"
          },
          {
            "name": "pygments",
            "direct": false,
            "version": "1.6",
            "ecosystem": "pypi"
          },
          {
            "name": "pygments",
            "direct": false,
            "version": "2.19.1",
            "ecosystem": "pypi"
          },
          {
            "name": "python-dotenv",
            "direct": false,
            "version": "1.1.0",
            "ecosystem": "pypi"
          },
          {
            "name": "python-multipart",
            "direct": false,
            "version": "0.0.20",
            "ecosystem": "pypi"
          },
          {
            "name": "pyyaml",
            "direct": false,
            "version": "6.0.2",
            "ecosystem": "pypi"
          },
          {
            "name": "requests",
            "direct": false,
            "version": "2.32.3",
            "ecosystem": "pypi"
          },
          {
            "name": "rich",
            "direct": false,
            "version": "0.3.3",
            "ecosystem": "pypi"
          },
          {
            "name": "rich",
            "direct": false,
            "version": "13.9.4",
            "ecosystem": "pypi"
          },
          {
            "name": "rich-toolkit",
            "direct": false,
            "version": "0.14.0",
            "ecosystem": "pypi"
          },
          {
            "name": "shellingham",
            "direct": false,
            "version": "1.5.4",
            "ecosystem": "pypi"
          },
          {
            "name": "sniffio",
            "direct": false,
            "version": "1.3.1",
            "ecosystem": "pypi"
          },
          {
            "name": "socksio",
            "direct": false,
            "version": "1.0.0",
            "ecosystem": "pypi"
          },
          {
            "name": "starlette",
            "direct": false,
            "version": "0.37.2",
            "ecosystem": "pypi"
          },
          {
            "name": "typer",
            "direct": false,
            "version": "0.15.2",
            "ecosystem": "pypi"
          },
          {
            "name": "typing-extensions",
            "direct": false,
            "version": "3.10.0.2",
            "ecosystem": "pypi"
          },
          {
            "name": "typing-extensions",
            "direct": false,
            "version": "4.13.0",
            "ecosystem": "pypi"
          },
          {
            "name": "typing-inspection",
            "direct": false,
            "version": "0.4.0",
            "ecosystem": "pypi"
          },
          {
            "name": "ujson",
            "direct": false,
            "version": "5.10.0",
            "ecosystem": "pypi"
          },
          {
            "name": "urllib3",
            "direct": false,
            "version": "2.3.0",
            "ecosystem": "pypi"
          },
          {
            "name": "uvicorn",
            "direct": false,
            "version": "0.34.0",
            "ecosystem": "pypi"
          },
          {
            "name": "uvloop",
            "direct": false,
            "version": "0.21.0",
            "ecosystem": "pypi"
          },
          {
            "name": "watchfiles",
            "direct": false,
            "version": "1.0.4",
            "ecosystem": "pypi"
          },
          {
            "name": "websockets",
            "direct": false,
            "version": "15.0.1",
            "ecosystem": "pypi"
          }
        ],
        "collected": true,
        "truncated": false,
        "total_count": 429,
        "direct_count": 104,
        "indirect_count": 325
      }
    },
    "maintainership": {
      "issues": {
        "open_prs": 0,
        "merged_prs": 0,
        "open_issues": 0,
        "closed_ratio": null,
        "closed_issues": 0,
        "closed_unmerged_prs": 4
      },
      "bus_factor": 2,
      "bot_contributors": 2,
      "top_contributors": [
        {
          "type": "User",
          "login": "wagoodman",
          "commits": 794,
          "avatar_url": "https://avatars.githubusercontent.com/u/590471?v=4"
        },
        {
          "type": "User",
          "login": "spiffcs",
          "commits": 206,
          "avatar_url": "https://avatars.githubusercontent.com/u/32073428?v=4"
        },
        {
          "type": "User",
          "login": "kzantow",
          "commits": 185,
          "avatar_url": "https://avatars.githubusercontent.com/u/3009477?v=4"
        },
        {
          "type": "User",
          "login": "luhring",
          "commits": 113,
          "avatar_url": "https://avatars.githubusercontent.com/u/5199289?v=4"
        },
        {
          "type": "User",
          "login": "westonsteimel",
          "commits": 83,
          "avatar_url": "https://avatars.githubusercontent.com/u/1593939?v=4"
        },
        {
          "type": "User",
          "login": "willmurphyscode",
          "commits": 67,
          "avatar_url": "https://avatars.githubusercontent.com/u/12529630?v=4"
        },
        {
          "type": "User",
          "login": "LaurentGoderre",
          "commits": 37,
          "avatar_url": "https://avatars.githubusercontent.com/u/1090826?v=4"
        },
        {
          "type": "User",
          "login": "jonasagx",
          "commits": 28,
          "avatar_url": "https://avatars.githubusercontent.com/u/774704?v=4"
        },
        {
          "type": "User",
          "login": "witchcraze",
          "commits": 22,
          "avatar_url": "https://avatars.githubusercontent.com/u/67056980?v=4"
        },
        {
          "type": "User",
          "login": "coheigea",
          "commits": 20,
          "avatar_url": "https://avatars.githubusercontent.com/u/472162?v=4"
        }
      ],
      "contributors_sampled": 98,
      "top_contributor_share": 0.44
    },
    "quality_signals": {
      "has_ci": true,
      "has_tests": true,
      "ci_workflows": [
        "codeql-analysis.yml",
        "dependabot-automation.yaml",
        "detect-schema-changes.yaml",
        "oss-project-board-add.yaml",
        "release.yaml",
        "remove-awaiting-response-label.yaml",
        "test-fixture-cache-publish.yaml",
        "update-anchore-dependencies.yml",
        "update-bootstrap-tools.yml",
        "update-cpe-dictionary-index.yml",
        "update-spdx-license-list.yaml",
        "validate-github-actions.yaml",
        "validations.yaml"
      ],
      "has_docs_dir": false,
      "linter_configs": [
        ".golangci.yaml"
      ],
      "has_editorconfig": false,
      "has_linter_config": true,
      "has_precommit_config": false
    },
    "security_signals": {
      "lockfiles": [
        "Cargo.lock",
        "Gemfile.lock",
        "Pipfile.lock",
        "composer.lock",
        "go.sum",
        "mix.lock",
        "package-lock.json",
        "packages.lock.json",
        "pdm.lock",
        "pnpm-lock.yaml",
        "poetry.lock",
        "uv.lock",
        "yarn.lock"
      ],
      "scorecard": {
        "checks": [
          {
            "name": "Binary-Artifacts",
            "score": 0,
            "reason": "binaries present in source code",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#binary-artifacts"
          },
          {
            "name": "Branch-Protection",
            "score": 0,
            "reason": "branch protection not enabled on development/release branches",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#branch-protection"
          },
          {
            "name": "CI-Tests",
            "score": null,
            "reason": "no pull request found",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#ci-tests"
          },
          {
            "name": "CII-Best-Practices",
            "score": 0,
            "reason": "no effort to earn an OpenSSF best practices badge detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#cii-best-practices"
          },
          {
            "name": "Code-Review",
            "score": 0,
            "reason": "Found 0/30 approved changesets -- score normalized to 0",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#code-review"
          },
          {
            "name": "Contributors",
            "score": 10,
            "reason": "project has 35 contributing companies or organizations",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#contributors"
          },
          {
            "name": "Dangerous-Workflow",
            "score": 10,
            "reason": "no dangerous workflow patterns detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dangerous-workflow"
          },
          {
            "name": "Dependency-Update-Tool",
            "score": 10,
            "reason": "update tool detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dependency-update-tool"
          },
          {
            "name": "Fuzzing",
            "score": 0,
            "reason": "project is not fuzzed",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#fuzzing"
          },
          {
            "name": "License",
            "score": 10,
            "reason": "license file detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#license"
          },
          {
            "name": "Maintained",
            "score": 0,
            "reason": "0 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 0",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#maintained"
          },
          {
            "name": "Packaging",
            "score": null,
            "reason": "packaging workflow not detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#packaging"
          },
          {
            "name": "Pinned-Dependencies",
            "score": 6,
            "reason": "dependency not pinned by hash detected -- score normalized to 6",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#pinned-dependencies"
          },
          {
            "name": "SAST",
            "score": 10,
            "reason": "SAST tool detected: CodeQL",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#sast"
          },
          {
            "name": "Security-Policy",
            "score": 10,
            "reason": "security policy file detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#security-policy"
          },
          {
            "name": "Signed-Releases",
            "score": 0,
            "reason": "Project has not signed or included provenance with any releases.",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#signed-releases"
          },
          {
            "name": "Token-Permissions",
            "score": 9,
            "reason": "detected GitHub workflow tokens with excessive permissions",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#token-permissions"
          },
          {
            "name": "Vulnerabilities",
            "score": 0,
            "reason": "319 existing vulnerabilities detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#vulnerabilities"
          }
        ],
        "commit": "55a190aed1608103733d4f75c6454658fa69da22",
        "ran_at": "2026-07-25T10:11:27Z",
        "aggregate_score": 4.3,
        "scorecard_version": "v5.5.0"
      },
      "has_codeql_workflow": true,
      "has_security_policy": true,
      "has_dependabot_config": true
    },
    "contribution_flow": {
      "collected": true,
      "ci_last_run_at": "2026-03-16T07:18:33Z",
      "oldest_open_prs": [],
      "last_merged_pr_at": null,
      "ci_last_conclusion": "SKIPPED",
      "oldest_open_issues": []
    }
  },
  "config": {
    "disabled_metrics": [],
    "disabled_categories": [],
    "disabled_components": {}
  },
  "source": {
    "url": "https://github.com/wagoodman/syft",
    "host": "github.com",
    "name": "syft",
    "owner": "wagoodman"
  },
  "metrics": {
    "overall": {
      "key": "overall",
      "band": "at_risk",
      "name": "Overall health",
      "note": null,
      "notes": [],
      "value": 40,
      "inputs": {
        "security": 42,
        "vitality": 42,
        "community": 14,
        "governance": 46,
        "engineering": 52
      },
      "components": []
    },
    "categories": [
      {
        "key": "vitality",
        "band": "at_risk",
        "name": "Vitality",
        "value": 42,
        "weight": 0.22,
        "metrics": [
          {
            "key": "development_activity",
            "band": "at_risk",
            "name": "Development activity",
            "note": null,
            "notes": [],
            "value": 38,
            "inputs": {
              "commits_last_year": 293,
              "human_commit_share": 0.4,
              "days_since_last_push": 196,
              "active_weeks_last_year": 23
            },
            "components": [
              {
                "key": "push_recency",
                "name": "Push recency",
                "detail": "last push 196 days ago",
                "points": 3.6,
                "status": "partial",
                "details": [
                  {
                    "code": "push_recency",
                    "params": {
                      "days": 196
                    }
                  }
                ],
                "max_points": 36
              },
              {
                "key": "commit_cadence",
                "name": "Commit cadence",
                "detail": "23/52 weeks with commits",
                "points": 15.9,
                "status": "partial",
                "details": [
                  {
                    "code": "commit_cadence_weeks",
                    "params": {
                      "weeks": 23
                    }
                  }
                ],
                "max_points": 36
              },
              {
                "key": "commit_volume",
                "name": "Commit volume",
                "detail": "293 commits in the last year",
                "points": 18,
                "status": "met",
                "details": [
                  {
                    "code": "commits_last_year",
                    "params": {
                      "count": 293
                    }
                  }
                ],
                "max_points": 18
              },
              {
                "key": "openssf_scorecard_maintained",
                "name": "OpenSSF Scorecard: Maintained",
                "detail": "0 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 0",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 10
              }
            ]
          },
          {
            "key": "release_discipline",
            "band": "at_risk",
            "name": "Release discipline",
            "note": null,
            "notes": [],
            "value": 47,
            "inputs": {
              "releases_count": 1,
              "latest_release_tag": "v0.0.0",
              "releases_from_tags": false,
              "days_since_latest_release": 611,
              "mean_days_between_releases": null
            },
            "components": [
              {
                "key": "ships_releases",
                "name": "Ships releases",
                "detail": "1 releases published",
                "points": 27,
                "status": "met",
                "details": [
                  {
                    "code": "releases_published",
                    "params": {
                      "count": 1
                    }
                  }
                ],
                "max_points": 27
              },
              {
                "key": "release_recency",
                "name": "Release recency",
                "detail": "latest release 611 days ago",
                "points": 7.2,
                "status": "partial",
                "details": [
                  {
                    "code": "release_recency",
                    "params": {
                      "days": 611
                    }
                  }
                ],
                "max_points": 36
              },
              {
                "key": "release_cadence",
                "name": "Release cadence",
                "detail": "cadence unknown (single release)",
                "points": 12.6,
                "status": "partial",
                "details": [
                  {
                    "code": "release_cadence_unknown",
                    "params": {}
                  }
                ],
                "max_points": 27
              },
              {
                "key": "openssf_scorecard_signed_releases",
                "name": "OpenSSF Scorecard: Signed-Releases",
                "detail": "Project has not signed or included provenance with any releases.",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 10
              }
            ]
          },
          {
            "key": "abandonment",
            "band": "excellent",
            "name": "Abandonment",
            "note": null,
            "notes": [],
            "value": 100,
            "inputs": {
              "cap": null,
              "state": "dormant",
              "guards": [
                "no_open_demand"
              ],
              "signals": [
                "unfixed_advisory",
                "scorecard_unmaintained"
              ],
              "red_flag": false,
              "multiplier_pct": 100,
              "declared_reason": null,
              "unverified_reason": null,
              "unanswered_open_prs": 0,
              "unanswered_open_issues": 0,
              "days_since_last_merged_pr": null,
              "days_since_last_human_commit": 197,
              "days_since_last_human_commit_is_floor": false
            },
            "components": [
              {
                "key": "project_is_still_maintained",
                "name": "Project is still maintained",
                "detail": "no human commit for 197 days, with nothing left unanswered; held at dormant by nothing open to answer",
                "points": 100,
                "status": "met",
                "details": [
                  {
                    "code": "abandonment_quiet",
                    "params": {
                      "days": 197
                    }
                  },
                  {
                    "code": "abandonment_guarded",
                    "params": {
                      "guards": "nothing open to answer"
                    }
                  }
                ],
                "max_points": 100
              }
            ]
          }
        ],
        "description": "Is the project alive — is code being written and are releases shipping?"
      },
      {
        "key": "community",
        "band": "critical",
        "name": "Community & Adoption",
        "value": 14,
        "weight": 0.18,
        "metrics": [
          {
            "key": "popularity",
            "band": "critical",
            "name": "Popularity & adoption",
            "note": null,
            "notes": [],
            "value": 5,
            "inputs": {
              "forks": 1,
              "stars": 3,
              "watchers": 0,
              "growth_state": "unverified",
              "growth_factor_pct": 100,
              "growth_unverified_reason": "no_history"
            },
            "components": [
              {
                "key": "stars",
                "name": "Stars",
                "detail": "3 stars",
                "points": 4.9,
                "status": "partial",
                "details": [
                  {
                    "code": "stars",
                    "params": {
                      "count": 3
                    }
                  }
                ],
                "max_points": 60
              },
              {
                "key": "forks",
                "name": "Forks",
                "detail": "1 forks",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "forks",
                    "params": {
                      "count": 1
                    }
                  }
                ],
                "max_points": 25
              },
              {
                "key": "watchers",
                "name": "Watchers",
                "detail": "0 watchers",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "watchers",
                    "params": {
                      "count": 0
                    }
                  }
                ],
                "max_points": 15
              }
            ]
          },
          {
            "key": "community_health",
            "band": "critical",
            "name": "Community health",
            "note": null,
            "notes": [],
            "value": 25,
            "inputs": {
              "has_readme": false,
              "has_license": false,
              "has_contributing": false,
              "has_issue_template": false,
              "has_code_of_conduct": false,
              "has_pull_request_template": false
            },
            "components": [
              {
                "key": "readme",
                "name": "README",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 22.5
              },
              {
                "key": "license",
                "name": "License",
                "detail": "recognized license (Apache-2.0)",
                "points": 22.5,
                "status": "met",
                "details": [
                  {
                    "code": "license_standard",
                    "params": {}
                  },
                  {
                    "code": "license_spdx",
                    "params": {
                      "spdx": "Apache-2.0"
                    }
                  }
                ],
                "max_points": 22.5
              },
              {
                "key": "contributing_guide",
                "name": "CONTRIBUTING guide",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 18
              },
              {
                "key": "code_of_conduct",
                "name": "Code of conduct",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 13.5
              },
              {
                "key": "issue_template",
                "name": "Issue template",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.2
              },
              {
                "key": "pr_template",
                "name": "PR template",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 6.3
              }
            ]
          }
        ],
        "description": "Does the project have users, downloads, attention, and a welcoming setup for contributors?"
      },
      {
        "key": "governance",
        "band": "at_risk",
        "name": "Sustainability & Governance",
        "value": 46,
        "weight": 0.24,
        "metrics": [
          {
            "key": "maintainer_resilience",
            "band": "moderate",
            "name": "Maintainer resilience (bus factor)",
            "note": null,
            "notes": [],
            "value": 61,
            "inputs": {
              "bus_factor": 2,
              "contributors_sampled": 98,
              "top_contributor_share": 0.44
            },
            "components": [
              {
                "key": "bus_factor",
                "name": "Bus factor",
                "detail": "2 contributor(s) cover half of all commits",
                "points": 25.2,
                "status": "partial",
                "details": [
                  {
                    "code": "bus_factor",
                    "params": {
                      "count": 2
                    }
                  }
                ],
                "max_points": 54
              },
              {
                "key": "commit_distribution",
                "name": "Commit distribution",
                "detail": "top contributor authored 44% of commits",
                "points": 12.6,
                "status": "partial",
                "details": [
                  {
                    "code": "top_contributor_share",
                    "params": {
                      "share": 44
                    }
                  }
                ],
                "max_points": 22.5
              },
              {
                "key": "contributor_breadth",
                "name": "Contributor breadth",
                "detail": "98 contributors",
                "points": 13.5,
                "status": "met",
                "details": [
                  {
                    "code": "contributors_sampled",
                    "params": {
                      "count": 98
                    }
                  }
                ],
                "max_points": 13.5
              },
              {
                "key": "openssf_scorecard_contributors",
                "name": "OpenSSF Scorecard: Contributors",
                "detail": "project has 35 contributing companies or organizations",
                "points": 10,
                "status": "met",
                "details": [],
                "max_points": 10
              }
            ]
          },
          {
            "key": "responsiveness",
            "band": "critical",
            "name": "Issue & PR responsiveness",
            "note": "Excluded from scoring (no data or not applicable): Issue resolution. Remaining weights renormalized.",
            "notes": [
              {
                "code": "excluded_no_data",
                "params": {
                  "components": [
                    "issue_resolution"
                  ]
                }
              },
              {
                "code": "weights_renormalized",
                "params": {}
              }
            ],
            "value": 1,
            "inputs": {
              "merged_prs": 0,
              "open_issues": 0,
              "closed_issues": 0,
              "issue_closed_ratio": null,
              "closed_unmerged_prs": 4
            },
            "components": [
              {
                "key": "issue_resolution",
                "name": "Issue resolution",
                "detail": "no issues or no data",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "no_issues_or_data",
                    "params": {}
                  }
                ],
                "max_points": 46.75
              },
              {
                "key": "pr_acceptance",
                "name": "PR acceptance",
                "detail": "0/4 decided PRs merged",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "decided_prs_merged",
                    "params": {
                      "merged": 0,
                      "decided": 4
                    }
                  }
                ],
                "max_points": 38.25
              },
              {
                "key": "openssf_scorecard_code_review",
                "name": "OpenSSF Scorecard: Code-Review",
                "detail": "Found 0/30 approved changesets -- score normalized to 0",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 15
              }
            ]
          },
          {
            "key": "stewardship",
            "band": "good",
            "name": "Ownership & stewardship",
            "note": "Excluded from scoring (no data or not applicable): Verified domain. Remaining weights renormalized.",
            "notes": [
              {
                "code": "excluded_no_data",
                "params": {
                  "components": [
                    "verified_domain"
                  ]
                }
              },
              {
                "code": "weights_renormalized",
                "params": {}
              }
            ],
            "value": 73,
            "inputs": {
              "followers": 1675,
              "owner_type": "User",
              "is_verified": null,
              "owner_login": "wagoodman",
              "public_repos": 110,
              "account_age_days": 5655
            },
            "components": [
              {
                "key": "ownership_backing",
                "name": "Ownership backing",
                "detail": "personal (user) account",
                "points": 10,
                "status": "partial",
                "details": [
                  {
                    "code": "owner_personal",
                    "params": {}
                  }
                ],
                "max_points": 30
              },
              {
                "key": "verified_domain",
                "name": "Verified domain",
                "detail": "not applicable to user accounts",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "not_applicable_to_user_accounts",
                    "params": {}
                  }
                ],
                "max_points": 20
              },
              {
                "key": "owner_reach",
                "name": "Owner reach",
                "detail": "1,675 followers of wagoodman",
                "points": 23.2,
                "status": "partial",
                "details": [
                  {
                    "code": "owner_followers",
                    "params": {
                      "count": 1675,
                      "login": "wagoodman"
                    }
                  }
                ],
                "max_points": 25
              },
              {
                "key": "track_record",
                "name": "Track record",
                "detail": "110 public repos, account ~15 yr old",
                "points": 25,
                "status": "met",
                "details": [
                  {
                    "code": "public_repos",
                    "params": {
                      "count": 110
                    }
                  },
                  {
                    "code": "account_age_years",
                    "params": {
                      "years": 15
                    }
                  }
                ],
                "max_points": 25
              }
            ]
          }
        ],
        "description": "Will the project survive its people — bus factor, responsiveness, who backs it, and package upkeep?"
      },
      {
        "key": "engineering",
        "band": "moderate",
        "name": "Engineering Quality",
        "value": 52,
        "weight": 0.2,
        "metrics": [
          {
            "key": "engineering_practices",
            "band": "good",
            "name": "Engineering practices",
            "note": "Excluded from scoring (no data or not applicable): OpenSSF Scorecard: CI-Tests. Remaining weights renormalized.",
            "notes": [
              {
                "code": "excluded_no_data",
                "params": {
                  "components": [
                    "openssf_scorecard_ci_tests"
                  ]
                }
              },
              {
                "code": "weights_renormalized",
                "params": {}
              }
            ],
            "value": 80,
            "inputs": {
              "has_ci": true,
              "has_tests": true,
              "has_editorconfig": false,
              "has_linter_config": true,
              "has_precommit_config": false
            },
            "components": [
              {
                "key": "ci_workflows",
                "name": "CI workflows",
                "detail": "13 workflow(s)",
                "points": 24,
                "status": "met",
                "details": [
                  {
                    "code": "ci_workflows",
                    "params": {
                      "count": 13
                    }
                  }
                ],
                "max_points": 24
              },
              {
                "key": "tests_present",
                "name": "Tests present",
                "detail": null,
                "points": 24,
                "status": "met",
                "details": [],
                "max_points": 24
              },
              {
                "key": "linter_config",
                "name": "Linter config",
                "detail": ".golangci.yaml",
                "points": 16,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": ".golangci.yaml"
                    }
                  }
                ],
                "max_points": 16
              },
              {
                "key": "pre_commit_hooks",
                "name": "Pre-commit hooks",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 9.6
              },
              {
                "key": "editorconfig",
                "name": ".editorconfig",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 6.4
              },
              {
                "key": "openssf_scorecard_ci_tests",
                "name": "OpenSSF Scorecard: CI-Tests",
                "detail": "no pull request found",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "no_data",
                    "params": {}
                  }
                ],
                "max_points": 20
              }
            ]
          },
          {
            "key": "documentation",
            "band": "critical",
            "name": "Documentation",
            "note": null,
            "notes": [],
            "value": 10,
            "inputs": {
              "topics": [],
              "has_wiki": true,
              "homepage": null,
              "has_readme": false,
              "has_docs_dir": false,
              "has_description": false
            },
            "components": [
              {
                "key": "readme",
                "name": "README",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 30
              },
              {
                "key": "documentation_directory",
                "name": "Documentation directory",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 25
              },
              {
                "key": "documentation_homepage_site",
                "name": "Documentation / homepage site",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 15
              },
              {
                "key": "repository_description",
                "name": "Repository description",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 10
              },
              {
                "key": "topics",
                "name": "Topics",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 10
              },
              {
                "key": "wiki",
                "name": "Wiki",
                "detail": null,
                "points": 10,
                "status": "met",
                "details": [],
                "max_points": 10
              }
            ]
          }
        ],
        "description": "Are baseline engineering and documentation practices in place?"
      },
      {
        "key": "security",
        "band": "at_risk",
        "name": "Security",
        "value": 42,
        "weight": 0.16,
        "metrics": [
          {
            "key": "security_posture",
            "band": "at_risk",
            "name": "Security posture",
            "note": "Excluded from scoring (no data or not applicable): CI-Tests, Packaging. Remaining weights renormalized.",
            "notes": [
              {
                "code": "excluded_no_data",
                "params": {
                  "components": [
                    "ci_tests",
                    "packaging"
                  ]
                }
              },
              {
                "code": "weights_renormalized",
                "params": {}
              }
            ],
            "value": 43,
            "inputs": {
              "source": "openssf_scorecard",
              "checks_evaluated": 16,
              "scorecard_version": "v5.5.0",
              "checks_inconclusive": 2,
              "scorecard_aggregate": 4.3
            },
            "components": [
              {
                "key": "binary_artifacts",
                "name": "Binary-Artifacts",
                "detail": "binaries present in source code",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "branch_protection",
                "name": "Branch-Protection",
                "detail": "branch protection not enabled on development/release branches",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "ci_tests",
                "name": "CI-Tests",
                "detail": "no pull request found",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "no_data",
                    "params": {}
                  }
                ],
                "max_points": 2.5
              },
              {
                "key": "cii_best_practices",
                "name": "CII-Best-Practices",
                "detail": "no effort to earn an OpenSSF best practices badge detected",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 2.5
              },
              {
                "key": "code_review",
                "name": "Code-Review",
                "detail": "Found 0/30 approved changesets -- score normalized to 0",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "contributors",
                "name": "Contributors",
                "detail": "project has 35 contributing companies or organizations",
                "points": 2.5,
                "status": "met",
                "details": [],
                "max_points": 2.5
              },
              {
                "key": "dangerous_workflow",
                "name": "Dangerous-Workflow",
                "detail": "no dangerous workflow patterns detected",
                "points": 10,
                "status": "met",
                "details": [],
                "max_points": 10
              },
              {
                "key": "dependency_update_tool",
                "name": "Dependency-Update-Tool",
                "detail": "update tool detected",
                "points": 7.5,
                "status": "met",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "fuzzing",
                "name": "Fuzzing",
                "detail": "project is not fuzzed",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 5
              },
              {
                "key": "license",
                "name": "License",
                "detail": "license file detected",
                "points": 2.5,
                "status": "met",
                "details": [],
                "max_points": 2.5
              },
              {
                "key": "maintained",
                "name": "Maintained",
                "detail": "0 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 0",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "packaging",
                "name": "Packaging",
                "detail": "packaging workflow not detected",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "no_data",
                    "params": {}
                  }
                ],
                "max_points": 5
              },
              {
                "key": "pinned_dependencies",
                "name": "Pinned-Dependencies",
                "detail": "dependency not pinned by hash detected -- score normalized to 6",
                "points": 3,
                "status": "partial",
                "details": [],
                "max_points": 5
              },
              {
                "key": "sast",
                "name": "SAST",
                "detail": "SAST tool detected: CodeQL",
                "points": 5,
                "status": "met",
                "details": [],
                "max_points": 5
              },
              {
                "key": "security_policy",
                "name": "Security-Policy",
                "detail": "security policy file detected",
                "points": 5,
                "status": "met",
                "details": [],
                "max_points": 5
              },
              {
                "key": "signed_releases",
                "name": "Signed-Releases",
                "detail": "Project has not signed or included provenance with any releases.",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "token_permissions",
                "name": "Token-Permissions",
                "detail": "detected GitHub workflow tokens with excessive permissions",
                "points": 6.8,
                "status": "partial",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "vulnerabilities",
                "name": "Vulnerabilities",
                "detail": "319 existing vulnerabilities detected",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.5
              }
            ]
          },
          {
            "key": "dependency_advisories",
            "band": "at_risk",
            "name": "Dependency advisories",
            "note": "Excluded from scoring (no data or not applicable): Indirect dependencies free of known advisories. Remaining weights renormalized. Matched 428 resolved dependencies against OSV; 1 could not be assessed (no resolved version, an unsupported ecosystem, or beyond the reported package list). This repository publishes no package the index resolves, so the repository dependency graph was assessed instead. That graph mixes development and test pins with shipped dependencies, so only the declared runtime dependencies are scored; transitive findings are reported as context and excluded from the score. Reachability is not analyzed.",
            "notes": [
              {
                "code": "excluded_no_data",
                "params": {
                  "components": [
                    "indirect_dependencies_free_of_known_advisories"
                  ]
                }
              },
              {
                "code": "weights_renormalized",
                "params": {}
              },
              {
                "code": "advisories_scope_repository",
                "params": {
                  "assessed": 428
                }
              },
              {
                "code": "advisories_unassessed",
                "params": {
                  "count": 1
                }
              },
              {
                "code": "advisories_repo_graph_caveat",
                "params": {}
              },
              {
                "code": "advisories_reachability",
                "params": {}
              }
            ],
            "value": 39,
            "inputs": {
              "source": "osv",
              "advisories": 195,
              "affected_packages": 43,
              "assessed_packages": 428,
              "unassessed_packages": 1,
              "affected_by_severity": "critical 4, high 18, moderate 14, low 3, unknown 4",
              "direct_affected_packages": 7
            },
            "components": [
              {
                "key": "direct_dependencies_free_of_known_advisories",
                "name": "Direct dependencies free of known advisories",
                "detail": "7 affected: github.com/go-git/go-billy/v5 v5.7.0 (high 8.1), github.com/hashicorp/go-getter v1.8.4 (high 7.5), github.com/anchore/stereoscope v0.0.0-20200706164556-7cf39d7f4639 (moderate 5.3), +4 more",
                "points": 6.5,
                "status": "partial",
                "details": [
                  {
                    "code": "advisories_affected",
                    "params": {
                      "count": 7,
                      "packages": "github.com/go-git/go-billy/v5 v5.7.0 (high 8.1), github.com/hashicorp/go-getter v1.8.4 (high 7.5), github.com/anchore/stereoscope v0.0.0-20200706164556-7cf39d7f4639 (moderate 5.3)"
                    }
                  },
                  {
                    "code": "advisories_affected_more",
                    "params": {
                      "count": 4
                    }
                  }
                ],
                "max_points": 35
              },
              {
                "key": "indirect_dependencies_free_of_known_advisories",
                "name": "Indirect dependencies free of known advisories",
                "detail": "transitive set not separable from development and test dependencies in this scope",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "advisories_scope_not_separable",
                    "params": {}
                  }
                ],
                "max_points": 25
              },
              {
                "key": "no_advisories_left_outstanding",
                "name": "No advisories left outstanding",
                "detail": "5 advisory-carrying package(s) unaddressed past 90 days; oldest published 905 days ago",
                "points": 22.9,
                "status": "partial",
                "details": [
                  {
                    "code": "advisories_stale",
                    "params": {
                      "days": 90,
                      "count": 5,
                      "oldest": 905
                    }
                  }
                ],
                "max_points": 40
              }
            ]
          },
          {
            "key": "malicious_dependencies",
            "band": "excellent",
            "name": "Malicious dependencies",
            "note": null,
            "notes": [],
            "value": 100,
            "inputs": {
              "source": "osv",
              "meaning": "reported as a malicious package by the OpenSSF corpus; the remedy is removal or moving off the compromised name, never an upgrade of the same artifact. Versions the registry has since pulled are listed but not scored",
              "packages": [],
              "red_flag": false,
              "assessed_packages": 428,
              "malicious_packages": 0,
              "direct_malicious_packages": 0,
              "withdrawn_malicious_packages": 0,
              "installable_malicious_packages": 0
            },
            "components": [
              {
                "key": "no_dependency_reported_as_a_malicious_package",
                "name": "No dependency reported as a malicious package",
                "detail": "no dependency is reported as a malicious package",
                "points": 100,
                "status": "met",
                "details": [
                  {
                    "code": "no_malicious_dependencies",
                    "params": {}
                  }
                ],
                "max_points": 100
              }
            ]
          },
          {
            "key": "high_risk_jurisdiction_exposure",
            "band": "excellent",
            "name": "High-Risk Jurisdiction Exposure",
            "note": "Only high-confidence self-published location evidence affects this multiplier. Ambiguous matches are review-only; country evidence is not proof of nationality, citizenship, legal registration, malicious intent, or sanctions status.",
            "notes": [
              {
                "code": "jurisdiction_evidence_limits",
                "params": {}
              }
            ],
            "value": 100,
            "inputs": {
              "meaning": "self-published location evidence; not nationality or citizenship",
              "red_flag": false,
              "exposures": [],
              "policy_countries": [
                "Russia",
                "Iran",
                "North Korea"
              ],
              "review_only_matches": 0,
              "assessed_self_published_locations": 11
            },
            "components": [
              {
                "key": "policy_exposure_multiplier",
                "name": "Policy exposure multiplier",
                "detail": "no confirmed policy-scope location match",
                "points": 100,
                "status": "met",
                "details": [
                  {
                    "code": "jurisdiction_no_match",
                    "params": {}
                  }
                ],
                "max_points": 100
              }
            ]
          }
        ],
        "description": "Are visible security and supply-chain practices strong, with no malicious dependency and no unresolved high-risk jurisdiction exposure?"
      },
      {
        "key": "ai_readiness",
        "band": "moderate",
        "name": "AI Readiness",
        "value": 67,
        "weight": 0,
        "metrics": [
          {
            "key": "ai_agent_context",
            "band": "at_risk",
            "name": "Agent context & guidance",
            "note": null,
            "notes": [],
            "value": 40,
            "inputs": {
              "has_llms_txt": false,
              "legible_history_share": 1,
              "agent_instruction_files": [],
              "agent_instruction_max_bytes": null
            },
            "components": [
              {
                "key": "agent_instructions",
                "name": "Agent instructions",
                "detail": "no CLAUDE.md / AGENTS.md / editor rules",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "no_agent_instructions",
                    "params": {}
                  }
                ],
                "max_points": 45
              },
              {
                "key": "machine_readable_docs_llms_txt",
                "name": "Machine-readable docs (llms.txt)",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 15
              },
              {
                "key": "legible_commit_history",
                "name": "Legible commit history",
                "detail": "40 of 40 human commits state their intent (structured subject or explanatory body)",
                "points": 40,
                "status": "met",
                "details": [
                  {
                    "code": "legible_history",
                    "params": {
                      "legible": 40,
                      "sampled": 40
                    }
                  }
                ],
                "max_points": 40
              }
            ]
          },
          {
            "key": "ai_verify_loop",
            "band": "excellent",
            "name": "Verify loop (build / test / typecheck)",
            "note": null,
            "notes": [],
            "value": 86,
            "inputs": {
              "has_nix": false,
              "has_tests": true,
              "lockfiles": [
                "Cargo.lock",
                "Gemfile.lock",
                "Pipfile.lock",
                "composer.lock",
                "go.sum",
                "mix.lock",
                "package-lock.json",
                "packages.lock.json",
                "pdm.lock",
                "pnpm-lock.yaml",
                "poetry.lock",
                "uv.lock",
                "yarn.lock"
              ],
              "has_dockerfile": true,
              "typed_language": true,
              "bootstrap_files": [
                "Makefile",
                "Taskfile.yaml",
                "cmd/syft/internal/test/integration/test-fixtures/Makefile",
                "schema/cyclonedx/Makefile",
                "syft/file/cataloger/executable/test-fixtures/Makefile",
                "syft/file/cataloger/executable/test-fixtures/elf/Makefile",
                "syft/file/cataloger/executable/test-fixtures/elf/project/Makefile",
                "syft/file/cataloger/executable/test-fixtures/shared-info/Makefile",
                "syft/file/cataloger/executable/test-fixtures/shared-info/project/Makefile",
                "syft/file/cataloger/executable/test-fixtures/shared-info/project/hello/Makefile",
                "syft/file/cataloger/executable/test-fixtures/shared-info/project/libhello/Makefile",
                "syft/pkg/cataloger/binary/test-fixtures/Makefile",
                "syft/pkg/cataloger/binary/test-fixtures/elf-test-fixtures/elfbinwithcorrupt/elfsrc/makefile",
                "syft/pkg/cataloger/binary/test-fixtures/elf-test-fixtures/elfbinwithcorrupt/makefile",
                "syft/pkg/cataloger/binary/test-fixtures/elf-test-fixtures/elfbinwithnestedlib/elfsrc/makefile",
                "syft/pkg/cataloger/binary/test-fixtures/elf-test-fixtures/elfbinwithnestedlib/makefile",
                "syft/pkg/cataloger/binary/test-fixtures/elf-test-fixtures/elfbinwithsisterlib/elfsrc1/makefile",
                "syft/pkg/cataloger/binary/test-fixtures/elf-test-fixtures/elfbinwithsisterlib/elfsrc2/makefile",
                "syft/pkg/cataloger/binary/test-fixtures/elf-test-fixtures/elfbinwithsisterlib/makefile",
                "syft/pkg/cataloger/dotnet/test-fixtures/Makefile",
                "syft/pkg/cataloger/golang/test-fixtures/Makefile",
                "syft/pkg/cataloger/golang/test-fixtures/archs/Makefile",
                "syft/pkg/cataloger/internal/pe/test-fixtures/Makefile",
                "syft/pkg/cataloger/java/test-fixtures/Makefile",
                "syft/pkg/cataloger/java/test-fixtures/jar-metadata/Makefile",
                "syft/pkg/cataloger/java/test-fixtures/java-builds/Makefile",
                "syft/pkg/cataloger/kernel/test-fixtures/Makefile",
                "syft/pkg/cataloger/redhat/test-fixtures/Makefile",
                "test/cli/test-fixtures/Makefile",
                "test/cli/test-fixtures/image-java-spdx-tools/Makefile",
                "test/cli/test-fixtures/registry/Makefile",
                "test/install/Makefile"
              ],
              "has_devcontainer": false,
              "has_linter_config": true,
              "typecheck_configs": [],
              "agent_commit_share": 0,
              "toolchain_manifests": [
                "cmd/syft/internal/test/integration/test-fixtures/image-go-bin-arch-coverage/go.mod",
                "cmd/syft/internal/test/integration/test-fixtures/image-pkg-coverage/pkgs/go/go.mod",
                "cmd/syft/internal/test/integration/test-fixtures/image-pkg-coverage/pkgs/java/pom.xml",
                "cmd/syft/internal/test/integration/test-fixtures/image-sbom-cataloger/go.mod",
                "go.mod",
                "syft/pkg/cataloger/dotnet/test-fixtures/image-net2-app/src/helloworld.csproj",
                "syft/pkg/cataloger/dotnet/test-fixtures/image-net6-asp-libman/src/LibManSample.csproj",
                "syft/pkg/cataloger/dotnet/test-fixtures/image-net8-app-no-depjson/src/dotnetapp.csproj",
                "syft/pkg/cataloger/dotnet/test-fixtures/image-net8-app-self-contained/src/dotnetapp.csproj",
                "syft/pkg/cataloger/dotnet/test-fixtures/image-net8-app-single-file/src/dotnetapp.csproj",
                "syft/pkg/cataloger/dotnet/test-fixtures/image-net8-app-with-runtime-nodepsjson/src/dotnetapp.csproj",
                "syft/pkg/cataloger/dotnet/test-fixtures/image-net8-app-with-runtime/src/dotnetapp.csproj",
                "syft/pkg/cataloger/dotnet/test-fixtures/image-net8-app/src/dotnetapp.csproj",
                "syft/pkg/cataloger/dotnet/test-fixtures/image-net8-compile-target/src/helloworld.csproj",
                "syft/pkg/cataloger/dotnet/test-fixtures/image-net8-ilrepack/src/dotnetapp.csproj",
                "syft/pkg/cataloger/dotnet/test-fixtures/image-net8-privateassets/src/dotnetapp.csproj",
                "syft/pkg/cataloger/golang/test-fixtures/archs/src/go.mod",
                "syft/pkg/cataloger/golang/test-fixtures/corrupt/go.mod",
                "syft/pkg/cataloger/golang/test-fixtures/glob-paths/src/go.mod",
                "syft/pkg/cataloger/golang/test-fixtures/go-mod-fixtures/many-packages/go.mod",
                "syft/pkg/cataloger/golang/test-fixtures/go-mod-fixtures/one-package/go.mod",
                "syft/pkg/cataloger/golang/test-fixtures/go-mod-fixtures/relative-replace/go.mod",
                "syft/pkg/cataloger/golang/test-fixtures/go-source/go.mod",
                "syft/pkg/cataloger/golang/test-fixtures/go-sum-hashes/go.mod",
                "syft/pkg/cataloger/golang/test-fixtures/image-not-a-module/go.mod",
                "syft/pkg/cataloger/golang/test-fixtures/image-small-upx/go.mod",
                "syft/pkg/cataloger/golang/test-fixtures/image-small/go.mod",
                "syft/pkg/cataloger/internal/pe/test-fixtures/image-dotnet31-single-file/src/hello.csproj",
                "syft/pkg/cataloger/internal/pe/test-fixtures/image-dotnet5-single-file/src/hello.csproj",
                "syft/pkg/cataloger/internal/pe/test-fixtures/image-dotnet6-single-file/src/hello.csproj",
                "syft/pkg/cataloger/java/internal/maven/test-fixtures/local/child-1/pom.xml",
                "syft/pkg/cataloger/java/internal/maven/test-fixtures/local/child-2/pom.xml",
                "syft/pkg/cataloger/java/internal/maven/test-fixtures/local/child-3/pom.xml",
                "syft/pkg/cataloger/java/internal/maven/test-fixtures/local/circular-1/pom.xml",
                "syft/pkg/cataloger/java/internal/maven/test-fixtures/local/circular-2/pom.xml",
                "syft/pkg/cataloger/java/internal/maven/test-fixtures/local/contains-child-1/pom.xml",
                "syft/pkg/cataloger/java/internal/maven/test-fixtures/local/parent-1/pom.xml",
                "syft/pkg/cataloger/java/internal/maven/test-fixtures/local/parent-2/pom.xml",
                "syft/pkg/cataloger/java/internal/maven/test-fixtures/local/parent-3/pom.xml",
                "syft/pkg/cataloger/java/test-fixtures/corrupt/pom.xml",
                "syft/pkg/cataloger/java/test-fixtures/glob-paths/src/pom.xml",
                "syft/pkg/cataloger/java/test-fixtures/gradle/build.gradle",
                "syft/pkg/cataloger/java/test-fixtures/jar-metadata/api-all-2.0.0-sources/META-INF/maven/org.apache.directory.api/api-all/pom.xml",
                "syft/pkg/cataloger/java/test-fixtures/jar-metadata/api-all-2.0.0-sources/META-INF/maven/org.apache.directory.api/api-asn1-api/pom.xml",
                "syft/pkg/cataloger/java/test-fixtures/jar-metadata/com.fasterxml.jackson.core.jackson-core-2.15.2/META-INF/maven/com.fasterxml.jackson.core/jackson-core/pom.xml",
                "syft/pkg/cataloger/java/test-fixtures/jar-metadata/commons-lang3-3.12.0/META-INF/maven/org.apache.commons-lang3/pom.xml",
                "syft/pkg/cataloger/java/test-fixtures/jar-metadata/jackson-core-2.15.2/META-INF/maven/com.fasterxml.jackson.core/jackson-core/pom.xml",
                "syft/pkg/cataloger/java/test-fixtures/jar-metadata/micronaut-aop-4.9.11/META-INF/maven/io.micronaut/micronaut-aop/pom.xml",
                "syft/pkg/cataloger/java/test-fixtures/jar-metadata/multiple-matching-2.11.5/META-INF/maven/org.multiple/multiple-matching-1/pom.xml",
                "syft/pkg/cataloger/java/test-fixtures/jar-metadata/multiple-matching-2.11.5/META-INF/maven/org.multiple/multiple-matching-2/pom.xml",
                "syft/pkg/cataloger/java/test-fixtures/jar-metadata/multiple-matching-2.11.5/META-INF/maven/org.multiple/multiple-matching-3/pom.xml",
                "syft/pkg/cataloger/java/test-fixtures/jar-metadata/opensaml-core-3.4.6/META-INF/maven/org.opensaml/opensaml-core/pom.xml",
                "syft/pkg/cataloger/java/test-fixtures/jar-metadata/org.multiple-thename/META-INF/maven/com.multiple/thename/pom.xml",
                "syft/pkg/cataloger/java/test-fixtures/jar-metadata/org.multiple-thename/META-INF/maven/org.multiple/thename/pom.xml",
                "syft/pkg/cataloger/java/test-fixtures/java-builds/example-java-app/build.gradle",
                "syft/pkg/cataloger/java/test-fixtures/java-builds/example-java-app/pom.xml",
                "syft/pkg/cataloger/java/test-fixtures/java-builds/example-jenkins-plugin/pom.xml",
                "syft/pkg/cataloger/java/test-fixtures/java-builds/example-sb-app/pom.xml",
                "syft/pkg/cataloger/java/test-fixtures/pom/commons-text-1.10.0/pom.xml",
                "syft/pkg/cataloger/java/test-fixtures/pom/example-java-app-maven/pom.xml",
                "syft/pkg/cataloger/java/test-fixtures/pom/transitive-top-level/pom.xml",
                "syft/pkg/cataloger/rust/test-fixtures/image-audit/Cargo.toml"
              ],
              "dependency_bot_commit_share": 0.47
            },
            "components": [
              {
                "key": "one_command_bootstrap",
                "name": "One-command bootstrap",
                "detail": "Makefile, Taskfile.yaml, cmd/syft/internal/test/integration/test-fixtures/Makefile, schema/cyclonedx/Makefile, syft/file/cataloger/executable/test-fixtures/Makefile, syft/file/cataloger/executable/test-fixtures/elf/Makefile, syft/file/cataloger/executable/test-fixtures/elf/project/Makefile, syft/file/cataloger/executable/test-fixtures/shared-info/Makefile, syft/file/cataloger/executable/test-fixtures/shared-info/project/Makefile, syft/file/cataloger/executable/test-fixtures/shared-info/project/hello/Makefile, syft/file/cataloger/executable/test-fixtures/shared-info/project/libhello/Makefile, syft/pkg/cataloger/binary/test-fixtures/Makefile, syft/pkg/cataloger/binary/test-fixtures/elf-test-fixtures/elfbinwithcorrupt/elfsrc/makefile, syft/pkg/cataloger/binary/test-fixtures/elf-test-fixtures/elfbinwithcorrupt/makefile, syft/pkg/cataloger/binary/test-fixtures/elf-test-fixtures/elfbinwithnestedlib/elfsrc/makefile, syft/pkg/cataloger/binary/test-fixtures/elf-test-fixtures/elfbinwithnestedlib/makefile, syft/pkg/cataloger/binary/test-fixtures/elf-test-fixtures/elfbinwithsisterlib/elfsrc1/makefile, syft/pkg/cataloger/binary/test-fixtures/elf-test-fixtures/elfbinwithsisterlib/elfsrc2/makefile, syft/pkg/cataloger/binary/test-fixtures/elf-test-fixtures/elfbinwithsisterlib/makefile, syft/pkg/cataloger/dotnet/test-fixtures/Makefile, syft/pkg/cataloger/golang/test-fixtures/Makefile, syft/pkg/cataloger/golang/test-fixtures/archs/Makefile, syft/pkg/cataloger/internal/pe/test-fixtures/Makefile, syft/pkg/cataloger/java/test-fixtures/Makefile, syft/pkg/cataloger/java/test-fixtures/jar-metadata/Makefile, syft/pkg/cataloger/java/test-fixtures/java-builds/Makefile, syft/pkg/cataloger/kernel/test-fixtures/Makefile, syft/pkg/cataloger/redhat/test-fixtures/Makefile, test/cli/test-fixtures/Makefile, test/cli/test-fixtures/image-java-spdx-tools/Makefile, test/cli/test-fixtures/registry/Makefile, test/install/Makefile",
                "points": 18,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": "Makefile, Taskfile.yaml, cmd/syft/internal/test/integration/test-fixtures/Makefile, schema/cyclonedx/Makefile, syft/file/cataloger/executable/test-fixtures/Makefile, syft/file/cataloger/executable/test-fixtures/elf/Makefile, syft/file/cataloger/executable/test-fixtures/elf/project/Makefile, syft/file/cataloger/executable/test-fixtures/shared-info/Makefile, syft/file/cataloger/executable/test-fixtures/shared-info/project/Makefile, syft/file/cataloger/executable/test-fixtures/shared-info/project/hello/Makefile, syft/file/cataloger/executable/test-fixtures/shared-info/project/libhello/Makefile, syft/pkg/cataloger/binary/test-fixtures/Makefile, syft/pkg/cataloger/binary/test-fixtures/elf-test-fixtures/elfbinwithcorrupt/elfsrc/makefile, syft/pkg/cataloger/binary/test-fixtures/elf-test-fixtures/elfbinwithcorrupt/makefile, syft/pkg/cataloger/binary/test-fixtures/elf-test-fixtures/elfbinwithnestedlib/elfsrc/makefile, syft/pkg/cataloger/binary/test-fixtures/elf-test-fixtures/elfbinwithnestedlib/makefile, syft/pkg/cataloger/binary/test-fixtures/elf-test-fixtures/elfbinwithsisterlib/elfsrc1/makefile, syft/pkg/cataloger/binary/test-fixtures/elf-test-fixtures/elfbinwithsisterlib/elfsrc2/makefile, syft/pkg/cataloger/binary/test-fixtures/elf-test-fixtures/elfbinwithsisterlib/makefile, syft/pkg/cataloger/dotnet/test-fixtures/Makefile, syft/pkg/cataloger/golang/test-fixtures/Makefile, syft/pkg/cataloger/golang/test-fixtures/archs/Makefile, syft/pkg/cataloger/internal/pe/test-fixtures/Makefile, syft/pkg/cataloger/java/test-fixtures/Makefile, syft/pkg/cataloger/java/test-fixtures/jar-metadata/Makefile, syft/pkg/cataloger/java/test-fixtures/java-builds/Makefile, syft/pkg/cataloger/kernel/test-fixtures/Makefile, syft/pkg/cataloger/redhat/test-fixtures/Makefile, test/cli/test-fixtures/Makefile, test/cli/test-fixtures/image-java-spdx-tools/Makefile, test/cli/test-fixtures/registry/Makefile, test/install/Makefile"
                    }
                  }
                ],
                "max_points": 18
              },
              {
                "key": "automated_tests",
                "name": "Automated tests",
                "detail": null,
                "points": 22,
                "status": "met",
                "details": [],
                "max_points": 22
              },
              {
                "key": "lint_format_config",
                "name": "Lint / format config",
                "detail": ".golangci.yaml",
                "points": 11,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": ".golangci.yaml"
                    }
                  }
                ],
                "max_points": 11
              },
              {
                "key": "static_type_checking",
                "name": "Static type checking",
                "detail": "Go (statically typed)",
                "points": 11,
                "status": "met",
                "details": [
                  {
                    "code": "statically_typed_language",
                    "params": {
                      "language": "Go"
                    }
                  }
                ],
                "max_points": 11
              },
              {
                "key": "reproducible_environment",
                "name": "Reproducible environment",
                "detail": "Dockerfile, lockfile",
                "points": 10,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": "Dockerfile, lockfile"
                    }
                  }
                ],
                "max_points": 10
              },
              {
                "key": "demonstrated_agent_practice",
                "name": "Demonstrated agent practice",
                "detail": "no agent-authored commits among the last 100",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "no_agent_authored_commits",
                    "params": {
                      "sampled": 100
                    }
                  }
                ],
                "max_points": 10
              },
              {
                "key": "automated_maintenance",
                "name": "Automated maintenance",
                "detail": "47 of the last 100 commits are automated dependency updates",
                "points": 8,
                "status": "met",
                "details": [
                  {
                    "code": "dependency_bot_commits",
                    "params": {
                      "count": 47,
                      "sampled": 100
                    }
                  }
                ],
                "max_points": 8
              },
              {
                "key": "openssf_scorecard_pinned_dependencies",
                "name": "OpenSSF Scorecard: Pinned-Dependencies",
                "detail": "dependency not pinned by hash detected -- score normalized to 6",
                "points": 6,
                "status": "partial",
                "details": [],
                "max_points": 10
              }
            ]
          },
          {
            "key": "ai_code_legibility",
            "band": "excellent",
            "name": "Code legibility for models",
            "note": null,
            "notes": [],
            "value": 100,
            "inputs": {
              "primary_language": "Go",
              "largest_source_bytes": 212636,
              "source_files_sampled": 1181,
              "oversized_source_files": 6
            },
            "components": [
              {
                "key": "type_checkable_code",
                "name": "Type-checkable code",
                "detail": "Go (statically typed)",
                "points": 45,
                "status": "met",
                "details": [
                  {
                    "code": "statically_typed_language",
                    "params": {
                      "language": "Go"
                    }
                  }
                ],
                "max_points": 45
              },
              {
                "key": "manageable_file_sizes",
                "name": "Manageable file sizes",
                "detail": "6/1181 source files over 60KB",
                "points": 54.7,
                "status": "partial",
                "details": [
                  {
                    "code": "oversized_source_files",
                    "params": {
                      "kb": 60,
                      "sampled": 1181,
                      "oversized": 6
                    }
                  }
                ],
                "max_points": 55
              }
            ]
          },
          {
            "key": "ai_interfaces",
            "band": "at_risk",
            "name": "Machine-readable interfaces",
            "note": null,
            "notes": [],
            "value": 40,
            "inputs": {
              "example_dirs": [
                "example",
                "examples",
                "sample"
              ],
              "has_mcp_signal": false,
              "api_schema_files": []
            },
            "components": [
              {
                "key": "api_schema_openapi_graphql_proto",
                "name": "API schema (OpenAPI/GraphQL/proto)",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 40
              },
              {
                "key": "mcp_server",
                "name": "MCP server",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 20
              },
              {
                "key": "runnable_examples",
                "name": "Runnable examples",
                "detail": "example, examples, sample",
                "points": 40,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": "example, examples, sample"
                    }
                  }
                ],
                "max_points": 40
              }
            ]
          }
        ],
        "description": "How well is the repo equipped to be developed and maintained with AI coding agents? An independent, experimental badge — weight 0.0, so it is surfaced on its own and does not affect the overall health score."
      }
    ],
    "metrics_version": "1.13.0"
  },
  "warnings": [
    "Star history unavailable: GitHub GraphQL error: Resource not accessible by personal access token",
    "Community profile unavailable",
    "go package 'github.com/anchore/syft' points at a different repository (https://github.com/anchore/syft); excluded from ecosystem scoring"
  ],
  "report_type": "repository",
  "generated_at": "2026-07-25T10:11:49.329453Z",
  "schema_version": "0.27.0",
  "badge_url": "https://raw.githubusercontent.com/inspect-software/badges/main/v1/w/wagoodman/syft.svg",
  "full_name": "wagoodman/syft",
  "license_state": "standard",
  "license_spdx": "Apache-2.0"
}

Registros relacionados

Repositorios inspeccionados que comparten etiquetas de catálogo o ecosistemas con wagoodman/syft. Leer en paralelo →

94wandb/wandbThe AI developer platform. Use Weights & Biases to train and fine-tune models, and manage models from experimentation to production.Excelente93apache/airflowApache Airflow - A platform to programmatically author, schedule, and monitor workflowsExcelente92envoyproxy/envoyCloud-native high-performance edge/middle/service proxyExcelente92moby/mobyThe Moby Project - a collaborative project for the container ecosystem to assemble container-based systemsExcelente91hashicorp/consulConsul is a distributed, highly available, and data center aware solution to connect and configure applications across dynamic, distributed infrastructure.Excelente91prometheus/prometheusThe Prometheus monitoring system and time series database.Excelente

Las puntuaciones son señales, no garantías. Reflejan prácticas públicamente visibles en GitHub; no son una auditoría de código ni una garantía de seguridad.

Los datos ausentes se excluyen y los pesos se renormalizan; nunca se puntúan como cero. La metodología es versionada y abierta: métricas v1.13.0, esquema v0.27.0 — metodología completa · wiki de métricas.

Cómo se sitúa un resultado dentro del registro general: estadísticas agregadas — Go.