westonsteimel / grype

Full resolved dependency set from the GitHub dependency graph: 75 direct and 258 indirect (transitive) packages. The transitive closure is complete when the repository commits a lockfile.

This repository publishes no package the index resolves, so its own dependency graph was assessed — 333 packages, which also include development and test pins that never ship: 5 carry known advisories, of which 2 are direct.

An advisory means the version recorded in the dependency graph falls inside an advisory’s affected range. Reachability is not analysed, and the graph includes development and test pins — a finding may concern tooling rather than shipped software.

{
  "data": {
    "repo": {
      "topics": [],
      "is_fork": true,
      "size_kb": 8947,
      "has_wiki": true,
      "homepage": null,
      "languages": {
        "Go": 3859248,
        "Shell": 44103,
        "Python": 3297,
        "Makefile": 8465,
        "Dockerfile": 1126,
        "Go Template": 65702
      },
      "pushed_at": "2026-06-25T08:21:41Z",
      "created_at": "2021-02-04T00:35:47Z",
      "owner_type": "User",
      "updated_at": "2026-06-25T08:21:48Z",
      "description": "A vulnerability scanner for container images and filesystems",
      "is_archived": false,
      "is_disabled": false,
      "license_spdx": "Apache-2.0",
      "default_branch": "main",
      "license_spdx_raw": "Apache-2.0",
      "primary_language": "Go",
      "significant_languages": [
        "Go"
      ]
    },
    "owner": {
      "blog": null,
      "name": "Weston Steimel",
      "type": "User",
      "login": "westonsteimel",
      "company": "@anchore",
      "location": "United Kingdom",
      "followers": 64,
      "avatar_url": "https://avatars.githubusercontent.com/u/1593939?v=4",
      "created_at": "2012-03-31T19:32:40Z",
      "is_verified": null,
      "public_repos": 436,
      "account_age_days": 5228
    },
    "license": {
      "state": "standard",
      "spdx_id": "Apache-2.0",
      "raw_spdx": "Apache-2.0",
      "file_present": true,
      "scorecard_found": true,
      "profile_has_license": false
    },
    "activity": {
      "releases": [
        {
          "tag": "v0.7.0",
          "kind": "minor",
          "published_at": "2021-01-27T19:15:02Z"
        },
        {
          "tag": "v0.6.1",
          "kind": "patch",
          "published_at": "2020-12-08T19:08:41Z"
        },
        {
          "tag": "v0.6.0",
          "kind": "minor",
          "published_at": "2020-12-03T22:04:12Z"
        },
        {
          "tag": "v0.5.0",
          "kind": "minor",
          "published_at": "2020-11-20T13:04:24Z"
        },
        {
          "tag": "v0.4.0",
          "kind": "minor",
          "published_at": "2020-11-12T15:10:19Z"
        },
        {
          "tag": "v0.3.0",
          "kind": "minor",
          "published_at": "2020-11-05T18:42:23Z"
        },
        {
          "tag": "v0.2.0",
          "kind": "minor",
          "published_at": "2020-10-23T18:12:34Z"
        },
        {
          "tag": "v0.1.0",
          "kind": "minor",
          "published_at": "2020-09-29T20:33:33Z"
        },
        {
          "tag": "v0.1.0-beta.11",
          "kind": "prerelease",
          "published_at": "2020-09-26T03:30:15Z"
        },
        {
          "tag": "v0.1.0-beta.10",
          "kind": "prerelease",
          "published_at": "2020-09-25T19:00:15Z"
        },
        {
          "tag": "v0.1.0-beta.9",
          "kind": "prerelease",
          "published_at": "2020-09-24T12:49:59Z"
        },
        {
          "tag": "v0.1.0-beta.8",
          "kind": "prerelease",
          "published_at": "2020-09-21T15:17:32Z"
        },
        {
          "tag": "v0.1.0-beta.7",
          "kind": "prerelease",
          "published_at": "2020-09-09T16:55:22Z"
        },
        {
          "tag": "v0.1.0-beta.6",
          "kind": "prerelease",
          "published_at": "2020-08-10T22:57:03Z"
        },
        {
          "tag": "v0.1.0-beta.5",
          "kind": "prerelease",
          "published_at": "2020-08-10T15:03:48Z"
        },
        {
          "tag": "v0.1.0-beta.4",
          "kind": "prerelease",
          "published_at": "2020-07-30T23:06:27Z"
        },
        {
          "tag": "v0.1.0-beta.3",
          "kind": "prerelease",
          "published_at": "2020-07-30T01:11:05Z"
        },
        {
          "tag": "v0.1.0-beta.2",
          "kind": "prerelease",
          "published_at": "2020-07-27T19:13:10Z"
        },
        {
          "tag": "v0.1.0-beta.1",
          "kind": "prerelease",
          "published_at": "2020-07-27T14:12:40Z"
        }
      ],
      "recent_commits": [
        {
          "oid": "219a3b808f03500eb0a4ed4e57f0841fd107a607",
          "body": "Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>",
          "is_bot": false,
          "headline": "Update go-make to v0.8.0 (#3528)",
          "author_name": "Alex Goodman",
          "author_login": "wagoodman",
          "committed_at": "2026-06-24T03:26:46Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "fa5977bd05eb82b621f21435e1dd16e81282d054",
          "body": "* fix(govulndb): only emit records for stdlib\n\nFor third party go packages, go vuln db has some very strange version\nranges, and this has caused a number of false positive reports.\nAdditionally, for most of them, Grype currently reports both a GHSA and\na GO record, resulting in user confusion.\n\nHowe\n[…]\n.com>\n\n* Clean up some additional test fixtures\n\nSigned-off-by: Will Murphy <willmurphyscode@users.noreply.github.com>\n\n---------\n\nSigned-off-by: Will Murphy <willmurphyscode@users.noreply.github.com>",
          "is_bot": false,
          "headline": "fix(govulndb): only emit records for stdlib (#3527)",
          "author_name": "Will Murphy",
          "author_login": "willmurphyscode",
          "committed_at": "2026-06-23T16:30:40Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "80c4dcbf25e3b7be23556dd60aad16a85d9a2b73",
          "body": "Previously, lower and upper bounds on vulnerable windows would be ORed\ntogether if part of the range was reported in osv standard affected\nevents and the other part was reported in OSV ecosystem-specific\ncustom_ranges events. Fix the merge logic so that floors from the custom\nranges have the correct effect.\n\nSigned-off-by: Will Murphy <willmurphyscode@users.noreply.github.com>",
          "is_bot": false,
          "headline": "fix(govulndb): mix floors from custom ranges as appropriate (#3522)",
          "author_name": "Will Murphy",
          "author_login": "willmurphyscode",
          "committed_at": "2026-06-22T20:45:51Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "7bf3e633b7f5be278e3b21121a703b89dd7371a7",
          "body": "Bumps [github.com/containerd/containerd/v2](https://github.com/containerd/containerd) from 2.3.1 to 2.3.2.\n- [Release notes](https://github.com/containerd/containerd/releases)\n- [Changelog](https://github.com/containerd/containerd/blob/main/RELEASES.md)\n- [Commits](https://github.com/containerd/cont\n[…]\n/v2\n  dependency-version: 2.3.2\n  dependency-type: indirect\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump github.com/containerd/containerd/v2 (#3525)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-06-22T18:41:31Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "ef6e79161441c4608306906fedf002edd2220ce0",
          "body": "… dependabot/zizmor/gci cleanup (#3524)\n\nSigned-off-by: Alex Goodman <wagoodman@users.noreply.github.com>",
          "is_bot": false,
          "headline": "refactor release pipeline: TAG_TOKEN, skip-checks gate, go-make bump,…",
          "author_name": "Alex Goodman",
          "author_login": "wagoodman",
          "committed_at": "2026-06-22T17:59:14Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "931e487f4ea35d4858070301df9bdde1ec3d8932",
          "body": "Previous hummingbird work incorrectly marked only the search side\n(data.go) as having a rolling label. Therefore also mark hummingbird as\na rolling distro at database creation time.\n\nSigned-off-by: Will Murphy <willmurphyscode@users.noreply.github.com>",
          "is_bot": false,
          "headline": "fix(hummingbird): mark hummingbird distro as rolling (#3521)",
          "author_name": "Will Murphy",
          "author_login": "willmurphyscode",
          "committed_at": "2026-06-22T15:31:59Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "7e7b75f4a985d32c4c72d13ac0375eb7f84df233",
          "body": "…updates (#3518)\n\nBumps the go-minor-patch group with 2 updates in the / directory: [golang.org/x/text](https://github.com/golang/text) and [golang.org/x/tools](https://github.com/golang/tools).\n\n\nUpdates `golang.org/x/text` from 0.37.0 to 0.38.0\n- [Release notes](https://github.com/golang/text/rele\n[…]\nsion-update:semver-minor\n  dependency-group: go-minor-patch\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump the go-minor-patch group across 1 directory with 2 …",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-06-19T15:55:09Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "d6dae9d36dcfa1bc37712491fce39f184a94d46a",
          "body": "Previously, because GHSA does not cover the go stdlib, in order to avoid\nfalse negatives on the go stdlib, CPE matching had to be used. However,\ngrype now includes the Go Vuln DB data it its database, which does\ninclude the stdlib as if a regular go module, so this CPE fallback can\nbe disabled by default, fixing many false positives.\n\nSigned-off-by: Will Murphy <willmurphyscode@users.noreply.github.com>",
          "is_bot": false,
          "headline": "fix: disable go stdlib CPE matching by default. (#3517)",
          "author_name": "Will Murphy",
          "author_login": "willmurphyscode",
          "committed_at": "2026-06-18T21:58:42Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "70d0100826b00860b579f074cf6bcc64758df731",
          "body": "* fix(go-vulndb): merge in custom ranges when applicable\n\nGo OSV data has the standard OSV ranges, but also has custom ranges.\nPackages that do non-standard go versioning, for example by pushing a\ntag that starts with v2.x.y but not adding a /v2 in their module path,\nget relegated to the custom rang\n[…]\n custom fields, and some\nreadability refactors.\n\nSigned-off-by: Will Murphy <willmurphyscode@users.noreply.github.com>\n\n---------\n\nSigned-off-by: Will Murphy <willmurphyscode@users.noreply.github.com>",
          "is_bot": false,
          "headline": "fix(go-vulndb): merge in custom ranges when applicable (#3514)",
          "author_name": "Will Murphy",
          "author_login": "willmurphyscode",
          "committed_at": "2026-06-18T19:41:22Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "d9b837c4714944be421d86786c066993516034be",
          "body": "Bumps the go-minor-patch group with 1 update in the /.make directory: [github.com/anchore/go-make](https://github.com/anchore/go-make).\n\n\nUpdates `github.com/anchore/go-make` from 0.5.0 to 0.6.0\n- [Release notes](https://github.com/anchore/go-make/releases)\n- [Commits](https://github.com/anchore/go-\n[…]\nsion-update:semver-minor\n  dependency-group: go-minor-patch\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump github.com/anchore/go-make (#3502)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-06-18T19:08:54Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "55b3304bcd0e782ec388d933fbd00acbb21073a6",
          "body": "* Add OSV Model generator\n\nPreviously, there was an OSV scanner repository that exported a\nmodels.Vulnerability struct we could use. That repository deprecated\ntheir exported models and the models in grype are falling behind.\nTherefore, add a generator target that generates our own models based on\nt\n[…]\nSigned-off-by: Will Murphy <willmurphyscode@users.noreply.github.com>\nSigned-off-by: Alex Goodman <wagoodman@users.noreply.github.com>\nCo-authored-by: Alex Goodman <wagoodman@users.noreply.github.com>",
          "is_bot": false,
          "headline": "Add OSV Model generator (#3499)",
          "author_name": "Will Murphy",
          "author_login": "willmurphyscode",
          "committed_at": "2026-06-16T13:14:28Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "3888f9b7139e44f95120a163180438b8d7690794",
          "body": "Signed-off-by: Weston Steimel <author@code.w.steimel.me.uk>",
          "is_bot": false,
          "headline": "exclude linux-kbuild deb indirect matches by default (#3506)",
          "author_name": "Weston Steimel",
          "author_login": "westonsteimel",
          "committed_at": "2026-06-15T13:16:03Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "f54a905415fb95fa47274f33241d63f4ca55d351",
          "body": "…with 7 updates (#3503)\n\nBumps the actions-minor-patch group with 6 updates in the / directory:\n\n| Package | From | To |\n| --- | --- | --- |\n| [anchore/workflows/.github/workflows/codeql.yaml](https://github.com/anchore/workflows) | `0.7.0` | `0.7.2` |\n| [anchore/workflows/.github/workflows/check-ve\n[…]\nupdate:semver-minor\n  dependency-group: actions-minor-patch\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump the actions-minor-patch group across 2 directories …",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-06-12T15:56:30Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "77bf6acbbbe42f66e10a8cd81e6b8f6294112c64",
          "body": "Signed-off-by: Jeremy Spilman <jeremy.spilman@anchore.com>",
          "is_bot": false,
          "headline": "fix: avoid panic on invalid RHEL version IDs (#3490)",
          "author_name": "Jeremy Spilman",
          "author_login": "jspilman",
          "committed_at": "2026-06-09T17:39:54Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "c3917206e6ff706d66dd511408cea103a7930e3b",
          "body": "Signed-off-by: Will Murphy <willmurphyscode@users.noreply.github.com>",
          "is_bot": false,
          "headline": "test: add test fixtures for multi RHSA records from vunnel (#3480)",
          "author_name": "Will Murphy",
          "author_login": "willmurphyscode",
          "committed_at": "2026-06-09T17:27:45Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "ef8e65adb2dec760f1f923e635da4c7696d3c295",
          "body": "Signed-off-by: anchore-oss-update-bot <anchore-oss-update-bot@users.noreply.github.com>\nCo-authored-by: anchore-oss-update-bot <anchore-oss-update-bot@users.noreply.github.com>",
          "is_bot": false,
          "headline": "chore(deps): update anchore dependencies (#3487)",
          "author_name": "anchore-oss-update-bot",
          "author_login": "anchore-oss-update-bot",
          "committed_at": "2026-06-05T15:02:13Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "024e26b9c93c98861db438076a1df0eb6e911c8d",
          "body": "Otherwise we get false positives. Includes a matcher test to assert that\nGrype does not find withdrawn go vulns.\n\nSigned-off-by: Will Murphy <willmurphyscode@users.noreply.github.com>",
          "is_bot": false,
          "headline": "fix: respect withdrawn status of Go Vuln DB OSV records (#3495)",
          "author_name": "Will Murphy",
          "author_login": "willmurphyscode",
          "committed_at": "2026-06-04T20:33:50Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "9879170de580886b5ddf6956a084596ceeca17cf",
          "body": "Signed-off-by: Brandt Keller <brandt.keller@defenseunicorns.com>",
          "is_bot": false,
          "headline": "feat(scan): add support for a Zarf scan target (#3366)",
          "author_name": "Brandt Keller",
          "author_login": "brandtkeller",
          "committed_at": "2026-06-04T20:29:40Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "09dcb8c15f6851310d6b95c75a1557a9faf1c43a",
          "body": "Signed-off-by: anchore-oss-update-bot <anchore-oss-update-bot@users.noreply.github.com>\nCo-authored-by: anchore-oss-update-bot <anchore-oss-update-bot@users.noreply.github.com>",
          "is_bot": false,
          "headline": "chore(deps): update quality gate database (#3478)",
          "author_name": "anchore-oss-update-bot",
          "author_login": "anchore-oss-update-bot",
          "committed_at": "2026-06-04T18:58:06Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "c4a53687de01ed3e7d268328fc1a8cbdcae1f05a",
          "body": "Signed-off-by: anchore-oss-update-bot <anchore-oss-update-bot@users.noreply.github.com>\nCo-authored-by: anchore-oss-update-bot <anchore-oss-update-bot@users.noreply.github.com>",
          "is_bot": false,
          "headline": "chore(deps): update tool versions (#3488)",
          "author_name": "anchore-oss-update-bot",
          "author_login": "anchore-oss-update-bot",
          "committed_at": "2026-06-04T18:56:08Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "7e47096960cb52efa5d34ba1b9e0d3387412003f",
          "body": "* govulndb osv\n\nSigned-off-by: Will Murphy <willmurphyscode@users.noreply.github.com>\n\n* add fixed dates to govulndb osv transformer\n\nSigned-off-by: Will Murphy <willmurphyscode@users.noreply.github.com>\n\n* enforce lowercase ids on cache\n\nSigned-off-by: Will Murphy <willmurphyscode@users.noreply.github.com>\n\n---------\n\nSigned-off-by: Will Murphy <willmurphyscode@users.noreply.github.com>",
          "is_bot": false,
          "headline": "Govulndb OSV transformer (#3485)",
          "author_name": "Will Murphy",
          "author_login": "willmurphyscode",
          "committed_at": "2026-06-03T16:08:10Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "a0c0312c6f5635816d2612cebf33c5ba8c1afc5e",
          "body": "Signed-off-by: Will Murphy <willmurphyscode@users.noreply.github.com>",
          "is_bot": false,
          "headline": "give install script uploader contents: read (#3489)",
          "author_name": "Will Murphy",
          "author_login": "willmurphyscode",
          "committed_at": "2026-06-03T13:28:51Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "577c4cd6e4f88649e961c25775c5821c9348d1d0",
          "body": "Signed-off-by: anchore-oss-update-bot <anchore-oss-update-bot@users.noreply.github.com>\nCo-authored-by: anchore-oss-update-bot <anchore-oss-update-bot@users.noreply.github.com>",
          "is_bot": false,
          "headline": "chore(deps): update anchore dependencies (#3412)",
          "author_name": "anchore-oss-update-bot",
          "author_login": "anchore-oss-update-bot",
          "committed_at": "2026-06-02T21:05:04Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "b5af082d64ae634f617cdbfae1d0beb7f40b6c9e",
          "body": "Otherwise it doesn't have enough permissions to do its job.\n\nSigned-off-by: Will Murphy <willmurphyscode@users.noreply.github.com>",
          "is_bot": false,
          "headline": "Pass contents: read to check-gate workflow (#3486)",
          "author_name": "Will Murphy",
          "author_login": "willmurphyscode",
          "committed_at": "2026-06-02T20:36:22Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "1a5ef89bbf52e54b3b2ee2a46dce57a6d68fc8c7",
          "body": "* chore: rename rpm_arch to architecture\n\nThis field was initially added to support RPM architecture distinctions\n(especially arch=src), but multiple package types will eventually want\nto have fixes or vulnerabilities that apply to only one architecture.\nSince the field hasn't been released yet, ren\n[…]\nide test code it does not belong in test utils.\n\nSigned-off-by: Will Murphy <willmurphyscode@users.noreply.github.com>\n\n---------\n\nSigned-off-by: Will Murphy <willmurphyscode@users.noreply.github.com>",
          "is_bot": false,
          "headline": "chore: rename rpm_arch to architecture (#3482)",
          "author_name": "Will Murphy",
          "author_login": "willmurphyscode",
          "committed_at": "2026-06-02T15:29:37Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "a1ee6b42e18360031073324d2ecb7b2cca266a00",
          "body": "Bumps [github.com/containerd/containerd/v2](https://github.com/containerd/containerd) from 2.3.0 to 2.3.1.\n- [Release notes](https://github.com/containerd/containerd/releases)\n- [Changelog](https://github.com/containerd/containerd/blob/main/RELEASES.md)\n- [Commits](https://github.com/containerd/cont\n[…]\n/v2\n  dependency-version: 2.3.1\n  dependency-type: indirect\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump github.com/containerd/containerd/v2 (#3483)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-06-02T01:38:46Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "c3b845a5a645023f8db6e93d8b0f8a5eaf36cd05",
          "body": "…4 updates (#3473)\n\n* chore(deps): bump the go-minor-patch group across 2 directories with 4 updates\n\nBumps the go-minor-patch group with 3 updates in the / directory: [github.com/CycloneDX/cyclonedx-go](https://github.com/CycloneDX/cyclonedx-go), [github.com/anchore/stereoscope](https://github.com/\n[…]\n8+spiffcs@users.noreply.github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>\nCo-authored-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump the go-minor-patch group across 2 directories with …",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-06-02T01:08:08Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "fd26c4097c991a26193fc63e955c98dcadaf56df",
          "body": "…ate (#3346)\n\nAdd Grype version (name + version) and vulnerability database metadata\nto the header section of the HTML vulnerability report template, so\nusers can verify the tool and DB versions used to generate the report.\n\nSigned-off-by: hellozzm <hellozzm@users.noreply.github.com>\nCo-authored-by: hellozzm <hellozzm@users.noreply.github.com>",
          "is_bot": false,
          "headline": "fix: add Grype version and vulnerability DB info to HTML report templ…",
          "author_name": "hellozzm",
          "author_login": "hellozzm",
          "committed_at": "2026-06-01T15:33:24Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "fe1ffa81108e40bc6196808ee37c5e2544d31b03",
          "body": "Signed-off-by: anchore-oss-update-bot <anchore-oss-update-bot@users.noreply.github.com>\nCo-authored-by: anchore-oss-update-bot <anchore-oss-update-bot@users.noreply.github.com>",
          "is_bot": false,
          "headline": "chore(deps): update tool versions (#3335)",
          "author_name": "anchore-oss-update-bot",
          "author_login": "anchore-oss-update-bot",
          "committed_at": "2026-06-01T14:53:22Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "3792920f0bd6ee833fc3a45603fee3e859ba8741",
          "body": "* fix(registry): warn when insecure transport is configured\n\nEmit a one-time warning during config load when either\n`insecure-skip-tls-verify` or `insecure-use-http` is enabled. These\nflags can be set silently via a config file or environment variable\nand produce no indication in normal CLI output t\n[…]\ntry traffic\nis unprotected.\n\nFixes #3101 (grype CLI half; stereoscope debug log to follow as a\nseparate PR per the issue's two-part scope)\n\nSigned-off-by: David Dashti <david.dashti@hermesmedical.com>",
          "is_bot": false,
          "headline": "fix(registry): warn when insecure transport is configured (#3396)",
          "author_name": "David Dashti",
          "author_login": "Dashtid",
          "committed_at": "2026-06-01T14:50:18Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "53845e1c96951408035f70eb9432c76e245010d2",
          "body": "Signed-off-by: msnandhis <45960035+msnandhis@users.noreply.github.com>",
          "is_bot": false,
          "headline": "fix: support aarch64 ruby gem platforms (#3475)",
          "author_name": "Nandhis",
          "author_login": "msnandhis",
          "committed_at": "2026-06-01T14:45:34Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "c5ce71d8b1dcd655cd305b95393db9cb66165ea6",
          "body": "Move the regexp.MustCompile call in extractCVSSInfo() from a local\nvariable to a package-level var so the pattern is compiled once at\ninit rather than on every invocation. \n\nSigned-off-by: Matías Insaurralde <matias@insaurral.de>",
          "is_bot": false,
          "headline": "perf: compile CVSS regex once at package level (#3447)",
          "author_name": "Matias Insaurralde",
          "author_login": "matiasinsaurralde",
          "committed_at": "2026-06-01T14:44:42Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "bc0447e1f2b31ccd618da3457454d655ead998f1",
          "body": "Ensures that CPEs are only surfaced as platforms if the versionless CPE\nis marked as non-vulnerable across all elements within a candidate node.\nThis prevents unaffected ranges of a package from being marked as a\nplatform of itself.\n\nSigned-off-by: Weston Steimel <author@code.w.steimel.me.uk>",
          "is_bot": false,
          "headline": "fix: improve platform CPE determination logic (#3470)",
          "author_name": "Weston Steimel",
          "author_login": "westonsteimel",
          "committed_at": "2026-06-01T14:16:21Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "075eed9f24576e8c1de1b129d2072e76cc6db1a2",
          "body": "…th 7 updates (#3471)\n\nBumps the actions-minor-patch group with 7 updates in the / directory:\n\n| Package | From | To |\n| --- | --- | --- |\n| [anchore/workflows/.github/workflows/codeql.yaml](https://github.com/anchore/workflows) | `0.6.0` | `0.7.0` |\n| [anchore/workflows/.github/workflows/check-vers\n[…]\nupdate:semver-patch\n  dependency-group: actions-minor-patch\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump the actions-minor-patch group across 1 directory wi…",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-05-29T19:04:43Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "4f57d03014f6e61fcee7d438cb3732e303debb25",
          "body": "Signed-off-by: immanuwell <pchpr.00@list.ru>",
          "is_bot": false,
          "headline": "fix: normalize uppercase V in semantic version comparison (#3461)",
          "author_name": "Immanuel Tikhonov",
          "author_login": "immanuwell",
          "committed_at": "2026-05-26T01:33:49Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "82044d54c18d21186c5b2ef4721a5c57359e5118",
          "body": "…with 3 updates (#3458)\n\nBumps the actions-minor-patch group with 2 updates in the / directory: [github/codeql-action](https://github.com/github/codeql-action) and [zizmorcore/zizmor-action](https://github.com/zizmorcore/zizmor-action).\nBumps the actions-minor-patch group with 1 update in the /.gith\n[…]\nupdate:semver-minor\n  dependency-group: actions-minor-patch\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump the actions-minor-patch group across 2 directories …",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-05-22T15:58:37Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "c306be24b0a26ed38bfc0c1602cddb6e99815623",
          "body": "Bumps [github.com/containerd/containerd/v2](https://github.com/containerd/containerd) from 2.2.2 to 2.2.4.\n- [Release notes](https://github.com/containerd/containerd/releases)\n- [Changelog](https://github.com/containerd/containerd/blob/main/RELEASES.md)\n- [Commits](https://github.com/containerd/cont\n[…]\n/v2\n  dependency-version: 2.2.4\n  dependency-type: indirect\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump github.com/containerd/containerd/v2 (#3457)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-05-21T22:25:19Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "a345ece29f37527158daacae2ca87d85502b34ef",
          "body": "* Add Root IO vulnerability qualifier support\n\n  Adds support for Root IO package qualification to enable the NAK\n  (Negative Acknowledgment) pattern, where vulnerabilities with Root IO\n  qualifier only match Root IO patched packages.\n\n  Implementation:\n  - Add RootIO field to PackageQualifiers in g\n[…]\n-off-by: Will Murphy <willmurphyscode@users.noreply.github.com>\nCo-authored-by: Alex Goodman <wagoodman@users.noreply.github.com>\nCo-authored-by: Will Murphy <willmurphyscode@users.noreply.github.com>",
          "is_bot": false,
          "headline": "Add Root IO vulnerability qualifier support (#3137)",
          "author_name": "chait-slim",
          "author_login": "chait-slim",
          "committed_at": "2026-05-20T15:01:08Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "e760f4a5fbfcc8c83327b0615a12b10a01530fd7",
          "body": "…#3454)\n\nBumps [github.com/go-git/go-git/v5](https://github.com/go-git/go-git) from 5.19.0 to 5.19.1.\n- [Release notes](https://github.com/go-git/go-git/releases)\n- [Changelog](https://github.com/go-git/go-git/blob/main/HISTORY.md)\n- [Commits](https://github.com/go-git/go-git/compare/v5.19.0...v5.19\n[…]\nv5\n  dependency-version: 5.19.1\n  dependency-type: indirect\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump github.com/go-git/go-git/v5 from 5.19.0 to 5.19.1 (…",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-05-19T16:34:05Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "95573073808c689e4214d893a6de66e274b0de96",
          "body": "* remove slack notification on release\n\nSigned-off-by: Alex Goodman <wagoodman@users.noreply.github.com>\n\n* deal with cache and permissions usage\n\nSigned-off-by: Alex Goodman <wagoodman@users.noreply.github.com>\n\n---------\n\nSigned-off-by: Alex Goodman <wagoodman@users.noreply.github.com>",
          "is_bot": false,
          "headline": "Remediate audit (#3451)",
          "author_name": "Alex Goodman",
          "author_login": "wagoodman",
          "committed_at": "2026-05-18T19:20:50Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "445f5b7b24ed141b72a6e62280ce15387a281ee3",
          "body": "…th 4 updates (#3449)\n\nBumps the actions-minor-patch group with 4 updates in the / directory: [anchore/workflows/.github/workflows/codeql.yaml](https://github.com/anchore/workflows), [anchore/workflows/.github/workflows/check-version-available.yaml](https://github.com/anchore/workflows), [anchore/wo\n[…]\nupdate:semver-minor\n  dependency-group: actions-minor-patch\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump the actions-minor-patch group across 1 directory wi…",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-05-18T16:39:03Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "052e55cc1b4ae3c388151c364b7bbc47077cb1ec",
          "body": "…updates (#3448)\n\nBumps the go-minor-patch group with 2 updates in the / directory: [golang.org/x/text](https://github.com/golang/text) and [golang.org/x/tools](https://github.com/golang/tools).\n\n\nUpdates `golang.org/x/text` from 0.36.0 to 0.37.0\n- [Release notes](https://github.com/golang/text/rele\n[…]\nsion-update:semver-minor\n  dependency-group: go-minor-patch\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump the go-minor-patch group across 1 directory with 2 …",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-05-18T16:38:21Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "fc1377ff22415a47aa6d649ab17781f394bd9a72",
          "body": "Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>",
          "is_bot": false,
          "headline": "port to go-make (#3446)",
          "author_name": "Alex Goodman",
          "author_login": "wagoodman",
          "committed_at": "2026-05-18T16:00:01Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "82d4c7a95f62b4be7ce2340830c264f275967da5",
          "body": "…th 2 updates (#3444)\n\nBumps the actions-minor-patch group with 2 updates in the / directory: [github/codeql-action](https://github.com/github/codeql-action) and [sigstore/cosign-installer](https://github.com/sigstore/cosign-installer).\n\n\nUpdates `github/codeql-action` from 4.35.3 to 4.35.4\n- [Relea\n[…]\nupdate:semver-patch\n  dependency-group: actions-minor-patch\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump the actions-minor-patch group across 1 directory wi…",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-05-15T15:58:04Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "03cbb5f8457cb6bccc4d5f92d0ec9f6651710dfe",
          "body": "* test(bitnami): add dbtest style tests to bitnami matcher\n\nSigned-off-by: Will Murphy <willmurphyscode@users.noreply.github.com>\n\n* refactor OSV transformer to use strategy per provider\n\nDifferent OSV providers are less uniform than different providers in\nother schemas, and OSV requires that identi\n[…]\nlper surface and move tests into separate files\n\nSigned-off-by: Will Murphy <willmurphyscode@users.noreply.github.com>\n\n---------\n\nSigned-off-by: Will Murphy <willmurphyscode@users.noreply.github.com>",
          "is_bot": false,
          "headline": "OSV strategy pattern (#3441)",
          "author_name": "Will Murphy",
          "author_login": "willmurphyscode",
          "committed_at": "2026-05-13T18:05:49Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "4c59477eb0f8ab672d1a4777dc2fdab94f8dcb77",
          "body": "…ut (#3271)\n\n* Fix finding description\n\nSigned-off-by: Stepan Dolgintsev <stepworm@yandex.ru>\n\n* chore: lint fix\n\nSigned-off-by: Will Murphy <willmurphyscode@users.noreply.github.com>\n\n---------\n\nSigned-off-by: Stepan Dolgintsev <stepworm@yandex.ru>\nSigned-off-by: Will Murphy <willmurphyscode@users.noreply.github.com>\nCo-authored-by: Will Murphy <willmurphyscode@users.noreply.github.com>",
          "is_bot": false,
          "headline": "fix: use relatedVulnerabilities description as fallback in SARIF outp…",
          "author_name": "Stepan",
          "author_login": "axidex",
          "committed_at": "2026-05-13T17:12:49Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "3d0e03b4864ef831820d498db44507d526799f24",
          "body": "Add dbtest style SLES tests and exercise SLES NAKs via this pattern.\n\nSigned-off-by: Will Murphy <willmurphyscode@users.noreply.github.com>",
          "is_bot": false,
          "headline": "chore: exercise SLES NAKs via dbtest style tests in RPM matcher (#3421)",
          "author_name": "Will Murphy",
          "author_login": "willmurphyscode",
          "committed_at": "2026-05-12T17:38:04Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "14dc722c82850d4aedad45d028686ba6ca36feac",
          "body": "Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>",
          "is_bot": false,
          "headline": "use released shared workflow (#3439)",
          "author_name": "Alex Goodman",
          "author_login": "wagoodman",
          "committed_at": "2026-05-11T20:22:44Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "ba3b9a5b50e9b22505d1f0da39a461ff205709f9",
          "body": "…#3438)\n\nBumps [github.com/go-git/go-git/v5](https://github.com/go-git/go-git) from 5.18.0 to 5.19.0.\n- [Release notes](https://github.com/go-git/go-git/releases)\n- [Changelog](https://github.com/go-git/go-git/blob/main/HISTORY.md)\n- [Commits](https://github.com/go-git/go-git/compare/v5.18.0...v5.19\n[…]\nv5\n  dependency-version: 5.19.0\n  dependency-type: indirect\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump github.com/go-git/go-git/v5 from 5.18.0 to 5.19.0 (…",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-05-11T16:26:35Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "7b26aa2aa40614bfbdd9798aaeb884646cc9534c",
          "body": "Signed-off-by: Brandt Keller <brandt.keller@defenseunicorns.com>",
          "is_bot": false,
          "headline": "fix(cli): enable autocompletion for zsh (#3433)",
          "author_name": "Brandt Keller",
          "author_login": "brandtkeller",
          "committed_at": "2026-05-09T16:16:57Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "70459ffae47896d507a283e496936a545ebbb191",
          "body": "* Tighten workflow-level permissions and modernize release gate\n\nReplace the bespoke quality-gate job in release.yaml with the canonical\ncheck-version-available + check-gate reusable workflows. Remove the\nskip_quality_gate bypass input. Set top-level permissions: {} across\nrelease.yaml, validate-git\n[…]\nly.github.com>\n\n* correct validations to check on release\n\nSigned-off-by: Alex Goodman <wagoodman@users.noreply.github.com>\n\n---------\n\nSigned-off-by: Alex Goodman <wagoodman@users.noreply.github.com>",
          "is_bot": false,
          "headline": "Tighten workflow-level permissions and modernize release gate (#3434)",
          "author_name": "Alex Goodman",
          "author_login": "wagoodman",
          "committed_at": "2026-05-08T21:03:08Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "5fa2d2d25b8238a184a195f4769b5e5a77532d7c",
          "body": "…th 2 updates (#3431)\n\nBumps the actions-minor-patch group with 2 updates in the / directory: [github/codeql-action](https://github.com/github/codeql-action) and [slackapi/slack-github-action](https://github.com/slackapi/slack-github-action).\n\n\nUpdates `github/codeql-action` from 4.35.2 to 4.35.3\n- \n[…]\nupdate:semver-patch\n  dependency-group: actions-minor-patch\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump the actions-minor-patch group across 1 directory wi…",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-05-08T15:59:58Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "28ad56743aafd6ec153b85fbda4e38a3cb606185",
          "body": "Bumps the go-minor-patch group with 3 updates: [github.com/Masterminds/semver/v3](https://github.com/Masterminds/semver), [github.com/gookit/color](https://github.com/gookit/color) and [github.com/klauspost/compress](https://github.com/klauspost/compress).\n\n\nUpdates `github.com/Masterminds/semver/v3\n[…]\nsion-update:semver-patch\n  dependency-group: go-minor-patch\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump the go-minor-patch group with 3 updates (#3430)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-05-08T15:55:04Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "ffc0abfef07f9adf5a7a11148f7a4e4f362872a9",
          "body": "Signed-off-by: wasp-yash <trooper0018080@gmail.com>\nSigned-off-by: Keith Zantow <kzantow@gmail.com>\nCo-authored-by: Keith Zantow <kzantow@gmail.com>",
          "is_bot": false,
          "headline": "fix: version comparison with case-insensitive v prefix (#3089)",
          "author_name": "Yash",
          "author_login": "wasup-yash",
          "committed_at": "2026-05-07T16:57:16Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "e149729cfd11fd04e9863d405530a5beae9b22ba",
          "body": "Signed-off-by: anchore-oss-update-bot <anchore-oss-update-bot@users.noreply.github.com>\nCo-authored-by: anchore-oss-update-bot <anchore-oss-update-bot@users.noreply.github.com>",
          "is_bot": false,
          "headline": "chore(deps): update quality gate database (#3407)",
          "author_name": "anchore-oss-update-bot",
          "author_login": "anchore-oss-update-bot",
          "committed_at": "2026-05-05T15:41:57Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "3b8f6fcc85b636105dd6abf2fcc2df433b297c9d",
          "body": "Bumps the go-minor-patch group with 1 update: [github.com/invopop/jsonschema](https://github.com/invopop/jsonschema).\n\n\nUpdates `github.com/invopop/jsonschema` from 0.13.0 to 0.14.0\n- [Release notes](https://github.com/invopop/jsonschema/releases)\n- [Commits](https://github.com/invopop/jsonschema/co\n[…]\nsion-update:semver-minor\n  dependency-group: go-minor-patch\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump github.com/invopop/jsonschema (#3408)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-05-05T15:41:39Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "ee62ea12b834cb1b3b9915914ebf3ba3bc64540a",
          "body": "…with 4 updates (#3409)\n\nBumps the actions-minor-patch group with 4 updates in the / directory: [github/codeql-action](https://github.com/github/codeql-action), [slackapi/slack-github-action](https://github.com/slackapi/slack-github-action), [zizmorcore/zizmor-action](https://github.com/zizmorcore/z\n[…]\nupdate:semver-patch\n  dependency-group: actions-minor-patch\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump the actions-minor-patch group across 2 directories …",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-05-05T15:40:48Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "b040d341b04853c6a6a9ef59724660fdcc5f003f",
          "body": "* chore: test cgr maven via dbtest\n\nSigned-off-by: Will Murphy <willmurphyscode@users.noreply.github.com>\n\n* chore: better tests for cgr maven libs\n\nSigned-off-by: Will Murphy <willmurphyscode@users.noreply.github.com>\n\n---------\n\nSigned-off-by: Will Murphy <willmurphyscode@users.noreply.github.com>",
          "is_bot": false,
          "headline": "fix: purl handling in cgr maven libs (#3420)",
          "author_name": "Will Murphy",
          "author_login": "willmurphyscode",
          "committed_at": "2026-05-05T13:22:46Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "3154f49362819c3dd6ff74322705ece3f6f81c13",
          "body": "* migrate language matchers to ghsa\n\nSigned-off-by: Will Murphy <willmurphyscode@users.noreply.github.com>\n\n* more language matcher tests\n\nSigned-off-by: Will Murphy <willmurphyscode@users.noreply.github.com>\n\n* add cgr libs test case\n\nSigned-off-by: Will Murphy <willmurphyscode@users.noreply.github.com>\n\n---------\n\nSigned-off-by: Will Murphy <willmurphyscode@users.noreply.github.com>",
          "is_bot": false,
          "headline": "chore: test language matchers via new dbtest pattern (#3419)",
          "author_name": "Will Murphy",
          "author_login": "willmurphyscode",
          "committed_at": "2026-05-04T20:53:18Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "194d6aae96c7aae08c83eba5f6b37d6ac176af3b",
          "body": "Signed-off-by: Will Murphy <willmurphyscode@users.noreply.github.com>",
          "is_bot": false,
          "headline": "chore: migrate apk matcher to dbtest pattern (#3418)",
          "author_name": "Will Murphy",
          "author_login": "willmurphyscode",
          "committed_at": "2026-05-04T20:18:15Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "2f6bdc5b68ebc58c49d076b67ddfbced94c002df",
          "body": "Removes deprecated common workflows now centralized elsewhere.\n\nSigned-off-by: Alex Goodman <wagoodman@users.noreply.github.com>",
          "is_bot": false,
          "headline": "chore: remove common workflows (#3417)",
          "author_name": "Alex Goodman",
          "author_login": "wagoodman",
          "committed_at": "2026-05-04T18:31:21Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "58d8013dc703efe5a2350829d4e7546971355755",
          "body": "Signed-off-by: anchore-oss-update-bot <anchore-oss-update-bot@users.noreply.github.com>\nCo-authored-by: anchore-oss-update-bot <anchore-oss-update-bot@users.noreply.github.com>",
          "is_bot": false,
          "headline": "chore(deps): update generated codename data (#3397)",
          "author_name": "anchore-oss-update-bot",
          "author_login": "anchore-oss-update-bot",
          "committed_at": "2026-05-04T14:13:25Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "51d0be5d37383319225effe0dd899bf6eda469ef",
          "body": "* tests: add tests to guard against reintroducing SLES FPs\n\nSigned-off-by: Will Murphy <willmurphyscode@users.noreply.github.com>\n\n* chore: gofmt\n\nSigned-off-by: Will Murphy <willmurphyscode@users.noreply.github.com>\n\n---------\n\nSigned-off-by: Will Murphy <willmurphyscode@users.noreply.github.com>",
          "is_bot": false,
          "headline": "tests: add tests to guard against reintroducing SLES FPs (#3411)",
          "author_name": "Will Murphy",
          "author_login": "willmurphyscode",
          "committed_at": "2026-05-01T21:41:36Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "2b5db3677c2db27c3e1556e9bf72ab8e4be37bbb",
          "body": "* feat: rpm upstream matching filters by src arch\n\nSigned-off-by: Will Murphy <willmurphyscode@users.noreply.github.com>\n\n* good tests for hummingbird fix\n\nSigned-off-by: Will Murphy <willmurphyscode@users.noreply.github.com>\n\n* do the schema bump ceremony\n\nSigned-off-by: Will Murphy <willmurphyscod\n[…]\n.github.com>\n\n* chore: clean up some test names\n\nSigned-off-by: Will Murphy <willmurphyscode@users.noreply.github.com>\n\n---------\n\nSigned-off-by: Will Murphy <willmurphyscode@users.noreply.github.com>",
          "is_bot": false,
          "headline": "source RPM filtering on Hummingbird (#3410)",
          "author_name": "Will Murphy",
          "author_login": "willmurphyscode",
          "committed_at": "2026-05-01T20:54:41Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "15dae193c83d9b351f5f076453a2f4761b2add23",
          "body": "* chore(rpm-unit-tests): migrate to dbtest pattern\n\nSigned-off-by: Will Murphy <willmurphyscode@users.noreply.github.com>\n\n* test: move other rpm matchers to dbtest\n\nSigned-off-by: Will Murphy <willmurphyscode@users.noreply.github.com>\n\n* remove -real from testdata paths\n\nSigned-off-by: Will Murphy \n[…]\nsers.noreply.github.com>\n\n* additional cleanups\n\nSigned-off-by: Will Murphy <willmurphyscode@users.noreply.github.com>\n\n---------\n\nSigned-off-by: Will Murphy <willmurphyscode@users.noreply.github.com>",
          "is_bot": false,
          "headline": "chore(rpm-unit-tests): migrate to dbtest pattern (#3406)",
          "author_name": "Will Murphy",
          "author_login": "willmurphyscode",
          "committed_at": "2026-05-01T19:27:37Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "244f2a10a5668078fcf771454bbd832b3a5b9e8a",
          "body": "Signed-off-by: anchore-oss-update-bot <anchore-oss-update-bot@users.noreply.github.com>\nCo-authored-by: anchore-oss-update-bot <anchore-oss-update-bot@users.noreply.github.com>",
          "is_bot": false,
          "headline": "chore(deps): update anchore dependencies (#3391)",
          "author_name": "anchore-oss-update-bot",
          "author_login": "anchore-oss-update-bot",
          "committed_at": "2026-05-01T18:14:09Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "d646a935cd1bb6cd96dea33ec9bc1bb5df91c192",
          "body": "…326)\n\nSigned-off-by: Keith Zantow <kzantow@gmail.com>\nSigned-off-by: Will Murphy <willmurphyscode@users.noreply.github.com>\nCo-authored-by: Will Murphy <willmurphyscode@users.noreply.github.com>",
          "is_bot": false,
          "headline": "feat: ignore known not-vulnerable records across related packages (#3…",
          "author_name": "Keith Zantow",
          "author_login": "kzantow",
          "committed_at": "2026-04-30T14:26:23Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "d11ee91c8a30999f72f8101f029570788bb98a19",
          "body": "* chore(units): use in-process CDX and Sarif validation\n\nPreviously, the unit tests would exec docker run on a custom validator\nimage to validate that things were passing correctly.\n\nSigned-off-by: Will Murphy <willmurphyscode@users.noreply.github.com>\n\n* vendor some schemas for more validation\n\nSigned-off-by: Will Murphy <willmurphyscode@users.noreply.github.com>\n\n---------\n\nSigned-off-by: Will Murphy <willmurphyscode@users.noreply.github.com>",
          "is_bot": false,
          "headline": "chore(units): use in-process CDX and Sarif validation (#3402)",
          "author_name": "Will Murphy",
          "author_login": "willmurphyscode",
          "committed_at": "2026-04-29T13:22:20Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "6d0b66c527ee116e36f642456c98c10639c20ca1",
          "body": "* [wip] initial testing\n\nSigned-off-by: Alex Goodman <wagoodman@users.noreply.github.com>\n\n* add db fixture manager\n\nSigned-off-by: Alex Goodman <wagoodman@users.noreply.github.com>\n\n* refine helpers\n\nSigned-off-by: Alex Goodman <wagoodman@users.noreply.github.com>\n\n* incorporate review comments\n\nSi\n[…]\ndman@users.noreply.github.com>\n\n* capture listing digests\n\nSigned-off-by: Alex Goodman <wagoodman@users.noreply.github.com>\n\n---------\n\nSigned-off-by: Alex Goodman <wagoodman@users.noreply.github.com>",
          "is_bot": false,
          "headline": "Add DB test harness (#3284)",
          "author_name": "Alex Goodman",
          "author_login": "wagoodman",
          "committed_at": "2026-04-24T15:55:43Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "89819276e8ebf63b4f607ca3a1b0faa3fc75f28d",
          "body": "Signed-off-by: anchore-oss-update-bot <anchore-oss-update-bot@users.noreply.github.com>\nCo-authored-by: anchore-oss-update-bot <anchore-oss-update-bot@users.noreply.github.com>",
          "is_bot": false,
          "headline": "chore(deps): update anchore dependencies (#3387)",
          "author_name": "anchore-oss-update-bot",
          "author_login": "anchore-oss-update-bot",
          "committed_at": "2026-04-22T16:51:01Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "1d73349fda0483fb696a93c61c148061e6dc5a15",
          "body": "Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>",
          "is_bot": false,
          "headline": "restore go version to 1.25.8 (#3386)",
          "author_name": "Alex Goodman",
          "author_login": "wagoodman",
          "committed_at": "2026-04-21T19:58:44Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "d47248bcde7ceb7a2d45ca9c0cf5d384ef7c5ca1",
          "body": "Signed-off-by: anchore-oss-update-bot <anchore-oss-update-bot@users.noreply.github.com>\nCo-authored-by: anchore-oss-update-bot <anchore-oss-update-bot@users.noreply.github.com>",
          "is_bot": false,
          "headline": "chore(deps): update anchore dependencies (#3383)",
          "author_name": "anchore-oss-update-bot",
          "author_login": "anchore-oss-update-bot",
          "committed_at": "2026-04-20T18:58:39Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "8f43856fe2b4b9b15790ca90d197f727f167b29d",
          "body": "Signed-off-by: anchore-oss-update-bot <anchore-oss-update-bot@users.noreply.github.com>\nCo-authored-by: anchore-oss-update-bot <anchore-oss-update-bot@users.noreply.github.com>",
          "is_bot": false,
          "headline": "chore(deps): update quality gate database (#3338)",
          "author_name": "anchore-oss-update-bot",
          "author_login": "anchore-oss-update-bot",
          "committed_at": "2026-04-20T18:58:19Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "6a2eebed702989033f13619208cf4dafe0f2e0c5",
          "body": "Signed-off-by: anchore-oss-update-bot <anchore-oss-update-bot@users.noreply.github.com>\nCo-authored-by: anchore-oss-update-bot <anchore-oss-update-bot@users.noreply.github.com>",
          "is_bot": false,
          "headline": "chore(deps): update anchore dependencies (#3381)",
          "author_name": "anchore-oss-update-bot",
          "author_login": "anchore-oss-update-bot",
          "committed_at": "2026-04-20T14:51:34Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "7f42c1e34faf397f3c216de99e63cf0b2efa6284",
          "body": "Signed-off-by: anchore-oss-update-bot <anchore-oss-update-bot@users.noreply.github.com>\nCo-authored-by: anchore-oss-update-bot <anchore-oss-update-bot@users.noreply.github.com>",
          "is_bot": false,
          "headline": "chore(deps): update Go version (#3382)",
          "author_name": "anchore-oss-update-bot",
          "author_login": "anchore-oss-update-bot",
          "committed_at": "2026-04-20T14:39:20Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "9b0cec6ed549d5f0cf704b7fbcbd6b54186dce95",
          "body": "…#3378)\n\nBumps [github.com/go-git/go-git/v5](https://github.com/go-git/go-git) from 5.17.1 to 5.18.0.\n- [Release notes](https://github.com/go-git/go-git/releases)\n- [Commits](https://github.com/go-git/go-git/compare/v5.17.1...v5.18.0)\n\n---\nupdated-dependencies:\n- dependency-name: github.com/go-git/g\n[…]\nv5\n  dependency-version: 5.18.0\n  dependency-type: indirect\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump github.com/go-git/go-git/v5 from 5.17.1 to 5.18.0 (…",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-04-20T14:09:06Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "5540558a6dceaa8ff43cce286a6a14d9b8d4aee1",
          "body": "Signed-off-by: Keith Zantow <kzantow@gmail.com>",
          "is_bot": false,
          "headline": "chore: pin syft to latest release (#3376)",
          "author_name": "Keith Zantow",
          "author_login": "kzantow",
          "committed_at": "2026-04-17T18:52:55Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "3b61ae1f7f5ad5a01cc1b5046c0fa53f255bb1be",
          "body": "Bumps the actions-minor-patch group with 1 update in the / directory: [actions/upload-artifact](https://github.com/actions/upload-artifact).\n\n\nUpdates `actions/upload-artifact` from 7.0.0 to 7.0.1\n- [Release notes](https://github.com/actions/upload-artifact/releases)\n- [Commits](https://github.com/a\n[…]\nupdate:semver-patch\n  dependency-group: actions-minor-patch\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump actions/upload-artifact (#3375)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-04-17T17:14:09Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "382b6f0aaf31f403337b09cebc93062e8604a304",
          "body": "Bumps the go-minor-patch group with 3 updates: [github.com/google/go-containerregistry](https://github.com/google/go-containerregistry), [golang.org/x/text](https://github.com/golang/text) and [golang.org/x/tools](https://github.com/golang/tools).\n\n\nUpdates `github.com/google/go-containerregistry` f\n[…]\nsion-update:semver-minor\n  dependency-group: go-minor-patch\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump the go-minor-patch group with 3 updates (#3374)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-04-17T17:13:47Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "bc23491af19c196926339caaf06d3d9580d5b755",
          "body": "Signed-off-by: Keith Zantow <kzantow@gmail.com>",
          "is_bot": false,
          "headline": "fix: compare mismatched package / db versions (#3372)",
          "author_name": "Keith Zantow",
          "author_login": "kzantow",
          "committed_at": "2026-04-17T13:58:48Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "f9683c699b15a76a0c80c5f70e14c400f606f81a",
          "body": "…onships (#3363)\n\nSigned-off-by: Keith Zantow <kzantow@gmail.com>",
          "is_bot": false,
          "headline": "fix: apply overlap by ownership removal to dynamically created relati…",
          "author_name": "Keith Zantow",
          "author_login": "kzantow",
          "committed_at": "2026-04-16T14:45:46Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "c4699a34bf683985f42d635efcf6350085aafae5",
          "body": "* perf: replace sort-based epssPercentile with O(n) linear scan\n\nFinding max of a slice doesn't require sorting. The previous\nimplementation called sort.Slice (O(n log n), 4 heap allocations) on\nevery sort comparison. The linear scan is O(n) with zero allocations.\n\nIt also removes a subtle mutation \n[…]\n>\n\n* fix: rename local var max to maxPercentile to avoid shadowing built-in\n\nSigned-off-by: Matías Insaurralde <matias@insaurral.de>\n\n---------\n\nSigned-off-by: Matías Insaurralde <matias@insaurral.de>",
          "is_bot": false,
          "headline": "perf: replace sort-based epssPercentile with O(n) linear scan (#3316)",
          "author_name": "Matias Insaurralde",
          "author_login": "matiasinsaurralde",
          "committed_at": "2026-04-15T18:38:06Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "5303febcbb260f3aad1bf8d55e219a3d56a1efc8",
          "body": "The helpUri field on each SARIF rule was hardcoded to\nhttps://github.com/anchore/grype regardless of the vulnerability being\nreported. This means tooling that surfaces helpUri (e.g. GitHub Code\nScanning) links users back to the Grype repository instead of the\nactual advisory.\n\nFix: add a helpURI() h\n[…]\n if neither is set\n\nAdd Test_helpURI covering all three resolution paths.\n\nFixes #2874\n\nSigned-off-by: Will Bates <william.bates11@outlook.com>\nCo-authored-by: Will Bates <william.bates11@outlook.com>",
          "is_bot": false,
          "headline": "fix: set SARIF helpUri to vulnerability advisory URL (#3351)",
          "author_name": "William Bates",
          "author_login": "will-bates11",
          "committed_at": "2026-04-15T15:10:55Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "475e3bad8f9b5f92d98f1d17c41d18823471b638",
          "body": "Signed-off-by: anchore-oss-update-bot <anchore-oss-update-bot@users.noreply.github.com>\nCo-authored-by: anchore-oss-update-bot <anchore-oss-update-bot@users.noreply.github.com>",
          "is_bot": false,
          "headline": "chore(deps): update Go version (#3367)",
          "author_name": "anchore-oss-update-bot",
          "author_login": "anchore-oss-update-bot",
          "committed_at": "2026-04-14T15:23:31Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "f89efb31687736152f43b83b996d21043a22b68a",
          "body": "Bumps [actions/download-artifact](https://github.com/actions/download-artifact) from 4.1.9 to 8.0.1.\n- [Release notes](https://github.com/actions/download-artifact/releases)\n- [Commits](https://github.com/actions/download-artifact/compare/cc203385981b70ca67e1cc392babf9cc229d5806...3e5f45b2cfb9172054\n[…]\nirect:production\n  update-type: version-update:semver-major\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump actions/download-artifact from 4.1.9 to 8.0.1 (#3342)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-04-13T20:59:43Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "fe1ceb48451b42f2741a99b6ad6bf14721c8bbe0",
          "body": "…#3325)\n\nBumps [github.com/go-git/go-git/v5](https://github.com/go-git/go-git) from 5.17.0 to 5.17.1.\n- [Release notes](https://github.com/go-git/go-git/releases)\n- [Commits](https://github.com/go-git/go-git/compare/v5.17.0...v5.17.1)\n\n---\nupdated-dependencies:\n- dependency-name: github.com/go-git/g\n[…]\nv5\n  dependency-version: 5.17.1\n  dependency-type: indirect\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump github.com/go-git/go-git/v5 from 5.17.0 to 5.17.1 (…",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-04-13T20:59:22Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "166a6c4e79e60d64eae680d5fbb8230c9a526385",
          "body": "…#3347)\n\nBumps [github.com/go-jose/go-jose/v4](https://github.com/go-jose/go-jose) from 4.1.3 to 4.1.4.\n- [Release notes](https://github.com/go-jose/go-jose/releases)\n- [Commits](https://github.com/go-jose/go-jose/compare/v4.1.3...v4.1.4)\n\n---\nupdated-dependencies:\n- dependency-name: github.com/go-j\n[…]\n/v4\n  dependency-version: 4.1.4\n  dependency-type: indirect\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump github.com/go-jose/go-jose/v4 from 4.1.3 to 4.1.4 (…",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-04-13T20:26:38Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "2cd34c1f11ea72ea4de670b222492384a2cfd8ed",
          "body": "Bumps the go-minor-patch group with 1 update in the / directory: [github.com/openvex/go-vex](https://github.com/openvex/go-vex).\n\n\nUpdates `github.com/openvex/go-vex` from 0.2.7 to 0.2.8\n- [Release notes](https://github.com/openvex/go-vex/releases)\n- [Commits](https://github.com/openvex/go-vex/compa\n[…]\nsion-update:semver-patch\n  dependency-group: go-minor-patch\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump github.com/openvex/go-vex (#3365)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-04-13T20:22:07Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "b2076d91bba614c0e69fafe7e747fdf286d1155b",
          "body": "Bumps [github.com/aws/aws-sdk-go-v2/service/s3](https://github.com/aws/aws-sdk-go-v2) from 1.96.0 to 1.97.3.\n- [Release notes](https://github.com/aws/aws-sdk-go-v2/releases)\n- [Commits](https://github.com/aws/aws-sdk-go-v2/compare/service/s3/v1.96.0...service/s3/v1.97.3)\n\n---\nupdated-dependencies:\n-\n[…]\ns3\n  dependency-version: 1.97.3\n  dependency-type: indirect\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump github.com/aws/aws-sdk-go-v2/service/s3 (#3357)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-04-13T18:42:04Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "aa98e8f3f92e9a7c28447bf51139c46439521930",
          "body": "…(#3358)\n\nBumps [go.opentelemetry.io/otel/sdk](https://github.com/open-telemetry/opentelemetry-go) from 1.40.0 to 1.43.0.\n- [Release notes](https://github.com/open-telemetry/opentelemetry-go/releases)\n- [Changelog](https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md)\n- [Commits\n[…]\ndk\n  dependency-version: 1.43.0\n  dependency-type: indirect\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump go.opentelemetry.io/otel/sdk from 1.40.0 to 1.43.0 …",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-04-13T18:38:57Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "0d0675438fb9341e4194142cf761c79e291880ec",
          "body": "…th 3 updates (#3361)\n\nBumps the actions-minor-patch group with 3 updates in the / directory: [github/codeql-action](https://github.com/github/codeql-action), [docker/login-action](https://github.com/docker/login-action) and [sigstore/cosign-installer](https://github.com/sigstore/cosign-installer).\n\n[…]\nupdate:semver-patch\n  dependency-group: actions-minor-patch\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump the actions-minor-patch group across 1 directory wi…",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-04-13T15:38:46Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "eded337d622fa3cea8b3c4a18cd9861a6ffc579f",
          "body": "…(#3362)\n\nBumps [github.com/hashicorp/go-getter](https://github.com/hashicorp/go-getter) from 1.8.5 to 1.8.6.\n- [Release notes](https://github.com/hashicorp/go-getter/releases)\n- [Commits](https://github.com/hashicorp/go-getter/compare/v1.8.5...v1.8.6)\n\n---\nupdated-dependencies:\n- dependency-name: g\n[…]\nendency-version: 1.8.6\n  dependency-type: direct:production\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump github.com/hashicorp/go-getter from 1.8.5 to 1.8.6 …",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-04-13T15:38:36Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "4f6e5d34b65bb3203f162b57ce495a20c8144b05",
          "body": "Signed-off-by: anchore-oss-update-bot <anchore-oss-update-bot@users.noreply.github.com>\nCo-authored-by: anchore-oss-update-bot <anchore-oss-update-bot@users.noreply.github.com>",
          "is_bot": false,
          "headline": "chore(deps): update anchore dependencies (#3364)",
          "author_name": "anchore-oss-update-bot",
          "author_login": "anchore-oss-update-bot",
          "committed_at": "2026-04-13T15:28:31Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "1f19355a7ee2d7e2bd58da6255bdeb618eb0c0d1",
          "body": "Signed-off-by: anchore-oss-update-bot <anchore-oss-update-bot@users.noreply.github.com>\nCo-authored-by: anchore-oss-update-bot <anchore-oss-update-bot@users.noreply.github.com>",
          "is_bot": false,
          "headline": "chore(deps): update anchore dependencies (#3321)",
          "author_name": "anchore-oss-update-bot",
          "author_login": "anchore-oss-update-bot",
          "committed_at": "2026-04-08T21:14:20Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "9428def201a9f38c8608c3762f05cdfee434d30a",
          "body": "Signed-off-by: Keith Zantow <kzantow@gmail.com>",
          "is_bot": false,
          "headline": "perf: create relationships for path-based ignores (#3355)",
          "author_name": "Keith Zantow",
          "author_login": "kzantow",
          "committed_at": "2026-04-08T15:55:43Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "94fe6a41c9708c3804be102f11d65b9d43532e6a",
          "body": "* feat: csaf transformer\n\nSigned-off-by: Will Murphy <willmurphyscode@users.noreply.github.com>\n\n* format and test csaf transformer\n\nSigned-off-by: Will Murphy <willmurphyscode@users.noreply.github.com>\n\n---------\n\nSigned-off-by: Will Murphy <willmurphyscode@users.noreply.github.com>",
          "is_bot": false,
          "headline": "feat: CSAF vex transformer (#3349)",
          "author_name": "Will Murphy",
          "author_login": "willmurphyscode",
          "committed_at": "2026-04-07T17:36:37Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "12611f013fd22520043427d329cc09a7891e2992",
          "body": "Signed-off-by: Weston Steimel <author@code.w.steimel.me.uk>",
          "is_bot": false,
          "headline": "feat: curated mapping of known CPE to grype package specifiers (#3332)",
          "author_name": "Weston Steimel",
          "author_login": "westonsteimel",
          "committed_at": "2026-04-07T15:49:20Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "03696ddbc45f6c183a3cc37c2d7dffdc7763c38d",
          "body": "Signed-off-by: Will Murphy <willmurphyscode@users.noreply.github.com>",
          "is_bot": false,
          "headline": "chore: remove unused ci yaml (#3348)",
          "author_name": "Will Murphy",
          "author_login": "willmurphyscode",
          "committed_at": "2026-04-03T13:09:28Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "53827d6c3d51ce571c84d9d37ddfd4bfff0b3142",
          "body": "Signed-off-by: kenvez <konradszl@pm.me>",
          "is_bot": false,
          "headline": "feat: add Grype version and DB built date to HTML report header (#3345)",
          "author_name": "Konrad Szlachetka",
          "author_login": "konradszl",
          "committed_at": "2026-04-03T01:12:04Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "d5fbdb1d970d2bc82594fabd97a42e94d45b26bb",
          "body": "Signed-off-by: Jeremy Spilman <jeremy.spilman@anchore.com>",
          "is_bot": false,
          "headline": "feat(pkg): add ProvideFromReader for in-memory SBOM processing (#3344)",
          "author_name": "Jeremy Spilman",
          "author_login": "jspilman",
          "committed_at": "2026-04-02T21:13:35Z",
          "body_truncated": false,
          "is_coding_agent": false
        }
      ],
      "releases_count": 19,
      "commits_last_year": 417,
      "latest_release_at": "2021-01-27T19:15:02Z",
      "latest_release_tag": "v0.7.0",
      "releases_from_tags": true,
      "days_since_last_push": 30,
      "active_weeks_last_year": 47,
      "days_since_latest_release": 2004,
      "mean_days_between_releases": 13.8
    },
    "community": {
      "has_readme": false,
      "has_license": false,
      "has_description": false,
      "has_contributing": false,
      "health_percentage": null,
      "has_issue_template": false,
      "has_code_of_conduct": false,
      "has_pull_request_template": false
    },
    "ecosystem": {
      "packages": [
        {
          "name": "github.com/anchore/grype",
          "exists": true,
          "license": null,
          "keywords": [],
          "ecosystem": "go",
          "matches_repo": false,
          "registry_url": "https://pkg.go.dev/github.com/anchore/grype",
          "is_deprecated": false,
          "latest_version": "v0.116.0",
          "repository_url": "https://github.com/anchore/grype",
          "versions_count": 209,
          "total_downloads": null,
          "dependents_count": null,
          "deprecation_note": null,
          "maintainers_count": null,
          "monthly_downloads": null,
          "first_published_at": null,
          "latest_published_at": "2026-07-16T16:02:15Z",
          "latest_version_yanked": null,
          "days_since_latest_publish": 8
        }
      ]
    },
    "popularity": {
      "forks": 0,
      "stars": 0,
      "watchers": 0,
      "fork_history": {
        "days": [],
        "complete": true,
        "collected": 0,
        "total_forks": 0
      },
      "star_history": {
        "days": [],
        "complete": true,
        "collected": 0,
        "total_stars": 0,
        "collected_at": null
      },
      "open_issues_and_prs": 0
    },
    "ai_readiness": {
      "has_nix": false,
      "example_dirs": [],
      "has_llms_txt": true,
      "has_dockerfile": true,
      "has_mcp_signal": false,
      "bootstrap_files": [
        "Makefile",
        "grype/db/v5/distribution/testdata/tls/Makefile",
        "test/cli/testdata/Makefile",
        "test/install/Makefile",
        "test/integration/testdata/Makefile",
        "test/quality/Makefile"
      ],
      "api_schema_files": [],
      "has_devcontainer": false,
      "typecheck_configs": [],
      "toolchain_manifests": [
        ".make/go.mod",
        "go.mod",
        "test/integration/testdata/image-debian-match-coverage/golang/go.mod"
      ],
      "largest_source_bytes": 51485,
      "source_files_sampled": 664,
      "oversized_source_files": 0,
      "agent_instruction_files": [],
      "agent_instruction_max_bytes": null
    },
    "dependencies": {
      "manifests": [
        ".make/go.mod",
        "go.mod"
      ],
      "advisories": {
        "error": null,
        "scope": "repository_graph",
        "source": "osv",
        "findings": [
          {
            "name": "google.golang.org/grpc",
            "direct": false,
            "version": "v1.80.0",
            "severity": "critical",
            "ecosystem": "go",
            "cvss_score": 9.1,
            "advisory_ids": [
              "GHSA-hrxh-6v49-42gf"
            ],
            "fixed_version": "1.82.1",
            "advisory_count": 1,
            "oldest_advisory_days": 3
          },
          {
            "name": "github.com/docker/docker",
            "direct": true,
            "version": "v28.5.2+incompatible",
            "severity": "high",
            "ecosystem": "go",
            "cvss_score": 8.8,
            "advisory_ids": [
              "GHSA-pxq6-2prw-chj9",
              "GHSA-rg2x-37c3-w2rh",
              "GHSA-vp62-88p7-qqf5",
              "GHSA-x744-4wpc-v9h2",
              "GHSA-x86f-5xw2-fm2r",
              "GO-2026-4883",
              "GO-2026-4887",
              "GO-2026-5617",
              "GO-2026-5668",
              "GO-2026-5746"
            ],
            "fixed_version": "29.3.1",
            "advisory_count": 10,
            "oldest_advisory_days": 119
          },
          {
            "name": "golang.org/x/text",
            "direct": true,
            "version": "v0.38.0",
            "severity": "unknown",
            "ecosystem": "go",
            "cvss_score": null,
            "advisory_ids": [
              "GO-2026-5970"
            ],
            "fixed_version": "0.39.0",
            "advisory_count": 1,
            "oldest_advisory_days": 10
          },
          {
            "name": "go.opentelemetry.io/otel",
            "direct": false,
            "version": "v1.43.0",
            "severity": "unknown",
            "ecosystem": "go",
            "cvss_score": null,
            "advisory_ids": [
              "GO-2026-5158"
            ],
            "fixed_version": "1.44.0",
            "advisory_count": 1,
            "oldest_advisory_days": 0
          },
          {
            "name": "golang.org/x/crypto",
            "direct": false,
            "version": "v0.53.0",
            "severity": "unknown",
            "ecosystem": "go",
            "cvss_score": null,
            "advisory_ids": [
              "GO-2026-5932"
            ],
            "fixed_version": null,
            "advisory_count": 1,
            "oldest_advisory_days": 17
          }
        ],
        "collected": true,
        "malicious": [],
        "truncated": false,
        "by_severity": {
          "high": 1,
          "unknown": 3,
          "critical": 1
        },
        "advisory_count": 14,
        "affected_count": 5,
        "assessed_count": 333,
        "malicious_count": 0,
        "assessed_package": null,
        "unassessed_count": 0,
        "direct_affected_count": 2
      },
      "ecosystems": [
        "go"
      ],
      "dependencies": [
        {
          "name": "github.com/anchore/go-make",
          "manifest": ".make/go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.8.0"
        },
        {
          "name": "github.com/CycloneDX/cyclonedx-go",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.11.0"
        },
        {
          "name": "github.com/Masterminds/semver/v3",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v3.5.0"
        },
        {
          "name": "github.com/Masterminds/sprig/v3",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v3.3.0"
        },
        {
          "name": "github.com/OneOfOne/xxhash",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.2.8"
        },
        {
          "name": "github.com/acarl005/stripansi",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.0.0-20180116102854-5a71ef0e047d"
        },
        {
          "name": "github.com/adrg/xdg",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.5.3"
        },
        {
          "name": "github.com/anchore/bubbly",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.2.0"
        },
        {
          "name": "github.com/anchore/clio",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.1.0"
        },
        {
          "name": "github.com/anchore/fangs",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.1.0"
        },
        {
          "name": "github.com/anchore/go-collections",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.1.0"
        },
        {
          "name": "github.com/anchore/go-homedir",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.1.0"
        },
        {
          "name": "github.com/anchore/go-logger",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.1.0"
        },
        {
          "name": "github.com/anchore/go-version",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.2.2-0.20210903204242-51efa5b487c4"
        },
        {
          "name": "github.com/anchore/packageurl-go",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.2.0"
        },
        {
          "name": "github.com/anchore/stereoscope",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.2.1"
        },
        {
          "name": "github.com/anchore/syft",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.45.1"
        },
        {
          "name": "github.com/aquasecurity/go-pep440-version",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.0.1"
        },
        {
          "name": "github.com/araddon/dateparse",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.0.0-20210429162001-6b43995a97de"
        },
        {
          "name": "github.com/bitnami/go-version",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.0.0-20250505154626-452e8c5ee607"
        },
        {
          "name": "github.com/bmatcuk/doublestar/v2",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v2.0.4"
        },
        {
          "name": "github.com/charmbracelet/bubbletea",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.3.10"
        },
        {
          "name": "github.com/charmbracelet/lipgloss",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.1.0"
        },
        {
          "name": "github.com/dave/jennifer",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.7.1"
        },
        {
          "name": "github.com/docker/docker",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v28.5.2+incompatible"
        },
        {
          "name": "github.com/dustin/go-humanize",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.0.1"
        },
        {
          "name": "github.com/facebookincubator/nvdtools",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.1.5"
        },
        {
          "name": "github.com/gabriel-vasile/mimetype",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.4.13"
        },
        {
          "name": "github.com/gkampitakis/go-snaps",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.5.22"
        },
        {
          "name": "github.com/glebarez/sqlite",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.11.0"
        },
        {
          "name": "github.com/go-test/deep",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.1.1"
        },
        {
          "name": "github.com/go-viper/mapstructure/v2",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v2.5.0"
        },
        {
          "name": "github.com/gocsaf/csaf/v3",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v3.5.1"
        },
        {
          "name": "github.com/gohugoio/hashstructure",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.6.0"
        },
        {
          "name": "github.com/google/go-cmp",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.7.0"
        },
        {
          "name": "github.com/google/go-containerregistry",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.21.6"
        },
        {
          "name": "github.com/google/shlex",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.0.0-20191202100458-e7afc7fbc510"
        },
        {
          "name": "github.com/google/uuid",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.6.0"
        },
        {
          "name": "github.com/gookit/color",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.6.1"
        },
        {
          "name": "github.com/hako/durafmt",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.0.0-20210608085754-5c1018a4e16b"
        },
        {
          "name": "github.com/hashicorp/go-cleanhttp",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.5.2"
        },
        {
          "name": "github.com/hashicorp/go-getter",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.8.6"
        },
        {
          "name": "github.com/hashicorp/go-multierror",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.1.1"
        },
        {
          "name": "github.com/iancoleman/strcase",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.3.0"
        },
        {
          "name": "github.com/invopop/jsonschema",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.14.0"
        },
        {
          "name": "github.com/jinzhu/copier",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.4.0"
        },
        {
          "name": "github.com/klauspost/compress",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.18.6"
        },
        {
          "name": "github.com/knqyf263/go-apk-version",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.0.0-20200609155635-041fdbb8563f"
        },
        {
          "name": "github.com/knqyf263/go-deb-version",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.0.0-20241115132648-6f4aee6ccd23"
        },
        {
          "name": "github.com/masahiro331/go-mvn-version",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.0.0-20250131095131-f4974fa13b8a"
        },
        {
          "name": "github.com/mholt/archives",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.1.5"
        },
        {
          "name": "github.com/muesli/termenv",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.16.0"
        },
        {
          "name": "github.com/olekukonko/tablewriter",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.1.4"
        },
        {
          "name": "github.com/openvex/go-vex",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.2.8"
        },
        {
          "name": "github.com/owenrumney/go-sarif",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.1.2-0.20231003122901-1000f5e05554"
        },
        {
          "name": "github.com/pandatix/go-cvss",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.6.2"
        },
        {
          "name": "github.com/scylladb/go-set",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.0.3-0.20200225121959-cc7b2070d91e"
        },
        {
          "name": "github.com/sergi/go-diff",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.4.0"
        },
        {
          "name": "github.com/spf13/afero",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.15.0"
        },
        {
          "name": "github.com/spf13/cobra",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.10.2"
        },
        {
          "name": "github.com/stretchr/testify",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.11.1"
        },
        {
          "name": "github.com/ulikunitz/xz",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.5.15"
        },
        {
          "name": "github.com/umisama/go-cpe",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.0.0-20190323060751-cdd6c3c28a23"
        },
        {
          "name": "github.com/wagoodman/go-partybus",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.0.0-20230516145632-8ccac152c651"
        },
        {
          "name": "github.com/wagoodman/go-presenter",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.0.0-20211015174752-f9c01afc824b"
        },
        {
          "name": "github.com/wagoodman/go-progress",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.0.0-20260303201901-10176f79b2c0"
        },
        {
          "name": "github.com/xi2/xz",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.0.0-20171230120015-48954b6210f8"
        },
        {
          "name": "golang.org/x/exp",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.0.0-20260410095643-746e56fc9e2f"
        },
        {
          "name": "golang.org/x/text",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.38.0"
        },
        {
          "name": "golang.org/x/time",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.15.0"
        },
        {
          "name": "golang.org/x/tools",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.46.0"
        },
        {
          "name": "gopkg.in/yaml.v3",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v3.0.1"
        },
        {
          "name": "gorm.io/gorm",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.31.1"
        },
        {
          "name": "github.com/bmatcuk/doublestar/v4",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v4.10.0"
        },
        {
          "name": "github.com/santhosh-tekuri/jsonschema/v6",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v6.0.2"
        }
      ],
      "all_dependencies": {
        "error": null,
        "source": "github-sbom",
        "packages": [
          {
            "name": "github.com/acarl005/stripansi",
            "direct": true,
            "version": "v0.0.0-20180116102854-5a71ef0e047d",
            "ecosystem": "go"
          },
          {
            "name": "github.com/adrg/xdg",
            "direct": true,
            "version": "v0.5.3",
            "ecosystem": "go"
          },
          {
            "name": "github.com/anchore/bubbly",
            "direct": true,
            "version": "v0.2.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/anchore/clio",
            "direct": true,
            "version": "v0.1.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/anchore/fangs",
            "direct": true,
            "version": "v0.1.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/anchore/go-collections",
            "direct": true,
            "version": "v0.1.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/anchore/go-homedir",
            "direct": true,
            "version": "v0.1.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/anchore/go-logger",
            "direct": true,
            "version": "v0.1.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/anchore/go-make",
            "direct": true,
            "version": "v0.8.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/anchore/go-version",
            "direct": true,
            "version": "v1.2.2-0.20210903204242-51efa5b487c4",
            "ecosystem": "go"
          },
          {
            "name": "github.com/anchore/packageurl-go",
            "direct": true,
            "version": "v0.2.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/anchore/stereoscope",
            "direct": true,
            "version": "v0.2.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/anchore/syft",
            "direct": true,
            "version": "v1.45.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/aquasecurity/go-pep440-version",
            "direct": true,
            "version": "v0.0.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/araddon/dateparse",
            "direct": true,
            "version": "v0.0.0-20210429162001-6b43995a97de",
            "ecosystem": "go"
          },
          {
            "name": "github.com/bitnami/go-version",
            "direct": true,
            "version": "v0.0.0-20250505154626-452e8c5ee607",
            "ecosystem": "go"
          },
          {
            "name": "github.com/bmatcuk/doublestar/v2",
            "direct": true,
            "version": "v2.0.4",
            "ecosystem": "go"
          },
          {
            "name": "github.com/bmatcuk/doublestar/v4",
            "direct": true,
            "version": "v4.10.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/charmbracelet/bubbletea",
            "direct": true,
            "version": "v1.3.10",
            "ecosystem": "go"
          },
          {
            "name": "github.com/charmbracelet/lipgloss",
            "direct": true,
            "version": "v1.1.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/cyclonedx/cyclonedx-go",
            "direct": true,
            "version": "v0.11.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/dave/jennifer",
            "direct": true,
            "version": "v1.7.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/docker/docker",
            "direct": true,
            "version": "v28.5.2+incompatible",
            "ecosystem": "go"
          },
          {
            "name": "github.com/dustin/go-humanize",
            "direct": true,
            "version": "v1.0.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/facebookincubator/nvdtools",
            "direct": true,
            "version": "v0.1.5",
            "ecosystem": "go"
          },
          {
            "name": "github.com/gabriel-vasile/mimetype",
            "direct": true,
            "version": "v1.4.13",
            "ecosystem": "go"
          },
          {
            "name": "github.com/gkampitakis/go-snaps",
            "direct": true,
            "version": "v0.5.22",
            "ecosystem": "go"
          },
          {
            "name": "github.com/glebarez/sqlite",
            "direct": true,
            "version": "v1.11.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/go-test/deep",
            "direct": true,
            "version": "v1.1.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/go-viper/mapstructure/v2",
            "direct": true,
            "version": "v2.5.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/gocsaf/csaf/v3",
            "direct": true,
            "version": "v3.5.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/gohugoio/hashstructure",
            "direct": true,
            "version": "v0.6.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/google/go-cmp",
            "direct": true,
            "version": "v0.7.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/google/go-containerregistry",
            "direct": true,
            "version": "v0.21.6",
            "ecosystem": "go"
          },
          {
            "name": "github.com/google/shlex",
            "direct": true,
            "version": "v0.0.0-20191202100458-e7afc7fbc510",
            "ecosystem": "go"
          },
          {
            "name": "github.com/google/uuid",
            "direct": true,
            "version": "v1.6.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/gookit/color",
            "direct": true,
            "version": "v1.6.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/hako/durafmt",
            "direct": true,
            "version": "v0.0.0-20210608085754-5c1018a4e16b",
            "ecosystem": "go"
          },
          {
            "name": "github.com/hashicorp/go-cleanhttp",
            "direct": true,
            "version": "v0.5.2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/hashicorp/go-getter",
            "direct": true,
            "version": "v1.8.6",
            "ecosystem": "go"
          },
          {
            "name": "github.com/hashicorp/go-multierror",
            "direct": true,
            "version": "v1.1.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/iancoleman/strcase",
            "direct": true,
            "version": "v0.3.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/invopop/jsonschema",
            "direct": true,
            "version": "v0.14.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/jinzhu/copier",
            "direct": true,
            "version": "v0.4.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/klauspost/compress",
            "direct": true,
            "version": "v1.18.6",
            "ecosystem": "go"
          },
          {
            "name": "github.com/knqyf263/go-apk-version",
            "direct": true,
            "version": "v0.0.0-20200609155635-041fdbb8563f",
            "ecosystem": "go"
          },
          {
            "name": "github.com/knqyf263/go-deb-version",
            "direct": true,
            "version": "v0.0.0-20241115132648-6f4aee6ccd23",
            "ecosystem": "go"
          },
          {
            "name": "github.com/masahiro331/go-mvn-version",
            "direct": true,
            "version": "v0.0.0-20250131095131-f4974fa13b8a",
            "ecosystem": "go"
          },
          {
            "name": "github.com/masterminds/semver/v3",
            "direct": true,
            "version": "v3.5.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/masterminds/sprig/v3",
            "direct": true,
            "version": "v3.3.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/mholt/archives",
            "direct": true,
            "version": "v0.1.5",
            "ecosystem": "go"
          },
          {
            "name": "github.com/muesli/termenv",
            "direct": true,
            "version": "v0.16.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/olekukonko/tablewriter",
            "direct": true,
            "version": "v1.1.4",
            "ecosystem": "go"
          },
          {
            "name": "github.com/oneofone/xxhash",
            "direct": true,
            "version": "v1.2.8",
            "ecosystem": "go"
          },
          {
            "name": "github.com/openvex/go-vex",
            "direct": true,
            "version": "v0.2.8",
            "ecosystem": "go"
          },
          {
            "name": "github.com/owenrumney/go-sarif",
            "direct": true,
            "version": "v1.1.2-0.20231003122901-1000f5e05554",
            "ecosystem": "go"
          },
          {
            "name": "github.com/pandatix/go-cvss",
            "direct": true,
            "version": "v0.6.2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/santhosh-tekuri/jsonschema/v6",
            "direct": true,
            "version": "v6.0.2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/scylladb/go-set",
            "direct": true,
            "version": "v1.0.3-0.20200225121959-cc7b2070d91e",
            "ecosystem": "go"
          },
          {
            "name": "github.com/sergi/go-diff",
            "direct": true,
            "version": "v1.4.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/spf13/afero",
            "direct": true,
            "version": "v1.15.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/spf13/cobra",
            "direct": true,
            "version": "v1.10.2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/stretchr/testify",
            "direct": true,
            "version": "v1.11.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/ulikunitz/xz",
            "direct": true,
            "version": "v0.5.15",
            "ecosystem": "go"
          },
          {
            "name": "github.com/umisama/go-cpe",
            "direct": true,
            "version": "v0.0.0-20190323060751-cdd6c3c28a23",
            "ecosystem": "go"
          },
          {
            "name": "github.com/wagoodman/go-partybus",
            "direct": true,
            "version": "v0.0.0-20230516145632-8ccac152c651",
            "ecosystem": "go"
          },
          {
            "name": "github.com/wagoodman/go-presenter",
            "direct": true,
            "version": "v0.0.0-20211015174752-f9c01afc824b",
            "ecosystem": "go"
          },
          {
            "name": "github.com/wagoodman/go-progress",
            "direct": true,
            "version": "v0.0.0-20260303201901-10176f79b2c0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/xi2/xz",
            "direct": true,
            "version": "v0.0.0-20171230120015-48954b6210f8",
            "ecosystem": "go"
          },
          {
            "name": "golang.org/x/exp",
            "direct": true,
            "version": "v0.0.0-20260410095643-746e56fc9e2f",
            "ecosystem": "go"
          },
          {
            "name": "golang.org/x/text",
            "direct": true,
            "version": "v0.38.0",
            "ecosystem": "go"
          },
          {
            "name": "golang.org/x/time",
            "direct": true,
            "version": "v0.15.0",
            "ecosystem": "go"
          },
          {
            "name": "golang.org/x/tools",
            "direct": true,
            "version": "v0.46.0",
            "ecosystem": "go"
          },
          {
            "name": "gopkg.in/yaml.v3",
            "direct": true,
            "version": "v3.0.1",
            "ecosystem": "go"
          },
          {
            "name": "gorm.io/gorm",
            "direct": true,
            "version": "v1.31.1",
            "ecosystem": "go"
          },
          {
            "name": "cel.dev/expr",
            "direct": false,
            "version": "v0.25.1",
            "ecosystem": "go"
          },
          {
            "name": "cloud.google.com/go",
            "direct": false,
            "version": "v0.123.0",
            "ecosystem": "go"
          },
          {
            "name": "cloud.google.com/go/auth",
            "direct": false,
            "version": "v0.18.2",
            "ecosystem": "go"
          },
          {
            "name": "cloud.google.com/go/auth/oauth2adapt",
            "direct": false,
            "version": "v0.2.8",
            "ecosystem": "go"
          },
          {
            "name": "cloud.google.com/go/compute/metadata",
            "direct": false,
            "version": "v0.9.0",
            "ecosystem": "go"
          },
          {
            "name": "cloud.google.com/go/iam",
            "direct": false,
            "version": "v1.5.3",
            "ecosystem": "go"
          },
          {
            "name": "cloud.google.com/go/monitoring",
            "direct": false,
            "version": "v1.24.3",
            "ecosystem": "go"
          },
          {
            "name": "cloud.google.com/go/storage",
            "direct": false,
            "version": "v1.61.3",
            "ecosystem": "go"
          },
          {
            "name": "dario.cat/mergo",
            "direct": false,
            "version": "v1.0.2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/acobaugh/osrelease",
            "direct": false,
            "version": "v0.1.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/agext/levenshtein",
            "direct": false,
            "version": "v1.2.3",
            "ecosystem": "go"
          },
          {
            "name": "github.com/anchore/go-lzo",
            "direct": false,
            "version": "v0.1.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/anchore/go-macholibre",
            "direct": false,
            "version": "v0.1.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/anchore/go-rpmdb",
            "direct": false,
            "version": "v0.1.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/anchore/go-struct-converter",
            "direct": false,
            "version": "v0.1.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/anchore/go-sync",
            "direct": false,
            "version": "v0.1.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/andybalholm/brotli",
            "direct": false,
            "version": "v1.2.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/apparentlymart/go-textseg/v15",
            "direct": false,
            "version": "v15.0.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/aquasecurity/go-version",
            "direct": false,
            "version": "v0.0.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/aws/aws-sdk-go-v2",
            "direct": false,
            "version": "v1.41.5",
            "ecosystem": "go"
          },
          {
            "name": "github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream",
            "direct": false,
            "version": "v1.7.8",
            "ecosystem": "go"
          },
          {
            "name": "github.com/aws/aws-sdk-go-v2/config",
            "direct": false,
            "version": "v1.32.12",
            "ecosystem": "go"
          },
          {
            "name": "github.com/aws/aws-sdk-go-v2/credentials",
            "direct": false,
            "version": "v1.19.12",
            "ecosystem": "go"
          },
          {
            "name": "github.com/aws/aws-sdk-go-v2/feature/ec2/imds",
            "direct": false,
            "version": "v1.18.20",
            "ecosystem": "go"
          },
          {
            "name": "github.com/aws/aws-sdk-go-v2/internal/configsources",
            "direct": false,
            "version": "v1.4.21",
            "ecosystem": "go"
          },
          {
            "name": "github.com/aws/aws-sdk-go-v2/internal/endpoints/v2",
            "direct": false,
            "version": "v2.7.21",
            "ecosystem": "go"
          },
          {
            "name": "github.com/aws/aws-sdk-go-v2/internal/ini",
            "direct": false,
            "version": "v1.8.6",
            "ecosystem": "go"
          },
          {
            "name": "github.com/aws/aws-sdk-go-v2/internal/v4a",
            "direct": false,
            "version": "v1.4.22",
            "ecosystem": "go"
          },
          {
            "name": "github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding",
            "direct": false,
            "version": "v1.13.7",
            "ecosystem": "go"
          },
          {
            "name": "github.com/aws/aws-sdk-go-v2/service/internal/checksum",
            "direct": false,
            "version": "v1.9.13",
            "ecosystem": "go"
          },
          {
            "name": "github.com/aws/aws-sdk-go-v2/service/internal/presigned-url",
            "direct": false,
            "version": "v1.13.21",
            "ecosystem": "go"
          },
          {
            "name": "github.com/aws/aws-sdk-go-v2/service/internal/s3shared",
            "direct": false,
            "version": "v1.19.21",
            "ecosystem": "go"
          },
          {
            "name": "github.com/aws/aws-sdk-go-v2/service/s3",
            "direct": false,
            "version": "v1.97.3",
            "ecosystem": "go"
          },
          {
            "name": "github.com/aws/aws-sdk-go-v2/service/signin",
            "direct": false,
            "version": "v1.0.8",
            "ecosystem": "go"
          },
          {
            "name": "github.com/aws/aws-sdk-go-v2/service/sso",
            "direct": false,
            "version": "v1.30.13",
            "ecosystem": "go"
          },
          {
            "name": "github.com/aws/aws-sdk-go-v2/service/ssooidc",
            "direct": false,
            "version": "v1.35.17",
            "ecosystem": "go"
          },
          {
            "name": "github.com/aws/aws-sdk-go-v2/service/sts",
            "direct": false,
            "version": "v1.41.9",
            "ecosystem": "go"
          },
          {
            "name": "github.com/aws/smithy-go",
            "direct": false,
            "version": "v1.24.2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/aymanbagabas/go-osc52/v2",
            "direct": false,
            "version": "v2.0.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/bahlo/generic-list-go",
            "direct": false,
            "version": "v0.2.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/becheran/wildmatch-go",
            "direct": false,
            "version": "v1.0.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/bgentry/go-netrc",
            "direct": false,
            "version": "v0.0.0-20140422174119-9fd32a8b3d3d",
            "ecosystem": "go"
          },
          {
            "name": "github.com/blakesmith/ar",
            "direct": false,
            "version": "v0.0.0-20190502131153-809d4375e1fb",
            "ecosystem": "go"
          },
          {
            "name": "github.com/bodgit/plumbing",
            "direct": false,
            "version": "v1.3.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/bodgit/sevenzip",
            "direct": false,
            "version": "v1.6.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/bodgit/windows",
            "direct": false,
            "version": "v1.0.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/buger/jsonparser",
            "direct": false,
            "version": "v1.1.2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/burntsushi/toml",
            "direct": false,
            "version": "v1.6.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/cespare/xxhash/v2",
            "direct": false,
            "version": "v2.3.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/charmbracelet/bubbles",
            "direct": false,
            "version": "v1.0.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/charmbracelet/colorprofile",
            "direct": false,
            "version": "v0.4.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/charmbracelet/harmonica",
            "direct": false,
            "version": "v0.2.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/charmbracelet/x/ansi",
            "direct": false,
            "version": "v0.11.6",
            "ecosystem": "go"
          },
          {
            "name": "github.com/charmbracelet/x/cellbuf",
            "direct": false,
            "version": "v0.0.15",
            "ecosystem": "go"
          },
          {
            "name": "github.com/charmbracelet/x/term",
            "direct": false,
            "version": "v0.2.2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/clipperhouse/displaywidth",
            "direct": false,
            "version": "v0.10.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/clipperhouse/uax29/v2",
            "direct": false,
            "version": "v2.6.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/cloudflare/circl",
            "direct": false,
            "version": "v1.6.3",
            "ecosystem": "go"
          },
          {
            "name": "github.com/cncf/xds/go",
            "direct": false,
            "version": "v0.0.0-20251210132809-ee656c7534f5",
            "ecosystem": "go"
          },
          {
            "name": "github.com/containerd/cgroups/v3",
            "direct": false,
            "version": "v3.1.3",
            "ecosystem": "go"
          },
          {
            "name": "github.com/containerd/containerd/api",
            "direct": false,
            "version": "v1.11.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/containerd/containerd/v2",
            "direct": false,
            "version": "v2.3.2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/containerd/continuity",
            "direct": false,
            "version": "v0.5.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/containerd/errdefs",
            "direct": false,
            "version": "v1.0.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/containerd/errdefs/pkg",
            "direct": false,
            "version": "v0.3.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/containerd/fifo",
            "direct": false,
            "version": "v1.1.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/containerd/log",
            "direct": false,
            "version": "v0.1.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/containerd/platforms",
            "direct": false,
            "version": "v1.0.0-rc.4",
            "ecosystem": "go"
          },
          {
            "name": "github.com/containerd/plugin",
            "direct": false,
            "version": "v1.1.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/containerd/ttrpc",
            "direct": false,
            "version": "v1.2.8",
            "ecosystem": "go"
          },
          {
            "name": "github.com/containerd/typeurl/v2",
            "direct": false,
            "version": "v2.2.3",
            "ecosystem": "go"
          },
          {
            "name": "github.com/cyphar/filepath-securejoin",
            "direct": false,
            "version": "v0.6.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/datadog/zstd",
            "direct": false,
            "version": "v1.5.7",
            "ecosystem": "go"
          },
          {
            "name": "github.com/davecgh/go-spew",
            "direct": false,
            "version": "v1.1.2-0.20180830191138-d8f796af33cc",
            "ecosystem": "go"
          },
          {
            "name": "github.com/deitch/magic",
            "direct": false,
            "version": "v0.0.0-20240306090643-c67ab88f10cb",
            "ecosystem": "go"
          },
          {
            "name": "github.com/diskfs/go-diskfs",
            "direct": false,
            "version": "v1.9.3",
            "ecosystem": "go"
          },
          {
            "name": "github.com/distribution/reference",
            "direct": false,
            "version": "v0.6.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/docker/cli",
            "direct": false,
            "version": "v29.4.3+incompatible",
            "ecosystem": "go"
          },
          {
            "name": "github.com/docker/docker-credential-helpers",
            "direct": false,
            "version": "v0.9.5",
            "ecosystem": "go"
          },
          {
            "name": "github.com/docker/go-connections",
            "direct": false,
            "version": "v0.7.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/docker/go-units",
            "direct": false,
            "version": "v0.5.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/dsnet/compress",
            "direct": false,
            "version": "v0.0.2-0.20230904184137-39efe44ab707",
            "ecosystem": "go"
          },
          {
            "name": "github.com/elliotchance/phpserialize",
            "direct": false,
            "version": "v1.4.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/emirpasic/gods",
            "direct": false,
            "version": "v1.18.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/envoyproxy/go-control-plane/envoy",
            "direct": false,
            "version": "v1.36.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/envoyproxy/protoc-gen-validate",
            "direct": false,
            "version": "v1.3.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/erikgeiser/coninput",
            "direct": false,
            "version": "v0.0.0-20211004153227-1c3628e74d0f",
            "ecosystem": "go"
          },
          {
            "name": "github.com/fatih/color",
            "direct": false,
            "version": "v1.18.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/felixge/fgprof",
            "direct": false,
            "version": "v0.9.5",
            "ecosystem": "go"
          },
          {
            "name": "github.com/felixge/httpsnoop",
            "direct": false,
            "version": "v1.0.4",
            "ecosystem": "go"
          },
          {
            "name": "github.com/fsnotify/fsnotify",
            "direct": false,
            "version": "v1.9.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/github/go-spdx/v2",
            "direct": false,
            "version": "v2.7.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/gkampitakis/ciinfo",
            "direct": false,
            "version": "v0.3.4",
            "ecosystem": "go"
          },
          {
            "name": "github.com/glebarez/go-sqlite",
            "direct": false,
            "version": "v1.22.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/go-git/gcfg",
            "direct": false,
            "version": "v1.5.1-0.20230307220236-3a3c6141e376",
            "ecosystem": "go"
          },
          {
            "name": "github.com/go-git/go-billy/v5",
            "direct": false,
            "version": "v5.9.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/go-git/go-git/v5",
            "direct": false,
            "version": "v5.19.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/go-jose/go-jose/v4",
            "direct": false,
            "version": "v4.1.4",
            "ecosystem": "go"
          },
          {
            "name": "github.com/go-logr/logr",
            "direct": false,
            "version": "v1.4.3",
            "ecosystem": "go"
          },
          {
            "name": "github.com/go-logr/stdr",
            "direct": false,
            "version": "v1.2.2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/go-restruct/restruct",
            "direct": false,
            "version": "v1.2.0-alpha",
            "ecosystem": "go"
          },
          {
            "name": "github.com/goccy/go-yaml",
            "direct": false,
            "version": "v1.19.2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/gogo/protobuf",
            "direct": false,
            "version": "v1.3.2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/golang/groupcache",
            "direct": false,
            "version": "v0.0.0-20241129210726-2c02b8208cf8",
            "ecosystem": "go"
          },
          {
            "name": "github.com/google/licensecheck",
            "direct": false,
            "version": "v0.3.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/google/pprof",
            "direct": false,
            "version": "v0.0.0-20250630185457-6e76a2b096b5",
            "ecosystem": "go"
          },
          {
            "name": "github.com/google/s2a-go",
            "direct": false,
            "version": "v0.1.9",
            "ecosystem": "go"
          },
          {
            "name": "github.com/googleapis/enterprise-certificate-proxy",
            "direct": false,
            "version": "v0.3.14",
            "ecosystem": "go"
          },
          {
            "name": "github.com/googleapis/gax-go/v2",
            "direct": false,
            "version": "v2.17.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/googlecloudplatform/opentelemetry-operations-go/detectors/gcp",
            "direct": false,
            "version": "v1.31.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/googlecloudplatform/opentelemetry-operations-go/exporter/metric",
            "direct": false,
            "version": "v0.55.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/googlecloudplatform/opentelemetry-operations-go/internal/resourcemapping",
            "direct": false,
            "version": "v0.55.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/gpustack/gguf-parser-go",
            "direct": false,
            "version": "v0.24.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/hashicorp/aws-sdk-go-base/v2",
            "direct": false,
            "version": "v2.0.0-beta.72",
            "ecosystem": "go"
          },
          {
            "name": "github.com/hashicorp/errwrap",
            "direct": false,
            "version": "v1.1.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/hashicorp/go-version",
            "direct": false,
            "version": "v1.8.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/hashicorp/golang-lru/v2",
            "direct": false,
            "version": "v2.0.7",
            "ecosystem": "go"
          },
          {
            "name": "github.com/hashicorp/hcl/v2",
            "direct": false,
            "version": "v2.24.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/henvic/httpretty",
            "direct": false,
            "version": "v0.1.4",
            "ecosystem": "go"
          },
          {
            "name": "github.com/huandu/xstrings",
            "direct": false,
            "version": "v1.5.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/in-toto/attestation",
            "direct": false,
            "version": "v1.2.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/inconshreveable/mousetrap",
            "direct": false,
            "version": "v1.1.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/intevation/gval",
            "direct": false,
            "version": "v1.3.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/intevation/jsonpath",
            "direct": false,
            "version": "v0.2.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/jbenet/go-context",
            "direct": false,
            "version": "v0.0.0-20150711004518-d14ea06fba99",
            "ecosystem": "go"
          },
          {
            "name": "github.com/jinzhu/inflection",
            "direct": false,
            "version": "v1.0.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/jinzhu/now",
            "direct": false,
            "version": "v1.1.5",
            "ecosystem": "go"
          },
          {
            "name": "github.com/json-iterator/go",
            "direct": false,
            "version": "v1.1.12",
            "ecosystem": "go"
          },
          {
            "name": "github.com/kastenhq/goversion",
            "direct": false,
            "version": "v0.0.0-20230811215019-93b2f8823953",
            "ecosystem": "go"
          },
          {
            "name": "github.com/kevinburke/ssh_config",
            "direct": false,
            "version": "v1.2.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/klauspost/cpuid/v2",
            "direct": false,
            "version": "v2.3.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/klauspost/pgzip",
            "direct": false,
            "version": "v1.2.6",
            "ecosystem": "go"
          },
          {
            "name": "github.com/kr/pretty",
            "direct": false,
            "version": "v0.3.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/kr/text",
            "direct": false,
            "version": "v0.2.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/lucasb-eyer/go-colorful",
            "direct": false,
            "version": "v1.3.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/maruel/natural",
            "direct": false,
            "version": "v1.3.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/masterminds/goutils",
            "direct": false,
            "version": "v1.1.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/mattn/go-colorable",
            "direct": false,
            "version": "v0.1.14",
            "ecosystem": "go"
          },
          {
            "name": "github.com/mattn/go-isatty",
            "direct": false,
            "version": "v0.0.20",
            "ecosystem": "go"
          },
          {
            "name": "github.com/mattn/go-localereader",
            "direct": false,
            "version": "v0.0.2-0.20220822084749-2491eb6c1c75",
            "ecosystem": "go"
          },
          {
            "name": "github.com/mattn/go-runewidth",
            "direct": false,
            "version": "v0.0.19",
            "ecosystem": "go"
          },
          {
            "name": "github.com/mgutz/ansi",
            "direct": false,
            "version": "v0.0.0-20200706080929-d51e80ef957d",
            "ecosystem": "go"
          },
          {
            "name": "github.com/microsoft/go-winio",
            "direct": false,
            "version": "v0.6.3-0.20251027160822-ad3df93bed29",
            "ecosystem": "go"
          },
          {
            "name": "github.com/microsoft/hcsshim",
            "direct": false,
            "version": "v0.15.0-rc.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/mikelolasagasti/xz",
            "direct": false,
            "version": "v1.0.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/minio/minlz",
            "direct": false,
            "version": "v1.0.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/mitchellh/copystructure",
            "direct": false,
            "version": "v1.2.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/mitchellh/go-homedir",
            "direct": false,
            "version": "v1.1.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/mitchellh/go-wordwrap",
            "direct": false,
            "version": "v1.0.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/mitchellh/reflectwalk",
            "direct": false,
            "version": "v1.0.2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/moby/docker-image-spec",
            "direct": false,
            "version": "v1.3.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/moby/locker",
            "direct": false,
            "version": "v1.0.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/moby/moby/api",
            "direct": false,
            "version": "v1.54.2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/moby/moby/client",
            "direct": false,
            "version": "v0.4.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/moby/sys/atomicwriter",
            "direct": false,
            "version": "v0.1.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/moby/sys/mountinfo",
            "direct": false,
            "version": "v0.7.2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/moby/sys/sequential",
            "direct": false,
            "version": "v0.6.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/moby/sys/signal",
            "direct": false,
            "version": "v0.7.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/moby/sys/user",
            "direct": false,
            "version": "v0.4.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/moby/sys/userns",
            "direct": false,
            "version": "v0.1.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/modern-go/concurrent",
            "direct": false,
            "version": "v0.0.0-20180306012644-bacd9c7ef1dd",
            "ecosystem": "go"
          },
          {
            "name": "github.com/modern-go/reflect2",
            "direct": false,
            "version": "v1.0.3-0.20250322232337-35a7c28c31ee",
            "ecosystem": "go"
          },
          {
            "name": "github.com/morikuni/aec",
            "direct": false,
            "version": "v1.1.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/muesli/ansi",
            "direct": false,
            "version": "v0.0.0-20230316100256-276c6243b2f6",
            "ecosystem": "go"
          },
          {
            "name": "github.com/muesli/cancelreader",
            "direct": false,
            "version": "v0.2.2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/ncruces/go-strftime",
            "direct": false,
            "version": "v1.0.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/nix-community/go-nix",
            "direct": false,
            "version": "v0.0.0-20250101154619-4bdde671e0a1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/nwaples/rardecode/v2",
            "direct": false,
            "version": "v2.2.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/olekukonko/cat",
            "direct": false,
            "version": "v0.0.0-20250911104152-50322a0618f6",
            "ecosystem": "go"
          },
          {
            "name": "github.com/olekukonko/errors",
            "direct": false,
            "version": "v1.2.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/olekukonko/ll",
            "direct": false,
            "version": "v0.1.6",
            "ecosystem": "go"
          },
          {
            "name": "github.com/opencontainers/go-digest",
            "direct": false,
            "version": "v1.0.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/opencontainers/image-spec",
            "direct": false,
            "version": "v1.1.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/opencontainers/runtime-spec",
            "direct": false,
            "version": "v1.3.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/package-url/packageurl-go",
            "direct": false,
            "version": "v0.1.5",
            "ecosystem": "go"
          },
          {
            "name": "github.com/pb33f/ordered-map/v2",
            "direct": false,
            "version": "v2.3.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/pborman/indent",
            "direct": false,
            "version": "v1.2.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/pelletier/go-toml",
            "direct": false,
            "version": "v1.9.5",
            "ecosystem": "go"
          },
          {
            "name": "github.com/pelletier/go-toml/v2",
            "direct": false,
            "version": "v2.3.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/pierrec/lz4/v4",
            "direct": false,
            "version": "v4.1.26",
            "ecosystem": "go"
          },
          {
            "name": "github.com/pjbgf/sha1cd",
            "direct": false,
            "version": "v0.6.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/pkg/errors",
            "direct": false,
            "version": "v0.9.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/pkg/profile",
            "direct": false,
            "version": "v1.7.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/pkg/xattr",
            "direct": false,
            "version": "v0.4.12",
            "ecosystem": "go"
          },
          {
            "name": "github.com/planetscale/vtprotobuf",
            "direct": false,
            "version": "v0.6.1-0.20240319094008-0393e58bdf10",
            "ecosystem": "go"
          },
          {
            "name": "github.com/pmezard/go-difflib",
            "direct": false,
            "version": "v1.0.1-0.20181226105442-5d4384ee4fb2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/protonmail/go-crypto",
            "direct": false,
            "version": "v1.4.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/remyoudompheng/bigfft",
            "direct": false,
            "version": "v0.0.0-20230129092748-24d4a6f8daec",
            "ecosystem": "go"
          },
          {
            "name": "github.com/rivo/uniseg",
            "direct": false,
            "version": "v0.4.7",
            "ecosystem": "go"
          },
          {
            "name": "github.com/rogpeppe/go-internal",
            "direct": false,
            "version": "v1.14.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/rust-secure-code/go-rustaudit",
            "direct": false,
            "version": "v0.0.0-20250226111315-e20ec32e963c",
            "ecosystem": "go"
          },
          {
            "name": "github.com/sagikazarmark/locafero",
            "direct": false,
            "version": "v0.11.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/saintfish/chardet",
            "direct": false,
            "version": "v0.0.0-20230101081208-5e3ef4b5456d",
            "ecosystem": "go"
          },
          {
            "name": "github.com/sassoftware/go-rpmutils",
            "direct": false,
            "version": "v0.4.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/shopspring/decimal",
            "direct": false,
            "version": "v1.4.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/sirupsen/logrus",
            "direct": false,
            "version": "v1.9.4",
            "ecosystem": "go"
          },
          {
            "name": "github.com/skeema/knownhosts",
            "direct": false,
            "version": "v1.3.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/smallnest/ringbuffer",
            "direct": false,
            "version": "v0.0.0-20241116012123-461381446e3d",
            "ecosystem": "go"
          },
          {
            "name": "github.com/sorairolake/lzip-go",
            "direct": false,
            "version": "v0.3.8",
            "ecosystem": "go"
          },
          {
            "name": "github.com/sourcegraph/conc",
            "direct": false,
            "version": "v0.3.1-0.20240121214520-5f936abd7ae8",
            "ecosystem": "go"
          },
          {
            "name": "github.com/spdx/gordf",
            "direct": false,
            "version": "v0.0.0-20250128162952-000978ccd6fb",
            "ecosystem": "go"
          },
          {
            "name": "github.com/spdx/tools-golang",
            "direct": false,
            "version": "v0.5.7",
            "ecosystem": "go"
          },
          {
            "name": "github.com/spf13/cast",
            "direct": false,
            "version": "v1.10.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/spf13/pflag",
            "direct": false,
            "version": "v1.0.10",
            "ecosystem": "go"
          },
          {
            "name": "github.com/spf13/viper",
            "direct": false,
            "version": "v1.21.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/spiffe/go-spiffe/v2",
            "direct": false,
            "version": "v2.6.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/starry-s/zip",
            "direct": false,
            "version": "v0.2.3",
            "ecosystem": "go"
          },
          {
            "name": "github.com/stretchr/objx",
            "direct": false,
            "version": "v0.5.2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/subosito/gotenv",
            "direct": false,
            "version": "v1.6.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/sylabs/sif/v2",
            "direct": false,
            "version": "v2.24.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/sylabs/squashfs",
            "direct": false,
            "version": "v1.0.6",
            "ecosystem": "go"
          },
          {
            "name": "github.com/therootcompany/xz",
            "direct": false,
            "version": "v1.0.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/tidwall/gjson",
            "direct": false,
            "version": "v1.19.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/tidwall/match",
            "direct": false,
            "version": "v1.1.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/tidwall/pretty",
            "direct": false,
            "version": "v1.2.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/tidwall/sjson",
            "direct": false,
            "version": "v1.2.5",
            "ecosystem": "go"
          },
          {
            "name": "github.com/vbatts/go-mtree",
            "direct": false,
            "version": "v0.7.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/vifraa/gopom",
            "direct": false,
            "version": "v1.0.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/xanzy/ssh-agent",
            "direct": false,
            "version": "v0.3.3",
            "ecosystem": "go"
          },
          {
            "name": "github.com/xo/terminfo",
            "direct": false,
            "version": "v0.0.0-20220910002029-abceb7e1c41e",
            "ecosystem": "go"
          },
          {
            "name": "github.com/zclconf/go-cty",
            "direct": false,
            "version": "v1.16.3",
            "ecosystem": "go"
          },
          {
            "name": "github.com/zyedidia/generic",
            "direct": false,
            "version": "v1.2.2-0.20230320175451-4410d2372cb1",
            "ecosystem": "go"
          },
          {
            "name": "go.etcd.io/bbolt",
            "direct": false,
            "version": "v1.4.3",
            "ecosystem": "go"
          },
          {
            "name": "go.opencensus.io",
            "direct": false,
            "version": "v0.24.0",
            "ecosystem": "go"
          },
          {
            "name": "go.opentelemetry.io/auto/sdk",
            "direct": false,
            "version": "v1.2.1",
            "ecosystem": "go"
          },
          {
            "name": "go.opentelemetry.io/contrib/detectors/gcp",
            "direct": false,
            "version": "v1.39.0",
            "ecosystem": "go"
          },
          {
            "name": "go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc",
            "direct": false,
            "version": "v0.68.0",
            "ecosystem": "go"
          },
          {
            "name": "go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp",
            "direct": false,
            "version": "v0.68.0",
            "ecosystem": "go"
          },
          {
            "name": "go.opentelemetry.io/otel",
            "direct": false,
            "version": "v1.43.0",
            "ecosystem": "go"
          },
          {
            "name": "go.opentelemetry.io/otel/metric",
            "direct": false,
            "version": "v1.43.0",
            "ecosystem": "go"
          },
          {
            "name": "go.opentelemetry.io/otel/sdk",
            "direct": false,
            "version": "v1.43.0",
            "ecosystem": "go"
          },
          {
            "name": "go.opentelemetry.io/otel/sdk/metric",
            "direct": false,
            "version": "v1.43.0",
            "ecosystem": "go"
          },
          {
            "name": "go.opentelemetry.io/otel/trace",
            "direct": false,
            "version": "v1.43.0",
            "ecosystem": "go"
          },
          {
            "name": "go.yaml.in/yaml/v3",
            "direct": false,
            "version": "v3.0.4",
            "ecosystem": "go"
          },
          {
            "name": "go.yaml.in/yaml/v4",
            "direct": false,
            "version": "v4.0.0-rc.2",
            "ecosystem": "go"
          },
          {
            "name": "go4.org",
            "direct": false,
            "version": "v0.0.0-20230225012048-214862532bf5",
            "ecosystem": "go"
          },
          {
            "name": "golang.org/x/crypto",
            "direct": false,
            "version": "v0.53.0",
            "ecosystem": "go"
          },
          {
            "name": "golang.org/x/mod",
            "direct": false,
            "version": "v0.37.0",
            "ecosystem": "go"
          },
          {
            "name": "golang.org/x/net",
            "direct": false,
            "version": "v0.56.0",
            "ecosystem": "go"
          },
          {
            "name": "golang.org/x/oauth2",
            "direct": false,
            "version": "v0.36.0",
            "ecosystem": "go"
          },
          {
            "name": "golang.org/x/sync",
            "direct": false,
            "version": "v0.21.0",
            "ecosystem": "go"
          },
          {
            "name": "golang.org/x/sys",
            "direct": false,
            "version": "v0.46.0",
            "ecosystem": "go"
          },
          {
            "name": "golang.org/x/term",
            "direct": false,
            "version": "v0.44.0",
            "ecosystem": "go"
          },
          {
            "name": "golang.org/x/xerrors",
            "direct": false,
            "version": "v0.0.0-20240903120638-7835f813f4da",
            "ecosystem": "go"
          },
          {
            "name": "gonum.org/v1/gonum",
            "direct": false,
            "version": "v0.17.0",
            "ecosystem": "go"
          },
          {
            "name": "google.golang.org/api",
            "direct": false,
            "version": "v0.271.0",
            "ecosystem": "go"
          },
          {
            "name": "google.golang.org/genproto",
            "direct": false,
            "version": "v0.0.0-20260128011058-8636f8732409",
            "ecosystem": "go"
          },
          {
            "name": "google.golang.org/genproto/googleapis/api",
            "direct": false,
            "version": "v0.0.0-20260401024825-9d38bb4040a9",
            "ecosystem": "go"
          },
          {
            "name": "google.golang.org/genproto/googleapis/rpc",
            "direct": false,
            "version": "v0.0.0-20260406210006-6f92a3bedf2d",
            "ecosystem": "go"
          },
          {
            "name": "google.golang.org/grpc",
            "direct": false,
            "version": "v1.80.0",
            "ecosystem": "go"
          },
          {
            "name": "google.golang.org/protobuf",
            "direct": false,
            "version": "v1.36.12-0.20260120151049-f2248ac996af",
            "ecosystem": "go"
          },
          {
            "name": "gopkg.in/warnings.v0",
            "direct": false,
            "version": "v0.1.2",
            "ecosystem": "go"
          },
          {
            "name": "modernc.org/libc",
            "direct": false,
            "version": "v1.72.3",
            "ecosystem": "go"
          },
          {
            "name": "modernc.org/mathutil",
            "direct": false,
            "version": "v1.7.1",
            "ecosystem": "go"
          },
          {
            "name": "modernc.org/memory",
            "direct": false,
            "version": "v1.11.0",
            "ecosystem": "go"
          },
          {
            "name": "modernc.org/sqlite",
            "direct": false,
            "version": "v1.51.0",
            "ecosystem": "go"
          },
          {
            "name": "dataclass-wizard",
            "direct": false,
            "version": "0.36.2",
            "ecosystem": "pypi"
          },
          {
            "name": "tabulate",
            "direct": false,
            "version": "0.9.0",
            "ecosystem": "pypi"
          }
        ],
        "collected": true,
        "truncated": false,
        "total_count": 333,
        "direct_count": 75,
        "indirect_count": 258
      }
    },
    "maintainership": {
      "issues": {
        "open_prs": 0,
        "merged_prs": 0,
        "open_issues": 0,
        "closed_ratio": null,
        "closed_issues": 0,
        "closed_unmerged_prs": 0
      },
      "bus_factor": 2,
      "bot_contributors": 2,
      "top_contributors": [
        {
          "type": "User",
          "login": "wagoodman",
          "commits": 493,
          "avatar_url": "https://avatars.githubusercontent.com/u/590471?v=4"
        },
        {
          "type": "User",
          "login": "spiffcs",
          "commits": 106,
          "avatar_url": "https://avatars.githubusercontent.com/u/32073428?v=4"
        },
        {
          "type": "User",
          "login": "willmurphyscode",
          "commits": 105,
          "avatar_url": "https://avatars.githubusercontent.com/u/12529630?v=4"
        },
        {
          "type": "User",
          "login": "kzantow",
          "commits": 101,
          "avatar_url": "https://avatars.githubusercontent.com/u/3009477?v=4"
        },
        {
          "type": "User",
          "login": "luhring",
          "commits": 99,
          "avatar_url": "https://avatars.githubusercontent.com/u/5199289?v=4"
        },
        {
          "type": "User",
          "login": "westonsteimel",
          "commits": 82,
          "avatar_url": "https://avatars.githubusercontent.com/u/1593939?v=4"
        },
        {
          "type": "User",
          "login": "anchore-oss-update-bot",
          "commits": 17,
          "avatar_url": "https://avatars.githubusercontent.com/u/271010566?v=4"
        },
        {
          "type": "User",
          "login": "cpendery",
          "commits": 16,
          "avatar_url": "https://avatars.githubusercontent.com/u/35637443?v=4"
        },
        {
          "type": "User",
          "login": "jonasagx",
          "commits": 11,
          "avatar_url": "https://avatars.githubusercontent.com/u/774704?v=4"
        },
        {
          "type": "User",
          "login": "Vijay-P",
          "commits": 6,
          "avatar_url": "https://avatars.githubusercontent.com/u/15178387?v=4"
        }
      ],
      "contributors_sampled": 98,
      "top_contributor_share": 0.419
    },
    "quality_signals": {
      "has_ci": true,
      "has_tests": true,
      "ci_workflows": [
        "codeql.yaml",
        "release.yaml",
        "scorecards.yaml",
        "validate-github-actions.yaml",
        "validations.yaml"
      ],
      "has_docs_dir": false,
      "linter_configs": [
        ".golangci.yaml"
      ],
      "has_editorconfig": false,
      "has_linter_config": true,
      "has_precommit_config": false
    },
    "security_signals": {
      "lockfiles": [
        "Gemfile.lock",
        "go.sum",
        "mix.lock"
      ],
      "scorecard": {
        "checks": [
          {
            "name": "Binary-Artifacts",
            "score": 10,
            "reason": "no binaries found in the repo",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#binary-artifacts"
          },
          {
            "name": "Branch-Protection",
            "score": 0,
            "reason": "branch protection not enabled on development/release branches",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#branch-protection"
          },
          {
            "name": "CI-Tests",
            "score": null,
            "reason": "no pull request found",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#ci-tests"
          },
          {
            "name": "CII-Best-Practices",
            "score": 0,
            "reason": "no effort to earn an OpenSSF best practices badge detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#cii-best-practices"
          },
          {
            "name": "Code-Review",
            "score": 0,
            "reason": "Found 0/30 approved changesets -- score normalized to 0",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#code-review"
          },
          {
            "name": "Contributors",
            "score": 10,
            "reason": "project has 7 contributing companies or organizations",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#contributors"
          },
          {
            "name": "Dangerous-Workflow",
            "score": 10,
            "reason": "no dangerous workflow patterns detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dangerous-workflow"
          },
          {
            "name": "Dependency-Update-Tool",
            "score": 10,
            "reason": "update tool detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dependency-update-tool"
          },
          {
            "name": "Fuzzing",
            "score": 0,
            "reason": "project is not fuzzed",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#fuzzing"
          },
          {
            "name": "License",
            "score": 10,
            "reason": "license file detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#license"
          },
          {
            "name": "Maintained",
            "score": 10,
            "reason": "30 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#maintained"
          },
          {
            "name": "Packaging",
            "score": null,
            "reason": "packaging workflow not detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#packaging"
          },
          {
            "name": "Pinned-Dependencies",
            "score": 6,
            "reason": "dependency not pinned by hash detected -- score normalized to 6",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#pinned-dependencies"
          },
          {
            "name": "SAST",
            "score": 0,
            "reason": "no SAST tool detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#sast"
          },
          {
            "name": "Security-Policy",
            "score": 10,
            "reason": "security policy file detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#security-policy"
          },
          {
            "name": "Signed-Releases",
            "score": null,
            "reason": "no releases found",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#signed-releases"
          },
          {
            "name": "Token-Permissions",
            "score": 10,
            "reason": "GitHub workflow tokens follow principle of least privilege",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#token-permissions"
          },
          {
            "name": "Vulnerabilities",
            "score": 0,
            "reason": "13 existing vulnerabilities detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#vulnerabilities"
          }
        ],
        "commit": "219a3b808f03500eb0a4ed4e57f0841fd107a607",
        "ran_at": "2026-07-25T11:25:24Z",
        "aggregate_score": 5.9,
        "scorecard_version": "v5.5.0"
      },
      "has_codeql_workflow": true,
      "has_security_policy": true,
      "has_dependabot_config": true
    },
    "contribution_flow": {
      "collected": true,
      "ci_last_run_at": "2026-07-22T13:06:20Z",
      "oldest_open_prs": [],
      "last_merged_pr_at": null,
      "ci_last_conclusion": "STARTUP_FAILURE",
      "oldest_open_issues": []
    }
  },
  "config": {
    "disabled_metrics": [],
    "disabled_categories": [],
    "disabled_components": {}
  },
  "source": {
    "url": "https://github.com/westonsteimel/grype",
    "host": "github.com",
    "name": "grype",
    "owner": "westonsteimel"
  },
  "metrics": {
    "overall": {
      "key": "overall",
      "band": "at_risk",
      "name": "Overall health",
      "note": null,
      "notes": [],
      "value": 48,
      "inputs": {
        "security": 59,
        "vitality": 73,
        "community": 12,
        "governance": 42,
        "engineering": 52
      },
      "components": []
    },
    "categories": [
      {
        "key": "vitality",
        "band": "good",
        "name": "Vitality",
        "value": 73,
        "weight": 0.22,
        "metrics": [
          {
            "key": "development_activity",
            "band": "excellent",
            "name": "Development activity",
            "note": null,
            "notes": [],
            "value": 89,
            "inputs": {
              "commits_last_year": 417,
              "human_commit_share": 0.71,
              "days_since_last_push": 30,
              "active_weeks_last_year": 47
            },
            "components": [
              {
                "key": "push_recency",
                "name": "Push recency",
                "detail": "last push 30 days ago",
                "points": 28.8,
                "status": "partial",
                "details": [
                  {
                    "code": "push_recency",
                    "params": {
                      "days": 30
                    }
                  }
                ],
                "max_points": 36
              },
              {
                "key": "commit_cadence",
                "name": "Commit cadence",
                "detail": "47/52 weeks with commits",
                "points": 32.5,
                "status": "partial",
                "details": [
                  {
                    "code": "commit_cadence_weeks",
                    "params": {
                      "weeks": 47
                    }
                  }
                ],
                "max_points": 36
              },
              {
                "key": "commit_volume",
                "name": "Commit volume",
                "detail": "417 commits in the last year",
                "points": 18,
                "status": "met",
                "details": [
                  {
                    "code": "commits_last_year",
                    "params": {
                      "count": 417
                    }
                  }
                ],
                "max_points": 18
              },
              {
                "key": "openssf_scorecard_maintained",
                "name": "OpenSSF Scorecard: Maintained",
                "detail": "30 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10",
                "points": 10,
                "status": "met",
                "details": [],
                "max_points": 10
              }
            ]
          },
          {
            "key": "release_discipline",
            "band": "at_risk",
            "name": "Release discipline",
            "note": "Excluded from scoring (no data or not applicable): OpenSSF Scorecard: Signed-Releases. Remaining weights renormalized.",
            "notes": [
              {
                "code": "excluded_no_data",
                "params": {
                  "components": [
                    "openssf_scorecard_signed_releases"
                  ]
                }
              },
              {
                "code": "weights_renormalized",
                "params": {}
              }
            ],
            "value": 48,
            "inputs": {
              "releases_count": 19,
              "latest_release_tag": "v0.7.0",
              "releases_from_tags": true,
              "days_since_latest_release": 2004,
              "mean_days_between_releases": 13.8
            },
            "components": [
              {
                "key": "ships_releases",
                "name": "Ships releases",
                "detail": "19 version tags (no GitHub releases)",
                "points": 16.2,
                "status": "partial",
                "details": [
                  {
                    "code": "version_tags_no_releases",
                    "params": {
                      "count": 19
                    }
                  }
                ],
                "max_points": 27
              },
              {
                "key": "release_recency",
                "name": "Release recency",
                "detail": "latest release 2004 days ago",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "release_recency",
                    "params": {
                      "days": 2004
                    }
                  }
                ],
                "max_points": 36
              },
              {
                "key": "release_cadence",
                "name": "Release cadence",
                "detail": "a release every ~13.8 days",
                "points": 27,
                "status": "met",
                "details": [
                  {
                    "code": "release_cadence",
                    "params": {
                      "gap": 13.8
                    }
                  }
                ],
                "max_points": 27
              },
              {
                "key": "openssf_scorecard_signed_releases",
                "name": "OpenSSF Scorecard: Signed-Releases",
                "detail": "no releases found",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "no_data",
                    "params": {}
                  }
                ],
                "max_points": 10
              }
            ]
          },
          {
            "key": "abandonment",
            "band": "excellent",
            "name": "Abandonment",
            "note": null,
            "notes": [],
            "value": 100,
            "inputs": {
              "cap": null,
              "state": "maintained",
              "guards": [],
              "signals": [],
              "red_flag": false,
              "multiplier_pct": 100,
              "declared_reason": null,
              "unverified_reason": null,
              "unanswered_open_prs": null,
              "unanswered_open_issues": null,
              "days_since_last_merged_pr": null,
              "days_since_last_human_commit": 31,
              "days_since_last_human_commit_is_floor": false
            },
            "components": [
              {
                "key": "project_is_still_maintained",
                "name": "Project is still maintained",
                "detail": "last human commit 31 days ago",
                "points": 100,
                "status": "met",
                "details": [
                  {
                    "code": "abandonment_maintained",
                    "params": {
                      "days": 31
                    }
                  }
                ],
                "max_points": 100
              }
            ]
          }
        ],
        "description": "Is the project alive — is code being written and are releases shipping?"
      },
      {
        "key": "community",
        "band": "critical",
        "name": "Community & Adoption",
        "value": 12,
        "weight": 0.18,
        "metrics": [
          {
            "key": "popularity",
            "band": "critical",
            "name": "Popularity & adoption",
            "note": null,
            "notes": [],
            "value": 1,
            "inputs": {
              "forks": 0,
              "stars": 0,
              "watchers": 0,
              "growth_state": "unverified",
              "growth_factor_pct": 100,
              "growth_unverified_reason": "no_history"
            },
            "components": [
              {
                "key": "stars",
                "name": "Stars",
                "detail": "0 stars",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "stars",
                    "params": {
                      "count": 0
                    }
                  }
                ],
                "max_points": 60
              },
              {
                "key": "forks",
                "name": "Forks",
                "detail": "0 forks",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "forks",
                    "params": {
                      "count": 0
                    }
                  }
                ],
                "max_points": 25
              },
              {
                "key": "watchers",
                "name": "Watchers",
                "detail": "0 watchers",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "watchers",
                    "params": {
                      "count": 0
                    }
                  }
                ],
                "max_points": 15
              }
            ]
          },
          {
            "key": "community_health",
            "band": "critical",
            "name": "Community health",
            "note": null,
            "notes": [],
            "value": 25,
            "inputs": {
              "has_readme": false,
              "has_license": false,
              "has_contributing": false,
              "has_issue_template": false,
              "has_code_of_conduct": false,
              "has_pull_request_template": false
            },
            "components": [
              {
                "key": "readme",
                "name": "README",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 22.5
              },
              {
                "key": "license",
                "name": "License",
                "detail": "recognized license (Apache-2.0)",
                "points": 22.5,
                "status": "met",
                "details": [
                  {
                    "code": "license_standard",
                    "params": {}
                  },
                  {
                    "code": "license_spdx",
                    "params": {
                      "spdx": "Apache-2.0"
                    }
                  }
                ],
                "max_points": 22.5
              },
              {
                "key": "contributing_guide",
                "name": "CONTRIBUTING guide",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 18
              },
              {
                "key": "code_of_conduct",
                "name": "Code of conduct",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 13.5
              },
              {
                "key": "issue_template",
                "name": "Issue template",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.2
              },
              {
                "key": "pr_template",
                "name": "PR template",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 6.3
              }
            ]
          }
        ],
        "description": "Does the project have users, downloads, attention, and a welcoming setup for contributors?"
      },
      {
        "key": "governance",
        "band": "at_risk",
        "name": "Sustainability & Governance",
        "value": 42,
        "weight": 0.24,
        "metrics": [
          {
            "key": "maintainer_resilience",
            "band": "moderate",
            "name": "Maintainer resilience (bus factor)",
            "note": null,
            "notes": [],
            "value": 62,
            "inputs": {
              "bus_factor": 2,
              "contributors_sampled": 98,
              "top_contributor_share": 0.419
            },
            "components": [
              {
                "key": "bus_factor",
                "name": "Bus factor",
                "detail": "2 contributor(s) cover half of all commits",
                "points": 25.2,
                "status": "partial",
                "details": [
                  {
                    "code": "bus_factor",
                    "params": {
                      "count": 2
                    }
                  }
                ],
                "max_points": 54
              },
              {
                "key": "commit_distribution",
                "name": "Commit distribution",
                "detail": "top contributor authored 42% of commits",
                "points": 13.1,
                "status": "partial",
                "details": [
                  {
                    "code": "top_contributor_share",
                    "params": {
                      "share": 42
                    }
                  }
                ],
                "max_points": 22.5
              },
              {
                "key": "contributor_breadth",
                "name": "Contributor breadth",
                "detail": "98 contributors",
                "points": 13.5,
                "status": "met",
                "details": [
                  {
                    "code": "contributors_sampled",
                    "params": {
                      "count": 98
                    }
                  }
                ],
                "max_points": 13.5
              },
              {
                "key": "openssf_scorecard_contributors",
                "name": "OpenSSF Scorecard: Contributors",
                "detail": "project has 7 contributing companies or organizations",
                "points": 10,
                "status": "met",
                "details": [],
                "max_points": 10
              }
            ]
          },
          {
            "key": "responsiveness",
            "band": "critical",
            "name": "Issue & PR responsiveness",
            "note": "Excluded from scoring (no data or not applicable): Issue resolution, PR acceptance. Remaining weights renormalized.",
            "notes": [
              {
                "code": "excluded_no_data",
                "params": {
                  "components": [
                    "issue_resolution",
                    "pr_acceptance"
                  ]
                }
              },
              {
                "code": "weights_renormalized",
                "params": {}
              }
            ],
            "value": 1,
            "inputs": {
              "merged_prs": 0,
              "open_issues": 0,
              "closed_issues": 0,
              "issue_closed_ratio": null,
              "closed_unmerged_prs": 0
            },
            "components": [
              {
                "key": "issue_resolution",
                "name": "Issue resolution",
                "detail": "no issues or no data",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "no_issues_or_data",
                    "params": {}
                  }
                ],
                "max_points": 46.75
              },
              {
                "key": "pr_acceptance",
                "name": "PR acceptance",
                "detail": "no decided pull requests or no data",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "no_decided_prs_or_data",
                    "params": {}
                  }
                ],
                "max_points": 38.25
              },
              {
                "key": "openssf_scorecard_code_review",
                "name": "OpenSSF Scorecard: Code-Review",
                "detail": "Found 0/30 approved changesets -- score normalized to 0",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 15
              }
            ]
          },
          {
            "key": "stewardship",
            "band": "moderate",
            "name": "Ownership & stewardship",
            "note": "Excluded from scoring (no data or not applicable): Verified domain. Remaining weights renormalized.",
            "notes": [
              {
                "code": "excluded_no_data",
                "params": {
                  "components": [
                    "verified_domain"
                  ]
                }
              },
              {
                "code": "weights_renormalized",
                "params": {}
              }
            ],
            "value": 60,
            "inputs": {
              "followers": 64,
              "owner_type": "User",
              "is_verified": null,
              "owner_login": "westonsteimel",
              "public_repos": 436,
              "account_age_days": 5228
            },
            "components": [
              {
                "key": "ownership_backing",
                "name": "Ownership backing",
                "detail": "personal (user) account",
                "points": 10,
                "status": "partial",
                "details": [
                  {
                    "code": "owner_personal",
                    "params": {}
                  }
                ],
                "max_points": 30
              },
              {
                "key": "verified_domain",
                "name": "Verified domain",
                "detail": "not applicable to user accounts",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "not_applicable_to_user_accounts",
                    "params": {}
                  }
                ],
                "max_points": 20
              },
              {
                "key": "owner_reach",
                "name": "Owner reach",
                "detail": "64 followers of westonsteimel",
                "points": 13,
                "status": "partial",
                "details": [
                  {
                    "code": "owner_followers",
                    "params": {
                      "count": 64,
                      "login": "westonsteimel"
                    }
                  }
                ],
                "max_points": 25
              },
              {
                "key": "track_record",
                "name": "Track record",
                "detail": "436 public repos, account ~14 yr old",
                "points": 25,
                "status": "met",
                "details": [
                  {
                    "code": "public_repos",
                    "params": {
                      "count": 436
                    }
                  },
                  {
                    "code": "account_age_years",
                    "params": {
                      "years": 14
                    }
                  }
                ],
                "max_points": 25
              }
            ]
          }
        ],
        "description": "Will the project survive its people — bus factor, responsiveness, who backs it, and package upkeep?"
      },
      {
        "key": "engineering",
        "band": "moderate",
        "name": "Engineering Quality",
        "value": 52,
        "weight": 0.2,
        "metrics": [
          {
            "key": "engineering_practices",
            "band": "good",
            "name": "Engineering practices",
            "note": "Excluded from scoring (no data or not applicable): OpenSSF Scorecard: CI-Tests. Remaining weights renormalized.",
            "notes": [
              {
                "code": "excluded_no_data",
                "params": {
                  "components": [
                    "openssf_scorecard_ci_tests"
                  ]
                }
              },
              {
                "code": "weights_renormalized",
                "params": {}
              }
            ],
            "value": 80,
            "inputs": {
              "has_ci": true,
              "has_tests": true,
              "has_editorconfig": false,
              "has_linter_config": true,
              "has_precommit_config": false
            },
            "components": [
              {
                "key": "ci_workflows",
                "name": "CI workflows",
                "detail": "5 workflow(s)",
                "points": 24,
                "status": "met",
                "details": [
                  {
                    "code": "ci_workflows",
                    "params": {
                      "count": 5
                    }
                  }
                ],
                "max_points": 24
              },
              {
                "key": "tests_present",
                "name": "Tests present",
                "detail": null,
                "points": 24,
                "status": "met",
                "details": [],
                "max_points": 24
              },
              {
                "key": "linter_config",
                "name": "Linter config",
                "detail": ".golangci.yaml",
                "points": 16,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": ".golangci.yaml"
                    }
                  }
                ],
                "max_points": 16
              },
              {
                "key": "pre_commit_hooks",
                "name": "Pre-commit hooks",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 9.6
              },
              {
                "key": "editorconfig",
                "name": ".editorconfig",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 6.4
              },
              {
                "key": "openssf_scorecard_ci_tests",
                "name": "OpenSSF Scorecard: CI-Tests",
                "detail": "no pull request found",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "no_data",
                    "params": {}
                  }
                ],
                "max_points": 20
              }
            ]
          },
          {
            "key": "documentation",
            "band": "critical",
            "name": "Documentation",
            "note": null,
            "notes": [],
            "value": 10,
            "inputs": {
              "topics": [],
              "has_wiki": true,
              "homepage": null,
              "has_readme": false,
              "has_docs_dir": false,
              "has_description": false
            },
            "components": [
              {
                "key": "readme",
                "name": "README",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 30
              },
              {
                "key": "documentation_directory",
                "name": "Documentation directory",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 25
              },
              {
                "key": "documentation_homepage_site",
                "name": "Documentation / homepage site",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 15
              },
              {
                "key": "repository_description",
                "name": "Repository description",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 10
              },
              {
                "key": "topics",
                "name": "Topics",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 10
              },
              {
                "key": "wiki",
                "name": "Wiki",
                "detail": null,
                "points": 10,
                "status": "met",
                "details": [],
                "max_points": 10
              }
            ]
          }
        ],
        "description": "Are baseline engineering and documentation practices in place?"
      },
      {
        "key": "security",
        "band": "moderate",
        "name": "Security",
        "value": 59,
        "weight": 0.16,
        "metrics": [
          {
            "key": "security_posture",
            "band": "moderate",
            "name": "Security posture",
            "note": "Excluded from scoring (no data or not applicable): CI-Tests, Packaging, Signed-Releases. Remaining weights renormalized.",
            "notes": [
              {
                "code": "excluded_no_data",
                "params": {
                  "components": [
                    "ci_tests",
                    "packaging",
                    "signed_releases"
                  ]
                }
              },
              {
                "code": "weights_renormalized",
                "params": {}
              }
            ],
            "value": 59,
            "inputs": {
              "source": "openssf_scorecard",
              "checks_evaluated": 15,
              "scorecard_version": "v5.5.0",
              "checks_inconclusive": 3,
              "scorecard_aggregate": 5.9
            },
            "components": [
              {
                "key": "binary_artifacts",
                "name": "Binary-Artifacts",
                "detail": "no binaries found in the repo",
                "points": 7.5,
                "status": "met",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "branch_protection",
                "name": "Branch-Protection",
                "detail": "branch protection not enabled on development/release branches",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "ci_tests",
                "name": "CI-Tests",
                "detail": "no pull request found",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "no_data",
                    "params": {}
                  }
                ],
                "max_points": 2.5
              },
              {
                "key": "cii_best_practices",
                "name": "CII-Best-Practices",
                "detail": "no effort to earn an OpenSSF best practices badge detected",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 2.5
              },
              {
                "key": "code_review",
                "name": "Code-Review",
                "detail": "Found 0/30 approved changesets -- score normalized to 0",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "contributors",
                "name": "Contributors",
                "detail": "project has 7 contributing companies or organizations",
                "points": 2.5,
                "status": "met",
                "details": [],
                "max_points": 2.5
              },
              {
                "key": "dangerous_workflow",
                "name": "Dangerous-Workflow",
                "detail": "no dangerous workflow patterns detected",
                "points": 10,
                "status": "met",
                "details": [],
                "max_points": 10
              },
              {
                "key": "dependency_update_tool",
                "name": "Dependency-Update-Tool",
                "detail": "update tool detected",
                "points": 7.5,
                "status": "met",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "fuzzing",
                "name": "Fuzzing",
                "detail": "project is not fuzzed",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 5
              },
              {
                "key": "license",
                "name": "License",
                "detail": "license file detected",
                "points": 2.5,
                "status": "met",
                "details": [],
                "max_points": 2.5
              },
              {
                "key": "maintained",
                "name": "Maintained",
                "detail": "30 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10",
                "points": 7.5,
                "status": "met",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "packaging",
                "name": "Packaging",
                "detail": "packaging workflow not detected",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "no_data",
                    "params": {}
                  }
                ],
                "max_points": 5
              },
              {
                "key": "pinned_dependencies",
                "name": "Pinned-Dependencies",
                "detail": "dependency not pinned by hash detected -- score normalized to 6",
                "points": 3,
                "status": "partial",
                "details": [],
                "max_points": 5
              },
              {
                "key": "sast",
                "name": "SAST",
                "detail": "no SAST tool detected",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 5
              },
              {
                "key": "security_policy",
                "name": "Security-Policy",
                "detail": "security policy file detected",
                "points": 5,
                "status": "met",
                "details": [],
                "max_points": 5
              },
              {
                "key": "signed_releases",
                "name": "Signed-Releases",
                "detail": "no releases found",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "no_data",
                    "params": {}
                  }
                ],
                "max_points": 7.5
              },
              {
                "key": "token_permissions",
                "name": "Token-Permissions",
                "detail": "GitHub workflow tokens follow principle of least privilege",
                "points": 7.5,
                "status": "met",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "vulnerabilities",
                "name": "Vulnerabilities",
                "detail": "13 existing vulnerabilities detected",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.5
              }
            ]
          },
          {
            "key": "dependency_advisories",
            "band": "moderate",
            "name": "Dependency advisories",
            "note": "Excluded from scoring (no data or not applicable): Indirect dependencies free of known advisories. Remaining weights renormalized. Matched 333 resolved dependencies against OSV. This repository publishes no package the index resolves, so the repository dependency graph was assessed instead. That graph mixes development and test pins with shipped dependencies, so only the declared runtime dependencies are scored; transitive findings are reported as context and excluded from the score. Reachability is not analyzed.",
            "notes": [
              {
                "code": "excluded_no_data",
                "params": {
                  "components": [
                    "indirect_dependencies_free_of_known_advisories"
                  ]
                }
              },
              {
                "code": "weights_renormalized",
                "params": {}
              },
              {
                "code": "advisories_scope_repository",
                "params": {
                  "assessed": 333
                }
              },
              {
                "code": "advisories_repo_graph_caveat",
                "params": {}
              },
              {
                "code": "advisories_reachability",
                "params": {}
              }
            ],
            "value": 57,
            "inputs": {
              "source": "osv",
              "advisories": 14,
              "affected_packages": 5,
              "assessed_packages": 333,
              "unassessed_packages": 0,
              "affected_by_severity": "critical 1, high 1, unknown 3",
              "direct_affected_packages": 2
            },
            "components": [
              {
                "key": "direct_dependencies_free_of_known_advisories",
                "name": "Direct dependencies free of known advisories",
                "detail": "2 affected: github.com/docker/docker v28.5.2+incompatible (high 8.8), golang.org/x/text v0.38.0 (unknown)",
                "points": 9.6,
                "status": "partial",
                "details": [
                  {
                    "code": "advisories_affected",
                    "params": {
                      "count": 2,
                      "packages": "github.com/docker/docker v28.5.2+incompatible (high 8.8), golang.org/x/text v0.38.0 (unknown)"
                    }
                  }
                ],
                "max_points": 35
              },
              {
                "key": "indirect_dependencies_free_of_known_advisories",
                "name": "Indirect dependencies free of known advisories",
                "detail": "transitive set not separable from development and test dependencies in this scope",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "advisories_scope_not_separable",
                    "params": {}
                  }
                ],
                "max_points": 25
              },
              {
                "key": "no_advisories_left_outstanding",
                "name": "No advisories left outstanding",
                "detail": "1 advisory-carrying package(s) unaddressed past 90 days; oldest published 119 days ago",
                "points": 32.8,
                "status": "partial",
                "details": [
                  {
                    "code": "advisories_stale",
                    "params": {
                      "days": 90,
                      "count": 1,
                      "oldest": 119
                    }
                  }
                ],
                "max_points": 40
              }
            ]
          },
          {
            "key": "malicious_dependencies",
            "band": "excellent",
            "name": "Malicious dependencies",
            "note": null,
            "notes": [],
            "value": 100,
            "inputs": {
              "source": "osv",
              "meaning": "reported as a malicious package by the OpenSSF corpus; the remedy is removal or moving off the compromised name, never an upgrade of the same artifact. Versions the registry has since pulled are listed but not scored",
              "packages": [],
              "red_flag": false,
              "assessed_packages": 333,
              "malicious_packages": 0,
              "direct_malicious_packages": 0,
              "withdrawn_malicious_packages": 0,
              "installable_malicious_packages": 0
            },
            "components": [
              {
                "key": "no_dependency_reported_as_a_malicious_package",
                "name": "No dependency reported as a malicious package",
                "detail": "no dependency is reported as a malicious package",
                "points": 100,
                "status": "met",
                "details": [
                  {
                    "code": "no_malicious_dependencies",
                    "params": {}
                  }
                ],
                "max_points": 100
              }
            ]
          },
          {
            "key": "high_risk_jurisdiction_exposure",
            "band": "excellent",
            "name": "High-Risk Jurisdiction Exposure",
            "note": "Only high-confidence self-published location evidence affects this multiplier. Ambiguous matches are review-only; country evidence is not proof of nationality, citizenship, legal registration, malicious intent, or sanctions status.",
            "notes": [
              {
                "code": "jurisdiction_evidence_limits",
                "params": {}
              }
            ],
            "value": 100,
            "inputs": {
              "meaning": "self-published location evidence; not nationality or citizenship",
              "red_flag": false,
              "exposures": [],
              "policy_countries": [
                "Russia",
                "Iran",
                "North Korea"
              ],
              "review_only_matches": 0,
              "assessed_self_published_locations": 8
            },
            "components": [
              {
                "key": "policy_exposure_multiplier",
                "name": "Policy exposure multiplier",
                "detail": "no confirmed policy-scope location match",
                "points": 100,
                "status": "met",
                "details": [
                  {
                    "code": "jurisdiction_no_match",
                    "params": {}
                  }
                ],
                "max_points": 100
              }
            ]
          }
        ],
        "description": "Are visible security and supply-chain practices strong, with no malicious dependency and no unresolved high-risk jurisdiction exposure?"
      },
      {
        "key": "ai_readiness",
        "band": "good",
        "name": "AI Readiness",
        "value": 78,
        "weight": 0,
        "metrics": [
          {
            "key": "ai_agent_context",
            "band": "moderate",
            "name": "Agent context & guidance",
            "note": null,
            "notes": [],
            "value": 55,
            "inputs": {
              "has_llms_txt": true,
              "legible_history_share": 1,
              "agent_instruction_files": [],
              "agent_instruction_max_bytes": null
            },
            "components": [
              {
                "key": "agent_instructions",
                "name": "Agent instructions",
                "detail": "no CLAUDE.md / AGENTS.md / editor rules",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "no_agent_instructions",
                    "params": {}
                  }
                ],
                "max_points": 45
              },
              {
                "key": "machine_readable_docs_llms_txt",
                "name": "Machine-readable docs (llms.txt)",
                "detail": "llms.txt present",
                "points": 15,
                "status": "met",
                "details": [
                  {
                    "code": "llms_txt_present",
                    "params": {}
                  }
                ],
                "max_points": 15
              },
              {
                "key": "legible_commit_history",
                "name": "Legible commit history",
                "detail": "71 of 71 human commits state their intent (structured subject or explanatory body)",
                "points": 40,
                "status": "met",
                "details": [
                  {
                    "code": "legible_history",
                    "params": {
                      "legible": 71,
                      "sampled": 71
                    }
                  }
                ],
                "max_points": 40
              }
            ]
          },
          {
            "key": "ai_verify_loop",
            "band": "excellent",
            "name": "Verify loop (build / test / typecheck)",
            "note": null,
            "notes": [],
            "value": 86,
            "inputs": {
              "has_nix": false,
              "has_tests": true,
              "lockfiles": [
                "Gemfile.lock",
                "go.sum",
                "mix.lock"
              ],
              "has_dockerfile": true,
              "typed_language": true,
              "bootstrap_files": [
                "Makefile",
                "grype/db/v5/distribution/testdata/tls/Makefile",
                "test/cli/testdata/Makefile",
                "test/install/Makefile",
                "test/integration/testdata/Makefile",
                "test/quality/Makefile"
              ],
              "has_devcontainer": false,
              "has_linter_config": true,
              "typecheck_configs": [],
              "agent_commit_share": 0,
              "toolchain_manifests": [
                ".make/go.mod",
                "go.mod",
                "test/integration/testdata/image-debian-match-coverage/golang/go.mod"
              ],
              "dependency_bot_commit_share": 0.29
            },
            "components": [
              {
                "key": "one_command_bootstrap",
                "name": "One-command bootstrap",
                "detail": "Makefile, grype/db/v5/distribution/testdata/tls/Makefile, test/cli/testdata/Makefile, test/install/Makefile, test/integration/testdata/Makefile, test/quality/Makefile",
                "points": 18,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": "Makefile, grype/db/v5/distribution/testdata/tls/Makefile, test/cli/testdata/Makefile, test/install/Makefile, test/integration/testdata/Makefile, test/quality/Makefile"
                    }
                  }
                ],
                "max_points": 18
              },
              {
                "key": "automated_tests",
                "name": "Automated tests",
                "detail": null,
                "points": 22,
                "status": "met",
                "details": [],
                "max_points": 22
              },
              {
                "key": "lint_format_config",
                "name": "Lint / format config",
                "detail": ".golangci.yaml",
                "points": 11,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": ".golangci.yaml"
                    }
                  }
                ],
                "max_points": 11
              },
              {
                "key": "static_type_checking",
                "name": "Static type checking",
                "detail": "Go (statically typed)",
                "points": 11,
                "status": "met",
                "details": [
                  {
                    "code": "statically_typed_language",
                    "params": {
                      "language": "Go"
                    }
                  }
                ],
                "max_points": 11
              },
              {
                "key": "reproducible_environment",
                "name": "Reproducible environment",
                "detail": "Dockerfile, lockfile",
                "points": 10,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": "Dockerfile, lockfile"
                    }
                  }
                ],
                "max_points": 10
              },
              {
                "key": "demonstrated_agent_practice",
                "name": "Demonstrated agent practice",
                "detail": "no agent-authored commits among the last 100",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "no_agent_authored_commits",
                    "params": {
                      "sampled": 100
                    }
                  }
                ],
                "max_points": 10
              },
              {
                "key": "automated_maintenance",
                "name": "Automated maintenance",
                "detail": "29 of the last 100 commits are automated dependency updates",
                "points": 8,
                "status": "met",
                "details": [
                  {
                    "code": "dependency_bot_commits",
                    "params": {
                      "count": 29,
                      "sampled": 100
                    }
                  }
                ],
                "max_points": 8
              },
              {
                "key": "openssf_scorecard_pinned_dependencies",
                "name": "OpenSSF Scorecard: Pinned-Dependencies",
                "detail": "dependency not pinned by hash detected -- score normalized to 6",
                "points": 6,
                "status": "partial",
                "details": [],
                "max_points": 10
              }
            ]
          },
          {
            "key": "ai_code_legibility",
            "band": "excellent",
            "name": "Code legibility for models",
            "note": null,
            "notes": [],
            "value": 100,
            "inputs": {
              "primary_language": "Go",
              "largest_source_bytes": 51485,
              "source_files_sampled": 664,
              "oversized_source_files": 0
            },
            "components": [
              {
                "key": "type_checkable_code",
                "name": "Type-checkable code",
                "detail": "Go (statically typed)",
                "points": 45,
                "status": "met",
                "details": [
                  {
                    "code": "statically_typed_language",
                    "params": {
                      "language": "Go"
                    }
                  }
                ],
                "max_points": 45
              },
              {
                "key": "manageable_file_sizes",
                "name": "Manageable file sizes",
                "detail": "0/664 source files over 60KB",
                "points": 55,
                "status": "met",
                "details": [
                  {
                    "code": "oversized_source_files",
                    "params": {
                      "kb": 60,
                      "sampled": 664,
                      "oversized": 0
                    }
                  }
                ],
                "max_points": 55
              }
            ]
          }
        ],
        "description": "How well is the repo equipped to be developed and maintained with AI coding agents? An independent, experimental badge — weight 0.0, so it is surfaced on its own and does not affect the overall health score."
      }
    ],
    "metrics_version": "1.13.0"
  },
  "warnings": [
    "Community profile unavailable",
    "go package 'github.com/anchore/grype' points at a different repository (https://github.com/anchore/grype); excluded from ecosystem scoring",
    "Could not fetch go package 'github.com/anchore/grype/.make' from its registry"
  ],
  "report_type": "repository",
  "generated_at": "2026-07-25T11:25:40.283417Z",
  "schema_version": "0.27.0",
  "badge_url": "https://raw.githubusercontent.com/inspect-software/badges/main/v1/w/westonsteimel/grype.svg",
  "full_name": "westonsteimel/grype",
  "license_state": "standard",
  "license_spdx": "Apache-2.0"
}