joshbressers / grype

Не вдалося зібрати розв'язаний набір залежностей для цього звіту: GitHub dependency-graph SBOM unavailable (404); the dependency graph may be disabled for this repository

{
  "data": {
    "repo": {
      "topics": [],
      "is_fork": true,
      "size_kb": 3363,
      "has_wiki": true,
      "homepage": null,
      "languages": {
        "Go": 1139203,
        "Java": 398,
        "Roff": 81,
        "Ruby": 1687,
        "Shell": 36310,
        "Python": 18670,
        "Makefile": 20806,
        "Dockerfile": 2670,
        "JavaScript": 530
      },
      "pushed_at": "2023-06-13T20:01:30Z",
      "created_at": "2021-10-23T00:58:14Z",
      "owner_type": "User",
      "updated_at": "2021-12-18T02:44:32Z",
      "description": "A vulnerability scanner for container images and filesystems",
      "is_archived": false,
      "is_disabled": false,
      "license_spdx": "Apache-2.0",
      "default_branch": "main",
      "license_spdx_raw": "Apache-2.0",
      "primary_language": "Go",
      "significant_languages": [
        "Go"
      ]
    },
    "owner": {
      "blog": "https://opensourcesecurity.io/",
      "name": "Josh Bressers",
      "type": "User",
      "login": "joshbressers",
      "company": "@anchore",
      "location": "localhost",
      "followers": 111,
      "avatar_url": "https://avatars.githubusercontent.com/u/1692786?v=4",
      "created_at": "2012-04-30T15:02:49Z",
      "is_verified": null,
      "public_repos": 109,
      "account_age_days": 5198
    },
    "license": {
      "state": "standard",
      "spdx_id": "Apache-2.0",
      "raw_spdx": "Apache-2.0",
      "file_present": true,
      "scorecard_found": true,
      "profile_has_license": false
    },
    "activity": {
      "releases": [
        {
          "tag": "v0.23.0",
          "kind": "minor",
          "published_at": "2021-10-06T13:59:36Z"
        },
        {
          "tag": "v0.22.0",
          "kind": "minor",
          "published_at": "2021-09-30T17:18:22Z"
        },
        {
          "tag": "v0.21.0",
          "kind": "minor",
          "published_at": "2021-09-28T20:55:50Z"
        },
        {
          "tag": "v0.20.0",
          "kind": "minor",
          "published_at": "2021-09-23T01:53:32Z"
        },
        {
          "tag": "v0.19.0",
          "kind": "minor",
          "published_at": "2021-09-14T21:27:15Z"
        },
        {
          "tag": "v0.18.0",
          "kind": "minor",
          "published_at": "2021-09-13T21:55:01Z"
        },
        {
          "tag": "v0.17.0",
          "kind": "minor",
          "published_at": "2021-08-25T18:35:57Z"
        },
        {
          "tag": "v0.16.0",
          "kind": "minor",
          "published_at": "2021-08-18T15:20:25Z"
        },
        {
          "tag": "v0.15.0",
          "kind": "minor",
          "published_at": "2021-07-14T12:57:33Z"
        },
        {
          "tag": "v0.14.0",
          "kind": "minor",
          "published_at": "2021-06-30T15:09:44Z"
        },
        {
          "tag": "v0.13.0",
          "kind": "minor",
          "published_at": "2021-06-02T01:25:19Z"
        },
        {
          "tag": "v0.12.1",
          "kind": "patch",
          "published_at": "2021-05-25T18:01:49Z"
        },
        {
          "tag": "v0.12.0",
          "kind": "minor",
          "published_at": "2021-05-07T19:04:23Z"
        },
        {
          "tag": "v0.11.0",
          "kind": "minor",
          "published_at": "2021-04-22T21:34:03Z"
        },
        {
          "tag": "v0.10.2",
          "kind": "patch",
          "published_at": "2021-04-14T21:30:53Z"
        },
        {
          "tag": "v0.10.1",
          "kind": "patch",
          "published_at": "2021-04-14T19:02:12Z"
        },
        {
          "tag": "v0.10.0",
          "kind": "minor",
          "published_at": "2021-04-14T13:54:48Z"
        },
        {
          "tag": "v0.9.0",
          "kind": "minor",
          "published_at": "2021-03-25T20:49:35Z"
        },
        {
          "tag": "v0.8.0",
          "kind": "minor",
          "published_at": "2021-03-15T20:39:11Z"
        },
        {
          "tag": "v0.7.0",
          "kind": "minor",
          "published_at": "2021-01-27T19:15:02Z"
        },
        {
          "tag": "v0.6.1",
          "kind": "patch",
          "published_at": "2020-12-08T19:08:41Z"
        },
        {
          "tag": "v0.6.0",
          "kind": "minor",
          "published_at": "2020-12-03T22:04:12Z"
        },
        {
          "tag": "v0.5.0",
          "kind": "minor",
          "published_at": "2020-11-20T13:04:24Z"
        },
        {
          "tag": "v0.4.0",
          "kind": "minor",
          "published_at": "2020-11-12T15:10:19Z"
        },
        {
          "tag": "v0.3.0",
          "kind": "minor",
          "published_at": "2020-11-05T18:42:23Z"
        },
        {
          "tag": "v0.2.0",
          "kind": "minor",
          "published_at": "2020-10-23T18:12:34Z"
        },
        {
          "tag": "v0.1.0",
          "kind": "minor",
          "published_at": "2020-09-29T20:33:33Z"
        },
        {
          "tag": "v0.1.0-beta.11",
          "kind": "prerelease",
          "published_at": "2020-09-26T03:30:15Z"
        },
        {
          "tag": "v0.1.0-beta.10",
          "kind": "prerelease",
          "published_at": "2020-09-25T19:00:15Z"
        },
        {
          "tag": "v0.1.0-beta.9",
          "kind": "prerelease",
          "published_at": "2020-09-24T12:49:59Z"
        },
        {
          "tag": "v0.1.0-beta.8",
          "kind": "prerelease",
          "published_at": "2020-09-21T15:17:32Z"
        },
        {
          "tag": "v0.1.0-beta.7",
          "kind": "prerelease",
          "published_at": "2020-09-09T16:55:22Z"
        },
        {
          "tag": "v0.1.0-beta.6",
          "kind": "prerelease",
          "published_at": "2020-08-10T22:57:03Z"
        },
        {
          "tag": "v0.1.0-beta.5",
          "kind": "prerelease",
          "published_at": "2020-08-10T15:03:48Z"
        },
        {
          "tag": "v0.1.0-beta.4",
          "kind": "prerelease",
          "published_at": "2020-07-30T23:06:27Z"
        },
        {
          "tag": "v0.1.0-beta.3",
          "kind": "prerelease",
          "published_at": "2020-07-30T01:11:05Z"
        },
        {
          "tag": "v0.1.0-beta.2",
          "kind": "prerelease",
          "published_at": "2020-07-27T19:13:10Z"
        },
        {
          "tag": "v0.1.0-beta.1",
          "kind": "prerelease",
          "published_at": "2020-07-27T14:12:40Z"
        }
      ],
      "recent_commits": [
        {
          "oid": "b7d0257347a52bc31f5242365ff43bf1fe2e183b",
          "body": null,
          "is_bot": false,
          "headline": "Add some changes for testing",
          "author_name": "Josh Bressers",
          "author_login": "joshbressers",
          "committed_at": "2023-06-13T19:36:53Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "6a21a2f7503d5d411a82ded4c4ccc9b5ae828434",
          "body": "Signed-off-by: Josh Bressers <josh@bress.net>",
          "is_bot": false,
          "headline": "Update the contributing guide",
          "author_name": "Josh Bressers",
          "author_login": "joshbressers",
          "committed_at": "2023-06-12T21:06:38Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "c47304b7a2b6f79c82c4b580421a10dd1e572676",
          "body": "Signed-off-by: James Neate <jamesmneate@gmail.com>",
          "is_bot": false,
          "headline": "feat: add community template folder and new table template (#1343)",
          "author_name": "James Neate",
          "author_login": "jneate",
          "committed_at": "2023-06-09T15:33:20Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "e8143f2c946a5563f14d39a420df7f9f3762166a",
          "body": "Logs unsupported package qualifiers at `debug` level rather than\r\n`warning`.  The message is only meant to convey that there are new\r\nqualifiers available in grype-db that the version of grype being used\r\ncannot take advantage of to improve matching behavior; however, the\r\nwarning is confusing to users and may make it seem like grype is in a\r\nbroken state.\r\n\r\nSigned-off-by: Weston Steimel <weston.steimel@anchore.com>",
          "is_bot": false,
          "headline": "chore: log unsupported package qualifier as debug (#1340)",
          "author_name": "Weston Steimel",
          "author_login": "westonsteimel",
          "committed_at": "2023-06-08T21:02:07Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "844711285b22c0e6ac55fa7c3a20ecd9650aaf71",
          "body": "Signed-off-by: Weston Steimel <weston.steimel@anchore.com>",
          "is_bot": false,
          "headline": "feat: add package info to search by for all match details (#1339)",
          "author_name": "Weston Steimel",
          "author_login": "westonsteimel",
          "committed_at": "2023-06-06T18:32:50Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "3865f4cc1dfcdcefbb7009400df153f24b18c772",
          "body": "* chore(deps): update bootstrap tools to latest versions\r\n\r\nSigned-off-by: GitHub <noreply@github.com>\r\n\r\n* chore: dependency clean-up\r\n\r\nSigned-off-by: Christopher Phillips <christopher.phillips@anchore.com>\r\n\r\n* chore: fix s/a changes\r\n\r\nSigned-off-by: Christopher Phillips <christopher.phillips@an\n[…]\nChristopher Phillips <christopher.phillips@anchore.com>\r\nCo-authored-by: westonsteimel <westonsteimel@users.noreply.github.com>\r\nCo-authored-by: Christopher Phillips <christopher.phillips@anchore.com>",
          "is_bot": true,
          "headline": "chore(deps): update bootstrap tools to latest versions (#1334)",
          "author_name": "anchore-actions-token-generator[bot]",
          "author_login": "anchore-actions-token-generator[bot]",
          "committed_at": "2023-06-05T21:17:20Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "7f71f7f8495ce59314754018ccf956bb5154daab",
          "body": "Bumps [github.com/sirupsen/logrus](https://github.com/sirupsen/logrus) from 1.9.2 to 1.9.3.\r\n- [Release notes](https://github.com/sirupsen/logrus/releases)\r\n- [Changelog](https://github.com/sirupsen/logrus/blob/master/CHANGELOG.md)\r\n- [Commits](https://github.com/sirupsen/logrus/compare/v1.9.2...v1.\n[…]\n:production\r\n  update-type: version-update:semver-patch\r\n...\r\n\r\nSigned-off-by: dependabot[bot] <support@github.com>\r\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump github.com/sirupsen/logrus from 1.9.2 to 1.9.3 (#1336)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2023-06-05T16:50:01Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "dc9bc1ee04492cebdac001bd0d4431cb39d015d8",
          "body": "Bumps [github/codeql-action](https://github.com/github/codeql-action) from 2.3.5 to 2.3.6.\r\n- [Release notes](https://github.com/github/codeql-action/releases)\r\n- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)\r\n- [Commits](https://github.com/github/codeql-action/compare/\n[…]\n:production\r\n  update-type: version-update:semver-patch\r\n...\r\n\r\nSigned-off-by: dependabot[bot] <support@github.com>\r\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump github/codeql-action from 2.3.5 to 2.3.6 (#1331)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2023-06-01T19:41:37Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "c1f677261c4561aa9c7f329c61d5710e429a48ac",
          "body": "…#1322)\n\nSigned-off-by: James Tran <jamestran201@github.com>",
          "is_bot": false,
          "headline": "Hide suppressed vulnerabilities when --show-suppressed is not given (…",
          "author_name": "James Tran",
          "author_login": null,
          "committed_at": "2023-05-30T17:46:46Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "7c681d50599d8262d2d729dd42596090ff38fec4",
          "body": "…324)\n\nBumps [github.com/stretchr/testify](https://github.com/stretchr/testify) from 1.8.3 to 1.8.4.\r\n- [Release notes](https://github.com/stretchr/testify/releases)\r\n- [Commits](https://github.com/stretchr/testify/compare/v1.8.3...v1.8.4)\r\n\r\n---\r\nupdated-dependencies:\r\n- dependency-name: github.com\n[…]\n:production\r\n  update-type: version-update:semver-patch\r\n...\r\n\r\nSigned-off-by: dependabot[bot] <support@github.com>\r\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump github.com/stretchr/testify from 1.8.3 to 1.8.4 (#1…",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2023-05-30T16:42:46Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "8fbcb42619c04c3b683b9b6929df3766045f296c",
          "body": "Bumps [github.com/spf13/viper](https://github.com/spf13/viper) from 1.15.0 to 1.16.0.\r\n- [Release notes](https://github.com/spf13/viper/releases)\r\n- [Commits](https://github.com/spf13/viper/compare/v1.15.0...v1.16.0)\r\n\r\n---\r\nupdated-dependencies:\r\n- dependency-name: github.com/spf13/viper\r\n  depende\n[…]\n:production\r\n  update-type: version-update:semver-minor\r\n...\r\n\r\nSigned-off-by: dependabot[bot] <support@github.com>\r\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump github.com/spf13/viper from 1.15.0 to 1.16.0 (#1323)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2023-05-30T16:13:39Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "77eb4bb53fa6a3c7fb9ae37aa35da456159dab57",
          "body": "Adds source and type to the CVSS score information to allow\r\nidentification of the organization that submitted the score and whether\r\nthey are a primary or secondary source.\r\n\r\nSigned-off-by: Weston Steimel <weston.steimel@anchore.com>",
          "is_bot": false,
          "headline": "feat: add source and type to CVSS information (#1317)",
          "author_name": "Weston Steimel",
          "author_login": "westonsteimel",
          "committed_at": "2023-05-26T17:37:08Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "2d1dcd72dceb0187f03a9fd1527783042edf7965",
          "body": "Bumps [github.com/docker/docker](https://github.com/docker/docker) from 24.0.1+incompatible to 24.0.2+incompatible.\r\n- [Release notes](https://github.com/docker/docker/releases)\r\n- [Commits](https://github.com/docker/docker/compare/v24.0.1...v24.0.2)\r\n\r\n---\r\nupdated-dependencies:\r\n- dependency-name:\n[…]\n:production\r\n  update-type: version-update:semver-patch\r\n...\r\n\r\nSigned-off-by: dependabot[bot] <support@github.com>\r\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump github.com/docker/docker (#1320)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2023-05-26T16:39:51Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "ac67a27a87a454702193804164bc92a116c2bf16",
          "body": "Bumps [github/codeql-action](https://github.com/github/codeql-action) from 2.3.3 to 2.3.5.\r\n- [Release notes](https://github.com/github/codeql-action/releases)\r\n- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)\r\n- [Commits](https://github.com/github/codeql-action/compare/\n[…]\n:production\r\n  update-type: version-update:semver-patch\r\n...\r\n\r\nSigned-off-by: dependabot[bot] <support@github.com>\r\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump github/codeql-action from 2.3.3 to 2.3.5 (#1321)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2023-05-26T16:35:45Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "0f71006f622a3aa84fe70c0f2f05b7f399c373f0",
          "body": "* chore: update go mod with latest syft\r\n\r\n---------\r\n\r\nSigned-off-by: Christopher Phillips <christopher.phillips@anchore.com>",
          "is_bot": false,
          "headline": "chore: update gomod with latest syft (#1313)",
          "author_name": "Christopher Angelo Phillips",
          "author_login": "spiffcs",
          "committed_at": "2023-05-23T17:57:53Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "3b80916c23b9f4110af646c40a5b5d0e5d95ff6a",
          "body": "Bumps [github.com/docker/docker](https://github.com/docker/docker) from 24.0.0+incompatible to 24.0.1+incompatible.\r\n- [Release notes](https://github.com/docker/docker/releases)\r\n- [Commits](https://github.com/docker/docker/compare/v24.0.0...v24.0.1)\r\n\r\n---\r\nupdated-dependencies:\r\n- dependency-name:\n[…]\n:production\r\n  update-type: version-update:semver-patch\r\n...\r\n\r\nSigned-off-by: dependabot[bot] <support@github.com>\r\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump github.com/docker/docker (#1311)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2023-05-23T17:42:03Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "852a2084171281049ab9cf5134627abeeacf82b2",
          "body": "Signed-off-by: Alex Goodman <alex.goodman@anchore.com>",
          "is_bot": false,
          "headline": "bump syft to pre-release of v0.81.0 (#1310)",
          "author_name": "Alex Goodman",
          "author_login": "wagoodman",
          "committed_at": "2023-05-22T14:17:34Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "efb611d800aec6f64f0f71e129b23616a8a6fdff",
          "body": "Signed-off-by: guoguangwu <guoguangwu@magic-shield.com>",
          "is_bot": false,
          "headline": "add main bin ignore (#1305)",
          "author_name": "guangwu",
          "author_login": "testwill",
          "committed_at": "2023-05-22T13:14:31Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "1a3b92a3f150b27733660fb0056918e37981c815",
          "body": "…309)\n\nBumps [github.com/stretchr/testify](https://github.com/stretchr/testify) from 1.8.2 to 1.8.3.\r\n- [Release notes](https://github.com/stretchr/testify/releases)\r\n- [Commits](https://github.com/stretchr/testify/compare/v1.8.2...v1.8.3)\r\n\r\n---\r\nupdated-dependencies:\r\n- dependency-name: github.com\n[…]\n:production\r\n  update-type: version-update:semver-patch\r\n...\r\n\r\nSigned-off-by: dependabot[bot] <support@github.com>\r\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump github.com/stretchr/testify from 1.8.2 to 1.8.3 (#1…",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2023-05-22T13:13:30Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "e7fa9d6d506ea8daffe4b24db12100f77fcdf534",
          "body": "Bumps [github.com/docker/docker](https://github.com/docker/docker) from 23.0.6+incompatible to 24.0.0+incompatible.\r\n- [Release notes](https://github.com/docker/docker/releases)\r\n- [Commits](https://github.com/docker/docker/compare/v23.0.6...v24.0.0)\r\n\r\n---\r\nupdated-dependencies:\r\n- dependency-name:\n[…]\n:production\r\n  update-type: version-update:semver-major\r\n...\r\n\r\nSigned-off-by: dependabot[bot] <support@github.com>\r\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump github.com/docker/docker (#1304)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2023-05-19T15:41:10Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "f15b1fa1f8001730d7cc2027ccc161ea94ffd444",
          "body": "Bumps [github.com/sirupsen/logrus](https://github.com/sirupsen/logrus) from 1.9.0 to 1.9.2.\r\n- [Release notes](https://github.com/sirupsen/logrus/releases)\r\n- [Changelog](https://github.com/sirupsen/logrus/blob/master/CHANGELOG.md)\r\n- [Commits](https://github.com/sirupsen/logrus/compare/v1.9.0...v1.\n[…]\n:production\r\n  update-type: version-update:semver-patch\r\n...\r\n\r\nSigned-off-by: dependabot[bot] <support@github.com>\r\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump github.com/sirupsen/logrus from 1.9.0 to 1.9.2 (#1307)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2023-05-19T15:40:38Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "a153b3047b44c9b5c854be2b7969f2f5c1293122",
          "body": "…289)",
          "is_bot": true,
          "headline": "chore(deps): bump github.com/cloudflare/circl from 1.1.0 to 1.3.3 (#1…",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2023-05-17T13:45:58Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "e4b756eb34548a9ce779752ffb1247cf7484ba6d",
          "body": null,
          "is_bot": true,
          "headline": "chore(deps): bump github.com/docker/distribution (#1290)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2023-05-17T13:45:39Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "745dca977ca3d7833ff3d35659717e4c2fd2aff6",
          "body": null,
          "is_bot": true,
          "headline": "chore(deps): bump actions/setup-go from 4.0.0 to 4.0.1 (#1298)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2023-05-17T13:24:06Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "8220910b8303c0e4dba11282ec8b0e4d1f4f60f4",
          "body": "Signed-off-by: guoguangwu <guoguangwu@magic-shield.com>",
          "is_bot": false,
          "headline": "chore: update deprecated io/ioutil calls (#1296)",
          "author_name": "guangwu",
          "author_login": "testwill",
          "committed_at": "2023-05-17T13:23:31Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "d34b28193e61ae31468425c51b602cdd08e35fc8",
          "body": "This allows filtering vulnerability matches that are only applicable\r\nwhen running on specific platforms.  It currently supports filtering\r\nmatches that are only applicable for windows, debian, and ubuntu when\r\nthe underlying distro is known and does not match.\r\n\r\nAdditionally, wordpress platform ma\n[…]\n.  These are already\r\nfiltered when the target software component of the CPE is used\r\nrather than a running on platform CPE configuration.\r\n\r\nSigned-off-by: Weston Steimel <weston.steimel@anchore.com>",
          "is_bot": false,
          "headline": "feat: package qualifier for platform CPE (#1291)",
          "author_name": "Weston Steimel",
          "author_login": "westonsteimel",
          "committed_at": "2023-05-17T12:35:03Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "e1bdbc7d272bb74ebc2b766048ddd61e1d95dae8",
          "body": "I figured out that running `cat syft.json | grype` works but\r\n`grype < syft.json` does not work. This happens, because the\r\nIsPipedInput method only checks if stdin is a pipe which will be false\r\nif stdin is fed by a redirect.\r\n\r\nThe go idiomatic way to fix this is by just checking if the file\r\nprod\n[…]\nredirect, in the\r\nIsPipedInput() method. Renamed the method to IsStdinPipeOrRedirect().\r\n\r\nSigned-off-by: Felix Becker <git@felixbecker.name>\r\nCo-authored-by: Benjamin Neff <benjamin@coding4coffee.ch>",
          "is_bot": false,
          "headline": "Fix reading syft json from stdin by redirect (#1299)",
          "author_name": "devfbe",
          "author_login": "devfbe",
          "committed_at": "2023-05-16T19:41:43Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "d74e85385ca0e83d28e14d2a6851c21cdf805638",
          "body": "Signed-off-by: Alex Goodman <alex.goodman@anchore.com>",
          "is_bot": false,
          "headline": "should only use hermetic functions in templates (#1288)",
          "author_name": "Alex Goodman",
          "author_login": "wagoodman",
          "committed_at": "2023-05-11T19:09:25Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "2c9a1740e38f47ac2b7f8a9ce4ca0c4a9b9ba0d8",
          "body": null,
          "is_bot": true,
          "headline": "chore(deps): update bootstrap tools to latest versions (#1285)",
          "author_name": "anchore-actions-token-generator[bot]",
          "author_login": "anchore-actions-token-generator[bot]",
          "committed_at": "2023-05-10T12:26:15Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "0ace6b1a981ad2c72fa0e10e2fc6f79fdd237a58",
          "body": "Because the general set of sprig functions can used to access\r\nenvironment variables, explicitly warn users never to run untrusted\r\ntemplates.\r\n\r\n---------\r\n\r\nSigned-off-by: James Neate <jamesmneate@gmail.com>\r\nSigned-off-by: Will Murphy <will.murphy@anchore.com>\r\nCo-authored-by: Will Murphy <will.murphy@anchore.com>",
          "is_bot": false,
          "headline": "feat: add non-hermetic sprig functions (#1243) (#1273)",
          "author_name": "James Neate",
          "author_login": "jneate",
          "committed_at": "2023-05-08T21:14:45Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "6f779ec4249607f1c323ccb0258e446d9b21ff96",
          "body": "s/form-lib/from-lib\r\n\r\nSigned-off-by: Will Murphy <will.murphy@anchore.com>",
          "is_bot": false,
          "headline": "fix: typo in logger prefix (#1283)",
          "author_name": "William Murphy",
          "author_login": "willmurphyscode",
          "committed_at": "2023-05-08T21:03:14Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "75e7ef43cd03baba4c76af3751274c7aa7452f36",
          "body": null,
          "is_bot": true,
          "headline": "chore(deps): bump github.com/docker/docker (#1280)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2023-05-08T17:07:59Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "fce29858cb4e06c77bb1efca63b0c55f80a20113",
          "body": null,
          "is_bot": true,
          "headline": "chore(deps): bump anchore/sbom-action from 0.14.1 to 0.14.2 (#1281)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2023-05-08T17:07:35Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "f9df952a2d791ddfdcbeaa6008a9475f6e364357",
          "body": null,
          "is_bot": true,
          "headline": "chore(deps): update Syft to v0.80.0 (#1276)",
          "author_name": "anchore-actions-token-generator[bot]",
          "author_login": "anchore-actions-token-generator[bot]",
          "committed_at": "2023-05-07T17:57:12Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "cddc8bcfcc00cfa481d19a4ffe4fb4e2c9cd0429",
          "body": null,
          "is_bot": true,
          "headline": "chore(deps): update bootstrap tools to latest versions (#1277)",
          "author_name": "anchore-actions-token-generator[bot]",
          "author_login": "anchore-actions-token-generator[bot]",
          "committed_at": "2023-05-07T15:35:32Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "2930a187866a89cf6ddcae377032a70976a4c19d",
          "body": "Signed-off-by: James Neate <jamesmneate@gmail.com>",
          "is_bot": false,
          "headline": "docs: add config flag to configuration section (#1271) (#1274)",
          "author_name": "James Neate",
          "author_login": "jneate",
          "committed_at": "2023-05-05T22:58:21Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "8d47fedd54b6d2b40fce677b4ca35ef99eff6b12",
          "body": null,
          "is_bot": true,
          "headline": "chore(deps): bump github/codeql-action from 2.3.2 to 2.3.3 (#1272)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2023-05-05T18:55:27Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "eb337bf45e22f19d1645b012aae20e748c8ca83e",
          "body": null,
          "is_bot": true,
          "headline": "chore(deps): bump golang.org/x/term from 0.7.0 to 0.8.0 (#1268)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2023-05-05T15:43:13Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "01ad5a52cde3af0b3cb28bd175f038d89190cb51",
          "body": null,
          "is_bot": true,
          "headline": "chore(deps): update bootstrap tools to latest versions (#1270)",
          "author_name": "anchore-actions-token-generator[bot]",
          "author_login": "anchore-actions-token-generator[bot]",
          "committed_at": "2023-05-05T15:42:28Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "850a4acb05287d66ea82a92073bca1737f0b5044",
          "body": "* Add support for Syft IDs in output\r\n\r\nSigned-off-by: Dan Luhring <dluhring@chainguard.dev>\r\n\r\n* go mod tidy\r\n\r\nSigned-off-by: Dan Luhring <dluhring@chainguard.dev>\r\n\r\n* make lint-fix\r\n\r\nSigned-off-by: Dan Luhring <dluhring@chainguard.dev>\r\n\r\n* Convert map to for loop\r\n\r\nSigned-off-by: Dan Luhring <dluhring@chainguard.dev>\r\n\r\n---------\r\n\r\nSigned-off-by: Dan Luhring <dluhring@chainguard.dev>",
          "is_bot": false,
          "headline": "Add support for Syft IDs in JSON output (#1266)",
          "author_name": "Dan Luhring",
          "author_login": "luhring",
          "committed_at": "2023-05-05T13:47:04Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "9ba7a6a1adff96b1f938b68a668eef47a8cfcde5",
          "body": "Signed-off-by: HNKNTA <hnknta@gmail.com>",
          "is_bot": false,
          "headline": "docs: add \"cyclonedx-json\" to output formats (#1252)",
          "author_name": "HNKNTA",
          "author_login": "HNKNTA",
          "committed_at": "2023-05-02T21:20:47Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "74a5d6d4fce403eda3e0a4da0cec167f55adcfa2",
          "body": null,
          "is_bot": true,
          "headline": "chore(deps): bump github.com/docker/docker (#1257)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2023-05-02T20:34:19Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "7861b63981cfda166abed3cbb652b9eb258bbcbe",
          "body": null,
          "is_bot": true,
          "headline": "chore(deps): bump github/codeql-action from 2.3.1 to 2.3.2 (#1261)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2023-05-02T20:34:05Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "2e835eaebf15705d534510adf8bb7ac07c7bc6f7",
          "body": "… (#1263)",
          "is_bot": true,
          "headline": "chore(deps): bump peter-evans/create-pull-request from 5.0.0 to 5.0.1…",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2023-05-02T20:33:51Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "f0a09c0b9a58f06e67b595e3de27f5fbedb44af4",
          "body": "The \"make integration\" target assumes that skopeo will be available on\r\nPATH, but this wasn't documented. Install it during bootstrap when other\r\nutilities are installed. (See ./test/integration/utils_test.go:50).\r\nInclude a sample skopeo policy.json, otherwise skopeo will look for a\r\nmissing policy\n[…]\ne sample policy document matches the one included by default with\r\n\"brew install skopeo\".\r\n\r\nSigned-off-by: Will Murphy <will.murphy@anchore.com>\r\nCo-authored-by: Will Murphy <will.murphy@anchore.com>",
          "is_bot": false,
          "headline": "Install skopeo during bootstrap (#1260)",
          "author_name": "William Murphy",
          "author_login": "willmurphyscode",
          "committed_at": "2023-04-28T14:10:29Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "aa52d673d08ba1c91a650a3520f04f47ea02117d",
          "body": "Bumps [github/codeql-action](https://github.com/github/codeql-action) from 2.3.0 to 2.3.1.\r\n- [Release notes](https://github.com/github/codeql-action/releases)\r\n- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)\r\n- [Commits](https://github.com/github/codeql-action/compare/\n[…]\n:production\r\n  update-type: version-update:semver-patch\r\n...\r\n\r\nSigned-off-by: dependabot[bot] <support@github.com>\r\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump github/codeql-action from 2.3.0 to 2.3.1 (#1258)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2023-04-27T16:43:05Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "ae2fe4f0632cec102da60188c5ac56a75b39fd53",
          "body": "Bumps [github/codeql-action](https://github.com/github/codeql-action) from 2.2.12 to 2.3.0.\r\n- [Release notes](https://github.com/github/codeql-action/releases)\r\n- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)\r\n- [Commits](https://github.com/github/codeql-action/compare\n[…]\n:production\r\n  update-type: version-update:semver-minor\r\n...\r\n\r\nSigned-off-by: dependabot[bot] <support@github.com>\r\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump github/codeql-action from 2.2.12 to 2.3.0 (#1256)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2023-04-24T18:49:01Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "2cd2998d0e1fdaeac6ff6a54f3406d09c37bc163",
          "body": "Signed-off-by: Weston Steimel <weston.steimel@anchore.com>",
          "is_bot": false,
          "headline": "chore: update quality gate labels and add keycloak (#1255)",
          "author_name": "Weston Steimel",
          "author_login": "westonsteimel",
          "committed_at": "2023-04-24T11:38:46Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "dfa540f727454da3172bc0cc5b5bc36a925bbd04",
          "body": "Signed-off-by: Shane Dell <shanedell100@gmail.com>",
          "is_bot": false,
          "headline": "fix: false positive for purl provider for RPM without epoch (#1237)",
          "author_name": "Shane Dell",
          "author_login": "shanedell",
          "committed_at": "2023-04-21T17:12:49Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "3caabc87114a3e0cbfbac7770989bc81e2f5a957",
          "body": "Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>",
          "is_bot": false,
          "headline": "chore: bump syft to latest version v0.79.0 (#1250)",
          "author_name": "Christopher Angelo Phillips",
          "author_login": "spiffcs",
          "committed_at": "2023-04-21T16:58:02Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "04c0bc1bcde0b28600acd720447243307aca93b0",
          "body": "Signed-off-by: James Neate <jamesmneate@gmail.com>",
          "is_bot": false,
          "headline": "feat: add timestamp to json output (#1170) (#1249)",
          "author_name": "James Neate",
          "author_login": "jneate",
          "committed_at": "2023-04-21T16:18:30Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "b9fa68e3a939b3146d4a536583277a7c79e00e21",
          "body": "* chore(deps): update Syft to v0.78.0\r\n\r\nSigned-off-by: GitHub <noreply@github.com>\r\n\r\n* fix test location references and package types\r\n\r\nSigned-off-by: Alex Goodman <alex.goodman@anchore.com>\r\n\r\n---------\r\n\r\nSigned-off-by: GitHub <noreply@github.com>\r\nSigned-off-by: Alex Goodman <alex.goodman@anchore.com>\r\nCo-authored-by: kzantow <kzantow@users.noreply.github.com>\r\nCo-authored-by: Alex Goodman <alex.goodman@anchore.com>",
          "is_bot": true,
          "headline": "chore(deps): update Syft to v0.78.0 (#1242)",
          "author_name": "anchore-actions-token-generator[bot]",
          "author_login": "anchore-actions-token-generator[bot]",
          "committed_at": "2023-04-19T17:38:06Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "0bc86761f202a3d8694af8733d9c68c5ce30e661",
          "body": "Bumps [github.com/docker/docker](https://github.com/docker/docker) from 23.0.3+incompatible to 23.0.4+incompatible.\r\n- [Release notes](https://github.com/docker/docker/releases)\r\n- [Commits](https://github.com/docker/docker/compare/v23.0.3...v23.0.4)\r\n\r\n---\r\nupdated-dependencies:\r\n- dependency-name:\n[…]\n:production\r\n  update-type: version-update:semver-patch\r\n...\r\n\r\nSigned-off-by: dependabot[bot] <support@github.com>\r\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump github.com/docker/docker (#1241)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2023-04-18T16:57:38Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "764022936b5cf6379d8dbd6f65bcb4a42cdb2768",
          "body": "Signed-off-by: GitHub <noreply@github.com>\r\nCo-authored-by: westonsteimel <westonsteimel@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): update bootstrap tools to latest versions (#1239)",
          "author_name": "anchore-actions-token-generator[bot]",
          "author_login": "anchore-actions-token-generator[bot]",
          "committed_at": "2023-04-18T14:25:33Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "45d03b6df05382b1d78f776812f90ae86e2e829d",
          "body": "Bumps [github/codeql-action](https://github.com/github/codeql-action) from 2.2.11 to 2.2.12.\r\n- [Release notes](https://github.com/github/codeql-action/releases)\r\n- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)\r\n- [Commits](https://github.com/github/codeql-action/compar\n[…]\n:production\r\n  update-type: version-update:semver-patch\r\n...\r\n\r\nSigned-off-by: dependabot[bot] <support@github.com>\r\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump github/codeql-action from 2.2.11 to 2.2.12 (#1233)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2023-04-17T15:42:08Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "6477f328c8f9ae04b379956e300830006f6d908b",
          "body": "Signed-off-by: GitHub <noreply@github.com>\r\nCo-authored-by: westonsteimel <westonsteimel@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): update bootstrap tools to latest versions (#1238)",
          "author_name": "anchore-actions-token-generator[bot]",
          "author_login": "anchore-actions-token-generator[bot]",
          "committed_at": "2023-04-17T15:41:48Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "17f4917da153d331c42bfff05190a62f64ab425a",
          "body": "Signed-off-by: Alex Goodman <alex.goodman@anchore.com>",
          "is_bot": false,
          "headline": "add format make target (#1231)",
          "author_name": "Alex Goodman",
          "author_login": "wagoodman",
          "committed_at": "2023-04-12T18:37:44Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "5f7b4f2416050cf5c3d59372a658a1e4bf9073c6",
          "body": "Bumps [8398a7/action-slack](https://github.com/8398a7/action-slack) from 3.15.0 to 3.15.1.\r\n- [Release notes](https://github.com/8398a7/action-slack/releases)\r\n- [Commits](https://github.com/8398a7/action-slack/compare/bdc6f9de222d3b7518e6cf99c4f3410f653cfde3...fbd6aa58ba854a740e11a35d0df80cb5d12101\n[…]\n:production\r\n  update-type: version-update:semver-patch\r\n...\r\n\r\nSigned-off-by: dependabot[bot] <support@github.com>\r\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump 8398a7/action-slack from 3.15.0 to 3.15.1 (#1223)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2023-04-12T14:55:31Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "1f51229e17dbe08c0e0d266465d9b84df9aa7c8c",
          "body": "Bumps [github.com/docker/docker](https://github.com/docker/docker) from 23.0.2+incompatible to 23.0.3+incompatible.\r\n- [Release notes](https://github.com/docker/docker/releases)\r\n- [Commits](https://github.com/docker/docker/compare/v23.0.2...v23.0.3)\r\n\r\n---\r\nupdated-dependencies:\r\n- dependency-name:\n[…]\n:production\r\n  update-type: version-update:semver-patch\r\n...\r\n\r\nSigned-off-by: dependabot[bot] <support@github.com>\r\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump github.com/docker/docker (#1218)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2023-04-12T14:55:21Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "4b773c583e87134179a52f58bc11854611912f22",
          "body": "Bumps [github/codeql-action](https://github.com/github/codeql-action) from 2.2.9 to 2.2.11.\r\n- [Release notes](https://github.com/github/codeql-action/releases)\r\n- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)\r\n- [Commits](https://github.com/github/codeql-action/compare\n[…]\n:production\r\n  update-type: version-update:semver-patch\r\n...\r\n\r\nSigned-off-by: dependabot[bot] <support@github.com>\r\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump github/codeql-action from 2.2.9 to 2.2.11 (#1225)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2023-04-12T14:54:35Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "47ff457a363fd282b607c44a7cc9ac44095439e8",
          "body": "Signed-off-by: GitHub <noreply@github.com>\r\nCo-authored-by: westonsteimel <westonsteimel@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): update bootstrap tools to latest versions (#1227)",
          "author_name": "anchore-actions-token-generator[bot]",
          "author_login": "anchore-actions-token-generator[bot]",
          "committed_at": "2023-04-12T14:54:17Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "01cbc981983181be65189540956817070907e9ac",
          "body": "… (#1219)\n\nBumps [peter-evans/create-pull-request](https://github.com/peter-evans/create-pull-request) from 4.2.4 to 5.0.0.\r\n- [Release notes](https://github.com/peter-evans/create-pull-request/releases)\r\n- [Commits](https://github.com/peter-evans/create-pull-request/compare/38e0b6e68b4c852a5500a947\n[…]\n:production\r\n  update-type: version-update:semver-major\r\n...\r\n\r\nSigned-off-by: dependabot[bot] <support@github.com>\r\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump peter-evans/create-pull-request from 4.2.4 to 5.0.0…",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2023-04-05T23:07:58Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "2e8a63dba62f38c1abc257433cd5658232a74e5c",
          "body": "Bumps [golang.org/x/term](https://github.com/golang/term) from 0.6.0 to 0.7.0.\r\n- [Release notes](https://github.com/golang/term/releases)\r\n- [Commits](https://github.com/golang/term/compare/v0.6.0...v0.7.0)\r\n\r\n---\r\nupdated-dependencies:\r\n- dependency-name: golang.org/x/term\r\n  dependency-type: dire\n[…]\n:production\r\n  update-type: version-update:semver-minor\r\n...\r\n\r\nSigned-off-by: dependabot[bot] <support@github.com>\r\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump golang.org/x/term from 0.6.0 to 0.7.0 (#1217)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2023-04-05T23:05:38Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "cecad5c9c48ea27ae3adf0becb95b521c3199664",
          "body": "Bumps [github.com/spf13/cobra](https://github.com/spf13/cobra) from 1.6.1 to 1.7.0.\r\n- [Release notes](https://github.com/spf13/cobra/releases)\r\n- [Commits](https://github.com/spf13/cobra/compare/v1.6.1...v1.7.0)\r\n\r\n---\r\nupdated-dependencies:\r\n- dependency-name: github.com/spf13/cobra\r\n  dependency-\n[…]\n:production\r\n  update-type: version-update:semver-minor\r\n...\r\n\r\nSigned-off-by: dependabot[bot] <support@github.com>\r\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump github.com/spf13/cobra from 1.6.1 to 1.7.0 (#1216)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2023-04-04T18:32:16Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "d8c0c0805b59659c4d6e49d6806a0eba11bdc2ee",
          "body": "…1222100750-41a1ac565cce to 0.7.1 (#1213)\n\n* chore(deps): bump github.com/CycloneDX/cyclonedx-go\r\n\r\nBumps [github.com/CycloneDX/cyclonedx-go](https://github.com/CycloneDX/cyclonedx-go) from 0.7.1-0.20221222100750-41a1ac565cce to 0.7.1.\r\n- [Release notes](https://github.com/CycloneDX/cyclonedx-go/rel\n[…]\nhillips <christopher.phillips@anchore.com>\r\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>\r\nCo-authored-by: Christopher Phillips <christopher.phillips@anchore.com>",
          "is_bot": true,
          "headline": "chore(deps): bump github.com/CycloneDX/cyclonedx-go from 0.7.1-0.2022…",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2023-04-04T14:41:03Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "8dec5c37845094e4f6cd7eb7719a68472152a60f",
          "body": "#1204 surfaces the need for allowing a user to express a preference over the default-image-pull-source to be used when building an SBOM for vulnerability scanning.\r\n\r\nThis adds a config option into grype to consume the new syft behavior.\r\n\r\nSigned-off-by: Christopher Phillips <christopher.phillips@anchore.com>",
          "is_bot": false,
          "headline": "feat: add default-image-source-config option (#1215)",
          "author_name": "Christopher Angelo Phillips",
          "author_login": "spiffcs",
          "committed_at": "2023-04-04T14:28:33Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "0b306fae25f004ebdc6af4b8c641a6aa9b5a137f",
          "body": "…1212)\n\nBumps google.golang.org/protobuf from 1.29.0 to 1.29.1.\r\n\r\n---\r\nupdated-dependencies:\r\n- dependency-name: google.golang.org/protobuf\r\n  dependency-type: indirect\r\n...\r\n\r\nSigned-off-by: dependabot[bot] <support@github.com>\r\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump google.golang.org/protobuf from 1.29.0 to 1.29.1 (#…",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2023-04-03T18:36:40Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "537c47735c3faab2f5cb78fdb0375e8722860a69",
          "body": "Bumps [anchore/sbom-action](https://github.com/anchore/sbom-action) from 0.13.4 to 0.14.1.\r\n- [Release notes](https://github.com/anchore/sbom-action/releases)\r\n- [Commits](https://github.com/anchore/sbom-action/compare/448520c4f19577ffce70a8317e619089054687e3...422cb34a0f8b599678c41b21163ea6088edb26\n[…]\n:production\r\n  update-type: version-update:semver-minor\r\n...\r\n\r\nSigned-off-by: dependabot[bot] <support@github.com>\r\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump anchore/sbom-action from 0.13.4 to 0.14.1 (#1214)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2023-04-03T18:35:56Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "147f5cf92f61ba6273663fea49a5eaed51fcd562",
          "body": "* chore(deps): bump github.com/anchore/syft from 0.75.0 to 0.76.0\r\n\r\nBumps [github.com/anchore/syft](https://github.com/anchore/syft) from 0.75.0 to 0.76.0.\r\n- [Release notes](https://github.com/anchore/syft/releases)\r\n- [Changelog](https://github.com/anchore/syft/blob/main/.goreleaser.yaml)\r\n- [Com\n[…]\nhillips <christopher.phillips@anchore.com>\r\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>\r\nCo-authored-by: Christopher Phillips <christopher.phillips@anchore.com>",
          "is_bot": true,
          "headline": "chore(deps): bump github.com/anchore/syft from 0.75.0 to 0.76.0 (#1207)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2023-04-03T14:48:33Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "b9e40306d20b55350d8f915a5314657ace260653",
          "body": "Signed-off-by: Keith Zantow <kzantow@gmail.com>",
          "is_bot": false,
          "headline": "chore: update syft update (#1211)",
          "author_name": "Keith Zantow",
          "author_login": "kzantow",
          "committed_at": "2023-04-03T14:28:53Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "f40b5d43abeaaeb7d02502536530d662cebdc2c1",
          "body": "Signed-off-by: Keith Zantow <kzantow@gmail.com>",
          "is_bot": false,
          "headline": "chore: update deprecated set-output calls (#1210)",
          "author_name": "Keith Zantow",
          "author_login": "kzantow",
          "committed_at": "2023-04-03T13:36:18Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "e5cb58f597e61ecd975c8ce4c5b5d7e4210056b9",
          "body": "Bumps [ossf/scorecard-action](https://github.com/ossf/scorecard-action) from 2.1.2 to 2.1.3.\r\n- [Release notes](https://github.com/ossf/scorecard-action/releases)\r\n- [Changelog](https://github.com/ossf/scorecard-action/blob/main/RELEASE.md)\r\n- [Commits](https://github.com/ossf/scorecard-action/compa\n[…]\n:production\r\n  update-type: version-update:semver-patch\r\n...\r\n\r\nSigned-off-by: dependabot[bot] <support@github.com>\r\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump ossf/scorecard-action from 2.1.2 to 2.1.3 (#1205)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2023-03-31T13:39:00Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "b2bd709e6db2466e400967a524b8c0130bb710f0",
          "body": "Signed-off-by: Weston Steimel <weston.steimel@anchore.com>",
          "is_bot": false,
          "headline": "chore: update quality gate dataset (#1206)",
          "author_name": "Weston Steimel",
          "author_login": "westonsteimel",
          "committed_at": "2023-03-31T12:16:59Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "7614621b1de9837abc9eb98c4df3df0c32f1a821",
          "body": "Bumps [github.com/docker/docker](https://github.com/docker/docker) from 23.0.1+incompatible to 23.0.2+incompatible.\r\n- [Release notes](https://github.com/docker/docker/releases)\r\n- [Commits](https://github.com/docker/docker/compare/v23.0.1...v23.0.2)\r\n\r\n---\r\nupdated-dependencies:\r\n- dependency-name:\n[…]\n:production\r\n  update-type: version-update:semver-patch\r\n...\r\n\r\nSigned-off-by: dependabot[bot] <support@github.com>\r\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump github.com/docker/docker (#1201)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2023-03-29T13:59:00Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "45c5f8c9c709e53ba5f40b8ef59b9dd9dfd0b569",
          "body": "Signed-off-by: Dan Luhring <dluhring@chainguard.dev>",
          "is_bot": false,
          "headline": "Implement support for Chainguard Linux (#1198)",
          "author_name": "Dan Luhring",
          "author_login": "luhring",
          "committed_at": "2023-03-28T14:52:33Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "dfcce84cdbfcd45ec1d6c2e5046ee063d325096e",
          "body": "Signed-off-by: GitHub <noreply@github.com>\r\nCo-authored-by: westonsteimel <westonsteimel@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): update bootstrap tools to latest versions (#1194)",
          "author_name": "anchore-actions-token-generator[bot]",
          "author_login": "anchore-actions-token-generator[bot]",
          "committed_at": "2023-03-27T16:51:53Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "fe76eb9efc8c14805782e6b363a8a1f3a1c04d33",
          "body": "Bumps [github/codeql-action](https://github.com/github/codeql-action) from 2.2.8 to 2.2.9.\r\n- [Release notes](https://github.com/github/codeql-action/releases)\r\n- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)\r\n- [Commits](https://github.com/github/codeql-action/compare/\n[…]\n:production\r\n  update-type: version-update:semver-patch\r\n...\r\n\r\nSigned-off-by: dependabot[bot] <support@github.com>\r\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump github/codeql-action from 2.2.8 to 2.2.9 (#1197)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2023-03-27T16:51:20Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "b3eff0c2d882aa3ef5acbf9a57a0da287d529b9a",
          "body": null,
          "is_bot": true,
          "headline": "chore(deps): bump github.com/gookit/color from 1.5.2 to 1.5.3 (#1192)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2023-03-24T11:49:36Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "4ac94147a4e72fcfccbb72c25df2c028e732d503",
          "body": null,
          "is_bot": true,
          "headline": "chore(deps): bump github/codeql-action from 2.2.7 to 2.2.8 (#1193)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2023-03-24T11:49:13Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "c1990daed11f3e43b0792aa9b81b15ffe689e10e",
          "body": null,
          "is_bot": true,
          "headline": "chore(deps): update bootstrap tools to latest versions (#1191)",
          "author_name": "anchore-actions-token-generator[bot]",
          "author_login": "anchore-actions-token-generator[bot]",
          "committed_at": "2023-03-22T13:00:47Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "c1bc54f9439f1b5611bce01217eb9d7bb370891e",
          "body": "Signed-off-by: Keith Zantow <kzantow@gmail.com>",
          "is_bot": false,
          "headline": "chore: tweak some workflow text (#1190)",
          "author_name": "Keith Zantow",
          "author_login": "kzantow",
          "committed_at": "2023-03-21T15:09:10Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "6716ca5e241ef861c1657eb7e9f4b7ab1e3ad222",
          "body": "…(#1181)",
          "is_bot": true,
          "headline": "chore(deps): bump github.com/hashicorp/go-getter from 1.7.0 to 1.7.1 …",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2023-03-21T13:51:55Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "568b504a7efcd583e8c5edf2ce74e6c01b24d700",
          "body": "… (#1184)",
          "is_bot": true,
          "headline": "chore(deps): bump peter-evans/create-pull-request from 4.2.3 to 4.2.4…",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2023-03-21T13:51:27Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "e8fa509e720ac1519f2e94cf7d30789afa689a6c",
          "body": null,
          "is_bot": true,
          "headline": "chore(deps): bump anchore/sbom-action from 0.13.3 to 0.13.4 (#1189)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2023-03-21T13:50:56Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "353bc87bb2ca590e5a4822273e715c5fd652dadb",
          "body": null,
          "is_bot": true,
          "headline": "chore: Update grype bootstrap tools to latest versions. (#1187)",
          "author_name": "anchore-actions-token-generator[bot]",
          "author_login": "anchore-actions-token-generator[bot]",
          "committed_at": "2023-03-21T13:36:06Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "b996cbe29bf34ca4e390ee0566e0c087a62c4055",
          "body": "…#1188)\n\nSigned-off-by: Weston Steimel <weston.steimel@anchore.com>",
          "is_bot": false,
          "headline": "fix: by-cpe pivot by vuln metadata rather than vulnerability record (…",
          "author_name": "Weston Steimel",
          "author_login": "westonsteimel",
          "committed_at": "2023-03-20T14:39:46Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "0bc0aa76a1f7139311771fc31c7fb79a4a809a91",
          "body": "Signed-off-by: GitHub <noreply@github.com>\r\nCo-authored-by: westonsteimel <westonsteimel@users.noreply.github.com>",
          "is_bot": true,
          "headline": "Update grype bootstrap tools to latest versions. (#1173)",
          "author_name": "anchore-actions-token-generator[bot]",
          "author_login": "anchore-actions-token-generator[bot]",
          "committed_at": "2023-03-15T21:20:06Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "96cbcad484ca0c7408bda0ceb42752683183c469",
          "body": "Bumps [actions/setup-go](https://github.com/actions/setup-go) from 3.5.0 to 4.0.0.\r\n- [Release notes](https://github.com/actions/setup-go/releases)\r\n- [Commits](https://github.com/actions/setup-go/compare/6edd4406fa81c3da01a34fa6f6343087c207a568...4d34df0c2316fe8122ab82dc22947d607c0c91f9)\r\n\r\n---\r\nup\n[…]\n:production\r\n  update-type: version-update:semver-major\r\n...\r\n\r\nSigned-off-by: dependabot[bot] <support@github.com>\r\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump actions/setup-go from 3.5.0 to 4.0.0 (#1182)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2023-03-15T21:19:41Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "0cc8b9e4f6315e63f90b9542eae405310bca3a02",
          "body": "Bumps [github/codeql-action](https://github.com/github/codeql-action) from 2.2.5 to 2.2.7.\r\n- [Release notes](https://github.com/github/codeql-action/releases)\r\n- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)\r\n- [Commits](https://github.com/github/codeql-action/compare/\n[…]\n:production\r\n  update-type: version-update:semver-patch\r\n...\r\n\r\nSigned-off-by: dependabot[bot] <support@github.com>\r\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump github/codeql-action from 2.2.5 to 2.2.7 (#1183)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2023-03-15T21:19:12Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "52f724f7859e88d0572b5ebbaf8f59491a5262ad",
          "body": "* feat: disable CPE-based matching by default for javascript\r\n\r\nSigned-off-by: Weston Steimel <weston.steimel@anchore.com>\r\n\r\n* chore: bump vuln match label dataset\r\n\r\nSigned-off-by: Weston Steimel <weston.steimel@anchore.com>\r\n\r\n---------\r\n\r\nSigned-off-by: Weston Steimel <weston.steimel@anchore.com>",
          "is_bot": false,
          "headline": "feat: disable CPE-based matching by default for javascript (#1180)",
          "author_name": "Weston Steimel",
          "author_login": "westonsteimel",
          "committed_at": "2023-03-14T16:34:41Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "6da09d4fda2078be86f29b2f4d4a238f3d731c80",
          "body": "Signed-off-by: GitHub <noreply@github.com>\r\nCo-authored-by: kzantow <kzantow@users.noreply.github.com>",
          "is_bot": true,
          "headline": "Update Syft to v0.75.0 (#1177)",
          "author_name": "anchore-actions-token-generator[bot]",
          "author_login": "anchore-actions-token-generator[bot]",
          "committed_at": "2023-03-14T08:47:20Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "c3fc8cba63671942a52e9f0dc6560e1f3c06fcad",
          "body": "Signed-off-by: Weston Steimel <weston.steimel@anchore.com>",
          "is_bot": false,
          "headline": "chore: bump vuln match quality dataset (#1174)",
          "author_name": "Weston Steimel",
          "author_login": "westonsteimel",
          "committed_at": "2023-03-13T19:36:26Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "3a4d01b59c20464bf0596aee238ea65c5fd8b3e1",
          "body": "…4.2 (#1166)\n\nBumps [github.com/gabriel-vasile/mimetype](https://github.com/gabriel-vasile/mimetype) from 1.4.1 to 1.4.2.\r\n- [Release notes](https://github.com/gabriel-vasile/mimetype/releases)\r\n- [Commits](https://github.com/gabriel-vasile/mimetype/compare/v1.4.1...v1.4.2)\r\n\r\n---\r\nupdated-dependenc\n[…]\n:production\r\n  update-type: version-update:semver-patch\r\n...\r\n\r\nSigned-off-by: dependabot[bot] <support@github.com>\r\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump github.com/gabriel-vasile/mimetype from 1.4.1 to 1.…",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2023-03-09T15:06:26Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "29b646568901d1ef48a528cf35f67f3cead49c9f",
          "body": "Signed-off-by: GitHub <noreply@github.com>\r\nCo-authored-by: westonsteimel <westonsteimel@users.noreply.github.com>",
          "is_bot": true,
          "headline": "Update grype bootstrap tools to latest versions. (#1163)",
          "author_name": "anchore-actions-token-generator[bot]",
          "author_login": "anchore-actions-token-generator[bot]",
          "committed_at": "2023-03-09T14:41:19Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "2bc4c35142e6c4cec46ae9706e01372b450e77ea",
          "body": "Signed-off-by: GitHub <noreply@github.com>\r\nCo-authored-by: kzantow <kzantow@users.noreply.github.com>",
          "is_bot": true,
          "headline": "Update Syft to v0.74.1 (#1168)",
          "author_name": "anchore-actions-token-generator[bot]",
          "author_login": "anchore-actions-token-generator[bot]",
          "committed_at": "2023-03-09T14:37:02Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "6a46070cb1f4b91db5ac9e72b6268d3f01842f20",
          "body": "Previously, the -r{buildindex} suffix of APK package versions were\r\ntreated as pre-release versions per the fuzzy matcher logic; however,\r\nthese should be treated as equivalent to the release version for the\r\npurposes of collecting CPE-based matches for APK packages.\r\n\r\nWe may want to make a similar\n[…]\nenerate cleaner CPE\r\nversions for APK packages, but making the change in grype corrects\r\nbehaviour for previously-generated SBOMs as well.\r\n\r\nSigned-off-by: Weston Steimel <weston.steimel@anchore.com>",
          "is_bot": false,
          "headline": "fix: correct APK CPE version comparison logic (#1165)",
          "author_name": "Weston Steimel",
          "author_login": "westonsteimel",
          "committed_at": "2023-03-08T14:36:56Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "5754360376ace11befb1bd9fa4b0f97d79ea2344",
          "body": "- Remove old apple signing flow in favor of [quill](https://github.com/anchore/quill)\r\n- Update changelog generation to be in sync with syft's flow\r\n- Remove old goreleaser docker workflow in favor of single file\r\n- Remove individual bootstrap options in favor of single bootstrap action\r\n- Update re\n[…]\nerns\r\n- Remove unused Dockerfile.dev\r\n- Remove docker-compose development cycle\r\n- Add organized test-fixture Makefile targets\r\n\r\nSigned-off-by: Christopher Phillips <christopher.phillips@anchore.com>",
          "is_bot": false,
          "headline": "Grype Release Pipeline Update (#1147)",
          "author_name": "Christopher Angelo Phillips",
          "author_login": "spiffcs",
          "committed_at": "2023-03-03T21:17:44Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "b88e96115912ccd9b61317c76165fc1856bad64a",
          "body": "* Add the total types of vulnerabilities in Grype output\r\n\r\nSigned-off-by: Maxim Zhiburt <zhiburt@gmail.com>\r\nSigned-off-by: Christopher Phillips <christopher.phillips@anchore.com>\r\nSigned-off-by: Albert Simon <simon.albert75@gmail.com>\r\nSigned-off-by: Alex Goodman <alex.goodman@anchore.com>",
          "is_bot": false,
          "headline": "Add the total types of vulnerabilities in Grype output (#946)",
          "author_name": "Maxim Zhiburt",
          "author_login": "zhiburt",
          "committed_at": "2023-03-03T20:38:29Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "8076863582c583fd828c50bbbcbbdd8ae718a0a0",
          "body": "Bumps [gorm.io/gorm](https://github.com/go-gorm/gorm) from 1.23.5 to 1.23.10.\r\n- [Release notes](https://github.com/go-gorm/gorm/releases)\r\n- [Commits](https://github.com/go-gorm/gorm/compare/v1.23.5...v1.23.10)\r\n\r\n---\r\nupdated-dependencies:\r\n- dependency-name: gorm.io/gorm\r\n  dependency-type: direc\n[…]\n:production\r\n  update-type: version-update:semver-patch\r\n...\r\n\r\nSigned-off-by: dependabot[bot] <support@github.com>\r\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump gorm.io/gorm from 1.23.5 to 1.23.10 (#1157)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2023-03-03T17:26:49Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "adad97628e7adfc3ad690ecefe8643285d2d1b06",
          "body": "Signed-off-by: Weston Steimel <weston.steimel@anchore.com>",
          "is_bot": false,
          "headline": "chore: bump quality gate labels and syft version (#1156)",
          "author_name": "Weston Steimel",
          "author_login": "westonsteimel",
          "committed_at": "2023-03-02T20:06:38Z",
          "body_truncated": false,
          "is_coding_agent": false
        }
      ],
      "releases_count": 38,
      "commits_last_year": 0,
      "latest_release_at": "2021-10-06T13:59:36Z",
      "latest_release_tag": "v0.23.0",
      "releases_from_tags": true,
      "days_since_last_push": 1137,
      "active_weeks_last_year": 0,
      "days_since_latest_release": 1752,
      "mean_days_between_releases": 10.9
    },
    "community": {
      "has_readme": false,
      "has_license": false,
      "has_description": false,
      "has_contributing": false,
      "health_percentage": null,
      "has_issue_template": false,
      "has_code_of_conduct": false,
      "has_pull_request_template": false
    },
    "ecosystem": {
      "packages": [
        {
          "name": "github.com/anchore/grype",
          "exists": true,
          "license": null,
          "keywords": [],
          "ecosystem": "go",
          "matches_repo": false,
          "registry_url": "https://pkg.go.dev/github.com/anchore/grype",
          "is_deprecated": false,
          "latest_version": "v0.116.0",
          "repository_url": "https://github.com/anchore/grype",
          "versions_count": 209,
          "total_downloads": null,
          "dependents_count": null,
          "deprecation_note": null,
          "maintainers_count": null,
          "monthly_downloads": null,
          "first_published_at": null,
          "latest_published_at": "2026-07-16T16:02:15Z",
          "latest_version_yanked": null,
          "days_since_latest_publish": 8
        }
      ]
    },
    "popularity": {
      "forks": 0,
      "stars": 0,
      "watchers": 0,
      "fork_history": {
        "days": [],
        "complete": true,
        "collected": 0,
        "total_forks": 0
      },
      "star_history": {
        "days": [],
        "complete": true,
        "collected": 0,
        "total_stars": 0,
        "collected_at": null
      },
      "open_issues_and_prs": 0
    },
    "ai_readiness": {
      "has_nix": false,
      "example_dirs": [],
      "has_llms_txt": false,
      "has_dockerfile": true,
      "has_mcp_signal": false,
      "bootstrap_files": [
        "Makefile",
        "grype/db/test-fixtures/tls/Makefile",
        "schema/cyclonedx/Makefile",
        "test/cli/test-fixtures/Makefile",
        "test/install/Makefile",
        "test/integration/test-fixtures/Makefile",
        "test/quality/Makefile"
      ],
      "api_schema_files": [],
      "has_devcontainer": false,
      "typecheck_configs": [],
      "toolchain_manifests": [
        "go.mod",
        "test/integration/test-fixtures/image-debian-match-coverage/golang/go.mod"
      ],
      "largest_source_bytes": 33193,
      "source_files_sampled": 400,
      "oversized_source_files": 0,
      "agent_instruction_files": [],
      "agent_instruction_max_bytes": null
    },
    "dependencies": {
      "manifests": [
        "go.mod"
      ],
      "advisories": {
        "error": null,
        "scope": null,
        "source": null,
        "findings": [],
        "collected": false,
        "malicious": [],
        "truncated": false,
        "by_severity": {},
        "advisory_count": 0,
        "affected_count": 0,
        "assessed_count": 0,
        "malicious_count": 0,
        "assessed_package": null,
        "unassessed_count": 0,
        "direct_affected_count": 0
      },
      "ecosystems": [
        "go"
      ],
      "dependencies": [
        {
          "name": "github.com/CycloneDX/cyclonedx-go",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.7.1"
        },
        {
          "name": "github.com/Masterminds/sprig/v3",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v3.2.3"
        },
        {
          "name": "github.com/acarl005/stripansi",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.0.0-20180116102854-5a71ef0e047d"
        },
        {
          "name": "github.com/adrg/xdg",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.4.0"
        },
        {
          "name": "github.com/anchore/go-testutils",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.0.0-20200925183923-d5f45b0d3c04"
        },
        {
          "name": "github.com/anchore/go-version",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.2.2-0.20210903204242-51efa5b487c4"
        },
        {
          "name": "github.com/anchore/packageurl-go",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.1.1-0.20230104203445-02e0a6721501"
        },
        {
          "name": "github.com/anchore/stereoscope",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.0.0-20230522170632-e14bc4437b2e"
        },
        {
          "name": "github.com/bmatcuk/doublestar/v2",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v2.0.4"
        },
        {
          "name": "github.com/docker/docker",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v24.0.2+incompatible"
        },
        {
          "name": "github.com/dustin/go-humanize",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.0.1"
        },
        {
          "name": "github.com/facebookincubator/nvdtools",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.1.5"
        },
        {
          "name": "github.com/gabriel-vasile/mimetype",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.4.2"
        },
        {
          "name": "github.com/go-test/deep",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.1.0"
        },
        {
          "name": "github.com/google/go-cmp",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.5.9"
        },
        {
          "name": "github.com/google/uuid",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.3.0"
        },
        {
          "name": "github.com/gookit/color",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.5.3"
        },
        {
          "name": "github.com/hashicorp/go-cleanhttp",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.5.2"
        },
        {
          "name": "github.com/hashicorp/go-getter",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.7.1"
        },
        {
          "name": "github.com/hashicorp/go-multierror",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.1.1"
        },
        {
          "name": "github.com/hashicorp/go-version",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.6.0"
        },
        {
          "name": "github.com/knqyf263/go-apk-version",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.0.0-20200609155635-041fdbb8563f"
        },
        {
          "name": "github.com/knqyf263/go-deb-version",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.0.0-20190517075300-09fca494f03d"
        },
        {
          "name": "github.com/mholt/archiver/v3",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v3.5.1"
        },
        {
          "name": "github.com/mitchellh/go-homedir",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.1.0"
        },
        {
          "name": "github.com/mitchellh/hashstructure/v2",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v2.0.2"
        },
        {
          "name": "github.com/olekukonko/tablewriter",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.0.5"
        },
        {
          "name": "github.com/owenrumney/go-sarif",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.1.1"
        },
        {
          "name": "github.com/pkg/profile",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.7.0"
        },
        {
          "name": "github.com/scylladb/go-set",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.0.3-0.20200225121959-cc7b2070d91e"
        },
        {
          "name": "github.com/sergi/go-diff",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.3.1"
        },
        {
          "name": "github.com/sirupsen/logrus",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.9.3"
        },
        {
          "name": "github.com/spf13/afero",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.9.5"
        },
        {
          "name": "github.com/spf13/cobra",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.7.0"
        },
        {
          "name": "github.com/spf13/pflag",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.0.5"
        },
        {
          "name": "github.com/spf13/viper",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.16.0"
        },
        {
          "name": "github.com/stretchr/testify",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.8.4"
        },
        {
          "name": "github.com/wagoodman/go-partybus",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.0.0-20210627031916-db1f5573bbc5"
        },
        {
          "name": "github.com/wagoodman/go-progress",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.0.0-20230301185719-21920a456ad5"
        },
        {
          "name": "github.com/wagoodman/jotframe",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.0.0-20211129225309-56b0d0a4aebb"
        },
        {
          "name": "github.com/x-cray/logrus-prefixed-formatter",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.5.2"
        },
        {
          "name": "golang.org/x/term",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.8.0"
        },
        {
          "name": "gopkg.in/yaml.v2",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v2.4.0"
        },
        {
          "name": "gorm.io/gorm",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.23.10"
        },
        {
          "name": "github.com/anchore/go-logger",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.0.0-20220728155337-03b66a5207d8"
        },
        {
          "name": "github.com/anchore/sqlite",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.4.6-0.20220607210448-bcc6ee5c4963"
        },
        {
          "name": "github.com/anchore/syft",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.83.0"
        },
        {
          "name": "github.com/hako/durafmt",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.0.0-20210608085754-5c1018a4e16b"
        },
        {
          "name": "github.com/mitchellh/mapstructure",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.5.0"
        }
      ],
      "all_dependencies": {
        "error": "GitHub dependency-graph SBOM unavailable (404); the dependency graph may be disabled for this repository",
        "source": null,
        "packages": [],
        "collected": false,
        "truncated": false,
        "total_count": null,
        "direct_count": null,
        "indirect_count": null
      }
    },
    "maintainership": {
      "issues": {
        "open_prs": 0,
        "merged_prs": 0,
        "open_issues": 0,
        "closed_ratio": null,
        "closed_issues": 0,
        "closed_unmerged_prs": 0
      },
      "bus_factor": 2,
      "bot_contributors": 2,
      "top_contributors": [
        {
          "type": "User",
          "login": "wagoodman",
          "commits": 331,
          "avatar_url": "https://avatars.githubusercontent.com/u/590471?v=4"
        },
        {
          "type": "User",
          "login": "luhring",
          "commits": 88,
          "avatar_url": "https://avatars.githubusercontent.com/u/5199289?v=4"
        },
        {
          "type": "User",
          "login": "spiffcs",
          "commits": 73,
          "avatar_url": "https://avatars.githubusercontent.com/u/32073428?v=4"
        },
        {
          "type": "User",
          "login": "kzantow",
          "commits": 42,
          "avatar_url": "https://avatars.githubusercontent.com/u/3009477?v=4"
        },
        {
          "type": "User",
          "login": "westonsteimel",
          "commits": 39,
          "avatar_url": "https://avatars.githubusercontent.com/u/1593939?v=4"
        },
        {
          "type": "User",
          "login": "cpendery",
          "commits": 16,
          "avatar_url": "https://avatars.githubusercontent.com/u/35637443?v=4"
        },
        {
          "type": "User",
          "login": "jonasagx",
          "commits": 11,
          "avatar_url": "https://avatars.githubusercontent.com/u/774704?v=4"
        },
        {
          "type": "User",
          "login": "Vijay-P",
          "commits": 6,
          "avatar_url": "https://avatars.githubusercontent.com/u/15178387?v=4"
        },
        {
          "type": "User",
          "login": "jneate",
          "commits": 4,
          "avatar_url": "https://avatars.githubusercontent.com/u/14006260?v=4"
        },
        {
          "type": "User",
          "login": "joycebrum",
          "commits": 3,
          "avatar_url": "https://avatars.githubusercontent.com/u/22223372?v=4"
        }
      ],
      "contributors_sampled": 56,
      "top_contributor_share": 0.488
    },
    "quality_signals": {
      "has_ci": true,
      "has_tests": true,
      "ci_workflows": [
        "codeql-analysis.yml",
        "release.yaml",
        "scorecards.yml",
        "update-bootstrap-tools.yml",
        "update-syft-release.yml",
        "validations.yaml"
      ],
      "has_docs_dir": false,
      "linter_configs": [
        ".golangci.yaml"
      ],
      "has_editorconfig": false,
      "has_linter_config": true,
      "has_precommit_config": false
    },
    "security_signals": {
      "lockfiles": [
        "Gemfile.lock",
        "go.sum"
      ],
      "scorecard": {
        "checks": [
          {
            "name": "Binary-Artifacts",
            "score": 9,
            "reason": "binaries present in source code",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#binary-artifacts"
          },
          {
            "name": "Branch-Protection",
            "score": 0,
            "reason": "branch protection not enabled on development/release branches",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#branch-protection"
          },
          {
            "name": "CI-Tests",
            "score": null,
            "reason": "no pull request found",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#ci-tests"
          },
          {
            "name": "CII-Best-Practices",
            "score": 0,
            "reason": "no effort to earn an OpenSSF best practices badge detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#cii-best-practices"
          },
          {
            "name": "Code-Review",
            "score": 0,
            "reason": "Found 0/30 approved changesets -- score normalized to 0",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#code-review"
          },
          {
            "name": "Contributors",
            "score": 10,
            "reason": "project has 7 contributing companies or organizations",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#contributors"
          },
          {
            "name": "Dangerous-Workflow",
            "score": 10,
            "reason": "no dangerous workflow patterns detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dangerous-workflow"
          },
          {
            "name": "Dependency-Update-Tool",
            "score": 10,
            "reason": "update tool detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dependency-update-tool"
          },
          {
            "name": "Fuzzing",
            "score": 0,
            "reason": "project is not fuzzed",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#fuzzing"
          },
          {
            "name": "License",
            "score": 10,
            "reason": "license file detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#license"
          },
          {
            "name": "Maintained",
            "score": 0,
            "reason": "0 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 0",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#maintained"
          },
          {
            "name": "Packaging",
            "score": null,
            "reason": "packaging workflow not detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#packaging"
          },
          {
            "name": "Pinned-Dependencies",
            "score": 6,
            "reason": "dependency not pinned by hash detected -- score normalized to 6",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#pinned-dependencies"
          },
          {
            "name": "SAST",
            "score": 10,
            "reason": "SAST tool detected: CodeQL",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#sast"
          },
          {
            "name": "Security-Policy",
            "score": 10,
            "reason": "security policy file detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#security-policy"
          },
          {
            "name": "Signed-Releases",
            "score": null,
            "reason": "no releases found",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#signed-releases"
          },
          {
            "name": "Token-Permissions",
            "score": 0,
            "reason": "detected GitHub workflow tokens with excessive permissions",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#token-permissions"
          },
          {
            "name": "Vulnerabilities",
            "score": 0,
            "reason": "93 existing vulnerabilities detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#vulnerabilities"
          }
        ],
        "commit": "b7d0257347a52bc31f5242365ff43bf1fe2e183b",
        "ran_at": "2026-07-25T11:26:34Z",
        "aggregate_score": 4.7,
        "scorecard_version": "v5.5.0"
      },
      "has_codeql_workflow": true,
      "has_security_policy": true,
      "has_dependabot_config": true
    },
    "contribution_flow": {
      "collected": true,
      "ci_last_run_at": null,
      "oldest_open_prs": [],
      "last_merged_pr_at": null,
      "ci_last_conclusion": null,
      "oldest_open_issues": []
    }
  },
  "config": {
    "disabled_metrics": [],
    "disabled_categories": [],
    "disabled_components": {}
  },
  "source": {
    "url": "https://github.com/joshbressers/grype",
    "host": "github.com",
    "name": "grype",
    "owner": "joshbressers"
  },
  "metrics": {
    "overall": {
      "key": "overall",
      "band": "at_risk",
      "name": "Overall health",
      "note": "Abandonment Policy applies a 85% multiplier to weighted overall health.",
      "notes": [
        {
          "code": "abandonment_overall_adjustment",
          "params": {
            "cap": 0,
            "pct": 85
          }
        }
      ],
      "value": 30,
      "inputs": {
        "security": 47,
        "vitality": 20,
        "community": 12,
        "governance": 42,
        "engineering": 52,
        "abandonment_cap": null,
        "abandonment_state": "at_risk",
        "abandonment_multiplier": 85,
        "weighted_overall_before_abandonment": 35,
        "overall_after_abandonment_multiplier": 30
      },
      "components": []
    },
    "categories": [
      {
        "key": "vitality",
        "band": "critical",
        "name": "Vitality",
        "value": 20,
        "weight": 0.22,
        "metrics": [
          {
            "key": "development_activity",
            "band": "critical",
            "name": "Development activity",
            "note": null,
            "notes": [],
            "value": 1,
            "inputs": {
              "commits_last_year": 0,
              "human_commit_share": 0.38,
              "days_since_last_push": 1137,
              "active_weeks_last_year": 0
            },
            "components": [
              {
                "key": "push_recency",
                "name": "Push recency",
                "detail": "last push 1137 days ago",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "push_recency",
                    "params": {
                      "days": 1137
                    }
                  }
                ],
                "max_points": 36
              },
              {
                "key": "commit_cadence",
                "name": "Commit cadence",
                "detail": "0/52 weeks with commits",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "commit_cadence_weeks",
                    "params": {
                      "weeks": 0
                    }
                  }
                ],
                "max_points": 36
              },
              {
                "key": "commit_volume",
                "name": "Commit volume",
                "detail": "0 commits in the last year",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "commits_last_year",
                    "params": {
                      "count": 0
                    }
                  }
                ],
                "max_points": 18
              },
              {
                "key": "openssf_scorecard_maintained",
                "name": "OpenSSF Scorecard: Maintained",
                "detail": "0 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 0",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 10
              }
            ]
          },
          {
            "key": "release_discipline",
            "band": "at_risk",
            "name": "Release discipline",
            "note": "Excluded from scoring (no data or not applicable): OpenSSF Scorecard: Signed-Releases. Remaining weights renormalized.",
            "notes": [
              {
                "code": "excluded_no_data",
                "params": {
                  "components": [
                    "openssf_scorecard_signed_releases"
                  ]
                }
              },
              {
                "code": "weights_renormalized",
                "params": {}
              }
            ],
            "value": 48,
            "inputs": {
              "releases_count": 38,
              "latest_release_tag": "v0.23.0",
              "releases_from_tags": true,
              "days_since_latest_release": 1752,
              "mean_days_between_releases": 10.9
            },
            "components": [
              {
                "key": "ships_releases",
                "name": "Ships releases",
                "detail": "38 version tags (no GitHub releases)",
                "points": 16.2,
                "status": "partial",
                "details": [
                  {
                    "code": "version_tags_no_releases",
                    "params": {
                      "count": 38
                    }
                  }
                ],
                "max_points": 27
              },
              {
                "key": "release_recency",
                "name": "Release recency",
                "detail": "latest release 1752 days ago",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "release_recency",
                    "params": {
                      "days": 1752
                    }
                  }
                ],
                "max_points": 36
              },
              {
                "key": "release_cadence",
                "name": "Release cadence",
                "detail": "a release every ~10.9 days",
                "points": 27,
                "status": "met",
                "details": [
                  {
                    "code": "release_cadence",
                    "params": {
                      "gap": 10.9
                    }
                  }
                ],
                "max_points": 27
              },
              {
                "key": "openssf_scorecard_signed_releases",
                "name": "OpenSSF Scorecard: Signed-Releases",
                "detail": "no releases found",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "no_data",
                    "params": {}
                  }
                ],
                "max_points": 10
              }
            ]
          },
          {
            "key": "abandonment",
            "band": "excellent",
            "name": "Abandonment",
            "note": null,
            "notes": [],
            "value": 85,
            "inputs": {
              "cap": null,
              "state": "at_risk",
              "guards": [
                "no_open_demand"
              ],
              "signals": [
                "release_stall",
                "scorecard_unmaintained"
              ],
              "red_flag": true,
              "multiplier_pct": 85,
              "declared_reason": null,
              "unverified_reason": null,
              "unanswered_open_prs": 0,
              "unanswered_open_issues": 0,
              "days_since_last_merged_pr": null,
              "days_since_last_human_commit": 1137,
              "days_since_last_human_commit_is_floor": false
            },
            "components": [
              {
                "key": "project_is_still_maintained",
                "name": "Project is still maintained",
                "detail": "no human commit for 1137 days; 2 unmet obligation(s): releases stalled, Scorecard reports it unmaintained",
                "points": 85,
                "status": "partial",
                "details": [
                  {
                    "code": "abandonment_flagged",
                    "params": {
                      "days": 1137,
                      "count": 2,
                      "signals": "releases stalled, Scorecard reports it unmaintained"
                    }
                  }
                ],
                "max_points": 100
              }
            ]
          }
        ],
        "description": "Is the project alive — is code being written and are releases shipping?"
      },
      {
        "key": "community",
        "band": "critical",
        "name": "Community & Adoption",
        "value": 12,
        "weight": 0.18,
        "metrics": [
          {
            "key": "popularity",
            "band": "critical",
            "name": "Popularity & adoption",
            "note": null,
            "notes": [],
            "value": 1,
            "inputs": {
              "forks": 0,
              "stars": 0,
              "watchers": 0,
              "growth_state": "unverified",
              "growth_factor_pct": 100,
              "growth_unverified_reason": "no_history"
            },
            "components": [
              {
                "key": "stars",
                "name": "Stars",
                "detail": "0 stars",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "stars",
                    "params": {
                      "count": 0
                    }
                  }
                ],
                "max_points": 60
              },
              {
                "key": "forks",
                "name": "Forks",
                "detail": "0 forks",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "forks",
                    "params": {
                      "count": 0
                    }
                  }
                ],
                "max_points": 25
              },
              {
                "key": "watchers",
                "name": "Watchers",
                "detail": "0 watchers",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "watchers",
                    "params": {
                      "count": 0
                    }
                  }
                ],
                "max_points": 15
              }
            ]
          },
          {
            "key": "community_health",
            "band": "critical",
            "name": "Community health",
            "note": null,
            "notes": [],
            "value": 25,
            "inputs": {
              "has_readme": false,
              "has_license": false,
              "has_contributing": false,
              "has_issue_template": false,
              "has_code_of_conduct": false,
              "has_pull_request_template": false
            },
            "components": [
              {
                "key": "readme",
                "name": "README",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 22.5
              },
              {
                "key": "license",
                "name": "License",
                "detail": "recognized license (Apache-2.0)",
                "points": 22.5,
                "status": "met",
                "details": [
                  {
                    "code": "license_standard",
                    "params": {}
                  },
                  {
                    "code": "license_spdx",
                    "params": {
                      "spdx": "Apache-2.0"
                    }
                  }
                ],
                "max_points": 22.5
              },
              {
                "key": "contributing_guide",
                "name": "CONTRIBUTING guide",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 18
              },
              {
                "key": "code_of_conduct",
                "name": "Code of conduct",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 13.5
              },
              {
                "key": "issue_template",
                "name": "Issue template",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.2
              },
              {
                "key": "pr_template",
                "name": "PR template",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 6.3
              }
            ]
          }
        ],
        "description": "Does the project have users, downloads, attention, and a welcoming setup for contributors?"
      },
      {
        "key": "governance",
        "band": "at_risk",
        "name": "Sustainability & Governance",
        "value": 42,
        "weight": 0.24,
        "metrics": [
          {
            "key": "maintainer_resilience",
            "band": "moderate",
            "name": "Maintainer resilience (bus factor)",
            "note": null,
            "notes": [],
            "value": 60,
            "inputs": {
              "bus_factor": 2,
              "contributors_sampled": 56,
              "top_contributor_share": 0.488
            },
            "components": [
              {
                "key": "bus_factor",
                "name": "Bus factor",
                "detail": "2 contributor(s) cover half of all commits",
                "points": 25.2,
                "status": "partial",
                "details": [
                  {
                    "code": "bus_factor",
                    "params": {
                      "count": 2
                    }
                  }
                ],
                "max_points": 54
              },
              {
                "key": "commit_distribution",
                "name": "Commit distribution",
                "detail": "top contributor authored 49% of commits",
                "points": 11.5,
                "status": "partial",
                "details": [
                  {
                    "code": "top_contributor_share",
                    "params": {
                      "share": 49
                    }
                  }
                ],
                "max_points": 22.5
              },
              {
                "key": "contributor_breadth",
                "name": "Contributor breadth",
                "detail": "56 contributors",
                "points": 13.5,
                "status": "met",
                "details": [
                  {
                    "code": "contributors_sampled",
                    "params": {
                      "count": 56
                    }
                  }
                ],
                "max_points": 13.5
              },
              {
                "key": "openssf_scorecard_contributors",
                "name": "OpenSSF Scorecard: Contributors",
                "detail": "project has 7 contributing companies or organizations",
                "points": 10,
                "status": "met",
                "details": [],
                "max_points": 10
              }
            ]
          },
          {
            "key": "responsiveness",
            "band": "critical",
            "name": "Issue & PR responsiveness",
            "note": "Excluded from scoring (no data or not applicable): Issue resolution, PR acceptance. Remaining weights renormalized.",
            "notes": [
              {
                "code": "excluded_no_data",
                "params": {
                  "components": [
                    "issue_resolution",
                    "pr_acceptance"
                  ]
                }
              },
              {
                "code": "weights_renormalized",
                "params": {}
              }
            ],
            "value": 1,
            "inputs": {
              "merged_prs": 0,
              "open_issues": 0,
              "closed_issues": 0,
              "issue_closed_ratio": null,
              "closed_unmerged_prs": 0
            },
            "components": [
              {
                "key": "issue_resolution",
                "name": "Issue resolution",
                "detail": "no issues or no data",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "no_issues_or_data",
                    "params": {}
                  }
                ],
                "max_points": 46.75
              },
              {
                "key": "pr_acceptance",
                "name": "PR acceptance",
                "detail": "no decided pull requests or no data",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "no_decided_prs_or_data",
                    "params": {}
                  }
                ],
                "max_points": 38.25
              },
              {
                "key": "openssf_scorecard_code_review",
                "name": "OpenSSF Scorecard: Code-Review",
                "detail": "Found 0/30 approved changesets -- score normalized to 0",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 15
              }
            ]
          },
          {
            "key": "stewardship",
            "band": "moderate",
            "name": "Ownership & stewardship",
            "note": "Excluded from scoring (no data or not applicable): Verified domain. Remaining weights renormalized.",
            "notes": [
              {
                "code": "excluded_no_data",
                "params": {
                  "components": [
                    "verified_domain"
                  ]
                }
              },
              {
                "code": "weights_renormalized",
                "params": {}
              }
            ],
            "value": 62,
            "inputs": {
              "followers": 111,
              "owner_type": "User",
              "is_verified": null,
              "owner_login": "joshbressers",
              "public_repos": 109,
              "account_age_days": 5198
            },
            "components": [
              {
                "key": "ownership_backing",
                "name": "Ownership backing",
                "detail": "personal (user) account",
                "points": 10,
                "status": "partial",
                "details": [
                  {
                    "code": "owner_personal",
                    "params": {}
                  }
                ],
                "max_points": 30
              },
              {
                "key": "verified_domain",
                "name": "Verified domain",
                "detail": "not applicable to user accounts",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "not_applicable_to_user_accounts",
                    "params": {}
                  }
                ],
                "max_points": 20
              },
              {
                "key": "owner_reach",
                "name": "Owner reach",
                "detail": "111 followers of joshbressers",
                "points": 14.7,
                "status": "partial",
                "details": [
                  {
                    "code": "owner_followers",
                    "params": {
                      "count": 111,
                      "login": "joshbressers"
                    }
                  }
                ],
                "max_points": 25
              },
              {
                "key": "track_record",
                "name": "Track record",
                "detail": "109 public repos, account ~14 yr old",
                "points": 25,
                "status": "met",
                "details": [
                  {
                    "code": "public_repos",
                    "params": {
                      "count": 109
                    }
                  },
                  {
                    "code": "account_age_years",
                    "params": {
                      "years": 14
                    }
                  }
                ],
                "max_points": 25
              }
            ]
          }
        ],
        "description": "Will the project survive its people — bus factor, responsiveness, who backs it, and package upkeep?"
      },
      {
        "key": "engineering",
        "band": "moderate",
        "name": "Engineering Quality",
        "value": 52,
        "weight": 0.2,
        "metrics": [
          {
            "key": "engineering_practices",
            "band": "good",
            "name": "Engineering practices",
            "note": "Excluded from scoring (no data or not applicable): OpenSSF Scorecard: CI-Tests. Remaining weights renormalized.",
            "notes": [
              {
                "code": "excluded_no_data",
                "params": {
                  "components": [
                    "openssf_scorecard_ci_tests"
                  ]
                }
              },
              {
                "code": "weights_renormalized",
                "params": {}
              }
            ],
            "value": 80,
            "inputs": {
              "has_ci": true,
              "has_tests": true,
              "has_editorconfig": false,
              "has_linter_config": true,
              "has_precommit_config": false
            },
            "components": [
              {
                "key": "ci_workflows",
                "name": "CI workflows",
                "detail": "6 workflow(s)",
                "points": 24,
                "status": "met",
                "details": [
                  {
                    "code": "ci_workflows",
                    "params": {
                      "count": 6
                    }
                  }
                ],
                "max_points": 24
              },
              {
                "key": "tests_present",
                "name": "Tests present",
                "detail": null,
                "points": 24,
                "status": "met",
                "details": [],
                "max_points": 24
              },
              {
                "key": "linter_config",
                "name": "Linter config",
                "detail": ".golangci.yaml",
                "points": 16,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": ".golangci.yaml"
                    }
                  }
                ],
                "max_points": 16
              },
              {
                "key": "pre_commit_hooks",
                "name": "Pre-commit hooks",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 9.6
              },
              {
                "key": "editorconfig",
                "name": ".editorconfig",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 6.4
              },
              {
                "key": "openssf_scorecard_ci_tests",
                "name": "OpenSSF Scorecard: CI-Tests",
                "detail": "no pull request found",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "no_data",
                    "params": {}
                  }
                ],
                "max_points": 20
              }
            ]
          },
          {
            "key": "documentation",
            "band": "critical",
            "name": "Documentation",
            "note": null,
            "notes": [],
            "value": 10,
            "inputs": {
              "topics": [],
              "has_wiki": true,
              "homepage": null,
              "has_readme": false,
              "has_docs_dir": false,
              "has_description": false
            },
            "components": [
              {
                "key": "readme",
                "name": "README",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 30
              },
              {
                "key": "documentation_directory",
                "name": "Documentation directory",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 25
              },
              {
                "key": "documentation_homepage_site",
                "name": "Documentation / homepage site",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 15
              },
              {
                "key": "repository_description",
                "name": "Repository description",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 10
              },
              {
                "key": "topics",
                "name": "Topics",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 10
              },
              {
                "key": "wiki",
                "name": "Wiki",
                "detail": null,
                "points": 10,
                "status": "met",
                "details": [],
                "max_points": 10
              }
            ]
          }
        ],
        "description": "Are baseline engineering and documentation practices in place?"
      },
      {
        "key": "security",
        "band": "at_risk",
        "name": "Security",
        "value": 47,
        "weight": 0.16,
        "metrics": [
          {
            "key": "security_posture",
            "band": "at_risk",
            "name": "Security posture",
            "note": "Excluded from scoring (no data or not applicable): CI-Tests, Packaging, Signed-Releases. Remaining weights renormalized.",
            "notes": [
              {
                "code": "excluded_no_data",
                "params": {
                  "components": [
                    "ci_tests",
                    "packaging",
                    "signed_releases"
                  ]
                }
              },
              {
                "code": "weights_renormalized",
                "params": {}
              }
            ],
            "value": 47,
            "inputs": {
              "source": "openssf_scorecard",
              "checks_evaluated": 15,
              "scorecard_version": "v5.5.0",
              "checks_inconclusive": 3,
              "scorecard_aggregate": 4.7
            },
            "components": [
              {
                "key": "binary_artifacts",
                "name": "Binary-Artifacts",
                "detail": "binaries present in source code",
                "points": 6.8,
                "status": "partial",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "branch_protection",
                "name": "Branch-Protection",
                "detail": "branch protection not enabled on development/release branches",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "ci_tests",
                "name": "CI-Tests",
                "detail": "no pull request found",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "no_data",
                    "params": {}
                  }
                ],
                "max_points": 2.5
              },
              {
                "key": "cii_best_practices",
                "name": "CII-Best-Practices",
                "detail": "no effort to earn an OpenSSF best practices badge detected",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 2.5
              },
              {
                "key": "code_review",
                "name": "Code-Review",
                "detail": "Found 0/30 approved changesets -- score normalized to 0",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "contributors",
                "name": "Contributors",
                "detail": "project has 7 contributing companies or organizations",
                "points": 2.5,
                "status": "met",
                "details": [],
                "max_points": 2.5
              },
              {
                "key": "dangerous_workflow",
                "name": "Dangerous-Workflow",
                "detail": "no dangerous workflow patterns detected",
                "points": 10,
                "status": "met",
                "details": [],
                "max_points": 10
              },
              {
                "key": "dependency_update_tool",
                "name": "Dependency-Update-Tool",
                "detail": "update tool detected",
                "points": 7.5,
                "status": "met",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "fuzzing",
                "name": "Fuzzing",
                "detail": "project is not fuzzed",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 5
              },
              {
                "key": "license",
                "name": "License",
                "detail": "license file detected",
                "points": 2.5,
                "status": "met",
                "details": [],
                "max_points": 2.5
              },
              {
                "key": "maintained",
                "name": "Maintained",
                "detail": "0 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 0",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "packaging",
                "name": "Packaging",
                "detail": "packaging workflow not detected",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "no_data",
                    "params": {}
                  }
                ],
                "max_points": 5
              },
              {
                "key": "pinned_dependencies",
                "name": "Pinned-Dependencies",
                "detail": "dependency not pinned by hash detected -- score normalized to 6",
                "points": 3,
                "status": "partial",
                "details": [],
                "max_points": 5
              },
              {
                "key": "sast",
                "name": "SAST",
                "detail": "SAST tool detected: CodeQL",
                "points": 5,
                "status": "met",
                "details": [],
                "max_points": 5
              },
              {
                "key": "security_policy",
                "name": "Security-Policy",
                "detail": "security policy file detected",
                "points": 5,
                "status": "met",
                "details": [],
                "max_points": 5
              },
              {
                "key": "signed_releases",
                "name": "Signed-Releases",
                "detail": "no releases found",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "no_data",
                    "params": {}
                  }
                ],
                "max_points": 7.5
              },
              {
                "key": "token_permissions",
                "name": "Token-Permissions",
                "detail": "detected GitHub workflow tokens with excessive permissions",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "vulnerabilities",
                "name": "Vulnerabilities",
                "detail": "93 existing vulnerabilities detected",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.5
              }
            ]
          },
          {
            "key": "high_risk_jurisdiction_exposure",
            "band": "excellent",
            "name": "High-Risk Jurisdiction Exposure",
            "note": "Only high-confidence self-published location evidence affects this multiplier. Ambiguous matches are review-only; country evidence is not proof of nationality, citizenship, legal registration, malicious intent, or sanctions status.",
            "notes": [
              {
                "code": "jurisdiction_evidence_limits",
                "params": {}
              }
            ],
            "value": 100,
            "inputs": {
              "meaning": "self-published location evidence; not nationality or citizenship",
              "red_flag": false,
              "exposures": [],
              "policy_countries": [
                "Russia",
                "Iran",
                "North Korea"
              ],
              "review_only_matches": 0,
              "assessed_self_published_locations": 8
            },
            "components": [
              {
                "key": "policy_exposure_multiplier",
                "name": "Policy exposure multiplier",
                "detail": "no confirmed policy-scope location match",
                "points": 100,
                "status": "met",
                "details": [
                  {
                    "code": "jurisdiction_no_match",
                    "params": {}
                  }
                ],
                "max_points": 100
              }
            ]
          }
        ],
        "description": "Are visible security and supply-chain practices strong, with no malicious dependency and no unresolved high-risk jurisdiction exposure?"
      },
      {
        "key": "ai_readiness",
        "band": "good",
        "name": "AI Readiness",
        "value": 72,
        "weight": 0,
        "metrics": [
          {
            "key": "ai_agent_context",
            "band": "at_risk",
            "name": "Agent context & guidance",
            "note": null,
            "notes": [],
            "value": 40,
            "inputs": {
              "has_llms_txt": false,
              "legible_history_share": 0.921,
              "agent_instruction_files": [],
              "agent_instruction_max_bytes": null
            },
            "components": [
              {
                "key": "agent_instructions",
                "name": "Agent instructions",
                "detail": "no CLAUDE.md / AGENTS.md / editor rules",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "no_agent_instructions",
                    "params": {}
                  }
                ],
                "max_points": 45
              },
              {
                "key": "machine_readable_docs_llms_txt",
                "name": "Machine-readable docs (llms.txt)",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 15
              },
              {
                "key": "legible_commit_history",
                "name": "Legible commit history",
                "detail": "35 of 38 human commits state their intent (structured subject or explanatory body)",
                "points": 40,
                "status": "met",
                "details": [
                  {
                    "code": "legible_history",
                    "params": {
                      "legible": 35,
                      "sampled": 38
                    }
                  }
                ],
                "max_points": 40
              }
            ]
          },
          {
            "key": "ai_verify_loop",
            "band": "excellent",
            "name": "Verify loop (build / test / typecheck)",
            "note": null,
            "notes": [],
            "value": 86,
            "inputs": {
              "has_nix": false,
              "has_tests": true,
              "lockfiles": [
                "Gemfile.lock",
                "go.sum"
              ],
              "has_dockerfile": true,
              "typed_language": true,
              "bootstrap_files": [
                "Makefile",
                "grype/db/test-fixtures/tls/Makefile",
                "schema/cyclonedx/Makefile",
                "test/cli/test-fixtures/Makefile",
                "test/install/Makefile",
                "test/integration/test-fixtures/Makefile",
                "test/quality/Makefile"
              ],
              "has_devcontainer": false,
              "has_linter_config": true,
              "typecheck_configs": [],
              "agent_commit_share": 0,
              "toolchain_manifests": [
                "go.mod",
                "test/integration/test-fixtures/image-debian-match-coverage/golang/go.mod"
              ],
              "dependency_bot_commit_share": 0.46
            },
            "components": [
              {
                "key": "one_command_bootstrap",
                "name": "One-command bootstrap",
                "detail": "Makefile, grype/db/test-fixtures/tls/Makefile, schema/cyclonedx/Makefile, test/cli/test-fixtures/Makefile, test/install/Makefile, test/integration/test-fixtures/Makefile, test/quality/Makefile",
                "points": 18,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": "Makefile, grype/db/test-fixtures/tls/Makefile, schema/cyclonedx/Makefile, test/cli/test-fixtures/Makefile, test/install/Makefile, test/integration/test-fixtures/Makefile, test/quality/Makefile"
                    }
                  }
                ],
                "max_points": 18
              },
              {
                "key": "automated_tests",
                "name": "Automated tests",
                "detail": null,
                "points": 22,
                "status": "met",
                "details": [],
                "max_points": 22
              },
              {
                "key": "lint_format_config",
                "name": "Lint / format config",
                "detail": ".golangci.yaml",
                "points": 11,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": ".golangci.yaml"
                    }
                  }
                ],
                "max_points": 11
              },
              {
                "key": "static_type_checking",
                "name": "Static type checking",
                "detail": "Go (statically typed)",
                "points": 11,
                "status": "met",
                "details": [
                  {
                    "code": "statically_typed_language",
                    "params": {
                      "language": "Go"
                    }
                  }
                ],
                "max_points": 11
              },
              {
                "key": "reproducible_environment",
                "name": "Reproducible environment",
                "detail": "Dockerfile, lockfile",
                "points": 10,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": "Dockerfile, lockfile"
                    }
                  }
                ],
                "max_points": 10
              },
              {
                "key": "demonstrated_agent_practice",
                "name": "Demonstrated agent practice",
                "detail": "no agent-authored commits among the last 100",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "no_agent_authored_commits",
                    "params": {
                      "sampled": 100
                    }
                  }
                ],
                "max_points": 10
              },
              {
                "key": "automated_maintenance",
                "name": "Automated maintenance",
                "detail": "46 of the last 100 commits are automated dependency updates",
                "points": 8,
                "status": "met",
                "details": [
                  {
                    "code": "dependency_bot_commits",
                    "params": {
                      "count": 46,
                      "sampled": 100
                    }
                  }
                ],
                "max_points": 8
              },
              {
                "key": "openssf_scorecard_pinned_dependencies",
                "name": "OpenSSF Scorecard: Pinned-Dependencies",
                "detail": "dependency not pinned by hash detected -- score normalized to 6",
                "points": 6,
                "status": "partial",
                "details": [],
                "max_points": 10
              }
            ]
          },
          {
            "key": "ai_code_legibility",
            "band": "excellent",
            "name": "Code legibility for models",
            "note": null,
            "notes": [],
            "value": 100,
            "inputs": {
              "primary_language": "Go",
              "largest_source_bytes": 33193,
              "source_files_sampled": 400,
              "oversized_source_files": 0
            },
            "components": [
              {
                "key": "type_checkable_code",
                "name": "Type-checkable code",
                "detail": "Go (statically typed)",
                "points": 45,
                "status": "met",
                "details": [
                  {
                    "code": "statically_typed_language",
                    "params": {
                      "language": "Go"
                    }
                  }
                ],
                "max_points": 45
              },
              {
                "key": "manageable_file_sizes",
                "name": "Manageable file sizes",
                "detail": "0/400 source files over 60KB",
                "points": 55,
                "status": "met",
                "details": [
                  {
                    "code": "oversized_source_files",
                    "params": {
                      "kb": 60,
                      "sampled": 400,
                      "oversized": 0
                    }
                  }
                ],
                "max_points": 55
              }
            ]
          }
        ],
        "description": "How well is the repo equipped to be developed and maintained with AI coding agents? An independent, experimental badge — weight 0.0, so it is surfaced on its own and does not affect the overall health score."
      }
    ],
    "metrics_version": "1.13.0"
  },
  "warnings": [
    "Community profile unavailable",
    "go package 'github.com/anchore/grype' points at a different repository (https://github.com/anchore/grype); excluded from ecosystem scoring",
    "GitHub dependency-graph SBOM unavailable (404); the dependency graph may be disabled for this repository"
  ],
  "report_type": "repository",
  "generated_at": "2026-07-25T11:26:49.909453Z",
  "schema_version": "0.27.0",
  "badge_url": "https://raw.githubusercontent.com/inspect-software/badges/main/v1/j/joshbressers/grype.svg",
  "full_name": "joshbressers/grype",
  "license_state": "standard",
  "license_spdx": "Apache-2.0"
}