siderolabs / image-factory

When each star and fork was added, collected from GitHub and bucketed by day. Cumulative growth sits directly above the daily additions it is made of, so the two read against each other: steady organic accretion looks nothing like an abrupt, short-lived burst. Where that difference is measurable, it is reported as growth authenticity.

Each point covers 3 days.

Full resolved dependency set from the GitHub dependency graph: 59 direct and 497 indirect (transitive) packages. The transitive closure is complete when the repository commits a lockfile.

This repository publishes no package the index resolves, so its own dependency graph was assessed — 556 packages, which also include development and test pins that never ship: 3 carry known advisories, of which 1 are direct.

An advisory means the version recorded in the dependency graph falls inside an advisory’s affected range. Reachability is not analysed, and the graph includes development and test pins — a finding may concern tooling rather than shipped software.

{
  "data": {
    "repo": {
      "topics": [],
      "is_fork": false,
      "size_kb": 7274,
      "has_wiki": true,
      "homepage": null,
      "languages": {
        "Go": 698169,
        "CSS": 124,
        "HTML": 61329,
        "Shell": 8846,
        "Makefile": 24686,
        "Dockerfile": 13366,
        "JavaScript": 1007,
        "Go Template": 3094
      },
      "pushed_at": "2026-07-28T18:27:13Z",
      "created_at": "2023-08-07T14:05:45Z",
      "owner_type": "Organization",
      "updated_at": "2026-07-28T15:16:18Z",
      "description": "A service to generate Talos boot assets",
      "is_archived": false,
      "is_disabled": false,
      "license_spdx": "MPL-2.0",
      "default_branch": "main",
      "license_spdx_raw": "MPL-2.0",
      "primary_language": "Go",
      "significant_languages": [
        "Go"
      ]
    },
    "owner": {
      "blog": "https://www.siderolabs.com",
      "name": "Sidero Labs, Inc.",
      "type": "Organization",
      "login": "siderolabs",
      "company": null,
      "location": "Earth",
      "followers": 729,
      "avatar_url": "https://avatars.githubusercontent.com/u/13804887?v=4",
      "created_at": "2015-08-15T01:42:12Z",
      "is_verified": null,
      "public_repos": 144,
      "account_age_days": 4001
    },
    "license": {
      "state": "standard",
      "spdx_id": "MPL-2.0",
      "raw_spdx": "MPL-2.0",
      "file_present": true,
      "scorecard_found": true,
      "profile_has_license": true
    },
    "activity": {
      "releases": [
        {
          "tag": "v1.4.0",
          "kind": "minor",
          "published_at": "2026-07-20T12:34:13Z"
        },
        {
          "tag": "v1.3.3",
          "kind": "patch",
          "published_at": "2026-06-01T17:09:28Z"
        },
        {
          "tag": "v1.3.2",
          "kind": "patch",
          "published_at": "2026-05-25T06:22:31Z"
        },
        {
          "tag": "v1.3.1",
          "kind": "patch",
          "published_at": "2026-05-14T07:37:27Z"
        },
        {
          "tag": "v1.3.0",
          "kind": "minor",
          "published_at": "2026-05-08T12:54:12Z"
        },
        {
          "tag": "v1.2.0",
          "kind": "minor",
          "published_at": "2026-04-28T08:59:54Z"
        },
        {
          "tag": "v1.1.0",
          "kind": "minor",
          "published_at": "2026-04-17T14:28:35Z"
        },
        {
          "tag": "v1.0.3",
          "kind": "patch",
          "published_at": "2026-02-09T11:53:29Z"
        },
        {
          "tag": "v1.0.2",
          "kind": "patch",
          "published_at": "2026-02-04T09:52:00Z"
        },
        {
          "tag": "v1.0.1",
          "kind": "patch",
          "published_at": "2026-02-04T02:09:53Z"
        },
        {
          "tag": "v1.0.0",
          "kind": "major",
          "published_at": "2026-01-30T02:31:58Z"
        },
        {
          "tag": "v1.0.0-beta.0",
          "kind": "prerelease",
          "published_at": "2026-01-23T08:31:46Z"
        },
        {
          "tag": "v0.9.0",
          "kind": "minor",
          "published_at": "2025-11-26T17:35:26Z"
        },
        {
          "tag": "v0.8.4",
          "kind": "patch",
          "published_at": "2025-09-10T13:45:29Z"
        },
        {
          "tag": "v0.8.3",
          "kind": "patch",
          "published_at": "2025-08-20T18:11:44Z"
        },
        {
          "tag": "v0.8.2",
          "kind": "patch",
          "published_at": "2025-08-19T09:41:11Z"
        },
        {
          "tag": "v0.8.1",
          "kind": "patch",
          "published_at": "2025-08-14T12:58:31Z"
        },
        {
          "tag": "v0.8.0",
          "kind": "minor",
          "published_at": "2025-08-12T13:34:56Z"
        },
        {
          "tag": "v0.7.6",
          "kind": "patch",
          "published_at": "2025-07-24T12:01:20Z"
        },
        {
          "tag": "v0.7.5",
          "kind": "patch",
          "published_at": "2025-07-23T14:55:27Z"
        },
        {
          "tag": "v0.7.4",
          "kind": "patch",
          "published_at": "2025-07-03T12:55:12Z"
        },
        {
          "tag": "v0.7.3",
          "kind": "patch",
          "published_at": "2025-06-05T10:32:11Z"
        },
        {
          "tag": "v0.7.2",
          "kind": "patch",
          "published_at": "2025-06-05T06:54:55Z"
        },
        {
          "tag": "v0.7.1",
          "kind": "patch",
          "published_at": "2025-05-28T16:40:13Z"
        },
        {
          "tag": "v0.7.0",
          "kind": "minor",
          "published_at": "2025-05-01T13:01:41Z"
        },
        {
          "tag": "v0.6.9",
          "kind": "patch",
          "published_at": "2025-04-28T13:37:33Z"
        },
        {
          "tag": "v0.6.8",
          "kind": "patch",
          "published_at": "2025-03-20T18:18:00Z"
        },
        {
          "tag": "v0.6.7",
          "kind": "patch",
          "published_at": "2025-02-03T17:44:51Z"
        },
        {
          "tag": "v0.6.6",
          "kind": "patch",
          "published_at": "2025-01-20T15:29:57Z"
        },
        {
          "tag": "v0.6.5",
          "kind": "patch",
          "published_at": "2024-12-23T14:31:44Z"
        },
        {
          "tag": "v0.6.4",
          "kind": "patch",
          "published_at": "2024-12-18T13:28:25Z"
        },
        {
          "tag": "v0.6.3",
          "kind": "patch",
          "published_at": "2024-12-12T10:15:43Z"
        },
        {
          "tag": "v0.6.2",
          "kind": "patch",
          "published_at": "2024-12-02T12:13:06Z"
        },
        {
          "tag": "v0.6.1",
          "kind": "patch",
          "published_at": "2024-11-14T17:14:00Z"
        },
        {
          "tag": "v0.6.0",
          "kind": "minor",
          "published_at": "2024-11-14T16:17:33Z"
        },
        {
          "tag": "v0.5.0",
          "kind": "minor",
          "published_at": "2024-09-03T12:02:33Z"
        },
        {
          "tag": "v0.4.2",
          "kind": "patch",
          "published_at": "2024-07-05T14:51:34Z"
        },
        {
          "tag": "v0.4.1",
          "kind": "patch",
          "published_at": "2024-05-15T17:41:08Z"
        },
        {
          "tag": "v0.4.0",
          "kind": "minor",
          "published_at": "2024-05-15T16:29:13Z"
        },
        {
          "tag": "v0.3.3",
          "kind": "patch",
          "published_at": "2024-05-02T14:20:10Z"
        },
        {
          "tag": "v0.3.2",
          "kind": "patch",
          "published_at": "2024-04-17T13:24:12Z"
        },
        {
          "tag": "v0.3.1",
          "kind": "patch",
          "published_at": "2024-04-10T15:54:36Z"
        },
        {
          "tag": "v0.3.0",
          "kind": "minor",
          "published_at": "2024-04-05T12:42:41Z"
        },
        {
          "tag": "v0.2.3",
          "kind": "patch",
          "published_at": "2024-03-14T19:12:51Z"
        },
        {
          "tag": "v0.2.2",
          "kind": "patch",
          "published_at": "2024-01-23T16:46:30Z"
        },
        {
          "tag": "v0.2.1",
          "kind": "patch",
          "published_at": "2023-12-22T17:19:56Z"
        },
        {
          "tag": "v0.2.0",
          "kind": "minor",
          "published_at": "2023-12-18T16:04:10Z"
        },
        {
          "tag": "v0.1.2",
          "kind": "patch",
          "published_at": "2023-11-08T13:47:08Z"
        },
        {
          "tag": "v0.1.1",
          "kind": "patch",
          "published_at": "2023-11-02T10:24:14Z"
        },
        {
          "tag": "v0.1.0",
          "kind": "minor",
          "published_at": "2023-11-01T12:57:02Z"
        }
      ],
      "recent_commits": [
        {
          "oid": "ae757b5b1ca6915a11e463a951cd77577318b263",
          "body": "cosign v3.1.2 removed the Rekor v1 signing path from its public API:\ncosign.TLogUpload, TLogUploadDSSEEnvelope, cbundle.MakeProtobufBundle\nand cbundle.MakeNewBundle are all gone. Rebuild GSA keyless signing on\nsigstore-go's sign primitives instead.\n\n- resolve Fulcio/Rekor/TSA from a root.SigningConf\n[…]\nnd an RFC3161 timestamp. cache.gsa.rekorURL pointing at\nrekor.sigstore.dev (v1) no longer works, and signer.DefaultRekorURL is\nremoved.\n\nSigned-off-by: Mateusz Urbanek <mateusz.urbanek@siderolabs.com>",
          "is_bot": false,
          "headline": "chore: bump cosign to v3.1.2, sign via Rekor v2 + TSA",
          "author_name": "Mateusz Urbanek",
          "author_login": "shanduur",
          "committed_at": "2026-07-28T14:33:42Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "615b279db9b70064b1855b2edc88f35b435b37d3",
          "body": "Add .sigstore.json sidecar endpoints that sign the exact bytes returned by asset downloads. Support both pinned local keys and GSA keyless signing, emitting Sigstore v0.3 bundles with the verification material required by each signer.\n\nPersist validated bundles in the shared asset cache using keys p\n[…]\n coverage. Exercise stock Cosign verification together with GET, HEAD, cache, concurrency, cancellation, and malformed-bundle behavior.\n\nSigned-off-by: Mateusz Urbanek <mateusz.urbanek@siderolabs.com>",
          "is_bot": false,
          "headline": "feat(enterprise): serve detached Sigstore bundles for assets",
          "author_name": "Mateusz Urbanek",
          "author_login": "shanduur",
          "committed_at": "2026-07-28T14:33:41Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "5296d4a8f8d5a7fbc0de296f3b5d515db478e19d",
          "body": "This PR updates the imported grpc library to address GO-2026-6061, which\nwas flagged by govulncheck.\n\nSigned-off-by: Spencer Smith <spencer.smith@talos-systems.com>",
          "is_bot": false,
          "headline": "chore: update grpc library",
          "author_name": "Spencer Smith",
          "author_login": "rsmitty",
          "committed_at": "2026-07-27T18:09:58Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "dee1a57377118d9e9ef9bc9bf7e503a5a03efceb",
          "body": "This PR allows for identity-scoped JWT download tokens.\nA token covers all schematics owned by the identity.\nIn the case of htaccess with IFE, that'd be the username.\nIn the future case of auth0, that's the org_id that we'll have for each Omni deployment.\n\nTokens are short-lived by default at 5m and\n[…]\nlled.\n\nSimilar story with current htaccess method, just will bypass the Auth0 setup and will use basic auth against IF to get the token.\n\nSigned-off-by: Spencer Smith <spencer.smith@talos-systems.com>",
          "is_bot": false,
          "headline": "feat: support JWT download tokens",
          "author_name": "Spencer Smith",
          "author_login": "rsmitty",
          "committed_at": "2026-07-27T13:43:47Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "c2339ee0acf197d9c3fe17a6431a1616eba4f1a7",
          "body": "This PR adds a PublicRoute interface so enterprise plugins can declare\nroutes that skip authentication. The registration loop checks for this\nmarker and uses registerPublicRoute accordingly. Plugins that do not\nimplement PublicRoute are registered as protected by default.\n\nThis is kind of a cheat of\n[…]\nthis\nyet, but it seems like it's a recommended thing to do incase we have\nexternal systems later that need to make use of this endpoint.\n\nSigned-off-by: Spencer Smith <spencer.smith@talos-systems.com>",
          "is_bot": false,
          "headline": "feat: support public routes in enterprise plugins",
          "author_name": "Spencer Smith",
          "author_login": "rsmitty",
          "committed_at": "2026-07-24T18:01:02Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "a81f6e9d219d03f6ceb411247676f1a5d5e70237",
          "body": "Allow pulling talos-bundle images through the backing registry.\nThis feature is mainly intended to be used by enterprise customers with a siderolabs\nhosted image factory configured to provide enterprise versions of sidero images.\n\nAdd a backing pull through cache registry for integration tests to speed up\nthe tests and be able to test the proxy logic.\n\nSigned-off-by: Orzelius <33936483+Orzelius@users.noreply.github.com>",
          "is_bot": false,
          "headline": "feat: proxy images through backing registry",
          "author_name": "Orzelius",
          "author_login": "Orzelius",
          "committed_at": "2026-07-23T14:17:35Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "32a3b0894882062290e707781872b4ce0320ba6c",
          "body": "Cosign discovers referrers once, but GetBundles loads each\ndescriptor by calling ociremote.Bundle. Without\nRegistryClientOpts, every bundle load creates a new\ngo-containerregistry puller and repeats registry discovery and\nauthentication. A cache entry with 125 historical bundles\ntherefore performs t\n[…]\nthe same 125-referrer index, main took 6.46 seconds for\none verification and 25.18 seconds for four. Reusing the\npuller took 72 ms and 157 ms respectively.\n\nSigned-off-by: Noel Georgi <git@frezbo.dev>",
          "is_bot": false,
          "headline": "fix: reuse registry puller for bundle verification",
          "author_name": "Noel Georgi",
          "author_login": "frezbo",
          "committed_at": "2026-07-22T12:56:11Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "efab38fc84e8884baec12c65081948ce0691b9f7",
          "body": "This is the official v1.4.0 release.\n\nSigned-off-by: Mateusz Urbanek <mateusz.urbanek@siderolabs.com>",
          "is_bot": false,
          "headline": "release(v1.4.0): prepare release",
          "author_name": "Mateusz Urbanek",
          "author_login": "shanduur",
          "committed_at": "2026-07-20T12:05:29Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "9c6423572ac34132753a52b881771312fdd744a2",
          "body": "Enforce owner field policy at API boundary — rejected in\nnon-enterprise, required in enterprise. Includes unit and\nintegration tests.\n\nSigned-off-by: Mateusz Urbanek <mateusz.urbanek@siderolabs.com>",
          "is_bot": false,
          "headline": "feat: add schematic owner validation",
          "author_name": "Mateusz Urbanek",
          "author_login": "shanduur",
          "committed_at": "2026-07-20T10:35:52Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "ca87d2388929bc3f391ac138f5d60e6254abc365",
          "body": "Fixes #465\n\nSigned-off-by: Mateusz Urbanek <mateusz.urbanek@siderolabs.com>",
          "is_bot": false,
          "headline": "fix: add single-flight around schematic factory",
          "author_name": "Mateusz Urbanek",
          "author_login": "shanduur",
          "committed_at": "2026-07-16T11:57:21Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "d45b5ac58987ccc6ea1d75b228937e228903fe54",
          "body": "Link our docs and help tooltips to IFE docs page.\n\nFixes https://github.com/siderolabs/image-factory/issues/479\n\nSigned-off-by: Mateusz Urbanek <mateusz.urbanek@siderolabs.com>",
          "is_bot": false,
          "headline": "docs: link to Image Factory Enterprise docs page",
          "author_name": "Mateusz Urbanek",
          "author_login": "shanduur",
          "committed_at": "2026-07-16T11:07:27Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "490a993a322bbe292d98cd36f3e1cc40c3f85e2e",
          "body": "https://github.com/siderolabs/talos/blob/v1.14.0-alpha.2/Makefile#L31\n\nSigned-off-by: Maja Bojarska <maja.bojarska@siderolabs.com>",
          "is_bot": false,
          "headline": "chore: bump pkgs revision to match talos v1.14.0-alpha.2",
          "author_name": "Maja Bojarska",
          "author_login": "majabojarska",
          "committed_at": "2026-07-16T10:31:48Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "f9ff935e8319c73c5877ee05b32fe556b664fea9",
          "body": "Bumps go pkgs per Renovate\n\nhttps://github.com/siderolabs/image-factory/pull/380\n\nSigned-off-by: Maja Bojarska <maja.bojarska@siderolabs.com>",
          "is_bot": false,
          "headline": "chore: bump go pkgs",
          "author_name": "Maja Bojarska",
          "author_login": "majabojarska",
          "committed_at": "2026-07-16T10:31:44Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "12cd6471ad76cef7a0be82192a2555f1dbc0d5b7",
          "body": "Adds the file to the root path for automatic discovery and helping LLMs\ndiscover endpoints and usage.\n\nSigned-off-by: Justin Garrison <justin.garrison@siderolabs.com>",
          "is_bot": false,
          "headline": "feat: add llms.txt for better LLM usage",
          "author_name": "Justin Garrison",
          "author_login": "rothgar",
          "committed_at": "2026-07-15T22:04:42Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "f65960f064fd9776725a0990bf90710ed2c2acd1",
          "body": "Set defaults for audit file\n\nSigned-off-by: Mateusz Urbanek <mateusz.urbanek@siderolabs.com>",
          "is_bot": false,
          "headline": "fix: audit file defaults",
          "author_name": "Mateusz Urbanek",
          "author_login": "shanduur",
          "committed_at": "2026-07-15T10:44:19Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "f26e5e25e0de055906268406f36bb3a7f514f735",
          "body": "Records a structured entry per authenticated request (who, what,\nwhen, status, duration, client IP) at the HTTP wrapHandler choke\npoint. Identity comes from the enterprise auth provider when\npresent; anonymous requests still record request ID and client IP.\n\nSink is pluggable via audit.mode: \"\" (non\n[…]\nhe application logger). Immutability is delegated to the\nsink's storage (append-only file, WORM bucket, SIEM), not enforced\nin-process.\n\nSigned-off-by: Mateusz Urbanek <mateusz.urbanek@siderolabs.com>",
          "is_bot": false,
          "headline": "feat: add audit log for authenticated requests",
          "author_name": "Mateusz Urbanek",
          "author_login": "shanduur",
          "committed_at": "2026-07-15T09:47:59Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "beff6e26c30feb1f8e45646066e014808180c83a",
          "body": "Add `artifacts.core.namespace`, an optional repository path prefix\nprepended to every image pulled from the core registry: the component\nimages as well as the extension and overlay images discovered via the\nmanifests. Previously only the registry host could be overridden, so\npull-through caches whic\n[…]\nbs/gvisor.\n\nThe prefix only affects pull references; extension identities (matched\nagainst schematics, the UI, and the meta API) are unchanged.\n\nSigned-off-by: Rowan Voermans <rowanvoermans@gmail.com>",
          "is_bot": false,
          "headline": "feat: support registry namespace prefix for core artifacts",
          "author_name": "Rowan Voermans",
          "author_login": "ruadhan",
          "committed_at": "2026-07-13T15:36:05Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "8c489d08f1c880bf5de022deba7fea6cc736eca4",
          "body": "Updated dependencies and run rekres.\n\nSigned-off-by: Mateusz Urbanek <mateusz.urbanek@siderolabs.com>",
          "is_bot": false,
          "headline": "chore: update dependencies",
          "author_name": "Mateusz Urbanek",
          "author_login": "shanduur",
          "committed_at": "2026-07-13T14:06:44Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "026f8a8887508d39b29a7dc89a2455bffed16ff8",
          "body": "Image factory can now be configured with an extra extensions manifest image allowing to easily add custom extensions in addition to the official Sideo extensions.\n\nSigned-off-by: Orzelius <33936483+Orzelius@users.noreply.github.com>",
          "is_bot": false,
          "headline": "feat: extra extensions (enterprise only)",
          "author_name": "Orzelius",
          "author_login": "Orzelius",
          "committed_at": "2026-07-06T09:21:48Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "915ef76a1b0210728d266e9342b17fe1a3b0d3e3",
          "body": "on some environments the local registries are not automatically detected as insecure\n\nSigned-off-by: Orzelius <33936483+Orzelius@users.noreply.github.com>",
          "is_bot": false,
          "headline": "chore: add insecure flag to dev config",
          "author_name": "Orzelius",
          "author_login": "Orzelius",
          "committed_at": "2026-07-02T07:35:34Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "3bccbe1286dde26f81fa084206a44e633f3c0324",
          "body": "go-containerregistry's partial.Descriptor only copies Platform onto the index entry\nwhen the image was resolved from a multi-arch index. Derive platform from the image's\nconfig file if present so single arch images keep working.\n\nPart of #395\n\nSigned-off-by: Orzelius <33936483+Orzelius@users.noreply.github.com>",
          "is_bot": false,
          "headline": "fix: handle single arch images",
          "author_name": "Orzelius",
          "author_login": "Orzelius",
          "committed_at": "2026-06-29T14:27:52Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "6b1c8556657df805955f57738872845f920987fd",
          "body": "Guess the insecure via the image reference passed to get image by\nreference.\n\nWhile fetching the extension catalog, patch in the registry into the\nimage reference immediately, so that we don't have to patch it in later\non fetch.\n\nPart of #395.\n\nSigned-off-by: Andrey Smirnov <andrey.smirnov@siderolabs.com>",
          "is_bot": false,
          "headline": "refactor: prepare for more than one artifact registry",
          "author_name": "Andrey Smirnov",
          "author_login": "smira",
          "committed_at": "2026-06-29T11:37:32Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "bee4fe39d89b854eb09aab68c146eb55164f9377",
          "body": "SBOM content depends only on the extension list, Talos version, and\narchitecture. Previously the cache key included the full schematicID,\ncausing cache misses when non-SBOM fields changed (kernel args, config,\nmeta, secureboot, etc.).\n\nNow hash only the relevant inputs so schematics with identical\nextension lists share cached bundles and scan results. Singleflight\nuses the same hash for both SPDX build and vulnerability scan.\n\nSigned-off-by: Mateusz Urbanek <mateusz.urbanek@siderolabs.com>",
          "is_bot": false,
          "headline": "feat: narrow sbom cache key to extension list only",
          "author_name": "Mateusz Urbanek",
          "author_login": "shanduur",
          "committed_at": "2026-06-15T15:11:08Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "e0e4a4469448dc0eec828fc9a5f8a0db0a0cf3a6",
          "body": "I didn't wan't to duplicate the code a fourth time for the extra extensions so here's a little abstraction\n\nSigned-off-by: Orzelius <33936483+Orzelius@users.noreply.github.com>",
          "is_bot": false,
          "headline": "refactor: abstract versioned cache",
          "author_name": "Orzelius",
          "author_login": "Orzelius",
          "committed_at": "2026-06-15T13:27:26Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "3359f6c6b8f1fabda0ed0c8b8487687432ee155d",
          "body": "Add a `secureboot.enrollKeys` field to the schematic, mapping to the\nimager's `SDBootEnrollKeys` profile option (off / manual / if-safe /\nforce) for the ISO and disk image outputs. It controls systemd-boot's\n`secure-boot-enroll` setting in loader.conf.\n\nThe default (if-safe) auto-enrolls SecureBoot \n[…]\ndded in siderolabs/talos#13571; see\nsiderolabs/talos#12568 for the discussion.\n\nSigned-off-by: Mickaël Canévet <mickael.canevet@proton.ch>\nSigned-off-by: Andrey Smirnov <andrey.smirnov@siderolabs.com>",
          "is_bot": false,
          "headline": "feat: add secureboot enrollKeys schematic option",
          "author_name": "Mickaël Canévet",
          "author_login": "mcanevet",
          "committed_at": "2026-06-12T13:10:44Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "805c51cb53287923c41070344e25194c1b30a008",
          "body": "Generate (or honor inbound X-Request-ID) a request ID per HTTP\nrequest, bind a request-scoped logger carrying it in the context,\nand echo the ID in the response header. All logs for one request\nnow share a request_id field.\n\nThreaded through the build path: the request logger is carried\ninto detache\n[…]\nhind singleflight, shared across\nrequests) and background htpasswd watcher logs are intentionally\nleft on the construction-time logger.\n\nSigned-off-by: Mateusz Urbanek <mateusz.urbanek@siderolabs.com>",
          "is_bot": false,
          "headline": "feat: add per-request correlation ID to logs",
          "author_name": "Mateusz Urbanek",
          "author_login": "shanduur",
          "committed_at": "2026-06-12T09:08:52Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "8cee96d4e7b51a233529f0d6c423890ba65c455c",
          "body": "Assert that PXE frontend is properly caching the\nassets.\n\nSigned-off-by: Mateusz Urbanek <mateusz.urbanek@siderolabs.com>",
          "is_bot": false,
          "headline": "feat: assert pxe cache in tests",
          "author_name": "Mateusz Urbanek",
          "author_login": "shanduur",
          "committed_at": "2026-06-12T07:43:07Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "4ec07895de9bda8df7c799472f9fb808a7fec920",
          "body": "Add options to configure debugging and setting default parallel jobs.\n\nSee: https://github.com/siderolabs/talos/pull/13462\n\nSigned-off-by: Noel Georgi <git@frezbo.dev>",
          "is_bot": false,
          "headline": "feat: bump go-conainerregistry",
          "author_name": "Noel Georgi",
          "author_login": "frezbo",
          "committed_at": "2026-06-04T17:37:01Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "425e59ee7350fadee7850ead7e329f889ee737f6",
          "body": "This is the official v1.3.3 release.\n\nSigned-off-by: Noel Georgi <git@frezbo.dev>",
          "is_bot": false,
          "headline": "release(v1.3.3): prepare release",
          "author_name": "Noel Georgi",
          "author_login": "frezbo",
          "committed_at": "2026-06-01T16:44:55Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "b5d3d9240959706c9b8bf5a0ad93b7ea4ca3c4e6",
          "body": "When adding extensions grype was unable to match the suppressions due to\nthe way we were generating sboms. So let's add a root identifier and put\nall others as a reference.\n\nSigned-off-by: Noel Georgi <git@frezbo.dev>",
          "is_bot": false,
          "headline": "fix: vulnerability scans with extensions",
          "author_name": "Noel Georgi",
          "author_login": "frezbo",
          "committed_at": "2026-06-01T15:23:02Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "916bcf69f12ef3bd7cf0991a166edba537300a2d",
          "body": "Update go-vex to bring in version ranges supported vex documents.\n\nSigned-off-by: Noel Georgi <git@frezbo.dev>",
          "is_bot": false,
          "headline": "feat: update go-vex",
          "author_name": "Noel Georgi",
          "author_login": "frezbo",
          "committed_at": "2026-06-01T13:05:55Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "9920386d1f64717786f6a4a930b0a719e81a95bc",
          "body": "Fixes #454\n\nMajor changes:\n\n* bump Talos & machinery & PKGS to match Talos 1.14.0-alpha.1\n* introduce disk image sector size\n* SecureBoot disk images auto-enroll\n\nSigned-off-by: Andrey Smirnov <andrey.smirnov@siderolabs.com>",
          "is_bot": false,
          "headline": "feat: update Image Factory with Talos 1.14.0-alpha.1",
          "author_name": "Andrey Smirnov",
          "author_login": "smira",
          "committed_at": "2026-05-29T17:38:57Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "d49e9523ba1755059eb8e6a2b08004c3fd6a68ad",
          "body": "In case of broken Talos release, we keep serving it in the UI/API. This\ncan lead to issues when customers download broken release and try to run\nit. We should be able to exclude the broken versions without creating\nnew release of Image Factory, purely by specifying them in config.\n\nFor API completeness, we will also serve /versions?broken=true endpoint\nthat lists the broken releases that should not be used.\n\nSigned-off-by: Mateusz Urbanek <mateusz.urbanek@siderolabs.com>",
          "is_bot": false,
          "headline": "feat: allow excluding Talos releases",
          "author_name": "Mateusz Urbanek",
          "author_login": "shanduur",
          "committed_at": "2026-05-27T11:07:28Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "147a3e8a648554a6810bb3423905d687efad6d31",
          "body": "Add a ScanReport function to the factory client to expose the /scans/ reporting endpoint.\n\nSigned-off-by: Edward Sammut Alessi <edward.sammutalessi@siderolabs.com>",
          "is_bot": false,
          "headline": "feat: add scan report to factory client",
          "author_name": "Edward Sammut Alessi",
          "author_login": "Slessi",
          "committed_at": "2026-05-26T14:24:15Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "2887e78d95a54e3eb397c7327d30c6754e84a22e",
          "body": "allow embedding machine configuration into Talos images.\n\nSigned-off-by: Orzelius <33936483+Orzelius@users.noreply.github.com>",
          "is_bot": false,
          "headline": "feat: add support for embedding machine configuration",
          "author_name": "Orzelius",
          "author_login": "Orzelius",
          "committed_at": "2026-05-25T11:45:07Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "660ac016f2ed970f0806f9f3f6b4d767ec280d84",
          "body": "This is the official v1.3.2 release.\n\nSigned-off-by: Mateusz Urbanek <mateusz.urbanek@siderolabs.com>",
          "is_bot": false,
          "headline": "release(v1.3.2): prepare release",
          "author_name": "Mateusz Urbanek",
          "author_login": "shanduur",
          "committed_at": "2026-05-25T06:08:19Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "38183fcbd0a0decebc7ea4ee4617f82fa52f637d",
          "body": "Update dependency to mitigate GO-2026-5025.\n\nSigned-off-by: Mateusz Urbanek <mateusz.urbanek@siderolabs.com>",
          "is_bot": false,
          "headline": "fix: update golang.org/x/net",
          "author_name": "Mateusz Urbanek",
          "author_login": "shanduur",
          "committed_at": "2026-05-25T05:07:04Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "9f6aee892c9446e54368f5efb0fcab00aadcf840",
          "body": "Fix bug where the PXE script path was not copyable when SecureBoot was enabled.\n\nSigned-off-by: Mateusz Urbanek <mateusz.urbanek@siderolabs.com>",
          "is_bot": false,
          "headline": "fix: make PXE copyable on SecureBoot",
          "author_name": "Mateusz Urbanek",
          "author_login": "shanduur",
          "committed_at": "2026-05-22T12:45:09Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "d7377c522e3a3c1e1d702d3ba41e76e3cce53847",
          "body": "Replace inline `style` attributes with Tailwind utility classes.\nImproves consistency across the codebase and reduces duplicated style definitions.\n\nSigned-off-by: Mateusz Urbanek <mateusz.urbanek@siderolabs.com>",
          "is_bot": false,
          "headline": "refactor: migrate to Tailwind CSS classes",
          "author_name": "Mateusz Urbanek",
          "author_login": "shanduur",
          "committed_at": "2026-05-22T10:29:43Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "1e86750993dac69f4dc1f0ea4b061ab6ec5c4c32",
          "body": "Update packages to fix some CVEs.\n\nSigned-off-by: Mateusz Urbanek <mateusz.urbanek@siderolabs.com>",
          "is_bot": false,
          "headline": "fix: update golang.org/x/* packages",
          "author_name": "Mateusz Urbanek",
          "author_login": "shanduur",
          "committed_at": "2026-05-22T09:08:37Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "33c79e4d5cdcee20c6018c7451f4263baf1f0b60",
          "body": "Chainsaw offers more debugging options compared to kuttl.\nIt also feels more natural for BDD tests.\n\nSigned-off-by: Mateusz Urbanek <mateusz.urbanek@siderolabs.com>",
          "is_bot": false,
          "headline": "test: move from kuttl to chainsaw",
          "author_name": "Mateusz Urbanek",
          "author_login": "shanduur",
          "committed_at": "2026-05-22T09:08:36Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "ba34dabf151028b77447449e4f255b7daf03e879",
          "body": "Migrate SPDX document cache configuration from global `Cache.OCI`\nto enterprise-specific `Enterprise.SPDX.Cache` for better separation\nof concerns and to enable per-component cache configurations.\n\nSigned-off-by: Mateusz Urbanek <mateusz.urbanek@siderolabs.com>",
          "is_bot": false,
          "headline": "feat: move SPDX cache to enterprise options",
          "author_name": "Mateusz Urbanek",
          "author_login": "shanduur",
          "committed_at": "2026-05-20T16:22:36Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "cd137edc8d54f3d9e8640552a0ca9a8a3e3dd582",
          "body": "and add some dev docs\n\nSigned-off-by: Orzelius <33936483+Orzelius@users.noreply.github.com>",
          "is_bot": false,
          "headline": "chore: disable authentication for local development",
          "author_name": "Orzelius",
          "author_login": "Orzelius",
          "committed_at": "2026-05-18T00:54:09Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "4ea792f31a1fabc331b6016da2e2138710a41772",
          "body": "extractTalosSPDX was building the imager profile via ParseFromPath\nalone, leaving prof.Version empty. The asset cache keys on\nfactoryprofile.Hash(prof), so every Talos version for a given (arch,\noutput kind) collapsed to the same hash and reused whichever\ninitramfs was built first. Two different ver\n[…]\nreturned\nSPDX bundles extracted from identical initramfs payloads - only\nDocumentName and DocumentNamespace differed between responses.\n\nSigned-off-by: Mateusz Urbanek <mateusz.urbanek@siderolabs.com>",
          "is_bot": false,
          "headline": "fix: build profile with version",
          "author_name": "Mateusz Urbanek",
          "author_login": "shanduur",
          "committed_at": "2026-05-14T17:31:08Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "fcf9d572b90ae0ef46083ca40117d72222381684",
          "body": "This is the official v1.3.1 release.\n\nSigned-off-by: Mateusz Urbanek <mateusz.urbanek@siderolabs.com>",
          "is_bot": false,
          "headline": "release(v1.3.1): prepare release",
          "author_name": "Mateusz Urbanek",
          "author_login": "shanduur",
          "committed_at": "2026-05-14T07:18:04Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "1d216c743a5739c3524a74df193b9153d8fd6934",
          "body": "Fix up the docs with correct ports and commands, and clarify\na bit.\n\nSigned-off-by: Andrey Smirnov <andrey.smirnov@siderolabs.com>",
          "is_bot": false,
          "headline": "docs: update the developing documentation",
          "author_name": "Andrey Smirnov",
          "author_login": "smira",
          "committed_at": "2026-05-13T12:29:53Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "4a60270218f1934e94376c662ee8d5b5ad8416ab",
          "body": "Config validation (externalURL, externalPXEURL) on startup -> catch\nerrors before runtime. Extracted buildDocumentNamespace for reuse.\n\nSort SPDX bundle files by source + filename -> fixes digest flips\nwhen rebuilding with identical inputs (map iteration order variance).\n\nChanges:\n- Add Options.Validate() checks URLs valid/required\n- Extract DocumentNamespace builder\n- Sort files deterministic\n- Add SPDX builder tests\n\nSigned-off-by: Mateusz Urbanek <mateusz.urbanek@siderolabs.com>",
          "is_bot": false,
          "headline": "fix(config): validate early and sort SPDX deterministically",
          "author_name": "Mateusz Urbanek",
          "author_login": "shanduur",
          "committed_at": "2026-05-11T14:42:26Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "41d39473ae7d7f150db45cdd1ea8dd1a986ed73a",
          "body": "This is the official v1.3.0 release.\n\nSigned-off-by: Mateusz Urbanek <mateusz.urbanek@siderolabs.com>",
          "is_bot": false,
          "headline": "release(v1.3.0): prepare release",
          "author_name": "Mateusz Urbanek",
          "author_login": "shanduur",
          "committed_at": "2026-05-08T12:28:53Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "ae3ed04c72ade3576647cf85cfe4d0a206b5cebe",
          "body": "This enables running image-factory Enterprise Edition via Helm while\nsupporting CVE vulnerability scanning with grype integration and VEX\nand SBOM document generation.\n\nSigned-off-by: Mateusz Urbanek <mateusz.urbanek@siderolabs.com>",
          "is_bot": false,
          "headline": "feat: add enterprise features with Helm chart support",
          "author_name": "Mateusz Urbanek",
          "author_login": "shanduur",
          "committed_at": "2026-05-08T11:55:29Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "3fb0f96a1acf9ec5920bb0c848ac2ee311d2efde",
          "body": "This feature is Enterprise only (requires BUSL).\n\nImplement Grype-backed vulnerability scanning for Talos SBOM with VEX\nsuppressions. Endpoint /scans/:schematic/:version/:arch/:report serves\nscan results in multiple formats (json, table, sarif, cdx) with per-version\ncaching and configurable database URL for air-gapped deployments.\n\nSigned-off-by: Mateusz Urbanek <mateusz.urbanek@siderolabs.com>",
          "is_bot": false,
          "headline": "feat(enterprise): add vulnerability scanning endpoint",
          "author_name": "Mateusz Urbanek",
          "author_login": "shanduur",
          "committed_at": "2026-05-07T11:48:04Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "92209b6d5e3f53320dedc61ca51b0261b10b9f0c",
          "body": "The schematic creation response now includes the canonical schematic body alongside the ID. Callers should adopt both as authoritative, since the factory may normalize formatting, reorder fields, or set the owner for authenticated requests, and the caller cannot reproduce all of these locally. The G\n[…]\n a non-empty owner is provided that does not match the authenticated user, instead of silently overwriting it.\n\nPart of siderolabs/omni#2797.\n\nSigned-off-by: Utku Ozdemir <utku.ozdemir@siderolabs.com>",
          "is_bot": false,
          "headline": "feat: return normalized schematic on creation",
          "author_name": "Utku Ozdemir",
          "author_login": "utkuozdemir",
          "committed_at": "2026-05-07T10:22:57Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "ba2a46de4940e5f732029a47a9e18b65b2689716",
          "body": "This feature is Enterprise only (requires BUSL).\n\nServes GET/HEAD /vex/:version/vex.json for Talos ≥ 1.13.0.\nPulls exploitability data from an OCI registry, generates a VEX\ndocument via go-vex, and caches it in-memory with configurable TTL.\n\nSigned-off-by: Mateusz Urbanek <mateusz.urbanek@siderolabs.com>",
          "is_bot": false,
          "headline": "feat(enterprise): implement VEX endpoint",
          "author_name": "Mateusz Urbanek",
          "author_login": "shanduur",
          "committed_at": "2026-05-05T14:28:55Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "9b40156959e2d659daa6c89af43c1382829b528b",
          "body": "This is useful as cli arguments and embedded config (to be added) can result in an extremely long url.\nAlso makes the final url easier to read and share, and allows users to bookmark the final configuration\nwith the schematic ID without needing to also include all the other parameters that were used to generate it.\n\nSigned-off-by: Orzelius <33936483+Orzelius@users.noreply.github.com>",
          "is_bot": false,
          "headline": "feat: show schematic-id url parameter on the final wizard step",
          "author_name": "Orzelius",
          "author_login": "Orzelius",
          "committed_at": "2026-05-04T06:43:31Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "114bb60b13dec500e1f07ddb3c2f85e699a2f4d6",
          "body": "Hardcoded `factory.talos.dev` in SPDX document namespace broke\ndeployments where image-factory runs under a different hostname.\nExternal URL now threads from service config through SPDXOptions\nand Builder down to namespace generation.\n\nFixes #440\n\nSigned-off-by: Mateusz Urbanek <mateusz.urbanek@siderolabs.com>",
          "is_bot": false,
          "headline": "fix(spdx): use configured external URL in document namespace",
          "author_name": "Mateusz Urbanek",
          "author_login": "shanduur",
          "committed_at": "2026-05-01T04:49:46Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "ccffefc07249de86eee00038a345aba504fa6e0b",
          "body": "This is the official v1.2.0 release.\n\nSigned-off-by: Edward Sammut Alessi <edward.sammutalessi@siderolabs.com>",
          "is_bot": false,
          "headline": "release(v1.2.0): prepare release",
          "author_name": "Edward Sammut Alessi",
          "author_login": "Slessi",
          "committed_at": "2026-04-28T08:13:23Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "4abeff4f1ac21e810f45e739c3be91eab68278a9",
          "body": "Add a /talosctl/:version endpoint which lists all downloadable talosctl binaries fro a given version.\n\nSigned-off-by: Edward Sammut Alessi <edward.sammutalessi@siderolabs.com>",
          "is_bot": false,
          "headline": "feat: add /talosctl/:version endpoint to list downloadable talosctls",
          "author_name": "Edward Sammut Alessi",
          "author_login": "Slessi",
          "committed_at": "2026-04-28T07:12:45Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "405b488070a54541dbc8f416f261cc660b744f30",
          "body": "Add French (fr) locale file with translations for the image-factory\nfrontend interface.\n\nSigned-off-by: Quentin Joly <quentinj@une-pause-cafe.fr>\nSigned-off-by: Andrey Smirnov <andrey.smirnov@siderolabs.com>",
          "is_bot": false,
          "headline": "feat(i18n): add french locale",
          "author_name": "Quentin Joly",
          "author_login": "qjoly",
          "committed_at": "2026-04-27T09:42:45Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "c6ad082dbbf9a084ad609f73788b1500ab8b0e08",
          "body": "\"latest\" now maps to latest non-prerelease version instead of external pass-through.\n\nSigned-off-by: Mateusz Urbanek <mateusz.urbanek@siderolabs.com>",
          "is_bot": false,
          "headline": "feat(registry): resolve latest tag to stable version",
          "author_name": "Mateusz Urbanek",
          "author_login": "shanduur",
          "committed_at": "2026-04-24T12:18:35Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "471706d29414e6349840ad2afc5e922add416edb",
          "body": "These were added when we were not keeping Image\nFactory up-to-date with Talos, this was a hack\nnever really worked in CI except a few times.\n\nSigned-off-by: Noel Georgi <git@frezbo.dev>",
          "is_bot": false,
          "headline": "chore: drop update to talos main tests",
          "author_name": "Noel Georgi",
          "author_login": "frezbo",
          "committed_at": "2026-04-22T20:14:36Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "403cd5a563a9b8aa08a328c026ad0303c7438429",
          "body": "  Move ownership/auth checks from scattered frontend handlers into\n  schematic.Factory.Get, which now accepts an OwnershipChecker. This\n  eliminates duplicated checkOwnership methods across http and spdx\n  frontends and ensures anonymous callers cannot probe schematic\n  existence when auth is enabled.\n\n  Also guard PXE credential embedding behind AuthProvider != nil so\n  credentials are never propagated when auth is disabled.\n\nSigned-off-by: Mateusz Urbanek <mateusz.urbanek@siderolabs.com>",
          "is_bot": false,
          "headline": "fix: centralize schematic ownership enforcement",
          "author_name": "Mateusz Urbanek",
          "author_login": "shanduur",
          "committed_at": "2026-04-21T13:12:24Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "f1cceee8cd394f377dd7910dfe7478a68ab36013",
          "body": "This feature is Enterprise only (requires BUSL).\n\nAny access to the schematic requires the user to be authenticated\nbefore access.\n\nMoreover, any schematic stores the owner in the schematic, so each\nschematic becomes private (owned by the user which created it).\n\nAuthentication is configured using a set of usernames and keys\nassociates with each user (API key).\n\nCo-authored-by: Andrey Smirnov <andrey.smirnov@siderolabs.com>\nSigned-off-by: Mateusz Urbanek <mateusz.urbanek@siderolabs.com>",
          "is_bot": false,
          "headline": "feat: implement authentication support",
          "author_name": "Mateusz Urbanek",
          "author_login": "shanduur",
          "committed_at": "2026-04-20T13:54:31Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "81f9312d0948d415be9d32629aacb30de50c5ab8",
          "body": "This is the official v1.1.0 release.\n\nSigned-off-by: Andrey Smirnov <andrey.smirnov@siderolabs.com>",
          "is_bot": false,
          "headline": "release(v1.1.0): prepare release",
          "author_name": "Andrey Smirnov",
          "author_login": "smira",
          "committed_at": "2026-04-17T13:38:22Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "1b834b7d2a9ffb384ea9043cd41da64f12acad8f",
          "body": "Add enterprise-only checksum endpoint: appending .sha256 or .sha512\nto any /image/ path returns a single-line checksum file instead of\nthe asset. Algorithm is selected from the suffix; the Checksummer\ninterface takes the suffix so no circular import is needed.\n\nWizard UI shows (sha256) and (sha512) \n[…]\nilds show a localized (checksums) tooltip.\nIntegration tests cover both algorithms (GET, HEAD, validate,\nreproducibility, error cases).\n\nSigned-off-by: Mateusz Urbanek <mateusz.urbanek@siderolabs.com>",
          "is_bot": false,
          "headline": "feat: add SHA-256 and SHA-512 checksum frontend",
          "author_name": "Mateusz Urbanek",
          "author_login": "shanduur",
          "committed_at": "2026-04-17T12:11:55Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "e775c3662baced044b6a8d6046c720de46177b55",
          "body": "Upgrade tailwind to v4, switch to bun.lock\n\nAlso fix check-dirty step in CI and cleanup helm values update.\n\nSigned-off-by: Noel Georgi <git@frezbo.dev>",
          "is_bot": false,
          "headline": "feat: upgrade tailwind to v4",
          "author_name": "Noel Georgi",
          "author_login": "frezbo",
          "committed_at": "2026-04-17T08:21:09Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "bb27d392abb0312c5cdf13212ecb26d1d16dd668",
          "body": "Rename consistently to 'Image Factory Enterprise'.\n\nPass Talos name down to profile.\n\nPass the image factory name (and url) in the schematic's extension\nAuthor field.\n\nSigned-off-by: Andrey Smirnov <andrey.smirnov@siderolabs.com>",
          "is_bot": false,
          "headline": "feat: update Talos to v1.13.0-rc.0",
          "author_name": "Andrey Smirnov",
          "author_login": "smira",
          "committed_at": "2026-04-16T14:20:50Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "2a5989044bd4b10775b39dfec6895e1effecf24e",
          "body": "Previous fix #419 fixed the push, but that was not enough to fix the pull for verify.\nThe error message returned from sigstore library was not helpful to debug this.\n\nSigned-off-by: Noel Georgi <git@frezbo.dev>",
          "is_bot": false,
          "headline": "fix: gsa signer pull during verify",
          "author_name": "Noel Georgi",
          "author_login": "frezbo",
          "committed_at": "2026-04-16T10:27:53Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "fbc302f868351e247833a33176de400b2883cda5",
          "body": "Support insecure registries for signature bundles.\n\nSigned-off-by: Noel Georgi <git@frezbo.dev>",
          "is_bot": false,
          "headline": "fix: support insecure registries for signature bundles",
          "author_name": "Noel Georgi",
          "author_login": "frezbo",
          "committed_at": "2026-04-15T14:34:14Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "8e7d10ec1318769a7f0cb0b5ea5e7f18bc35f42b",
          "body": "Add support for signing installer images with a Google Service Account.\n\nFixes: #412\n\nSigned-off-by: Noel Georgi <git@frezbo.dev>",
          "is_bot": false,
          "headline": "feat: add support for google service account signing",
          "author_name": "Noel Georgi",
          "author_login": "frezbo",
          "committed_at": "2026-04-15T07:52:25Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "74afd807740c38cc9e0378969f8836c2258e4637",
          "body": "Fixes #414\n\nSigned-off-by: Andrey Smirnov <andrey.smirnov@siderolabs.com>",
          "is_bot": false,
          "headline": "fix: set correct Content-Type when downloading images",
          "author_name": "Andrey Smirnov",
          "author_login": "smira",
          "committed_at": "2026-04-07T16:05:55Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "8372fe8854368362f0133047c8e6888b5b5ba207",
          "body": "Fixes #284\n\nSigned-off-by: Mateusz Urbanek <mateusz.urbanek@siderolabs.com>",
          "is_bot": false,
          "headline": "feat: add SPDX frontend",
          "author_name": "Mateusz Urbanek",
          "author_login": "shanduur",
          "committed_at": "2026-03-18T11:02:33Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "b379bf2cd2e3a3fc79f2cb1002e13d26a88f20b5",
          "body": "Fixes #408\n\nNow we have proper cache capacity, LRU, and also negative cache TTL to\nhelp with case when multiple instance might disagree on whether cache\ncontains not found or not.\n\nSigned-off-by: Andrey Smirnov <andrey.smirnov@siderolabs.com>",
          "is_bot": false,
          "headline": "feat: switch schematic cache to LRU and negative TTL",
          "author_name": "Andrey Smirnov",
          "author_login": "smira",
          "committed_at": "2026-02-27T12:17:26Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "04500387d7ff52dbe17f9f4bbe2d3ed35c641f2a",
          "body": "remove duplicate step, rekres, bump deps, fix lint issues\n\nSigned-off-by: Orzelius <33936483+Orzelius@users.noreply.github.com>",
          "is_bot": false,
          "headline": "chore: remove deuplicate k8s-down ci step",
          "author_name": "Orzelius",
          "author_login": "Orzelius",
          "committed_at": "2026-02-19T03:00:57Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "470cb2f0e8489faf2489a923e3698728a9b8aee0",
          "body": "Rekres to use large runners instead of generic ones, as Image Factory\ntests require lots of resources.\n\nSigned-off-by: Andrey Smirnov <andrey.smirnov@siderolabs.com>",
          "is_bot": false,
          "headline": "chore: switch to large runners",
          "author_name": "Andrey Smirnov",
          "author_login": "smira",
          "committed_at": "2026-02-18T13:08:59Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "713fc6ef2dc59b9db33c15a044019d6ff66f5b6f",
          "body": "Pulls in a fix https://github.com/siderolabs/talos/pull/12807.\n\nSigned-off-by: Andrey Smirnov <andrey.smirnov@siderolabs.com>",
          "is_bot": false,
          "headline": "fix: memory usage when building images",
          "author_name": "Andrey Smirnov",
          "author_login": "smira",
          "committed_at": "2026-02-18T12:26:53Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "0a252747c5d822d2567cea233981dac94e09aea7",
          "body": "Pulls in a fix https://github.com/siderolabs/talos/pull/12790\n\nSigned-off-by: Andrey Smirnov <andrey.smirnov@siderolabs.com>",
          "is_bot": false,
          "headline": "fix: excessive memory usage",
          "author_name": "Andrey Smirnov",
          "author_login": "smira",
          "committed_at": "2026-02-13T14:50:09Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "0f9eb2203599c417b362bfece38ee6b6a885573a",
          "body": "Bump Talos version and update machinery doc links to point to docs.siderolabs.com.\n\nSigned-off-by: Edward Sammut Alessi <edward.sammutalessi@siderolabs.com>",
          "is_bot": false,
          "headline": "feat: update machinery doc links",
          "author_name": "Edward Sammut Alessi",
          "author_login": "Slessi",
          "committed_at": "2026-02-10T14:34:27Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "f0c7a7b53ce86c49c1531e1f1fd15c5bf3f00a70",
          "body": "This is the official v1.0.3 release.\n\nSigned-off-by: Andrey Smirnov <andrey.smirnov@siderolabs.com>",
          "is_bot": false,
          "headline": "release(v1.0.3): prepare release",
          "author_name": "Andrey Smirnov",
          "author_login": "smira",
          "committed_at": "2026-02-09T11:11:24Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "dd926314f61e4bbd8797c0302e4a8a14b9d693fb",
          "body": "Documentation update.\n\nSigned-off-by: Andrey Smirnov <andrey.smirnov@siderolabs.com>",
          "is_bot": false,
          "headline": "docs: correct path to hack/copy-artifacts.sh",
          "author_name": "Daddie0",
          "author_login": "GoByeBye",
          "committed_at": "2026-02-09T10:37:40Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "ddc1a8389189e77e3f3679927ce550e9549a3e48",
          "body": "Pulls in a fix https://github.com/siderolabs/talos/pull/12747\n\nSigned-off-by: Andrey Smirnov <andrey.smirnov@siderolabs.com>",
          "is_bot": false,
          "headline": "fix: update Talos to fix rpi_5 build",
          "author_name": "Andrey Smirnov",
          "author_login": "smira",
          "committed_at": "2026-02-09T09:24:13Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "b3d07e5e38da475018493adb5106eca9348de517",
          "body": "Remove the generic \"Kubernetes 1.23+\" prerequisite as it's redundant and\npotentially confusing. The actual minimum Kubernetes version depends on\nthe hostUsers configuration:\n\nSigned-off-by: Kevin Tijssen <kevin.tijssen@siderolabs.com>",
          "is_bot": false,
          "headline": "docs: remove redundant Kubernetes version prerequisite",
          "author_name": "Kevin Tijssen",
          "author_login": "kevintijssen",
          "committed_at": "2026-02-06T13:43:52Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "96667959f60f6c4b6b670affdedc6ea898f6cfb2",
          "body": "Signed-off-by: Kevin Tijssen <kevin.tijssen@siderolabs.com>",
          "is_bot": false,
          "headline": "fix: values.schema.json",
          "author_name": "Kevin Tijssen",
          "author_login": "kevintijssen",
          "committed_at": "2026-02-06T13:34:42Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "8a8da46331b9dcd6353e93879f63c6a422d8d035",
          "body": "Signed-off-by: Kevin Tijssen <kevin.tijssen@siderolabs.com>",
          "is_bot": false,
          "headline": "feat: adjust security context for user namespace mode",
          "author_name": "Kevin Tijssen",
          "author_login": "kevintijssen",
          "committed_at": "2026-02-06T13:29:24Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "bc631dc3f9515bdbeabcb903190291805625ed9c",
          "body": "Signed-off-by: Kevin Tijssen <kevin.tijssen@siderolabs.com>",
          "is_bot": false,
          "headline": "fix: values.schema.json",
          "author_name": "Kevin Tijssen",
          "author_login": "kevintijssen",
          "committed_at": "2026-02-06T13:22:13Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "8ea6fe9eccba498f761061a4842616f58566e68e",
          "body": "Add support for Kubernetes user namespaces to enhance pod security isolation.\nThis feature allows pods to run with a separate user namespace instead of\nthe host's user namespace when hostUsers is set to false.\n\nChanges:\n- Add hostUsers configuration option to values.yaml (default: true)\n- Add Kubern\n[…]\nm-docs template (README.md.gotmpl) for automated documentation\n- Update README with comprehensive security, configuration, and setup guides\n\nSigned-off-by: Kevin Tijssen <kevin.tijssen@siderolabs.com>",
          "is_bot": false,
          "headline": "feat: add user namespace support with Kubernetes version validation",
          "author_name": "Kevin Tijssen",
          "author_login": "kevintijssen",
          "committed_at": "2026-02-06T13:13:36Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "324c464e22fff6ae13f4a199d7664229f628f07a",
          "body": "Also fix up the docs and allow doucumenting the non-leaf items to\nclarify the documentation.\n\nClarify external registry, add a note about proxying.\n\nFixes #388\n\nFixes #389\n\nSigned-off-by: Andrey Smirnov <andrey.smirnov@siderolabs.com>",
          "is_bot": false,
          "headline": "fix: skip initializing TUF if keyless signing is disabled",
          "author_name": "Andrey Smirnov",
          "author_login": "smira",
          "committed_at": "2026-02-06T09:58:49Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "a42b9d91c35d28817e43c8abc794f4cb3e7ae429",
          "body": "This is the official v1.0.2 release.\n\nSigned-off-by: Noel Georgi <git@frezbo.dev>",
          "is_bot": false,
          "headline": "release(v1.0.2): prepare release",
          "author_name": "Noel Georgi",
          "author_login": "frezbo",
          "committed_at": "2026-02-04T09:11:30Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "80d1ba3e0e2a94f86cd37f80786743d928eb2b24",
          "body": "This was missed in: #381\n\nSigned-off-by: Noel Georgi <git@frezbo.dev>",
          "is_bot": false,
          "headline": "fix: pass nameoptions to verify bundle too",
          "author_name": "Noel Georgi",
          "author_login": "frezbo",
          "committed_at": "2026-02-04T06:27:48Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "eec01d1d0351b31faa7357389933589d16d3dc04",
          "body": "This is the official v1.0.1 release.\n\nSigned-off-by: Andrey Smirnov <andrey.smirnov@siderolabs.com>",
          "is_bot": false,
          "headline": "release(v1.0.1): prepare release",
          "author_name": "Andrey Smirnov",
          "author_login": "smira",
          "committed_at": "2026-02-03T19:06:35Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "ec1c0a790c99c55fcc3c315429f96e266bee7343",
          "body": "The new verifier requires explicit insecure option for insecure\nregistries.\n\nThis affects configurations when the cache registry doesn't use\nlocalhost endpoint, but some hostname.\n\nAlso rekres and bump Talos.\n\nSigned-off-by: Andrey Smirnov <andrey.smirnov@siderolabs.com>",
          "is_bot": false,
          "headline": "fix: pass insecure to the cosign new bundle verifier",
          "author_name": "Andrey Smirnov",
          "author_login": "smira",
          "committed_at": "2026-02-03T17:21:17Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "14d0f2a1fa2d40448c28c51a8d3c57caa44d5bbf",
          "body": "This is the official v1.0.0 release.\n\nSigned-off-by: Noel Georgi <git@frezbo.dev>",
          "is_bot": false,
          "headline": "release(v1.0.0): prepare release",
          "author_name": "Noel Georgi",
          "author_login": "frezbo",
          "committed_at": "2026-01-30T00:07:25Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "a90529cc0066cd4c401b6e97bb69becfdcffc4f7",
          "body": "* Changed E2E timeouts\n* Changes Container securityContext\n\nSigned-off-by: Kevin Tijssen <kevin.tijssen@siderolabs.com>\nSigned-off-by: Noel Georgi <git@frezbo.dev>",
          "is_bot": false,
          "headline": "feat: add more security contexts",
          "author_name": "Kevin Tijssen",
          "author_login": "kevintijssen",
          "committed_at": "2026-01-29T15:14:16Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "ec69fe25da648422ef6a414bcddacab36e275579",
          "body": "Fix don't skip extra kernel args for overlay installers.\n\nFixes: #376\n\nSigned-off-by: Noel Georgi <git@frezbo.dev>",
          "is_bot": false,
          "headline": "fix: extra kernel args for overlays",
          "author_name": "Noel Georgi",
          "author_login": "frezbo",
          "committed_at": "2026-01-29T14:04:56Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "aa325ee4ffe3f5cc8ed818027e0b31e055d7fcdf",
          "body": "Add generation of Helm Docs and Helm JSON Schema for Factory chart.\n\nSigned-off-by: Mateusz Urbanek <mateusz.urbanek@siderolabs.com>",
          "is_bot": false,
          "headline": "feat: add Helm docs and schema",
          "author_name": "Mateusz Urbanek",
          "author_login": "shanduur",
          "committed_at": "2026-01-28T09:48:04Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "3c18e053c118131006b86affa7d0bb2af754cf95",
          "body": "Add Sidero Google Service Account Email also to the signer list.\n\nSigned-off-by: Noel Georgi <git@frezbo.dev>",
          "is_bot": false,
          "headline": "feat: add Sidero google service account email also to verfiers",
          "author_name": "Noel Georgi",
          "author_login": "frezbo",
          "committed_at": "2026-01-28T01:13:04Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "151feb5589624ad2a8365a9a056e08c4d6780b2c",
          "body": "Fixes: #355\n\nSigned-off-by: Noel Georgi <git@frezbo.dev>",
          "is_bot": false,
          "headline": "fix: docs url",
          "author_name": "Noel Georgi",
          "author_login": "frezbo",
          "committed_at": "2026-01-27T13:47:49Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "42a1c45849be02ca572ee6f66b875135d49b4805",
          "body": "Add kres rules for Helm chart management.\n\nSigned-off-by: Mateusz Urbanek <mateusz.urbanek@siderolabs.com>",
          "is_bot": false,
          "headline": "feat: add helm to kres",
          "author_name": "Mateusz Urbanek",
          "author_login": "shanduur",
          "committed_at": "2026-01-27T09:46:38Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "ac4718a617f88bfcfbe28edb2ee03a997fd19f7a",
          "body": "Brings in RPi5 SBC support, GRUB 2.14, and GRUB prefix fixes.\n\nSigned-off-by: Andrey Smirnov <andrey.smirnov@siderolabs.com>",
          "is_bot": false,
          "headline": "feat: update Talos and pkgs",
          "author_name": "Andrey Smirnov",
          "author_login": "smira",
          "committed_at": "2026-01-26T15:42:07Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "1d6468ee6daac0eddd0ae01cdd47d83190f6b9d0",
          "body": "Add kres configuration to enable testing Helm Chart in the CI.\n\nSigned-off-by: Mateusz Urbanek <mateusz.urbanek@siderolabs.com>",
          "is_bot": false,
          "headline": "feat: add helm e2e to CI",
          "author_name": "Mateusz Urbanek",
          "author_login": "shanduur",
          "committed_at": "2026-01-26T10:12:09Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "2f0499cc73b5c20ad806a26bc5392eafbf03a87c",
          "body": "Signed-off-by: Kevin Tijssen <kevin.tijssen@siderolabs.com>",
          "is_bot": false,
          "headline": "feat: added e2e tests",
          "author_name": "Kevin Tijssen",
          "author_login": "kevintijssen",
          "committed_at": "2026-01-26T08:11:26Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "2eccf98ad5eb3fc79f13bfc4a712743d09fc65ca",
          "body": "Signed-off-by: Kevin Tijssen <kevin.tijssen@siderolabs.com>",
          "is_bot": false,
          "headline": "fix: made changes on the recommendation of copilot",
          "author_name": "Kevin Tijssen",
          "author_login": "kevintijssen",
          "committed_at": "2026-01-26T08:11:24Z",
          "body_truncated": false,
          "is_coding_agent": false
        }
      ],
      "releases_count": 50,
      "commits_last_year": 158,
      "latest_release_at": "2026-07-20T12:34:13Z",
      "latest_release_tag": "v1.4.0",
      "releases_from_tags": false,
      "days_since_last_push": 0,
      "active_weeks_last_year": 44,
      "days_since_latest_release": 8,
      "mean_days_between_releases": 18.5
    },
    "community": {
      "has_readme": true,
      "has_license": true,
      "has_description": true,
      "has_contributing": false,
      "health_percentage": 50,
      "has_issue_template": false,
      "has_code_of_conduct": false,
      "has_pull_request_template": false
    },
    "ecosystem": {
      "packages": [
        {
          "name": "github.com/siderolabs/image-factory",
          "exists": true,
          "license": null,
          "keywords": [],
          "ecosystem": "go",
          "matches_repo": true,
          "registry_url": "https://pkg.go.dev/github.com/siderolabs/image-factory",
          "is_deprecated": false,
          "latest_version": "v1.4.0",
          "repository_url": "https://github.com/siderolabs/image-factory",
          "versions_count": 50,
          "total_downloads": null,
          "dependents_count": null,
          "deprecation_note": null,
          "maintainers_count": null,
          "monthly_downloads": null,
          "first_published_at": null,
          "latest_published_at": "2026-07-20T12:05:29Z",
          "latest_version_yanked": null,
          "days_since_latest_publish": 8
        }
      ]
    },
    "popularity": {
      "forks": 56,
      "stars": 191,
      "watchers": 6,
      "fork_history": {
        "days": [
          {
            "date": "2023-08-14",
            "count": 1
          },
          {
            "date": "2023-09-15",
            "count": 1
          },
          {
            "date": "2023-09-27",
            "count": 1
          },
          {
            "date": "2023-09-28",
            "count": 1
          },
          {
            "date": "2023-11-24",
            "count": 1
          },
          {
            "date": "2023-11-25",
            "count": 1
          },
          {
            "date": "2023-11-29",
            "count": 1
          },
          {
            "date": "2023-12-16",
            "count": 1
          },
          {
            "date": "2024-03-08",
            "count": 1
          },
          {
            "date": "2024-03-14",
            "count": 1
          },
          {
            "date": "2024-04-02",
            "count": 1
          },
          {
            "date": "2024-04-04",
            "count": 1
          },
          {
            "date": "2024-05-16",
            "count": 1
          },
          {
            "date": "2024-05-17",
            "count": 1
          },
          {
            "date": "2024-06-18",
            "count": 1
          },
          {
            "date": "2024-11-01",
            "count": 1
          },
          {
            "date": "2024-11-17",
            "count": 1
          },
          {
            "date": "2024-12-02",
            "count": 1
          },
          {
            "date": "2024-12-20",
            "count": 1
          },
          {
            "date": "2024-12-23",
            "count": 1
          },
          {
            "date": "2024-12-24",
            "count": 1
          },
          {
            "date": "2024-12-27",
            "count": 1
          },
          {
            "date": "2025-01-15",
            "count": 1
          },
          {
            "date": "2025-01-19",
            "count": 2
          },
          {
            "date": "2025-04-11",
            "count": 1
          },
          {
            "date": "2025-04-16",
            "count": 1
          },
          {
            "date": "2025-05-08",
            "count": 1
          },
          {
            "date": "2025-06-17",
            "count": 1
          },
          {
            "date": "2025-07-01",
            "count": 1
          },
          {
            "date": "2025-07-23",
            "count": 1
          },
          {
            "date": "2025-08-06",
            "count": 1
          },
          {
            "date": "2025-09-18",
            "count": 1
          },
          {
            "date": "2025-09-19",
            "count": 1
          },
          {
            "date": "2025-10-08",
            "count": 1
          },
          {
            "date": "2025-11-11",
            "count": 1
          },
          {
            "date": "2025-11-13",
            "count": 1
          },
          {
            "date": "2025-12-16",
            "count": 1
          },
          {
            "date": "2025-12-23",
            "count": 1
          },
          {
            "date": "2026-01-07",
            "count": 1
          },
          {
            "date": "2026-01-15",
            "count": 1
          },
          {
            "date": "2026-02-06",
            "count": 2
          },
          {
            "date": "2026-02-07",
            "count": 1
          },
          {
            "date": "2026-02-09",
            "count": 1
          },
          {
            "date": "2026-02-10",
            "count": 1
          },
          {
            "date": "2026-03-12",
            "count": 1
          },
          {
            "date": "2026-03-20",
            "count": 1
          },
          {
            "date": "2026-04-18",
            "count": 1
          },
          {
            "date": "2026-04-26",
            "count": 1
          },
          {
            "date": "2026-05-05",
            "count": 1
          },
          {
            "date": "2026-05-07",
            "count": 1
          },
          {
            "date": "2026-05-14",
            "count": 1
          },
          {
            "date": "2026-06-12",
            "count": 1
          },
          {
            "date": "2026-07-09",
            "count": 1
          },
          {
            "date": "2026-07-25",
            "count": 1
          }
        ],
        "complete": true,
        "collected": 56,
        "total_forks": 56
      },
      "star_history": null,
      "open_issues_and_prs": 17
    },
    "ai_readiness": {
      "has_nix": false,
      "example_dirs": [],
      "has_llms_txt": true,
      "has_dockerfile": true,
      "has_mcp_signal": false,
      "bootstrap_files": [
        "Makefile"
      ],
      "api_schema_files": [],
      "has_devcontainer": false,
      "typecheck_configs": [],
      "toolchain_manifests": [
        "go.mod"
      ],
      "largest_source_bytes": 47052,
      "source_files_sampled": 152,
      "oversized_source_files": 0,
      "agent_instruction_files": [],
      "agent_instruction_max_bytes": null
    },
    "dependencies": {
      "manifests": [
        "go.mod",
        "package.json"
      ],
      "advisories": {
        "error": null,
        "scope": "repository_graph",
        "source": "osv",
        "findings": [
          {
            "name": "github.com/google/cel-go",
            "direct": false,
            "version": "v0.28.1",
            "severity": "moderate",
            "ecosystem": "go",
            "cvss_score": 5.3,
            "advisory_ids": [
              "GHSA-gcjh-h69q-9w9g"
            ],
            "fixed_version": "0.29.0",
            "advisory_count": 1,
            "oldest_advisory_days": 4
          },
          {
            "name": "github.com/opencontainers/runc",
            "direct": false,
            "version": "v1.3.3",
            "severity": "low",
            "ecosystem": "go",
            "cvss_score": 3.3,
            "advisory_ids": [
              "GHSA-xjvp-4fhw-gc47",
              "GO-2026-5761"
            ],
            "fixed_version": "1.5.0-rc.3",
            "advisory_count": 2,
            "oldest_advisory_days": 36
          },
          {
            "name": "golang.org/x/crypto",
            "direct": true,
            "version": "v0.54.0",
            "severity": "unknown",
            "ecosystem": "go",
            "cvss_score": null,
            "advisory_ids": [
              "GO-2026-5932"
            ],
            "fixed_version": null,
            "advisory_count": 1,
            "oldest_advisory_days": 21
          }
        ],
        "collected": true,
        "malicious": [],
        "truncated": false,
        "by_severity": {
          "low": 1,
          "unknown": 1,
          "moderate": 1
        },
        "advisory_count": 4,
        "affected_count": 3,
        "assessed_count": 556,
        "malicious_count": 0,
        "assessed_package": null,
        "unassessed_count": 0,
        "direct_affected_count": 1
      },
      "ecosystems": [
        "go",
        "npm"
      ],
      "dependencies": [
        {
          "name": "cloud.google.com/go/auth",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.22.0"
        },
        {
          "name": "github.com/CalebQ42/squashfs",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.4.1"
        },
        {
          "name": "github.com/anchore/clio",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.1.1"
        },
        {
          "name": "github.com/anchore/grype",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.115.0"
        },
        {
          "name": "github.com/anchore/syft",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.46.0"
        },
        {
          "name": "github.com/blang/semver/v4",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v4.0.0"
        },
        {
          "name": "github.com/fsnotify/fsnotify",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.10.1"
        },
        {
          "name": "github.com/go-jose/go-jose/v4",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v4.1.4"
        },
        {
          "name": "github.com/google/go-containerregistry",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.21.7"
        },
        {
          "name": "github.com/google/uuid",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.6.0"
        },
        {
          "name": "github.com/h2non/filetype",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.1.3"
        },
        {
          "name": "github.com/hashicorp/go-cleanhttp",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.5.2"
        },
        {
          "name": "github.com/in-toto/attestation",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.2.0"
        },
        {
          "name": "github.com/jellydator/ttlcache/v3",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v3.4.1"
        },
        {
          "name": "github.com/julienschmidt/httprouter",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.3.0"
        },
        {
          "name": "github.com/klauspost/compress",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.19.0"
        },
        {
          "name": "github.com/knadh/koanf/parsers/dotenv",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.1.1"
        },
        {
          "name": "github.com/knadh/koanf/parsers/json",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.0.0"
        },
        {
          "name": "github.com/knadh/koanf/parsers/yaml",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.1.0"
        },
        {
          "name": "github.com/knadh/koanf/providers/env/v2",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v2.0.0"
        },
        {
          "name": "github.com/knadh/koanf/providers/file",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.2.1"
        },
        {
          "name": "github.com/knadh/koanf/providers/structs",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.0.0"
        },
        {
          "name": "github.com/knadh/koanf/v2",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v2.3.5"
        },
        {
          "name": "github.com/minio/minio-go/v7",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v7.2.1"
        },
        {
          "name": "github.com/nicksnyder/go-i18n/v2",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v2.6.1"
        },
        {
          "name": "github.com/opencontainers/go-digest",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.0.0"
        },
        {
          "name": "github.com/ory/dockertest",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v3.3.5+incompatible"
        },
        {
          "name": "github.com/prometheus/client_golang",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.23.2"
        },
        {
          "name": "github.com/rs/cors",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.11.1"
        },
        {
          "name": "github.com/siderolabs/crypto",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.6.5"
        },
        {
          "name": "github.com/siderolabs/gen",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.8.7"
        },
        {
          "name": "github.com/siderolabs/go-blockdevice/v2",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v2.0.32"
        },
        {
          "name": "github.com/siderolabs/go-debug",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.6.2"
        },
        {
          "name": "github.com/siderolabs/go-pointer",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.0.1"
        },
        {
          "name": "github.com/siderolabs/go-vex",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.1.1"
        },
        {
          "name": "github.com/siderolabs/talos",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.14.0-alpha.1"
        },
        {
          "name": "github.com/siderolabs/talos/pkg/machinery",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.14.0-alpha.1"
        },
        {
          "name": "github.com/sigstore/cosign/v3",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v3.1.2"
        },
        {
          "name": "github.com/sigstore/protobuf-specs",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.5.1"
        },
        {
          "name": "github.com/sigstore/sigstore",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.10.8"
        },
        {
          "name": "github.com/sigstore/sigstore-go",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.2.2"
        },
        {
          "name": "github.com/slok/go-http-metrics",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.13.0"
        },
        {
          "name": "github.com/spdx/tools-golang",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.6.0-rc4"
        },
        {
          "name": "github.com/spf13/pflag",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.0.10"
        },
        {
          "name": "github.com/stretchr/testify",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.11.1"
        },
        {
          "name": "github.com/u-root/u-root",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.16.0"
        },
        {
          "name": "github.com/ulikunitz/xz",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.5.15"
        },
        {
          "name": "go.uber.org/goleak",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.3.0"
        },
        {
          "name": "go.uber.org/zap",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.28.0"
        },
        {
          "name": "go.yaml.in/yaml/v4",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v4.0.0-rc.4"
        },
        {
          "name": "golang.org/x/crypto",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.54.0"
        },
        {
          "name": "golang.org/x/sync",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.22.0"
        },
        {
          "name": "golang.org/x/sys",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.47.0"
        },
        {
          "name": "golang.org/x/text",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.40.0"
        },
        {
          "name": "google.golang.org/protobuf",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.36.12-0.20260120151049-f2248ac996af"
        },
        {
          "name": "gopkg.in/natefinch/lumberjack.v2",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v2.2.1"
        },
        {
          "name": "@tailwindcss/forms",
          "manifest": "package.json",
          "ecosystem": "npm",
          "version_constraint": "^0.5.11"
        },
        {
          "name": "@tailwindcss/typography",
          "manifest": "package.json",
          "ecosystem": "npm",
          "version_constraint": "^0.5.19"
        },
        {
          "name": "tailwindcss",
          "manifest": "package.json",
          "ecosystem": "npm",
          "version_constraint": "^4.2.2"
        }
      ],
      "all_dependencies": {
        "error": null,
        "source": "github-sbom",
        "packages": [
          {
            "name": "cloud.google.com/go/auth",
            "direct": true,
            "version": "v0.22.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/anchore/clio",
            "direct": true,
            "version": "v0.1.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/anchore/grype",
            "direct": true,
            "version": "v0.115.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/anchore/syft",
            "direct": true,
            "version": "v1.46.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/blang/semver/v4",
            "direct": true,
            "version": "v4.0.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/calebq42/squashfs",
            "direct": true,
            "version": "v1.4.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/fsnotify/fsnotify",
            "direct": true,
            "version": "v1.10.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/go-jose/go-jose/v4",
            "direct": true,
            "version": "v4.1.4",
            "ecosystem": "go"
          },
          {
            "name": "github.com/google/go-containerregistry",
            "direct": true,
            "version": "v0.21.7",
            "ecosystem": "go"
          },
          {
            "name": "github.com/google/uuid",
            "direct": true,
            "version": "v1.6.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/h2non/filetype",
            "direct": true,
            "version": "v1.1.3",
            "ecosystem": "go"
          },
          {
            "name": "github.com/hashicorp/go-cleanhttp",
            "direct": true,
            "version": "v0.5.2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/in-toto/attestation",
            "direct": true,
            "version": "v1.2.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/jellydator/ttlcache/v3",
            "direct": true,
            "version": "v3.4.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/julienschmidt/httprouter",
            "direct": true,
            "version": "v1.3.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/klauspost/compress",
            "direct": true,
            "version": "v1.19.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/knadh/koanf/parsers/dotenv",
            "direct": true,
            "version": "v1.1.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/knadh/koanf/parsers/json",
            "direct": true,
            "version": "v1.0.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/knadh/koanf/parsers/yaml",
            "direct": true,
            "version": "v1.1.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/knadh/koanf/providers/env/v2",
            "direct": true,
            "version": "v2.0.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/knadh/koanf/providers/file",
            "direct": true,
            "version": "v1.2.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/knadh/koanf/providers/structs",
            "direct": true,
            "version": "v1.0.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/knadh/koanf/v2",
            "direct": true,
            "version": "v2.3.5",
            "ecosystem": "go"
          },
          {
            "name": "github.com/minio/minio-go/v7",
            "direct": true,
            "version": "v7.2.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/nicksnyder/go-i18n/v2",
            "direct": true,
            "version": "v2.6.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/opencontainers/go-digest",
            "direct": true,
            "version": "v1.0.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/ory/dockertest",
            "direct": true,
            "version": "v3.3.5+incompatible",
            "ecosystem": "go"
          },
          {
            "name": "github.com/prometheus/client_golang",
            "direct": true,
            "version": "v1.23.2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/rs/cors",
            "direct": true,
            "version": "v1.11.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/siderolabs/crypto",
            "direct": true,
            "version": "v0.6.5",
            "ecosystem": "go"
          },
          {
            "name": "github.com/siderolabs/gen",
            "direct": true,
            "version": "v0.8.7",
            "ecosystem": "go"
          },
          {
            "name": "github.com/siderolabs/go-blockdevice/v2",
            "direct": true,
            "version": "v2.0.32",
            "ecosystem": "go"
          },
          {
            "name": "github.com/siderolabs/go-debug",
            "direct": true,
            "version": "v0.6.2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/siderolabs/go-pointer",
            "direct": true,
            "version": "v1.0.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/siderolabs/go-vex",
            "direct": true,
            "version": "v0.1.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/siderolabs/talos",
            "direct": true,
            "version": "v1.14.0-alpha.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/siderolabs/talos/pkg/machinery",
            "direct": true,
            "version": "v1.14.0-alpha.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/sigstore/cosign/v3",
            "direct": true,
            "version": "v3.1.2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/sigstore/protobuf-specs",
            "direct": true,
            "version": "v0.5.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/sigstore/sigstore",
            "direct": true,
            "version": "v1.10.8",
            "ecosystem": "go"
          },
          {
            "name": "github.com/sigstore/sigstore-go",
            "direct": true,
            "version": "v1.2.2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/slok/go-http-metrics",
            "direct": true,
            "version": "v0.13.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/spdx/tools-golang",
            "direct": true,
            "version": "v0.6.0-rc4",
            "ecosystem": "go"
          },
          {
            "name": "github.com/spf13/pflag",
            "direct": true,
            "version": "v1.0.10",
            "ecosystem": "go"
          },
          {
            "name": "github.com/stretchr/testify",
            "direct": true,
            "version": "v1.11.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/u-root/u-root",
            "direct": true,
            "version": "v0.16.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/ulikunitz/xz",
            "direct": true,
            "version": "v0.5.15",
            "ecosystem": "go"
          },
          {
            "name": "go.uber.org/goleak",
            "direct": true,
            "version": "v1.3.0",
            "ecosystem": "go"
          },
          {
            "name": "go.uber.org/zap",
            "direct": true,
            "version": "v1.28.0",
            "ecosystem": "go"
          },
          {
            "name": "go.yaml.in/yaml/v4",
            "direct": true,
            "version": "v4.0.0-rc.4",
            "ecosystem": "go"
          },
          {
            "name": "golang.org/x/crypto",
            "direct": true,
            "version": "v0.54.0",
            "ecosystem": "go"
          },
          {
            "name": "golang.org/x/sync",
            "direct": true,
            "version": "v0.22.0",
            "ecosystem": "go"
          },
          {
            "name": "golang.org/x/sys",
            "direct": true,
            "version": "v0.47.0",
            "ecosystem": "go"
          },
          {
            "name": "golang.org/x/text",
            "direct": true,
            "version": "v0.40.0",
            "ecosystem": "go"
          },
          {
            "name": "google.golang.org/protobuf",
            "direct": true,
            "version": "v1.36.12-0.20260120151049-f2248ac996af",
            "ecosystem": "go"
          },
          {
            "name": "gopkg.in/natefinch/lumberjack.v2",
            "direct": true,
            "version": "v2.2.1",
            "ecosystem": "go"
          },
          {
            "name": "@tailwindcss/forms",
            "direct": true,
            "version": "0.5.11",
            "ecosystem": "npm"
          },
          {
            "name": "@tailwindcss/typography",
            "direct": true,
            "version": "0.5.19",
            "ecosystem": "npm"
          },
          {
            "name": "tailwindcss",
            "direct": true,
            "version": "4.2.2",
            "ecosystem": "npm"
          },
          {
            "name": "cel.dev/expr",
            "direct": false,
            "version": "v0.25.1",
            "ecosystem": "go"
          },
          {
            "name": "cloud.google.com/go",
            "direct": false,
            "version": "v0.123.0",
            "ecosystem": "go"
          },
          {
            "name": "cloud.google.com/go/auth/oauth2adapt",
            "direct": false,
            "version": "v0.2.8",
            "ecosystem": "go"
          },
          {
            "name": "cloud.google.com/go/compute/metadata",
            "direct": false,
            "version": "v0.9.0",
            "ecosystem": "go"
          },
          {
            "name": "cloud.google.com/go/iam",
            "direct": false,
            "version": "v1.11.0",
            "ecosystem": "go"
          },
          {
            "name": "cloud.google.com/go/monitoring",
            "direct": false,
            "version": "v1.25.0",
            "ecosystem": "go"
          },
          {
            "name": "cloud.google.com/go/storage",
            "direct": false,
            "version": "v1.62.2",
            "ecosystem": "go"
          },
          {
            "name": "dario.cat/mergo",
            "direct": false,
            "version": "v1.0.2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/acobaugh/osrelease",
            "direct": false,
            "version": "v0.1.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/adrg/xdg",
            "direct": false,
            "version": "v0.5.3",
            "ecosystem": "go"
          },
          {
            "name": "github.com/agext/levenshtein",
            "direct": false,
            "version": "v1.2.3",
            "ecosystem": "go"
          },
          {
            "name": "github.com/anchore/fangs",
            "direct": false,
            "version": "v0.1.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/anchore/go-collections",
            "direct": false,
            "version": "v0.1.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/anchore/go-homedir",
            "direct": false,
            "version": "v0.1.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/anchore/go-logger",
            "direct": false,
            "version": "v0.1.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/anchore/go-lzo",
            "direct": false,
            "version": "v0.1.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/anchore/go-macholibre",
            "direct": false,
            "version": "v0.1.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/anchore/go-rpmdb",
            "direct": false,
            "version": "v0.1.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/anchore/go-struct-converter",
            "direct": false,
            "version": "v0.2.0-rc2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/anchore/go-sync",
            "direct": false,
            "version": "v0.1.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/anchore/go-version",
            "direct": false,
            "version": "v1.2.2-0.20210903204242-51efa5b487c4",
            "ecosystem": "go"
          },
          {
            "name": "github.com/anchore/packageurl-go",
            "direct": false,
            "version": "v0.2.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/anchore/stereoscope",
            "direct": false,
            "version": "v0.2.2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/andybalholm/brotli",
            "direct": false,
            "version": "v1.2.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/antlr4-go/antlr/v4",
            "direct": false,
            "version": "v4.13.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/apparentlymart/go-textseg/v15",
            "direct": false,
            "version": "v15.0.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/aquasecurity/go-pep440-version",
            "direct": false,
            "version": "v0.0.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/aquasecurity/go-version",
            "direct": false,
            "version": "v0.0.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/armon/circbuf",
            "direct": false,
            "version": "v0.0.0-20190214190532-5111143e8da2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/asaskevich/govalidator",
            "direct": false,
            "version": "v0.0.0-20230301143203-a9d515a09cc2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/aws/aws-sdk-go-v2",
            "direct": false,
            "version": "v1.42.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream",
            "direct": false,
            "version": "v1.7.11",
            "ecosystem": "go"
          },
          {
            "name": "github.com/aws/aws-sdk-go-v2/config",
            "direct": false,
            "version": "v1.32.25",
            "ecosystem": "go"
          },
          {
            "name": "github.com/aws/aws-sdk-go-v2/credentials",
            "direct": false,
            "version": "v1.19.24",
            "ecosystem": "go"
          },
          {
            "name": "github.com/aws/aws-sdk-go-v2/feature/ec2/imds",
            "direct": false,
            "version": "v1.18.29",
            "ecosystem": "go"
          },
          {
            "name": "github.com/aws/aws-sdk-go-v2/internal/configsources",
            "direct": false,
            "version": "v1.4.29",
            "ecosystem": "go"
          },
          {
            "name": "github.com/aws/aws-sdk-go-v2/internal/endpoints/v2",
            "direct": false,
            "version": "v2.7.29",
            "ecosystem": "go"
          },
          {
            "name": "github.com/aws/aws-sdk-go-v2/internal/v4a",
            "direct": false,
            "version": "v1.4.30",
            "ecosystem": "go"
          },
          {
            "name": "github.com/aws/aws-sdk-go-v2/service/acm",
            "direct": false,
            "version": "v1.39.2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding",
            "direct": false,
            "version": "v1.13.12",
            "ecosystem": "go"
          },
          {
            "name": "github.com/aws/aws-sdk-go-v2/service/internal/checksum",
            "direct": false,
            "version": "v1.9.18",
            "ecosystem": "go"
          },
          {
            "name": "github.com/aws/aws-sdk-go-v2/service/internal/presigned-url",
            "direct": false,
            "version": "v1.13.29",
            "ecosystem": "go"
          },
          {
            "name": "github.com/aws/aws-sdk-go-v2/service/internal/s3shared",
            "direct": false,
            "version": "v1.19.25",
            "ecosystem": "go"
          },
          {
            "name": "github.com/aws/aws-sdk-go-v2/service/kms",
            "direct": false,
            "version": "v1.53.4",
            "ecosystem": "go"
          },
          {
            "name": "github.com/aws/aws-sdk-go-v2/service/s3",
            "direct": false,
            "version": "v1.102.2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/aws/aws-sdk-go-v2/service/signin",
            "direct": false,
            "version": "v1.2.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/aws/aws-sdk-go-v2/service/sso",
            "direct": false,
            "version": "v1.31.3",
            "ecosystem": "go"
          },
          {
            "name": "github.com/aws/aws-sdk-go-v2/service/ssooidc",
            "direct": false,
            "version": "v1.36.6",
            "ecosystem": "go"
          },
          {
            "name": "github.com/aws/aws-sdk-go-v2/service/sts",
            "direct": false,
            "version": "v1.43.3",
            "ecosystem": "go"
          },
          {
            "name": "github.com/aws/smithy-go",
            "direct": false,
            "version": "v1.27.2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/aymanbagabas/go-osc52/v2",
            "direct": false,
            "version": "v2.0.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/azure/azure-sdk-for-go/sdk/azcore",
            "direct": false,
            "version": "v1.22.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/azure/azure-sdk-for-go/sdk/azidentity",
            "direct": false,
            "version": "v1.14.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/azure/azure-sdk-for-go/sdk/internal",
            "direct": false,
            "version": "v1.12.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/azure/azure-sdk-for-go/sdk/security/keyvault/azcertificates",
            "direct": false,
            "version": "v1.5.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/azure/azure-sdk-for-go/sdk/security/keyvault/azkeys",
            "direct": false,
            "version": "v1.5.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/azure/azure-sdk-for-go/sdk/security/keyvault/internal",
            "direct": false,
            "version": "v1.2.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/azure/go-ansiterm",
            "direct": false,
            "version": "v0.0.0-20250102033503-faa5f7b0171c",
            "ecosystem": "go"
          },
          {
            "name": "github.com/azuread/microsoft-authentication-library-for-go",
            "direct": false,
            "version": "v1.7.2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/becheran/wildmatch-go",
            "direct": false,
            "version": "v1.0.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/beorn7/perks",
            "direct": false,
            "version": "v1.0.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/bgentry/go-netrc",
            "direct": false,
            "version": "v0.0.0-20140422174119-9fd32a8b3d3d",
            "ecosystem": "go"
          },
          {
            "name": "github.com/bitnami/go-version",
            "direct": false,
            "version": "v0.0.0-20250505154626-452e8c5ee607",
            "ecosystem": "go"
          },
          {
            "name": "github.com/blakesmith/ar",
            "direct": false,
            "version": "v0.0.0-20190502131153-809d4375e1fb",
            "ecosystem": "go"
          },
          {
            "name": "github.com/blang/semver",
            "direct": false,
            "version": "v3.5.1+incompatible",
            "ecosystem": "go"
          },
          {
            "name": "github.com/bmatcuk/doublestar/v2",
            "direct": false,
            "version": "v2.0.4",
            "ecosystem": "go"
          },
          {
            "name": "github.com/bmatcuk/doublestar/v4",
            "direct": false,
            "version": "v4.10.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/bodgit/plumbing",
            "direct": false,
            "version": "v1.3.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/bodgit/sevenzip",
            "direct": false,
            "version": "v1.6.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/bodgit/windows",
            "direct": false,
            "version": "v1.0.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/burntsushi/toml",
            "direct": false,
            "version": "v1.6.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/cenkalti/backoff",
            "direct": false,
            "version": "v2.2.1+incompatible",
            "ecosystem": "go"
          },
          {
            "name": "github.com/cenkalti/backoff/v4",
            "direct": false,
            "version": "v4.3.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/cenkalti/backoff/v5",
            "direct": false,
            "version": "v5.0.3",
            "ecosystem": "go"
          },
          {
            "name": "github.com/cespare/xxhash/v2",
            "direct": false,
            "version": "v2.3.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/charmbracelet/colorprofile",
            "direct": false,
            "version": "v0.4.3",
            "ecosystem": "go"
          },
          {
            "name": "github.com/charmbracelet/lipgloss",
            "direct": false,
            "version": "v1.1.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/charmbracelet/x/ansi",
            "direct": false,
            "version": "v0.11.7",
            "ecosystem": "go"
          },
          {
            "name": "github.com/charmbracelet/x/cellbuf",
            "direct": false,
            "version": "v0.0.15",
            "ecosystem": "go"
          },
          {
            "name": "github.com/charmbracelet/x/term",
            "direct": false,
            "version": "v0.2.2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/clipperhouse/displaywidth",
            "direct": false,
            "version": "v0.11.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/clipperhouse/uax29/v2",
            "direct": false,
            "version": "v2.7.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/cloudflare/circl",
            "direct": false,
            "version": "v1.6.3",
            "ecosystem": "go"
          },
          {
            "name": "github.com/cncf/xds/go",
            "direct": false,
            "version": "v0.0.0-20260202195803-dba9d589def2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/containerd/cgroups/v3",
            "direct": false,
            "version": "v3.1.3",
            "ecosystem": "go"
          },
          {
            "name": "github.com/containerd/containerd/api",
            "direct": false,
            "version": "v1.11.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/containerd/containerd/v2",
            "direct": false,
            "version": "v2.3.2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/containerd/continuity",
            "direct": false,
            "version": "v0.5.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/containerd/errdefs",
            "direct": false,
            "version": "v1.0.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/containerd/errdefs/pkg",
            "direct": false,
            "version": "v0.3.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/containerd/fifo",
            "direct": false,
            "version": "v1.1.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/containerd/go-cni",
            "direct": false,
            "version": "v1.1.13",
            "ecosystem": "go"
          },
          {
            "name": "github.com/containerd/log",
            "direct": false,
            "version": "v0.1.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/containerd/platforms",
            "direct": false,
            "version": "v1.0.0-rc.4",
            "ecosystem": "go"
          },
          {
            "name": "github.com/containerd/plugin",
            "direct": false,
            "version": "v1.1.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/containerd/ttrpc",
            "direct": false,
            "version": "v1.2.8",
            "ecosystem": "go"
          },
          {
            "name": "github.com/containerd/typeurl/v2",
            "direct": false,
            "version": "v2.3.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/containernetworking/cni",
            "direct": false,
            "version": "v1.3.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/coreos/go-oidc/v3",
            "direct": false,
            "version": "v3.20.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/cosi-project/runtime",
            "direct": false,
            "version": "v1.16.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/cyberphone/json-canonicalization",
            "direct": false,
            "version": "v0.0.0-20241213102144-19d51d7fe467",
            "ecosystem": "go"
          },
          {
            "name": "github.com/cyclonedx/cyclonedx-go",
            "direct": false,
            "version": "v0.11.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/cyphar/filepath-securejoin",
            "direct": false,
            "version": "v0.6.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/datadog/zstd",
            "direct": false,
            "version": "v1.5.7",
            "ecosystem": "go"
          },
          {
            "name": "github.com/davecgh/go-spew",
            "direct": false,
            "version": "v1.1.2-0.20180830191138-d8f796af33cc",
            "ecosystem": "go"
          },
          {
            "name": "github.com/deitch/magic",
            "direct": false,
            "version": "v0.0.0-20240306090643-c67ab88f10cb",
            "ecosystem": "go"
          },
          {
            "name": "github.com/digitorus/pkcs7",
            "direct": false,
            "version": "v0.0.0-20250730155240-ffadbf3f398c",
            "ecosystem": "go"
          },
          {
            "name": "github.com/digitorus/timestamp",
            "direct": false,
            "version": "v0.0.0-20250524132541-c45532741eea",
            "ecosystem": "go"
          },
          {
            "name": "github.com/diskfs/go-diskfs",
            "direct": false,
            "version": "v1.9.3",
            "ecosystem": "go"
          },
          {
            "name": "github.com/distribution/reference",
            "direct": false,
            "version": "v0.6.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/docker/cli",
            "direct": false,
            "version": "v29.6.1+incompatible",
            "ecosystem": "go"
          },
          {
            "name": "github.com/docker/docker-credential-helpers",
            "direct": false,
            "version": "v0.9.8",
            "ecosystem": "go"
          },
          {
            "name": "github.com/docker/go-connections",
            "direct": false,
            "version": "v0.7.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/docker/go-units",
            "direct": false,
            "version": "v0.5.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/dsnet/compress",
            "direct": false,
            "version": "v0.0.2-0.20230904184137-39efe44ab707",
            "ecosystem": "go"
          },
          {
            "name": "github.com/dustin/go-humanize",
            "direct": false,
            "version": "v1.0.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/elliotchance/phpserialize",
            "direct": false,
            "version": "v1.4.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/emicklei/go-restful/v3",
            "direct": false,
            "version": "v3.13.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/emirpasic/gods",
            "direct": false,
            "version": "v1.18.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/envoyproxy/go-control-plane/envoy",
            "direct": false,
            "version": "v1.37.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/envoyproxy/protoc-gen-validate",
            "direct": false,
            "version": "v1.3.3",
            "ecosystem": "go"
          },
          {
            "name": "github.com/equinix-ms/go-vmw-guestrpc",
            "direct": false,
            "version": "v1.0.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/facebookincubator/nvdtools",
            "direct": false,
            "version": "v0.1.5",
            "ecosystem": "go"
          },
          {
            "name": "github.com/fatih/color",
            "direct": false,
            "version": "v1.19.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/fatih/structs",
            "direct": false,
            "version": "v1.1.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/felixge/fgprof",
            "direct": false,
            "version": "v0.9.5",
            "ecosystem": "go"
          },
          {
            "name": "github.com/felixge/httpsnoop",
            "direct": false,
            "version": "v1.0.4",
            "ecosystem": "go"
          },
          {
            "name": "github.com/foxboron/go-uefi",
            "direct": false,
            "version": "v0.0.0-20251010190908-d29549a44f29",
            "ecosystem": "go"
          },
          {
            "name": "github.com/freddierice/go-losetup/v2",
            "direct": false,
            "version": "v2.0.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/fxamacker/cbor/v2",
            "direct": false,
            "version": "v2.9.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/g0rbe/go-chattr",
            "direct": false,
            "version": "v1.0.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/gabriel-vasile/mimetype",
            "direct": false,
            "version": "v1.4.13",
            "ecosystem": "go"
          },
          {
            "name": "github.com/gertd/go-pluralize",
            "direct": false,
            "version": "v0.2.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/github/go-spdx/v2",
            "direct": false,
            "version": "v2.7.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/glebarez/go-sqlite",
            "direct": false,
            "version": "v1.22.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/glebarez/sqlite",
            "direct": false,
            "version": "v1.11.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/go-chi/chi/v5",
            "direct": false,
            "version": "v5.3.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/go-git/gcfg",
            "direct": false,
            "version": "v1.5.1-0.20230307220236-3a3c6141e376",
            "ecosystem": "go"
          },
          {
            "name": "github.com/go-git/go-billy/v5",
            "direct": false,
            "version": "v5.9.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/go-git/go-git/v5",
            "direct": false,
            "version": "v5.19.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/go-logr/logr",
            "direct": false,
            "version": "v1.4.3",
            "ecosystem": "go"
          },
          {
            "name": "github.com/go-logr/stdr",
            "direct": false,
            "version": "v1.2.2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/go-openapi/analysis",
            "direct": false,
            "version": "v0.25.3",
            "ecosystem": "go"
          },
          {
            "name": "github.com/go-openapi/errors",
            "direct": false,
            "version": "v0.22.8",
            "ecosystem": "go"
          },
          {
            "name": "github.com/go-openapi/jsonpointer",
            "direct": false,
            "version": "v1.0.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/go-openapi/jsonreference",
            "direct": false,
            "version": "v1.0.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/go-openapi/loads",
            "direct": false,
            "version": "v0.24.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/go-openapi/runtime",
            "direct": false,
            "version": "v0.32.4",
            "ecosystem": "go"
          },
          {
            "name": "github.com/go-openapi/runtime/server-middleware",
            "direct": false,
            "version": "v0.32.4",
            "ecosystem": "go"
          },
          {
            "name": "github.com/go-openapi/spec",
            "direct": false,
            "version": "v0.22.6",
            "ecosystem": "go"
          },
          {
            "name": "github.com/go-openapi/strfmt",
            "direct": false,
            "version": "v0.26.4",
            "ecosystem": "go"
          },
          {
            "name": "github.com/go-openapi/swag",
            "direct": false,
            "version": "v0.27.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/go-openapi/swag/cmdutils",
            "direct": false,
            "version": "v0.27.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/go-openapi/swag/conv",
            "direct": false,
            "version": "v0.27.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/go-openapi/swag/fileutils",
            "direct": false,
            "version": "v0.27.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/go-openapi/swag/jsonname",
            "direct": false,
            "version": "v0.27.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/go-openapi/swag/jsonutils",
            "direct": false,
            "version": "v0.27.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/go-openapi/swag/loading",
            "direct": false,
            "version": "v0.27.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/go-openapi/swag/mangling",
            "direct": false,
            "version": "v0.27.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/go-openapi/swag/netutils",
            "direct": false,
            "version": "v0.27.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/go-openapi/swag/stringutils",
            "direct": false,
            "version": "v0.27.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/go-openapi/swag/typeutils",
            "direct": false,
            "version": "v0.27.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/go-openapi/swag/yamlutils",
            "direct": false,
            "version": "v0.27.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/go-openapi/validate",
            "direct": false,
            "version": "v0.26.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/go-restruct/restruct",
            "direct": false,
            "version": "v1.2.0-alpha",
            "ecosystem": "go"
          },
          {
            "name": "github.com/go-resty/resty/v2",
            "direct": false,
            "version": "v2.17.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/go-viper/mapstructure/v2",
            "direct": false,
            "version": "v2.5.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/goccy/go-yaml",
            "direct": false,
            "version": "v1.19.2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/gocsaf/csaf/v3",
            "direct": false,
            "version": "v3.5.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/gohugoio/hashstructure",
            "direct": false,
            "version": "v0.6.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/golang-jwt/jwt/v5",
            "direct": false,
            "version": "v5.3.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/golang/groupcache",
            "direct": false,
            "version": "v0.0.0-20241129210726-2c02b8208cf8",
            "ecosystem": "go"
          },
          {
            "name": "github.com/golang/snappy",
            "direct": false,
            "version": "v1.0.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/google/cel-go",
            "direct": false,
            "version": "v0.28.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/google/certificate-transparency-go",
            "direct": false,
            "version": "v1.3.3",
            "ecosystem": "go"
          },
          {
            "name": "github.com/google/gnostic-models",
            "direct": false,
            "version": "v0.7.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/google/go-cmp",
            "direct": false,
            "version": "v0.7.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/google/go-github/v88",
            "direct": false,
            "version": "v88.0.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/google/go-querystring",
            "direct": false,
            "version": "v1.2.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/google/go-tpm",
            "direct": false,
            "version": "v0.9.8",
            "ecosystem": "go"
          },
          {
            "name": "github.com/google/go-tpm-tools",
            "direct": false,
            "version": "v0.4.5",
            "ecosystem": "go"
          },
          {
            "name": "github.com/google/licensecheck",
            "direct": false,
            "version": "v0.3.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/google/nftables",
            "direct": false,
            "version": "v0.3.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/google/pprof",
            "direct": false,
            "version": "v0.0.0-20260402051712-545e8a4df936",
            "ecosystem": "go"
          },
          {
            "name": "github.com/google/s2a-go",
            "direct": false,
            "version": "v0.1.9",
            "ecosystem": "go"
          },
          {
            "name": "github.com/googleapis/enterprise-certificate-proxy",
            "direct": false,
            "version": "v0.3.17",
            "ecosystem": "go"
          },
          {
            "name": "github.com/googleapis/gax-go/v2",
            "direct": false,
            "version": "v2.23.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/googlecloudplatform/opentelemetry-operations-go/detectors/gcp",
            "direct": false,
            "version": "v1.32.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/googlecloudplatform/opentelemetry-operations-go/exporter/metric",
            "direct": false,
            "version": "v0.55.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/googlecloudplatform/opentelemetry-operations-go/internal/resourcemapping",
            "direct": false,
            "version": "v0.55.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/gookit/color",
            "direct": false,
            "version": "v1.6.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/gotestyourself/gotestyourself",
            "direct": false,
            "version": "v2.2.0+incompatible",
            "ecosystem": "go"
          },
          {
            "name": "github.com/gpustack/gguf-parser-go",
            "direct": false,
            "version": "v0.24.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/grpc-ecosystem/grpc-gateway/v2",
            "direct": false,
            "version": "v2.29.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/hako/durafmt",
            "direct": false,
            "version": "v0.0.0-20210608085754-5c1018a4e16b",
            "ecosystem": "go"
          },
          {
            "name": "github.com/hashicorp/aws-sdk-go-base/v2",
            "direct": false,
            "version": "v2.0.0-beta.72",
            "ecosystem": "go"
          },
          {
            "name": "github.com/hashicorp/errwrap",
            "direct": false,
            "version": "v1.1.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/hashicorp/go-envparse",
            "direct": false,
            "version": "v0.1.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/hashicorp/go-getter",
            "direct": false,
            "version": "v1.8.6",
            "ecosystem": "go"
          },
          {
            "name": "github.com/hashicorp/go-multierror",
            "direct": false,
            "version": "v1.1.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/hashicorp/go-retryablehttp",
            "direct": false,
            "version": "v0.7.8",
            "ecosystem": "go"
          },
          {
            "name": "github.com/hashicorp/go-version",
            "direct": false,
            "version": "v1.9.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/hashicorp/golang-lru/v2",
            "direct": false,
            "version": "v2.0.7",
            "ecosystem": "go"
          },
          {
            "name": "github.com/hashicorp/hcl/v2",
            "direct": false,
            "version": "v2.24.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/henvic/httpretty",
            "direct": false,
            "version": "v0.1.4",
            "ecosystem": "go"
          },
          {
            "name": "github.com/huandu/xstrings",
            "direct": false,
            "version": "v1.5.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/iancoleman/strcase",
            "direct": false,
            "version": "v0.3.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/in-toto/in-toto-golang",
            "direct": false,
            "version": "v0.11.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/inconshreveable/mousetrap",
            "direct": false,
            "version": "v1.1.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/intevation/gval",
            "direct": false,
            "version": "v1.3.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/intevation/jsonpath",
            "direct": false,
            "version": "v0.2.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/jbenet/go-context",
            "direct": false,
            "version": "v0.0.0-20150711004518-d14ea06fba99",
            "ecosystem": "go"
          },
          {
            "name": "github.com/jedisct1/go-minisign",
            "direct": false,
            "version": "v0.0.0-20260527172527-a09352b57a22",
            "ecosystem": "go"
          },
          {
            "name": "github.com/jinzhu/copier",
            "direct": false,
            "version": "v0.4.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/jinzhu/inflection",
            "direct": false,
            "version": "v1.0.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/jinzhu/now",
            "direct": false,
            "version": "v1.1.5",
            "ecosystem": "go"
          },
          {
            "name": "github.com/joho/godotenv",
            "direct": false,
            "version": "v1.5.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/jsimonetti/rtnetlink/v2",
            "direct": false,
            "version": "v2.2.1-0.20260614152944-ab8601692836",
            "ecosystem": "go"
          },
          {
            "name": "github.com/json-iterator/go",
            "direct": false,
            "version": "v1.1.12",
            "ecosystem": "go"
          },
          {
            "name": "github.com/kastenhq/goversion",
            "direct": false,
            "version": "v0.0.0-20230811215019-93b2f8823953",
            "ecosystem": "go"
          },
          {
            "name": "github.com/kevinburke/ssh_config",
            "direct": false,
            "version": "v1.2.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/klauspost/cpuid/v2",
            "direct": false,
            "version": "v2.3.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/klauspost/crc32",
            "direct": false,
            "version": "v1.3.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/klauspost/pgzip",
            "direct": false,
            "version": "v1.2.6",
            "ecosystem": "go"
          },
          {
            "name": "github.com/knadh/koanf/maps",
            "direct": false,
            "version": "v0.1.2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/knqyf263/go-apk-version",
            "direct": false,
            "version": "v0.0.0-20200609155635-041fdbb8563f",
            "ecosystem": "go"
          },
          {
            "name": "github.com/knqyf263/go-deb-version",
            "direct": false,
            "version": "v0.0.0-20241115132648-6f4aee6ccd23",
            "ecosystem": "go"
          },
          {
            "name": "github.com/kylelemons/godebug",
            "direct": false,
            "version": "v1.1.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/letsencrypt/boulder",
            "direct": false,
            "version": "v0.20260707.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/linode/go-metadata",
            "direct": false,
            "version": "v0.2.4",
            "ecosystem": "go"
          },
          {
            "name": "github.com/lucasb-eyer/go-colorful",
            "direct": false,
            "version": "v1.4.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/masahiro331/go-mvn-version",
            "direct": false,
            "version": "v0.0.0-20250131095131-f4974fa13b8a",
            "ecosystem": "go"
          },
          {
            "name": "github.com/masterminds/goutils",
            "direct": false,
            "version": "v1.1.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/masterminds/semver/v3",
            "direct": false,
            "version": "v3.5.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/masterminds/sprig/v3",
            "direct": false,
            "version": "v3.3.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/mattn/go-colorable",
            "direct": false,
            "version": "v0.1.14",
            "ecosystem": "go"
          },
          {
            "name": "github.com/mattn/go-isatty",
            "direct": false,
            "version": "v0.0.22",
            "ecosystem": "go"
          },
          {
            "name": "github.com/mattn/go-runewidth",
            "direct": false,
            "version": "v0.0.23",
            "ecosystem": "go"
          },
          {
            "name": "github.com/mdlayher/ethtool",
            "direct": false,
            "version": "v0.6.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/mdlayher/genetlink",
            "direct": false,
            "version": "v1.4.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/mdlayher/netlink",
            "direct": false,
            "version": "v1.11.2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/mdlayher/socket",
            "direct": false,
            "version": "v0.6.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/mdp/qrterminal/v3",
            "direct": false,
            "version": "v3.2.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/mgutz/ansi",
            "direct": false,
            "version": "v0.0.0-20200706080929-d51e80ef957d",
            "ecosystem": "go"
          },
          {
            "name": "github.com/mholt/archives",
            "direct": false,
            "version": "v0.1.5",
            "ecosystem": "go"
          },
          {
            "name": "github.com/microsoft/go-winio",
            "direct": false,
            "version": "v0.6.3-0.20251027160822-ad3df93bed29",
            "ecosystem": "go"
          },
          {
            "name": "github.com/microsoft/hcsshim",
            "direct": false,
            "version": "v0.15.0-rc.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/miekg/pkcs11",
            "direct": false,
            "version": "v1.1.2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/mikelolasagasti/xz",
            "direct": false,
            "version": "v1.0.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/minio/crc64nvme",
            "direct": false,
            "version": "v1.1.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/minio/md5-simd",
            "direct": false,
            "version": "v1.1.2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/minio/minlz",
            "direct": false,
            "version": "v1.0.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/mitchellh/copystructure",
            "direct": false,
            "version": "v1.2.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/mitchellh/go-homedir",
            "direct": false,
            "version": "v1.1.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/mitchellh/go-wordwrap",
            "direct": false,
            "version": "v1.0.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/mitchellh/reflectwalk",
            "direct": false,
            "version": "v1.0.2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/moby/docker-image-spec",
            "direct": false,
            "version": "v1.3.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/moby/locker",
            "direct": false,
            "version": "v1.0.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/moby/moby/api",
            "direct": false,
            "version": "v1.54.2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/moby/moby/client",
            "direct": false,
            "version": "v0.4.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/moby/sys/mountinfo",
            "direct": false,
            "version": "v0.7.2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/moby/sys/sequential",
            "direct": false,
            "version": "v0.6.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/moby/sys/signal",
            "direct": false,
            "version": "v0.7.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/moby/sys/user",
            "direct": false,
            "version": "v0.4.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/moby/sys/userns",
            "direct": false,
            "version": "v0.1.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/moby/term",
            "direct": false,
            "version": "v0.5.2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/modern-go/concurrent",
            "direct": false,
            "version": "v0.0.0-20180306012644-bacd9c7ef1dd",
            "ecosystem": "go"
          },
          {
            "name": "github.com/modern-go/reflect2",
            "direct": false,
            "version": "v1.0.3-0.20250322232337-35a7c28c31ee",
            "ecosystem": "go"
          },
          {
            "name": "github.com/muesli/termenv",
            "direct": false,
            "version": "v0.16.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/munnerz/goautoneg",
            "direct": false,
            "version": "v0.0.0-20191010083416-a7dc8b61c822",
            "ecosystem": "go"
          },
          {
            "name": "github.com/ncruces/go-strftime",
            "direct": false,
            "version": "v1.0.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/nix-community/go-nix",
            "direct": false,
            "version": "v0.0.0-20250101154619-4bdde671e0a1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/nozzle/throttler",
            "direct": false,
            "version": "v0.0.0-20180817012639-2ea982251481",
            "ecosystem": "go"
          },
          {
            "name": "github.com/nvveen/gotty",
            "direct": false,
            "version": "v0.0.0-20120604004816-cd527374f1e5",
            "ecosystem": "go"
          },
          {
            "name": "github.com/nwaples/rardecode/v2",
            "direct": false,
            "version": "v2.2.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/oklog/ulid/v2",
            "direct": false,
            "version": "v2.1.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/olekukonko/cat",
            "direct": false,
            "version": "v0.0.0-20250911104152-50322a0618f6",
            "ecosystem": "go"
          },
          {
            "name": "github.com/olekukonko/errors",
            "direct": false,
            "version": "v1.2.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/olekukonko/ll",
            "direct": false,
            "version": "v0.1.6",
            "ecosystem": "go"
          },
          {
            "name": "github.com/olekukonko/tablewriter",
            "direct": false,
            "version": "v1.1.4",
            "ecosystem": "go"
          },
          {
            "name": "github.com/oneofone/xxhash",
            "direct": false,
            "version": "v1.2.8",
            "ecosystem": "go"
          },
          {
            "name": "github.com/opencontainers/image-spec",
            "direct": false,
            "version": "v1.1.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/opencontainers/runc",
            "direct": false,
            "version": "v1.3.3",
            "ecosystem": "go"
          },
          {
            "name": "github.com/opencontainers/runtime-spec",
            "direct": false,
            "version": "v1.3.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/openvex/go-vex",
            "direct": false,
            "version": "v0.2.8",
            "ecosystem": "go"
          },
          {
            "name": "github.com/owenrumney/go-sarif",
            "direct": false,
            "version": "v1.1.2-0.20231003122901-1000f5e05554",
            "ecosystem": "go"
          },
          {
            "name": "github.com/package-url/packageurl-go",
            "direct": false,
            "version": "v0.1.5",
            "ecosystem": "go"
          },
          {
            "name": "github.com/pandatix/go-cvss",
            "direct": false,
            "version": "v0.6.2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/pborman/indent",
            "direct": false,
            "version": "v1.2.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/pelletier/go-toml",
            "direct": false,
            "version": "v1.9.5",
            "ecosystem": "go"
          },
          {
            "name": "github.com/pelletier/go-toml/v2",
            "direct": false,
            "version": "v2.3.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/petermattis/goid",
            "direct": false,
            "version": "v0.0.0-20260226131333-17d1149c6ac6",
            "ecosystem": "go"
          },
          {
            "name": "github.com/philhofer/fwd",
            "direct": false,
            "version": "v1.2.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/pierrec/lz4/v4",
            "direct": false,
            "version": "v4.1.26",
            "ecosystem": "go"
          },
          {
            "name": "github.com/pin/tftp/v3",
            "direct": false,
            "version": "v3.2.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/piprate/json-gold",
            "direct": false,
            "version": "v0.7.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/pjbgf/sha1cd",
            "direct": false,
            "version": "v0.6.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/pkg/browser",
            "direct": false,
            "version": "v0.0.0-20240102092130-5ac0b6a4141c",
            "ecosystem": "go"
          },
          {
            "name": "github.com/pkg/errors",
            "direct": false,
            "version": "v0.9.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/pkg/profile",
            "direct": false,
            "version": "v1.7.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/pkg/xattr",
            "direct": false,
            "version": "v0.4.12",
            "ecosystem": "go"
          },
          {
            "name": "github.com/planetscale/vtprotobuf",
            "direct": false,
            "version": "v0.6.1-0.20250313105119-ba97887b0a25",
            "ecosystem": "go"
          },
          {
            "name": "github.com/pmezard/go-difflib",
            "direct": false,
            "version": "v1.0.1-0.20181226105442-5d4384ee4fb2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/pquerna/cachecontrol",
            "direct": false,
            "version": "v0.0.0-20180517163645-1555304b9b35",
            "ecosystem": "go"
          },
          {
            "name": "github.com/prometheus/client_model",
            "direct": false,
            "version": "v0.6.2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/prometheus/common",
            "direct": false,
            "version": "v0.67.5",
            "ecosystem": "go"
          },
          {
            "name": "github.com/prometheus/procfs",
            "direct": false,
            "version": "v0.20.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/protonmail/go-crypto",
            "direct": false,
            "version": "v1.4.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/protonmail/gopenpgp/v3",
            "direct": false,
            "version": "v3.4.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/rasky/go-lzo",
            "direct": false,
            "version": "v0.0.0-20200203143853-96a758eda86e",
            "ecosystem": "go"
          },
          {
            "name": "github.com/remyoudompheng/bigfft",
            "direct": false,
            "version": "v0.0.0-20230129092748-24d4a6f8daec",
            "ecosystem": "go"
          },
          {
            "name": "github.com/rivo/uniseg",
            "direct": false,
            "version": "v0.4.7",
            "ecosystem": "go"
          },
          {
            "name": "github.com/rs/xid",
            "direct": false,
            "version": "v1.6.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/rust-secure-code/go-rustaudit",
            "direct": false,
            "version": "v0.0.0-20250226111315-e20ec32e963c",
            "ecosystem": "go"
          },
          {
            "name": "github.com/ryanuber/go-glob",
            "direct": false,
            "version": "v1.0.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/sagikazarmark/locafero",
            "direct": false,
            "version": "v0.11.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/saintfish/chardet",
            "direct": false,
            "version": "v0.0.0-20230101081208-5e3ef4b5456d",
            "ecosystem": "go"
          },
          {
            "name": "github.com/santhosh-tekuri/jsonschema/v6",
            "direct": false,
            "version": "v6.0.2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/sasha-s/go-deadlock",
            "direct": false,
            "version": "v0.3.6",
            "ecosystem": "go"
          },
          {
            "name": "github.com/sassoftware/go-rpmutils",
            "direct": false,
            "version": "v0.4.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/sassoftware/relic",
            "direct": false,
            "version": "v7.2.1+incompatible",
            "ecosystem": "go"
          },
          {
            "name": "github.com/scaleway/scaleway-sdk-go",
            "direct": false,
            "version": "v1.0.0-beta.36",
            "ecosystem": "go"
          },
          {
            "name": "github.com/scylladb/go-set",
            "direct": false,
            "version": "v1.0.3-0.20200225121959-cc7b2070d91e",
            "ecosystem": "go"
          },
          {
            "name": "github.com/secure-systems-lab/go-securesystemslib",
            "direct": false,
            "version": "v0.11.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/sergi/go-diff",
            "direct": false,
            "version": "v1.4.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/shibumi/go-pathspec",
            "direct": false,
            "version": "v1.3.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/shopspring/decimal",
            "direct": false,
            "version": "v1.4.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/siderolabs/go-adv",
            "direct": false,
            "version": "v1.0.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/siderolabs/go-api-signature",
            "direct": false,
            "version": "v0.3.13",
            "ecosystem": "go"
          },
          {
            "name": "github.com/siderolabs/go-cmd",
            "direct": false,
            "version": "v0.2.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/siderolabs/go-copy",
            "direct": false,
            "version": "v0.1.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/siderolabs/go-procfs",
            "direct": false,
            "version": "v0.1.2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/siderolabs/go-retry",
            "direct": false,
            "version": "v0.3.3",
            "ecosystem": "go"
          },
          {
            "name": "github.com/siderolabs/go-smbios",
            "direct": false,
            "version": "v0.3.4",
            "ecosystem": "go"
          },
          {
            "name": "github.com/siderolabs/net",
            "direct": false,
            "version": "v0.4.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/siderolabs/protoenc",
            "direct": false,
            "version": "v0.2.4",
            "ecosystem": "go"
          },
          {
            "name": "github.com/sigstore/rekor",
            "direct": false,
            "version": "v1.5.3",
            "ecosystem": "go"
          },
          {
            "name": "github.com/sigstore/rekor-tiles/v2",
            "direct": false,
            "version": "v2.3.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/sigstore/timestamp-authority/v2",
            "direct": false,
            "version": "v2.1.3",
            "ecosystem": "go"
          },
          {
            "name": "github.com/sirupsen/logrus",
            "direct": false,
            "version": "v1.9.4",
            "ecosystem": "go"
          },
          {
            "name": "github.com/skeema/knownhosts",
            "direct": false,
            "version": "v1.3.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/smallnest/ringbuffer",
            "direct": false,
            "version": "v0.0.0-20241116012123-461381446e3d",
            "ecosystem": "go"
          },
          {
            "name": "github.com/sorairolake/lzip-go",
            "direct": false,
            "version": "v0.3.8",
            "ecosystem": "go"
          },
          {
            "name": "github.com/sourcegraph/conc",
            "direct": false,
            "version": "v0.3.1-0.20240121214520-5f936abd7ae8",
            "ecosystem": "go"
          },
          {
            "name": "github.com/spdx/gordf",
            "direct": false,
            "version": "v0.0.0-20250128162952-000978ccd6fb",
            "ecosystem": "go"
          },
          {
            "name": "github.com/spf13/afero",
            "direct": false,
            "version": "v1.15.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/spf13/cast",
            "direct": false,
            "version": "v1.10.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/spf13/cobra",
            "direct": false,
            "version": "v1.10.2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/spf13/viper",
            "direct": false,
            "version": "v1.21.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/spiffe/go-spiffe/v2",
            "direct": false,
            "version": "v2.7.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/starry-s/zip",
            "direct": false,
            "version": "v0.2.3",
            "ecosystem": "go"
          },
          {
            "name": "github.com/subosito/gotenv",
            "direct": false,
            "version": "v1.6.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/sylabs/sif/v2",
            "direct": false,
            "version": "v2.24.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/sylabs/squashfs",
            "direct": false,
            "version": "v1.0.6",
            "ecosystem": "go"
          },
          {
            "name": "github.com/syndtr/goleveldb",
            "direct": false,
            "version": "v1.0.1-0.20220721030215-126854af5e6d",
            "ecosystem": "go"
          },
          {
            "name": "github.com/tailscale/hujson",
            "direct": false,
            "version": "v0.0.0-20260302212456-ecc657c15afd",
            "ecosystem": "go"
          },
          {
            "name": "github.com/thales-e-security/pool",
            "direct": false,
            "version": "v0.0.2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/thalesignite/crypto11",
            "direct": false,
            "version": "v1.2.5",
            "ecosystem": "go"
          },
          {
            "name": "github.com/therootcompany/xz",
            "direct": false,
            "version": "v1.0.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/theupdateframework/go-tuf",
            "direct": false,
            "version": "v0.7.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/theupdateframework/go-tuf/v2",
            "direct": false,
            "version": "v2.4.2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/tinylib/msgp",
            "direct": false,
            "version": "v1.6.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/titanous/rocacheck",
            "direct": false,
            "version": "v0.0.0-20171023193734-afe73141d399",
            "ecosystem": "go"
          },
          {
            "name": "github.com/transparency-dev/formats",
            "direct": false,
            "version": "v0.1.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/transparency-dev/merkle",
            "direct": false,
            "version": "v0.0.2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/u-root/uio",
            "direct": false,
            "version": "v0.0.0-20240224005618-d2acac8f3701",
            "ecosystem": "go"
          },
          {
            "name": "github.com/vbatts/go-mtree",
            "direct": false,
            "version": "v0.7.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/vifraa/gopom",
            "direct": false,
            "version": "v1.0.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/vultr/metadata",
            "direct": false,
            "version": "v1.1.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/wagoodman/go-partybus",
            "direct": false,
            "version": "v0.0.0-20230516145632-8ccac152c651",
            "ecosystem": "go"
          },
          {
            "name": "github.com/wagoodman/go-presenter",
            "direct": false,
            "version": "v0.0.0-20211015174752-f9c01afc824b",
            "ecosystem": "go"
          },
          {
            "name": "github.com/wagoodman/go-progress",
            "direct": false,
            "version": "v0.0.0-20260303201901-10176f79b2c0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/x448/float16",
            "direct": false,
            "version": "v0.8.4",
            "ecosystem": "go"
          },
          {
            "name": "github.com/xanzy/ssh-agent",
            "direct": false,
            "version": "v0.3.3",
            "ecosystem": "go"
          },
          {
            "name": "github.com/xi2/xz",
            "direct": false,
            "version": "v0.0.0-20171230120015-48954b6210f8",
            "ecosystem": "go"
          },
          {
            "name": "github.com/xo/terminfo",
            "direct": false,
            "version": "v0.0.0-20220910002029-abceb7e1c41e",
            "ecosystem": "go"
          },
          {
            "name": "github.com/youmark/pkcs8",
            "direct": false,
            "version": "v0.0.0-20240726163527-a2c0da244d78",
            "ecosystem": "go"
          },
          {
            "name": "github.com/zclconf/go-cty",
            "direct": false,
            "version": "v1.16.3",
            "ecosystem": "go"
          },
          {
            "name": "github.com/zeebo/xxh3",
            "direct": false,
            "version": "v1.1.0",
            "ecosystem": "go"
          },
          {
            "name": "gitlab.com/gitlab-org/api/client-go",
            "direct": false,
            "version": "v1.46.0",
            "ecosystem": "go"
          },
          {
            "name": "go.etcd.io/bbolt",
            "direct": false,
            "version": "v1.5.0-rc.0",
            "ecosystem": "go"
          },
          {
            "name": "go.opencensus.io",
            "direct": false,
            "version": "v0.24.0",
            "ecosystem": "go"
          },
          {
            "name": "go.opentelemetry.io/auto/sdk",
            "direct": false,
            "version": "v1.2.1",
            "ecosystem": "go"
          },
          {
            "name": "go.opentelemetry.io/contrib/detectors/gcp",
            "direct": false,
            "version": "v1.43.0",
            "ecosystem": "go"
          },
          {
            "name": "go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc",
            "direct": false,
            "version": "v0.68.0",
            "ecosystem": "go"
          },
          {
            "name": "go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp",
            "direct": false,
            "version": "v0.68.0",
            "ecosystem": "go"
          },
          {
            "name": "go.opentelemetry.io/otel",
            "direct": false,
            "version": "v1.44.0",
            "ecosystem": "go"
          },
          {
            "name": "go.opentelemetry.io/otel/metric",
            "direct": false,
            "version": "v1.44.0",
            "ecosystem": "go"
          },
          {
            "name": "go.opentelemetry.io/otel/sdk",
            "direct": false,
            "version": "v1.44.0",
            "ecosystem": "go"
          },
          {
            "name": "go.opentelemetry.io/otel/sdk/metric",
            "direct": false,
            "version": "v1.44.0",
            "ecosystem": "go"
          },
          {
            "name": "go.opentelemetry.io/otel/trace",
            "direct": false,
            "version": "v1.44.0",
            "ecosystem": "go"
          },
          {
            "name": "go.uber.org/multierr",
            "direct": false,
            "version": "v1.11.0",
            "ecosystem": "go"
          },
          {
            "name": "go.yaml.in/yaml/v2",
            "direct": false,
            "version": "v2.4.4",
            "ecosystem": "go"
          },
          {
            "name": "go.yaml.in/yaml/v3",
            "direct": false,
            "version": "v3.0.4",
            "ecosystem": "go"
          },
          {
            "name": "go4.org",
            "direct": false,
            "version": "v0.0.0-20230225012048-214862532bf5",
            "ecosystem": "go"
          },
          {
            "name": "go4.org/netipx",
            "direct": false,
            "version": "v0.0.0-20231129151722-fdeea329fbba",
            "ecosystem": "go"
          },
          {
            "name": "golang.org/x/exp",
            "direct": false,
            "version": "v0.0.0-20260410095643-746e56fc9e2f",
            "ecosystem": "go"
          },
          {
            "name": "golang.org/x/mod",
            "direct": false,
            "version": "v0.38.0",
            "ecosystem": "go"
          },
          {
            "name": "golang.org/x/net",
            "direct": false,
            "version": "v0.57.0",
            "ecosystem": "go"
          },
          {
            "name": "golang.org/x/oauth2",
            "direct": false,
            "version": "v0.36.0",
            "ecosystem": "go"
          },
          {
            "name": "golang.org/x/term",
            "direct": false,
            "version": "v0.45.0",
            "ecosystem": "go"
          },
          {
            "name": "golang.org/x/time",
            "direct": false,
            "version": "v0.15.0",
            "ecosystem": "go"
          },
          {
            "name": "golang.org/x/tools",
            "direct": false,
            "version": "v0.47.0",
            "ecosystem": "go"
          },
          {
            "name": "golang.org/x/xerrors",
            "direct": false,
            "version": "v0.0.0-20240903120638-7835f813f4da",
            "ecosystem": "go"
          },
          {
            "name": "golang.zx2c4.com/wireguard/wgctrl",
            "direct": false,
            "version": "v0.0.0-20241231184526-a9ab2273dd10",
            "ecosystem": "go"
          },
          {
            "name": "gonum.org/v1/gonum",
            "direct": false,
            "version": "v0.17.0",
            "ecosystem": "go"
          },
          {
            "name": "google.golang.org/api",
            "direct": false,
            "version": "v0.287.1",
            "ecosystem": "go"
          },
          {
            "name": "google.golang.org/genproto",
            "direct": false,
            "version": "v0.0.0-20260406210006-6f92a3bedf2d",
            "ecosystem": "go"
          },
          {
            "name": "google.golang.org/genproto/googleapis/api",
            "direct": false,
            "version": "v0.0.0-20260706201446-f0a921348800",
            "ecosystem": "go"
          },
          {
            "name": "google.golang.org/genproto/googleapis/rpc",
            "direct": false,
            "version": "v0.0.0-20260706201446-f0a921348800",
            "ecosystem": "go"
          },
          {
            "name": "google.golang.org/grpc",
            "direct": false,
            "version": "v1.82.1",
            "ecosystem": "go"
          },
          {
            "name": "gopkg.in/evanphx/json-patch.v4",
            "direct": false,
            "version": "v4.13.0",
            "ecosystem": "go"
          },
          {
            "name": "gopkg.in/inf.v0",
            "direct": false,
            "version": "v0.9.1",
            "ecosystem": "go"
          },
          {
            "name": "gopkg.in/ini.v1",
            "direct": false,
            "version": "v1.67.3",
            "ecosystem": "go"
          },
          {
            "name": "gopkg.in/warnings.v0",
            "direct": false,
            "version": "v0.1.2",
            "ecosystem": "go"
          },
          {
            "name": "gopkg.in/yaml.v2",
            "direct": false,
            "version": "v2.4.0",
            "ecosystem": "go"
          },
          {
            "name": "gopkg.in/yaml.v3",
            "direct": false,
            "version": "v3.0.1",
            "ecosystem": "go"
          },
          {
            "name": "gorm.io/gorm",
            "direct": false,
            "version": "v1.31.1",
            "ecosystem": "go"
          },
          {
            "name": "gotest.tools",
            "direct": false,
            "version": "v2.2.0+incompatible",
            "ecosystem": "go"
          },
          {
            "name": "k8s.io/api",
            "direct": false,
            "version": "v0.36.2",
            "ecosystem": "go"
          },
          {
            "name": "k8s.io/apimachinery",
            "direct": false,
            "version": "v0.36.2",
            "ecosystem": "go"
          },
          {
            "name": "k8s.io/client-go",
            "direct": false,
            "version": "v0.36.2",
            "ecosystem": "go"
          },
          {
            "name": "k8s.io/klog/v2",
            "direct": false,
            "version": "v2.140.0",
            "ecosystem": "go"
          },
          {
            "name": "k8s.io/kube-openapi",
            "direct": false,
            "version": "v0.0.0-20260319004828-5883c5ee87b9",
            "ecosystem": "go"
          },
          {
            "name": "k8s.io/utils",
            "direct": false,
            "version": "v0.0.0-20260319190234-28399d86e0b5",
            "ecosystem": "go"
          },
          {
            "name": "modernc.org/libc",
            "direct": false,
            "version": "v1.72.3",
            "ecosystem": "go"
          },
          {
            "name": "modernc.org/mathutil",
            "direct": false,
            "version": "v1.7.1",
            "ecosystem": "go"
          },
          {
            "name": "modernc.org/memory",
            "direct": false,
            "version": "v1.11.0",
            "ecosystem": "go"
          },
          {
            "name": "modernc.org/sqlite",
            "direct": false,
            "version": "v1.51.0",
            "ecosystem": "go"
          },
          {
            "name": "rsc.io/qr",
            "direct": false,
            "version": "v0.2.0",
            "ecosystem": "go"
          },
          {
            "name": "sigs.k8s.io/json",
            "direct": false,
            "version": "v0.0.0-20250730193827-2d320260d730",
            "ecosystem": "go"
          },
          {
            "name": "sigs.k8s.io/randfill",
            "direct": false,
            "version": "v1.0.0",
            "ecosystem": "go"
          },
          {
            "name": "sigs.k8s.io/structured-merge-diff/v6",
            "direct": false,
            "version": "v6.3.2",
            "ecosystem": "go"
          },
          {
            "name": "sigs.k8s.io/yaml",
            "direct": false,
            "version": "v1.6.0",
            "ecosystem": "go"
          },
          {
            "name": "@jridgewell/gen-mapping",
            "direct": false,
            "version": "0.3.13",
            "ecosystem": "npm"
          },
          {
            "name": "@jridgewell/remapping",
            "direct": false,
            "version": "2.3.5",
            "ecosystem": "npm"
          },
          {
            "name": "@jridgewell/resolve-uri",
            "direct": false,
            "version": "3.1.2",
            "ecosystem": "npm"
          },
          {
            "name": "@jridgewell/sourcemap-codec",
            "direct": false,
            "version": "1.5.5",
            "ecosystem": "npm"
          },
          {
            "name": "@jridgewell/trace-mapping",
            "direct": false,
            "version": "0.3.31",
            "ecosystem": "npm"
          },
          {
            "name": "@parcel/watcher",
            "direct": false,
            "version": "2.5.6",
            "ecosystem": "npm"
          },
          {
            "name": "@parcel/watcher-android-arm64",
            "direct": false,
            "version": "2.5.6",
            "ecosystem": "npm"
          },
          {
            "name": "@parcel/watcher-darwin-arm64",
            "direct": false,
            "version": "2.5.6",
            "ecosystem": "npm"
          },
          {
            "name": "@parcel/watcher-darwin-x64",
            "direct": false,
            "version": "2.5.6",
            "ecosystem": "npm"
          },
          {
            "name": "@parcel/watcher-freebsd-x64",
            "direct": false,
            "version": "2.5.6",
            "ecosystem": "npm"
          },
          {
            "name": "@parcel/watcher-linux-arm-glibc",
            "direct": false,
            "version": "2.5.6",
            "ecosystem": "npm"
          },
          {
            "name": "@parcel/watcher-linux-arm-musl",
            "direct": false,
            "version": "2.5.6",
            "ecosystem": "npm"
          },
          {
            "name": "@parcel/watcher-linux-arm64-glibc",
            "direct": false,
            "version": "2.5.6",
            "ecosystem": "npm"
          },
          {
            "name": "@parcel/watcher-linux-arm64-musl",
            "direct": false,
            "version": "2.5.6",
            "ecosystem": "npm"
          },
          {
            "name": "@parcel/watcher-linux-x64-glibc",
            "direct": false,
            "version": "2.5.6",
            "ecosystem": "npm"
          },
          {
            "name": "@parcel/watcher-linux-x64-musl",
            "direct": false,
            "version": "2.5.6",
            "ecosystem": "npm"
          },
          {
            "name": "@parcel/watcher-win32-arm64",
            "direct": false,
            "version": "2.5.6",
            "ecosystem": "npm"
          },
          {
            "name": "@parcel/watcher-win32-ia32",
            "direct": false,
            "version": "2.5.6",
            "ecosystem": "npm"
          },
          {
            "name": "@parcel/watcher-win32-x64",
            "direct": false,
            "version": "2.5.6",
            "ecosystem": "npm"
          },
          {
            "name": "@tailwindcss/cli",
            "direct": false,
            "version": "4.2.2",
            "ecosystem": "npm"
          },
          {
            "name": "@tailwindcss/node",
            "direct": false,
            "version": "4.2.2",
            "ecosystem": "npm"
          },
          {
            "name": "@tailwindcss/oxide",
            "direct": false,
            "version": "4.2.2",
            "ecosystem": "npm"
          },
          {
            "name": "@tailwindcss/oxide-android-arm64",
            "direct": false,
            "version": "4.2.2",
            "ecosystem": "npm"
          },
          {
            "name": "@tailwindcss/oxide-darwin-arm64",
            "direct": false,
            "version": "4.2.2",
            "ecosystem": "npm"
          },
          {
            "name": "@tailwindcss/oxide-darwin-x64",
            "direct": false,
            "version": "4.2.2",
            "ecosystem": "npm"
          },
          {
            "name": "@tailwindcss/oxide-freebsd-x64",
            "direct": false,
            "version": "4.2.2",
            "ecosystem": "npm"
          },
          {
            "name": "@tailwindcss/oxide-linux-arm-gnueabihf",
            "direct": false,
            "version": "4.2.2",
            "ecosystem": "npm"
          },
          {
            "name": "@tailwindcss/oxide-linux-arm64-gnu",
            "direct": false,
            "version": "4.2.2",
            "ecosystem": "npm"
          },
          {
            "name": "@tailwindcss/oxide-linux-arm64-musl",
            "direct": false,
            "version": "4.2.2",
            "ecosystem": "npm"
          },
          {
            "name": "@tailwindcss/oxide-linux-x64-gnu",
            "direct": false,
            "version": "4.2.2",
            "ecosystem": "npm"
          },
          {
            "name": "@tailwindcss/oxide-linux-x64-musl",
            "direct": false,
            "version": "4.2.2",
            "ecosystem": "npm"
          },
          {
            "name": "@tailwindcss/oxide-wasm32-wasi",
            "direct": false,
            "version": "4.2.2",
            "ecosystem": "npm"
          },
          {
            "name": "@tailwindcss/oxide-win32-arm64-msvc",
            "direct": false,
            "version": "4.2.2",
            "ecosystem": "npm"
          },
          {
            "name": "@tailwindcss/oxide-win32-x64-msvc",
            "direct": false,
            "version": "4.2.2",
            "ecosystem": "npm"
          },
          {
            "name": "cssesc",
            "direct": false,
            "version": "3.0.0",
            "ecosystem": "npm"
          },
          {
            "name": "detect-libc",
            "direct": false,
            "version": "2.1.2",
            "ecosystem": "npm"
          },
          {
            "name": "enhanced-resolve",
            "direct": false,
            "version": "5.20.1",
            "ecosystem": "npm"
          },
          {
            "name": "graceful-fs",
            "direct": false,
            "version": "4.2.11",
            "ecosystem": "npm"
          },
          {
            "name": "is-extglob",
            "direct": false,
            "version": "2.1.1",
            "ecosystem": "npm"
          },
          {
            "name": "is-glob",
            "direct": false,
            "version": "4.0.3",
            "ecosystem": "npm"
          },
          {
            "name": "jiti",
            "direct": false,
            "version": "2.6.1",
            "ecosystem": "npm"
          },
          {
            "name": "lightningcss",
            "direct": false,
            "version": "1.32.0",
            "ecosystem": "npm"
          },
          {
            "name": "lightningcss-android-arm64",
            "direct": false,
            "version": "1.32.0",
            "ecosystem": "npm"
          },
          {
            "name": "lightningcss-darwin-arm64",
            "direct": false,
            "version": "1.32.0",
            "ecosystem": "npm"
          },
          {
            "name": "lightningcss-darwin-x64",
            "direct": false,
            "version": "1.32.0",
            "ecosystem": "npm"
          },
          {
            "name": "lightningcss-freebsd-x64",
            "direct": false,
            "version": "1.32.0",
            "ecosystem": "npm"
          },
          {
            "name": "lightningcss-linux-arm-gnueabihf",
            "direct": false,
            "version": "1.32.0",
            "ecosystem": "npm"
          },
          {
            "name": "lightningcss-linux-arm64-gnu",
            "direct": false,
            "version": "1.32.0",
            "ecosystem": "npm"
          },
          {
            "name": "lightningcss-linux-arm64-musl",
            "direct": false,
            "version": "1.32.0",
            "ecosystem": "npm"
          },
          {
            "name": "lightningcss-linux-x64-gnu",
            "direct": false,
            "version": "1.32.0",
            "ecosystem": "npm"
          },
          {
            "name": "lightningcss-linux-x64-musl",
            "direct": false,
            "version": "1.32.0",
            "ecosystem": "npm"
          },
          {
            "name": "lightningcss-win32-arm64-msvc",
            "direct": false,
            "version": "1.32.0",
            "ecosystem": "npm"
          },
          {
            "name": "lightningcss-win32-x64-msvc",
            "direct": false,
            "version": "1.32.0",
            "ecosystem": "npm"
          },
          {
            "name": "magic-string",
            "direct": false,
            "version": "0.30.21",
            "ecosystem": "npm"
          },
          {
            "name": "mini-svg-data-uri",
            "direct": false,
            "version": "1.4.4",
            "ecosystem": "npm"
          },
          {
            "name": "mri",
            "direct": false,
            "version": "1.2.0",
            "ecosystem": "npm"
          },
          {
            "name": "node-addon-api",
            "direct": false,
            "version": "7.1.1",
            "ecosystem": "npm"
          },
          {
            "name": "picocolors",
            "direct": false,
            "version": "1.1.1",
            "ecosystem": "npm"
          },
          {
            "name": "picomatch",
            "direct": false,
            "version": "4.0.4",
            "ecosystem": "npm"
          },
          {
            "name": "postcss-selector-parser",
            "direct": false,
            "version": "6.0.10",
            "ecosystem": "npm"
          },
          {
            "name": "source-map-js",
            "direct": false,
            "version": "1.2.1",
            "ecosystem": "npm"
          },
          {
            "name": "tapable",
            "direct": false,
            "version": "2.3.2",
            "ecosystem": "npm"
          },
          {
            "name": "util-deprecate",
            "direct": false,
            "version": "1.0.2",
            "ecosystem": "npm"
          }
        ],
        "collected": true,
        "truncated": false,
        "total_count": 556,
        "direct_count": 59,
        "indirect_count": 497
      }
    },
    "maintainership": {
      "issues": {
        "open_prs": 5,
        "merged_prs": 297,
        "open_issues": 12,
        "closed_ratio": 0.924,
        "closed_issues": 146,
        "closed_unmerged_prs": 22
      },
      "bus_factor": 2,
      "bot_contributors": 0,
      "top_contributors": [
        {
          "type": "User",
          "login": "smira",
          "commits": 142,
          "avatar_url": "https://avatars.githubusercontent.com/u/55211?v=4"
        },
        {
          "type": "User",
          "login": "frezbo",
          "commits": 58,
          "avatar_url": "https://avatars.githubusercontent.com/u/18496730?v=4"
        },
        {
          "type": "User",
          "login": "shanduur",
          "commits": 50,
          "avatar_url": "https://avatars.githubusercontent.com/u/32583062?v=4"
        },
        {
          "type": "User",
          "login": "kevintijssen",
          "commits": 12,
          "avatar_url": "https://avatars.githubusercontent.com/u/20204800?v=4"
        },
        {
          "type": "User",
          "login": "Orzelius",
          "commits": 9,
          "avatar_url": "https://avatars.githubusercontent.com/u/33936483?v=4"
        },
        {
          "type": "User",
          "login": "Unix4ever",
          "commits": 5,
          "avatar_url": "https://avatars.githubusercontent.com/u/830532?v=4"
        },
        {
          "type": "User",
          "login": "TimJones",
          "commits": 5,
          "avatar_url": "https://avatars.githubusercontent.com/u/113170?v=4"
        },
        {
          "type": "User",
          "login": "Slessi",
          "commits": 4,
          "avatar_url": "https://avatars.githubusercontent.com/u/3223500?v=4"
        },
        {
          "type": "User",
          "login": "mattiascockburn",
          "commits": 3,
          "avatar_url": "https://avatars.githubusercontent.com/u/2472944?v=4"
        },
        {
          "type": "User",
          "login": "rsmitty",
          "commits": 3,
          "avatar_url": "https://avatars.githubusercontent.com/u/1529818?v=4"
        }
      ],
      "contributors_sampled": 25,
      "top_contributor_share": 0.457
    },
    "quality_signals": {
      "has_ci": true,
      "has_tests": true,
      "ci_workflows": [
        "ci.yaml",
        "helm.yaml",
        "lock.yml",
        "slack-notify-ci-failure.yaml",
        "slack-notify.yaml",
        "stale.yml"
      ],
      "has_docs_dir": true,
      "linter_configs": [
        ".golangci.yml"
      ],
      "has_editorconfig": false,
      "has_linter_config": true,
      "has_precommit_config": false
    },
    "security_signals": {
      "lockfiles": [
        "go.sum",
        "package-lock.json"
      ],
      "scorecard": {
        "checks": [
          {
            "name": "Binary-Artifacts",
            "score": 10,
            "reason": "no binaries found in the repo",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#binary-artifacts"
          },
          {
            "name": "Branch-Protection",
            "score": null,
            "reason": "internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#branch-protection"
          },
          {
            "name": "CI-Tests",
            "score": 10,
            "reason": "28 out of 28 merged PRs checked by a CI test -- score normalized to 10",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#ci-tests"
          },
          {
            "name": "CII-Best-Practices",
            "score": 0,
            "reason": "no effort to earn an OpenSSF best practices badge detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#cii-best-practices"
          },
          {
            "name": "Code-Review",
            "score": 10,
            "reason": "all changesets reviewed",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#code-review"
          },
          {
            "name": "Contributors",
            "score": 10,
            "reason": "project has 9 contributing companies or organizations",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#contributors"
          },
          {
            "name": "Dangerous-Workflow",
            "score": 10,
            "reason": "no dangerous workflow patterns detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dangerous-workflow"
          },
          {
            "name": "Dependency-Update-Tool",
            "score": 10,
            "reason": "update tool detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dependency-update-tool"
          },
          {
            "name": "Fuzzing",
            "score": 0,
            "reason": "project is not fuzzed",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#fuzzing"
          },
          {
            "name": "License",
            "score": 10,
            "reason": "license file detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#license"
          },
          {
            "name": "Maintained",
            "score": 10,
            "reason": "30 commit(s) and 16 issue activity found in the last 90 days -- score normalized to 10",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#maintained"
          },
          {
            "name": "Packaging",
            "score": null,
            "reason": "packaging workflow not detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#packaging"
          },
          {
            "name": "Pinned-Dependencies",
            "score": 5,
            "reason": "dependency not pinned by hash detected -- score normalized to 5",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#pinned-dependencies"
          },
          {
            "name": "SAST",
            "score": 0,
            "reason": "SAST tool is not run on all commits -- score normalized to 0",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#sast"
          },
          {
            "name": "Security-Policy",
            "score": 0,
            "reason": "security policy file not detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#security-policy"
          },
          {
            "name": "Signed-Releases",
            "score": 0,
            "reason": "Project has not signed or included provenance with any releases.",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#signed-releases"
          },
          {
            "name": "Token-Permissions",
            "score": 0,
            "reason": "detected GitHub workflow tokens with excessive permissions",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#token-permissions"
          },
          {
            "name": "Vulnerabilities",
            "score": 7,
            "reason": "3 existing vulnerabilities detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#vulnerabilities"
          }
        ],
        "commit": "ae757b5b1ca6915a11e463a951cd77577318b263",
        "ran_at": "2026-07-29T06:11:04Z",
        "aggregate_score": 6,
        "scorecard_version": "v5.5.0"
      },
      "has_codeql_workflow": false,
      "has_security_policy": false,
      "has_dependabot_config": false
    },
    "contribution_flow": {
      "collected": true,
      "ci_last_run_at": "2026-07-29T05:55:04Z",
      "oldest_open_prs": [
        {
          "number": 122,
          "created_at": "2024-06-06T12:05:47Z",
          "last_comment_at": "2025-06-13T02:11:43Z",
          "last_comment_author": "github-actions"
        },
        {
          "number": 323,
          "created_at": "2025-10-15T13:05:12Z",
          "last_comment_at": "2025-12-06T02:07:40Z",
          "last_comment_author": "github-actions"
        },
        {
          "number": 380,
          "created_at": "2026-02-02T03:31:36Z",
          "last_comment_at": "2026-07-17T01:30:11Z",
          "last_comment_author": "renovate"
        },
        {
          "number": 511,
          "created_at": "2026-07-27T20:43:20Z",
          "last_comment_at": "2026-07-28T13:19:37Z",
          "last_comment_author": "rsmitty"
        },
        {
          "number": 513,
          "created_at": "2026-07-29T05:26:36Z",
          "last_comment_at": null,
          "last_comment_author": null
        }
      ],
      "last_merged_pr_at": "2026-07-28T15:11:30Z",
      "ci_last_conclusion": "SUCCESS",
      "oldest_open_issues": [
        {
          "number": 60,
          "created_at": "2023-11-17T14:17:24Z",
          "last_comment_at": "2026-07-15T05:15:33Z",
          "last_comment_author": "tz-torchai"
        },
        {
          "number": 198,
          "created_at": "2025-02-06T16:04:35Z",
          "last_comment_at": null,
          "last_comment_author": null
        },
        {
          "number": 202,
          "created_at": "2025-02-18T09:29:43Z",
          "last_comment_at": "2026-05-04T02:15:52Z",
          "last_comment_author": "github-actions"
        },
        {
          "number": 286,
          "created_at": "2025-08-07T22:46:17Z",
          "last_comment_at": "2026-05-20T18:43:03Z",
          "last_comment_author": "fsgh42"
        },
        {
          "number": 310,
          "created_at": "2025-09-29T12:27:33Z",
          "last_comment_at": "2026-03-31T02:14:39Z",
          "last_comment_author": "github-actions"
        },
        {
          "number": 318,
          "created_at": "2025-10-01T09:58:44Z",
          "last_comment_at": "2026-03-31T02:14:38Z",
          "last_comment_author": "github-actions"
        },
        {
          "number": 356,
          "created_at": "2026-01-20T11:57:35Z",
          "last_comment_at": "2026-04-24T10:06:54Z",
          "last_comment_author": "smira"
        },
        {
          "number": 413,
          "created_at": "2026-03-17T19:37:42Z",
          "last_comment_at": "2026-03-18T07:52:30Z",
          "last_comment_author": "smira"
        },
        {
          "number": 415,
          "created_at": "2026-04-01T20:10:54Z",
          "last_comment_at": null,
          "last_comment_author": null
        },
        {
          "number": 459,
          "created_at": "2026-05-20T16:19:47Z",
          "last_comment_at": "2026-05-25T11:46:27Z",
          "last_comment_author": "Orzelius"
        },
        {
          "number": 477,
          "created_at": "2026-06-04T22:11:41Z",
          "last_comment_at": "2026-06-12T08:03:41Z",
          "last_comment_author": "fsgh42"
        },
        {
          "number": 498,
          "created_at": "2026-07-15T15:56:35Z",
          "last_comment_at": "2026-07-20T14:23:50Z",
          "last_comment_author": "jeffbehl-beep"
        }
      ]
    }
  },
  "config": {
    "disabled_metrics": [],
    "disabled_categories": [],
    "disabled_components": {}
  },
  "source": {
    "url": "https://github.com/siderolabs/image-factory",
    "host": "github.com",
    "name": "image-factory",
    "owner": "siderolabs"
  },
  "metrics": {
    "overall": {
      "key": "overall",
      "band": "excellent",
      "name": "Overall health",
      "note": "The weighted overall 76 is calibrated to 90 on the published index scale (record calibration 2026-08-02).",
      "notes": [
        {
          "code": "overall_calibration",
          "params": {
            "raw": 76,
            "calibrated": 90,
            "calibration": "2026-08-02"
          }
        }
      ],
      "value": 90,
      "inputs": {
        "security": 66,
        "vitality": 92,
        "community": 53,
        "governance": 81,
        "calibration": "2026-08-02",
        "engineering": 80,
        "ai_readiness": 73,
        "weighted_overall_raw": 76
      },
      "components": []
    },
    "categories": [
      {
        "key": "vitality",
        "band": "excellent",
        "name": "Vitality",
        "value": 92,
        "weight": 0.21,
        "metrics": [
          {
            "key": "development_activity",
            "band": "exceptional",
            "name": "Development activity",
            "note": null,
            "notes": [],
            "value": 94,
            "inputs": {
              "commits_last_year": 158,
              "human_commit_share": 1,
              "days_since_last_push": 0,
              "active_weeks_last_year": 44
            },
            "components": [
              {
                "key": "push_recency",
                "name": "Push recency",
                "detail": "last push 0 days ago",
                "points": 36,
                "status": "met",
                "details": [
                  {
                    "code": "push_recency",
                    "params": {
                      "days": 0
                    }
                  }
                ],
                "max_points": 36
              },
              {
                "key": "commit_cadence",
                "name": "Commit cadence",
                "detail": "44/52 weeks with commits",
                "points": 30.5,
                "status": "partial",
                "details": [
                  {
                    "code": "commit_cadence_weeks",
                    "params": {
                      "weeks": 44
                    }
                  }
                ],
                "max_points": 36
              },
              {
                "key": "commit_volume",
                "name": "Commit volume",
                "detail": "158 commits in the last year",
                "points": 18,
                "status": "met",
                "details": [
                  {
                    "code": "commits_last_year",
                    "params": {
                      "count": 158
                    }
                  }
                ],
                "max_points": 18
              },
              {
                "key": "openssf_scorecard_maintained",
                "name": "OpenSSF Scorecard: Maintained",
                "detail": "30 commit(s) and 16 issue activity found in the last 90 days -- score normalized to 10",
                "points": 10,
                "status": "met",
                "details": [],
                "max_points": 10
              }
            ]
          },
          {
            "key": "release_discipline",
            "band": "excellent",
            "name": "Release discipline",
            "note": null,
            "notes": [],
            "value": 90,
            "inputs": {
              "releases_count": 50,
              "latest_release_tag": "v1.4.0",
              "releases_from_tags": false,
              "days_since_latest_release": 8,
              "mean_days_between_releases": 18.5
            },
            "components": [
              {
                "key": "ships_releases",
                "name": "Ships releases",
                "detail": "50 releases published",
                "points": 27,
                "status": "met",
                "details": [
                  {
                    "code": "releases_published",
                    "params": {
                      "count": 50
                    }
                  }
                ],
                "max_points": 27
              },
              {
                "key": "release_recency",
                "name": "Release recency",
                "detail": "latest release 8 days ago",
                "points": 36,
                "status": "met",
                "details": [
                  {
                    "code": "release_recency",
                    "params": {
                      "days": 8
                    }
                  }
                ],
                "max_points": 36
              },
              {
                "key": "release_cadence",
                "name": "Release cadence",
                "detail": "a release every ~18.5 days",
                "points": 27,
                "status": "met",
                "details": [
                  {
                    "code": "release_cadence",
                    "params": {
                      "gap": 18.5
                    }
                  }
                ],
                "max_points": 27
              },
              {
                "key": "openssf_scorecard_signed_releases",
                "name": "OpenSSF Scorecard: Signed-Releases",
                "detail": "Project has not signed or included provenance with any releases.",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 10
              }
            ]
          },
          {
            "key": "abandonment",
            "band": "exceptional",
            "name": "Abandonment",
            "note": null,
            "notes": [],
            "value": 100,
            "inputs": {
              "cap": null,
              "state": "maintained",
              "guards": [],
              "signals": [],
              "red_flag": false,
              "multiplier_pct": 100,
              "declared_reason": null,
              "unverified_reason": null,
              "unanswered_open_prs": null,
              "unanswered_open_issues": null,
              "days_since_last_merged_pr": null,
              "days_since_last_human_commit": 5,
              "days_since_last_human_commit_is_floor": false
            },
            "components": [
              {
                "key": "project_is_still_maintained",
                "name": "Project is still maintained",
                "detail": "last human commit 5 days ago",
                "points": 100,
                "status": "met",
                "details": [
                  {
                    "code": "abandonment_maintained",
                    "params": {
                      "days": 5
                    }
                  }
                ],
                "max_points": 100
              }
            ]
          }
        ],
        "description": "Is the project alive — is code being written and are releases shipping?"
      },
      {
        "key": "community",
        "band": "moderate",
        "name": "Community & Adoption",
        "value": 53,
        "weight": 0.17,
        "metrics": [
          {
            "key": "popularity",
            "band": "moderate",
            "name": "Popularity & adoption",
            "note": null,
            "notes": [],
            "value": 55,
            "inputs": {
              "forks": 56,
              "stars": 191,
              "watchers": 6,
              "growth_state": "unverified",
              "growth_factor_pct": 100,
              "growth_unverified_reason": "no_history"
            },
            "components": [
              {
                "key": "stars",
                "name": "Stars",
                "detail": "191 stars",
                "points": 37,
                "status": "partial",
                "details": [
                  {
                    "code": "stars",
                    "params": {
                      "count": 191
                    }
                  }
                ],
                "max_points": 60
              },
              {
                "key": "forks",
                "name": "Forks",
                "detail": "56 forks",
                "points": 14.5,
                "status": "partial",
                "details": [
                  {
                    "code": "forks",
                    "params": {
                      "count": 56
                    }
                  }
                ],
                "max_points": 25
              },
              {
                "key": "watchers",
                "name": "Watchers",
                "detail": "6 watchers",
                "points": 3.9,
                "status": "partial",
                "details": [
                  {
                    "code": "watchers",
                    "params": {
                      "count": 6
                    }
                  }
                ],
                "max_points": 15
              }
            ]
          },
          {
            "key": "community_health",
            "band": "moderate",
            "name": "Community health",
            "note": null,
            "notes": [],
            "value": 50,
            "inputs": {
              "has_readme": true,
              "has_license": true,
              "readme_badges": null,
              "has_contributing": false,
              "has_issue_template": false,
              "has_code_of_conduct": false,
              "readme_badge_services": [],
              "has_pull_request_template": false
            },
            "components": [
              {
                "key": "readme",
                "name": "README",
                "detail": null,
                "points": 22.5,
                "status": "met",
                "details": [],
                "max_points": 22.5
              },
              {
                "key": "license",
                "name": "License",
                "detail": "recognized license (MPL-2.0)",
                "points": 22.5,
                "status": "met",
                "details": [
                  {
                    "code": "license_standard",
                    "params": {}
                  },
                  {
                    "code": "license_spdx",
                    "params": {
                      "spdx": "MPL-2.0"
                    }
                  }
                ],
                "max_points": 22.5
              },
              {
                "key": "contributing_guide",
                "name": "CONTRIBUTING guide",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 18
              },
              {
                "key": "code_of_conduct",
                "name": "Code of conduct",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 13.5
              },
              {
                "key": "issue_template",
                "name": "Issue template",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.2
              },
              {
                "key": "pr_template",
                "name": "PR template",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 6.3
              }
            ]
          }
        ],
        "description": "Does the project have users, downloads, attention, and a welcoming setup for contributors?"
      },
      {
        "key": "governance",
        "band": "excellent",
        "name": "Sustainability & Governance",
        "value": 81,
        "weight": 0.23,
        "metrics": [
          {
            "key": "maintainer_resilience",
            "band": "moderate",
            "name": "Maintainer resilience (bus factor)",
            "note": null,
            "notes": [],
            "value": 61,
            "inputs": {
              "bus_factor": 2,
              "contributors_sampled": 25,
              "top_contributor_share": 0.457
            },
            "components": [
              {
                "key": "bus_factor",
                "name": "Bus factor",
                "detail": "2 contributor(s) cover half of all commits",
                "points": 25.2,
                "status": "partial",
                "details": [
                  {
                    "code": "bus_factor",
                    "params": {
                      "count": 2
                    }
                  }
                ],
                "max_points": 54
              },
              {
                "key": "commit_distribution",
                "name": "Commit distribution",
                "detail": "top contributor authored 46% of commits",
                "points": 12.2,
                "status": "partial",
                "details": [
                  {
                    "code": "top_contributor_share",
                    "params": {
                      "share": 46
                    }
                  }
                ],
                "max_points": 22.5
              },
              {
                "key": "contributor_breadth",
                "name": "Contributor breadth",
                "detail": "25 contributors",
                "points": 13.5,
                "status": "met",
                "details": [
                  {
                    "code": "contributors_sampled",
                    "params": {
                      "count": 25
                    }
                  }
                ],
                "max_points": 13.5
              },
              {
                "key": "openssf_scorecard_contributors",
                "name": "OpenSSF Scorecard: Contributors",
                "detail": "project has 9 contributing companies or organizations",
                "points": 10,
                "status": "met",
                "details": [],
                "max_points": 10
              }
            ]
          },
          {
            "key": "responsiveness",
            "band": "exceptional",
            "name": "Issue & PR responsiveness",
            "note": "Excluded from scoring (no data or not applicable): Newcomer PR acceptance. Remaining weights renormalized.",
            "notes": [
              {
                "code": "excluded_no_data",
                "params": {
                  "components": [
                    "newcomer_pr_acceptance"
                  ]
                }
              },
              {
                "code": "weights_renormalized",
                "params": {}
              }
            ],
            "value": 94,
            "inputs": {
              "merged_prs": 297,
              "open_issues": 12,
              "closed_issues": 146,
              "prs_merged_7d": null,
              "prs_decided_7d": null,
              "prs_merged_30d": null,
              "prs_decided_30d": null,
              "issue_closed_ratio": 0.924,
              "closed_unmerged_prs": 22,
              "first_time_authors_30d": null,
              "first_time_prs_merged_30d": null,
              "first_time_prs_decided_30d": null
            },
            "components": [
              {
                "key": "issue_resolution",
                "name": "Issue resolution",
                "detail": "92% of issues closed",
                "points": 38.8,
                "status": "partial",
                "details": [
                  {
                    "code": "issues_closed_share",
                    "params": {
                      "share": 92
                    }
                  }
                ],
                "max_points": 42
              },
              {
                "key": "pr_acceptance",
                "name": "PR acceptance",
                "detail": "297/319 decided PRs merged",
                "points": 27.9,
                "status": "partial",
                "details": [
                  {
                    "code": "decided_prs_merged",
                    "params": {
                      "merged": 297,
                      "decided": 319
                    }
                  }
                ],
                "max_points": 30
              },
              {
                "key": "newcomer_pr_acceptance",
                "name": "Newcomer PR acceptance",
                "detail": "no first-time contributor's PR decided in 30d",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "no_newcomer_prs",
                    "params": {
                      "days": 30
                    }
                  }
                ],
                "max_points": 13
              },
              {
                "key": "openssf_scorecard_code_review",
                "name": "OpenSSF Scorecard: Code-Review",
                "detail": "all changesets reviewed",
                "points": 15,
                "status": "met",
                "details": [],
                "max_points": 15
              }
            ]
          },
          {
            "key": "stewardship",
            "band": "good",
            "name": "Ownership & stewardship",
            "note": null,
            "notes": [],
            "value": 76,
            "inputs": {
              "followers": 729,
              "owner_type": "Organization",
              "is_verified": null,
              "owner_login": "siderolabs",
              "public_repos": 144,
              "account_age_days": 4001
            },
            "components": [
              {
                "key": "ownership_backing",
                "name": "Ownership backing",
                "detail": "organization-owned",
                "points": 30,
                "status": "met",
                "details": [
                  {
                    "code": "owner_organization",
                    "params": {}
                  }
                ],
                "max_points": 30
              },
              {
                "key": "verified_domain",
                "name": "Verified domain",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 20
              },
              {
                "key": "owner_reach",
                "name": "Owner reach",
                "detail": "729 followers of siderolabs",
                "points": 20.6,
                "status": "partial",
                "details": [
                  {
                    "code": "owner_followers",
                    "params": {
                      "count": 729,
                      "login": "siderolabs"
                    }
                  }
                ],
                "max_points": 25
              },
              {
                "key": "track_record",
                "name": "Track record",
                "detail": "144 public repos, account ~10 yr old",
                "points": 25,
                "status": "met",
                "details": [
                  {
                    "code": "public_repos",
                    "params": {
                      "count": 144
                    }
                  },
                  {
                    "code": "account_age_years",
                    "params": {
                      "years": 10
                    }
                  }
                ],
                "max_points": 25
              }
            ]
          },
          {
            "key": "package_maintenance",
            "band": "exceptional",
            "name": "Package maintenance",
            "note": null,
            "notes": [],
            "value": 100,
            "inputs": {
              "packages": [
                "github.com/siderolabs/image-factory"
              ],
              "ecosystems": "go",
              "any_deprecated": false,
              "min_days_since_publish": 8
            },
            "components": [
              {
                "key": "published_resolvable",
                "name": "Published & resolvable",
                "detail": "1 package(s) on go",
                "points": 25,
                "status": "met",
                "details": [
                  {
                    "code": "packages_published",
                    "params": {
                      "count": 1,
                      "ecosystems": "go"
                    }
                  }
                ],
                "max_points": 25
              },
              {
                "key": "publish_recency",
                "name": "Publish recency",
                "detail": "latest publish 8 days ago",
                "points": 35,
                "status": "met",
                "details": [
                  {
                    "code": "publish_recency",
                    "params": {
                      "days": 8
                    }
                  }
                ],
                "max_points": 35
              },
              {
                "key": "version_history",
                "name": "Version history",
                "detail": "50 published versions",
                "points": 20,
                "status": "met",
                "details": [
                  {
                    "code": "published_versions",
                    "params": {
                      "count": 50
                    }
                  }
                ],
                "max_points": 20
              },
              {
                "key": "not_deprecated",
                "name": "Not deprecated",
                "detail": "active, not deprecated or yanked",
                "points": 20,
                "status": "met",
                "details": [
                  {
                    "code": "package_not_deprecated",
                    "params": {}
                  }
                ],
                "max_points": 20
              }
            ]
          }
        ],
        "description": "Will the project survive its people — bus factor, responsiveness, who backs it, and package upkeep?"
      },
      {
        "key": "engineering",
        "band": "excellent",
        "name": "Engineering Quality",
        "value": 80,
        "weight": 0.19,
        "metrics": [
          {
            "key": "engineering_practices",
            "band": "excellent",
            "name": "Engineering practices",
            "note": null,
            "notes": [],
            "value": 84,
            "inputs": {
              "has_ci": true,
              "has_tests": true,
              "has_editorconfig": false,
              "has_linter_config": true,
              "has_precommit_config": false
            },
            "components": [
              {
                "key": "ci_workflows",
                "name": "CI workflows",
                "detail": "6 workflow(s)",
                "points": 24,
                "status": "met",
                "details": [
                  {
                    "code": "ci_workflows",
                    "params": {
                      "count": 6
                    }
                  }
                ],
                "max_points": 24
              },
              {
                "key": "tests_present",
                "name": "Tests present",
                "detail": null,
                "points": 24,
                "status": "met",
                "details": [],
                "max_points": 24
              },
              {
                "key": "linter_config",
                "name": "Linter config",
                "detail": ".golangci.yml",
                "points": 16,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": ".golangci.yml"
                    }
                  }
                ],
                "max_points": 16
              },
              {
                "key": "pre_commit_hooks",
                "name": "Pre-commit hooks",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 9.6
              },
              {
                "key": "editorconfig",
                "name": ".editorconfig",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 6.4
              },
              {
                "key": "openssf_scorecard_ci_tests",
                "name": "OpenSSF Scorecard: CI-Tests",
                "detail": "28 out of 28 merged PRs checked by a CI test -- score normalized to 10",
                "points": 20,
                "status": "met",
                "details": [],
                "max_points": 20
              }
            ]
          },
          {
            "key": "documentation",
            "band": "good",
            "name": "Documentation",
            "note": null,
            "notes": [],
            "value": 75,
            "inputs": {
              "topics": [],
              "has_wiki": true,
              "homepage": null,
              "has_readme": true,
              "has_docs_dir": true,
              "has_description": true
            },
            "components": [
              {
                "key": "readme",
                "name": "README",
                "detail": null,
                "points": 30,
                "status": "met",
                "details": [],
                "max_points": 30
              },
              {
                "key": "documentation_directory",
                "name": "Documentation directory",
                "detail": null,
                "points": 25,
                "status": "met",
                "details": [],
                "max_points": 25
              },
              {
                "key": "documentation_homepage_site",
                "name": "Documentation / homepage site",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 15
              },
              {
                "key": "repository_description",
                "name": "Repository description",
                "detail": null,
                "points": 10,
                "status": "met",
                "details": [],
                "max_points": 10
              },
              {
                "key": "topics",
                "name": "Topics",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 10
              },
              {
                "key": "wiki",
                "name": "Wiki",
                "detail": null,
                "points": 10,
                "status": "met",
                "details": [],
                "max_points": 10
              }
            ]
          }
        ],
        "description": "Are baseline engineering and documentation practices in place?"
      },
      {
        "key": "security",
        "band": "good",
        "name": "Security",
        "value": 66,
        "weight": 0.16,
        "metrics": [
          {
            "key": "security_posture",
            "band": "moderate",
            "name": "Security posture",
            "note": "Excluded from scoring (no data or not applicable): Branch-Protection, Packaging. Remaining weights renormalized.",
            "notes": [
              {
                "code": "excluded_no_data",
                "params": {
                  "components": [
                    "branch_protection",
                    "packaging"
                  ]
                }
              },
              {
                "code": "weights_renormalized",
                "params": {}
              }
            ],
            "value": 60,
            "inputs": {
              "source": "openssf_scorecard",
              "checks_evaluated": 16,
              "scorecard_version": "v5.5.0",
              "checks_inconclusive": 2,
              "scorecard_aggregate": 6
            },
            "components": [
              {
                "key": "binary_artifacts",
                "name": "Binary-Artifacts",
                "detail": "no binaries found in the repo",
                "points": 7.5,
                "status": "met",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "branch_protection",
                "name": "Branch-Protection",
                "detail": "internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "no_data",
                    "params": {}
                  }
                ],
                "max_points": 7.5
              },
              {
                "key": "ci_tests",
                "name": "CI-Tests",
                "detail": "28 out of 28 merged PRs checked by a CI test -- score normalized to 10",
                "points": 2.5,
                "status": "met",
                "details": [],
                "max_points": 2.5
              },
              {
                "key": "cii_best_practices",
                "name": "CII-Best-Practices",
                "detail": "no effort to earn an OpenSSF best practices badge detected",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 2.5
              },
              {
                "key": "code_review",
                "name": "Code-Review",
                "detail": "all changesets reviewed",
                "points": 7.5,
                "status": "met",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "contributors",
                "name": "Contributors",
                "detail": "project has 9 contributing companies or organizations",
                "points": 2.5,
                "status": "met",
                "details": [],
                "max_points": 2.5
              },
              {
                "key": "dangerous_workflow",
                "name": "Dangerous-Workflow",
                "detail": "no dangerous workflow patterns detected",
                "points": 10,
                "status": "met",
                "details": [],
                "max_points": 10
              },
              {
                "key": "dependency_update_tool",
                "name": "Dependency-Update-Tool",
                "detail": "update tool detected",
                "points": 7.5,
                "status": "met",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "fuzzing",
                "name": "Fuzzing",
                "detail": "project is not fuzzed",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 5
              },
              {
                "key": "license",
                "name": "License",
                "detail": "license file detected",
                "points": 2.5,
                "status": "met",
                "details": [],
                "max_points": 2.5
              },
              {
                "key": "maintained",
                "name": "Maintained",
                "detail": "30 commit(s) and 16 issue activity found in the last 90 days -- score normalized to 10",
                "points": 7.5,
                "status": "met",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "packaging",
                "name": "Packaging",
                "detail": "packaging workflow not detected",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "no_data",
                    "params": {}
                  }
                ],
                "max_points": 5
              },
              {
                "key": "pinned_dependencies",
                "name": "Pinned-Dependencies",
                "detail": "dependency not pinned by hash detected -- score normalized to 5",
                "points": 2.5,
                "status": "partial",
                "details": [],
                "max_points": 5
              },
              {
                "key": "sast",
                "name": "SAST",
                "detail": "SAST tool is not run on all commits -- score normalized to 0",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 5
              },
              {
                "key": "security_policy",
                "name": "Security-Policy",
                "detail": "security policy file not detected",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 5
              },
              {
                "key": "signed_releases",
                "name": "Signed-Releases",
                "detail": "Project has not signed or included provenance with any releases.",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "token_permissions",
                "name": "Token-Permissions",
                "detail": "detected GitHub workflow tokens with excessive permissions",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "vulnerabilities",
                "name": "Vulnerabilities",
                "detail": "3 existing vulnerabilities detected",
                "points": 5.2,
                "status": "partial",
                "details": [],
                "max_points": 7.5
              }
            ]
          },
          {
            "key": "dependency_advisories",
            "band": "excellent",
            "name": "Dependency advisories",
            "note": "Excluded from scoring (no data or not applicable): Indirect dependencies free of known advisories. Remaining weights renormalized. Matched 556 resolved dependencies against OSV. This repository publishes no package the index resolves, so the repository dependency graph was assessed instead. That graph mixes development and test pins with shipped dependencies, so only the declared runtime dependencies are scored; transitive findings are reported as context and excluded from the score. Reachability is not analyzed.",
            "notes": [
              {
                "code": "excluded_no_data",
                "params": {
                  "components": [
                    "indirect_dependencies_free_of_known_advisories"
                  ]
                }
              },
              {
                "code": "weights_renormalized",
                "params": {}
              },
              {
                "code": "advisories_scope_repository",
                "params": {
                  "assessed": 556
                }
              },
              {
                "code": "advisories_repo_graph_caveat",
                "params": {}
              },
              {
                "code": "advisories_reachability",
                "params": {}
              }
            ],
            "value": 89,
            "inputs": {
              "source": "osv",
              "advisories": 4,
              "affected_packages": 3,
              "assessed_packages": 556,
              "unassessed_packages": 0,
              "affected_by_severity": "moderate 1, low 1, unknown 1",
              "direct_affected_packages": 1
            },
            "components": [
              {
                "key": "direct_dependencies_free_of_known_advisories",
                "name": "Direct dependencies free of known advisories",
                "detail": "1 affected: golang.org/x/crypto v0.54.0 (unknown)",
                "points": 26.6,
                "status": "partial",
                "details": [
                  {
                    "code": "advisories_affected",
                    "params": {
                      "count": 1,
                      "packages": "golang.org/x/crypto v0.54.0 (unknown)"
                    }
                  }
                ],
                "max_points": 35
              },
              {
                "key": "indirect_dependencies_free_of_known_advisories",
                "name": "Indirect dependencies free of known advisories",
                "detail": "transitive set not separable from development and test dependencies in this scope",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "advisories_scope_not_separable",
                    "params": {}
                  }
                ],
                "max_points": 25
              },
              {
                "key": "no_advisories_left_outstanding",
                "name": "No advisories left outstanding",
                "detail": "no advisory has been public longer than 90 days",
                "points": 40,
                "status": "met",
                "details": [
                  {
                    "code": "advisories_none_stale",
                    "params": {
                      "days": 90
                    }
                  }
                ],
                "max_points": 40
              }
            ]
          },
          {
            "key": "malicious_dependencies",
            "band": "exceptional",
            "name": "Malicious dependencies",
            "note": null,
            "notes": [],
            "value": 100,
            "inputs": {
              "source": "osv",
              "meaning": "reported as a malicious package by the OpenSSF corpus; the remedy is removal or moving off the compromised name, never an upgrade of the same artifact. Versions the registry has since pulled are listed but not scored",
              "packages": [],
              "red_flag": false,
              "assessed_packages": 556,
              "malicious_packages": 0,
              "direct_malicious_packages": 0,
              "withdrawn_malicious_packages": 0,
              "installable_malicious_packages": 0
            },
            "components": [
              {
                "key": "no_dependency_reported_as_a_malicious_package",
                "name": "No dependency reported as a malicious package",
                "detail": "no dependency is reported as a malicious package",
                "points": 100,
                "status": "met",
                "details": [
                  {
                    "code": "no_malicious_dependencies",
                    "params": {}
                  }
                ],
                "max_points": 100
              }
            ]
          },
          {
            "key": "high_risk_jurisdiction_exposure",
            "band": "exceptional",
            "name": "High-Risk Jurisdiction Exposure",
            "note": "Only high-confidence self-published location evidence affects this multiplier. Ambiguous matches are review-only; country evidence is not proof of nationality, citizenship, legal registration, malicious intent, or sanctions status.",
            "notes": [
              {
                "code": "jurisdiction_evidence_limits",
                "params": {}
              }
            ],
            "value": 100,
            "inputs": {
              "meaning": "self-published location evidence; not nationality or citizenship",
              "red_flag": false,
              "exposures": [],
              "policy_countries": [
                "Russia",
                "Iran",
                "North Korea"
              ],
              "commit_weight_rule": {
                "min_commits": 50,
                "min_commit_share": 0.1
              },
              "review_only_matches": 0,
              "below_threshold_exposures": [],
              "assessed_self_published_locations": 18
            },
            "components": [
              {
                "key": "policy_exposure_multiplier",
                "name": "Policy exposure multiplier",
                "detail": "no confirmed policy-scope location match",
                "points": 100,
                "status": "met",
                "details": [
                  {
                    "code": "jurisdiction_no_match",
                    "params": {}
                  }
                ],
                "max_points": 100
              }
            ]
          }
        ],
        "description": "Are visible security and supply-chain practices strong, with no malicious dependency and no unresolved high-risk jurisdiction exposure?"
      },
      {
        "key": "ai_readiness",
        "band": "good",
        "name": "AI Readiness",
        "value": 73,
        "weight": 0.04,
        "metrics": [
          {
            "key": "ai_agent_context",
            "band": "moderate",
            "name": "Agent context & guidance",
            "note": null,
            "notes": [],
            "value": 55,
            "inputs": {
              "has_llms_txt": true,
              "legible_history_share": 1,
              "agent_instruction_files": [],
              "agent_instruction_max_bytes": null
            },
            "components": [
              {
                "key": "agent_instructions",
                "name": "Agent instructions",
                "detail": "no CLAUDE.md / AGENTS.md / editor rules",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "no_agent_instructions",
                    "params": {}
                  }
                ],
                "max_points": 45
              },
              {
                "key": "machine_readable_docs_llms_txt",
                "name": "Machine-readable docs (llms.txt)",
                "detail": "llms.txt present",
                "points": 15,
                "status": "met",
                "details": [
                  {
                    "code": "llms_txt_present",
                    "params": {}
                  }
                ],
                "max_points": 15
              },
              {
                "key": "legible_commit_history",
                "name": "Legible commit history",
                "detail": "100 of 100 human commits state their intent (structured subject or explanatory body)",
                "points": 40,
                "status": "met",
                "details": [
                  {
                    "code": "legible_history",
                    "params": {
                      "legible": 100,
                      "sampled": 100
                    }
                  }
                ],
                "max_points": 40
              }
            ]
          },
          {
            "key": "ai_verify_loop",
            "band": "good",
            "name": "Verify loop (build / test / typecheck)",
            "note": null,
            "notes": [],
            "value": 77,
            "inputs": {
              "has_nix": false,
              "has_tests": true,
              "lockfiles": [
                "go.sum",
                "package-lock.json"
              ],
              "has_dockerfile": true,
              "typed_language": true,
              "bootstrap_files": [
                "Makefile"
              ],
              "has_devcontainer": false,
              "has_linter_config": true,
              "typecheck_configs": [],
              "agent_commit_share": 0,
              "toolchain_manifests": [
                "go.mod"
              ],
              "dependency_bot_commit_share": 0
            },
            "components": [
              {
                "key": "one_command_bootstrap",
                "name": "One-command bootstrap",
                "detail": "Makefile",
                "points": 18,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": "Makefile"
                    }
                  }
                ],
                "max_points": 18
              },
              {
                "key": "automated_tests",
                "name": "Automated tests",
                "detail": null,
                "points": 22,
                "status": "met",
                "details": [],
                "max_points": 22
              },
              {
                "key": "lint_format_config",
                "name": "Lint / format config",
                "detail": ".golangci.yml",
                "points": 11,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": ".golangci.yml"
                    }
                  }
                ],
                "max_points": 11
              },
              {
                "key": "static_type_checking",
                "name": "Static type checking",
                "detail": "Go (statically typed)",
                "points": 11,
                "status": "met",
                "details": [
                  {
                    "code": "statically_typed_language",
                    "params": {
                      "language": "Go"
                    }
                  }
                ],
                "max_points": 11
              },
              {
                "key": "reproducible_environment",
                "name": "Reproducible environment",
                "detail": "Dockerfile, lockfile",
                "points": 10,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": "Dockerfile, lockfile"
                    }
                  }
                ],
                "max_points": 10
              },
              {
                "key": "demonstrated_agent_practice",
                "name": "Demonstrated agent practice",
                "detail": "no agent-authored commits among the last 100",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "no_agent_authored_commits",
                    "params": {
                      "sampled": 100
                    }
                  }
                ],
                "max_points": 10
              },
              {
                "key": "automated_maintenance",
                "name": "Automated maintenance",
                "detail": "no automated dependency updates observed",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "no_dependency_automation",
                    "params": {}
                  }
                ],
                "max_points": 8
              },
              {
                "key": "openssf_scorecard_pinned_dependencies",
                "name": "OpenSSF Scorecard: Pinned-Dependencies",
                "detail": "dependency not pinned by hash detected -- score normalized to 5",
                "points": 5,
                "status": "partial",
                "details": [],
                "max_points": 10
              }
            ]
          },
          {
            "key": "ai_code_legibility",
            "band": "exceptional",
            "name": "Code legibility for models",
            "note": null,
            "notes": [],
            "value": 100,
            "inputs": {
              "primary_language": "Go",
              "largest_source_bytes": 47052,
              "source_files_sampled": 152,
              "oversized_source_files": 0
            },
            "components": [
              {
                "key": "type_checkable_code",
                "name": "Type-checkable code",
                "detail": "Go (statically typed)",
                "points": 45,
                "status": "met",
                "details": [
                  {
                    "code": "statically_typed_language",
                    "params": {
                      "language": "Go"
                    }
                  }
                ],
                "max_points": 45
              },
              {
                "key": "manageable_file_sizes",
                "name": "Manageable file sizes",
                "detail": "0/152 source files over 60KB",
                "points": 55,
                "status": "met",
                "details": [
                  {
                    "code": "oversized_source_files",
                    "params": {
                      "kb": 60,
                      "sampled": 152,
                      "oversized": 0
                    }
                  }
                ],
                "max_points": 55
              }
            ]
          }
        ],
        "description": "How well is the repo equipped to be developed and maintained with AI coding agents? Carries a deliberately small weight: agent tooling is a real maintenance signal, but its absence must never gate the top of the scale (calibration saturates at raw 91, so 100/100 remains reachable with AI Readiness at zero)."
      }
    ],
    "classification": {
      "labels": [
        "library"
      ],
      "scores": {
        "library": 6
      },
      "primary": "library",
      "evidence": [
        {
          "tier": "distribution",
          "label": "library",
          "source": "registry:go",
          "weight": 6
        }
      ],
      "artifacts": [],
      "confidence": "medium",
      "host_extension": false,
      "runs_as_process": false,
      "consumed_by_code": true
    },
    "metrics_version": "2.3.1"
  },
  "warnings": [
    "Star history unavailable: GitHub GraphQL error: Resource not accessible by personal access token"
  ],
  "report_type": "repository",
  "generated_at": "2026-07-29T06:11:45.907005Z",
  "schema_version": "0.27.0",
  "badge_url": "https://raw.githubusercontent.com/inspect-software/badges/main/v1/s/siderolabs/image-factory.svg",
  "full_name": "siderolabs/image-factory",
  "license_state": "standard",
  "license_spdx": "MPL-2.0"
}