joshbressers / syft

来自 GitHub 依赖图的完整解析依赖集合：98 个直接依赖与 235 个间接（传递）软件包。仓库提交锁文件时，传递闭包才是完整的。

该仓库未发布可被索引解析的包，因此评估的是其自身的依赖图——共 333 个包，其中也包含从不交付的开发与测试版本固定：17 个存在已知公告，5 个为直接依赖。

公告表示依赖图中记录的版本落入某条公告的受影响范围。可达性未经分析，且依赖图包含开发与测试的版本固定——某项发现可能只涉及工具链而非交付的软件。

{
  "data": {
    "repo": {
      "topics": [],
      "is_fork": true,
      "size_kb": 20330,
      "has_wiki": true,
      "homepage": null,
      "languages": {
        "Go": 5510197,
        "Shell": 49583,
        "Python": 5206,
        "Makefile": 6742,
        "Dockerfile": 1164
      },
      "pushed_at": "2026-03-30T13:43:39Z",
      "created_at": "2021-10-06T12:59:27Z",
      "owner_type": "User",
      "updated_at": "2026-03-30T13:32:40Z",
      "description": "CLI tool and library for generating a Software Bill of Materials from container images and filesystems",
      "is_archived": false,
      "is_disabled": false,
      "license_spdx": "Apache-2.0",
      "default_branch": "main",
      "license_spdx_raw": "Apache-2.0",
      "primary_language": "Go",
      "significant_languages": [
        "Go"
      ]
    },
    "owner": {
      "blog": "https://opensourcesecurity.io/",
      "name": "Josh Bressers",
      "type": "User",
      "login": "joshbressers",
      "company": "@anchore",
      "location": "localhost",
      "followers": 111,
      "avatar_url": "https://avatars.githubusercontent.com/u/1692786?v=4",
      "created_at": "2012-04-30T15:02:49Z",
      "is_verified": null,
      "public_repos": 109,
      "account_age_days": 5198
    },
    "license": {
      "state": "standard",
      "spdx_id": "Apache-2.0",
      "raw_spdx": "Apache-2.0",
      "file_present": true,
      "scorecard_found": true,
      "profile_has_license": false
    },
    "activity": {
      "releases": [
        {
          "tag": "v0.24.1",
          "kind": "patch",
          "published_at": "2021-09-27T22:31:59Z"
        },
        {
          "tag": "v0.24.0",
          "kind": "minor",
          "published_at": "2021-09-23T00:55:03Z"
        },
        {
          "tag": "v0.23.0",
          "kind": "minor",
          "published_at": "2021-09-13T17:06:23Z"
        },
        {
          "tag": "v0.22.0",
          "kind": "minor",
          "published_at": "2021-09-03T21:29:34Z"
        },
        {
          "tag": "v0.21.0",
          "kind": "minor",
          "published_at": "2021-08-20T17:50:28Z"
        },
        {
          "tag": "v0.20.0",
          "kind": "minor",
          "published_at": "2021-08-18T15:00:49Z"
        },
        {
          "tag": "v0.19.1",
          "kind": "patch",
          "published_at": "2021-06-30T17:10:00Z"
        },
        {
          "tag": "v0.19.0",
          "kind": "minor",
          "published_at": "2021-06-29T22:16:32Z"
        },
        {
          "tag": "v0.18.0",
          "kind": "minor",
          "published_at": "2021-06-29T18:28:09Z"
        },
        {
          "tag": "v0.17.1",
          "kind": "patch",
          "published_at": "2021-06-19T18:32:13Z"
        },
        {
          "tag": "v0.17.0",
          "kind": "minor",
          "published_at": "2021-06-04T16:50:22Z"
        },
        {
          "tag": "v0.16.1",
          "kind": "patch",
          "published_at": "2021-05-25T21:13:58Z"
        },
        {
          "tag": "v0.16.0",
          "kind": "minor",
          "published_at": "2021-05-25T19:01:02Z"
        },
        {
          "tag": "v0.15.2",
          "kind": "patch",
          "published_at": "2021-05-12T21:28:52Z"
        },
        {
          "tag": "v0.15.1",
          "kind": "patch",
          "published_at": "2021-04-22T20:38:09Z"
        },
        {
          "tag": "v0.15.0",
          "kind": "minor",
          "published_at": "2021-04-22T19:56:18Z"
        },
        {
          "tag": "v0.14.0",
          "kind": "minor",
          "published_at": "2021-03-20T16:23:57Z"
        },
        {
          "tag": "v0.13.1",
          "kind": "patch",
          "published_at": "2021-02-26T20:59:49Z"
        },
        {
          "tag": "v0.13.0",
          "kind": "minor",
          "published_at": "2021-02-25T18:47:13Z"
        },
        {
          "tag": "v0.12.7",
          "kind": "patch",
          "published_at": "2021-02-17T13:14:18Z"
        },
        {
          "tag": "v0.12.6",
          "kind": "patch",
          "published_at": "2021-02-05T16:26:40Z"
        },
        {
          "tag": "v0.12.5",
          "kind": "patch",
          "published_at": "2021-02-01T17:03:28Z"
        },
        {
          "tag": "v0.12.4",
          "kind": "patch",
          "published_at": "2021-01-27T16:51:40Z"
        },
        {
          "tag": "v0.12.3",
          "kind": "patch",
          "published_at": "2021-01-22T21:10:06Z"
        },
        {
          "tag": "v0.12.2",
          "kind": "patch",
          "published_at": "2021-01-06T02:32:24Z"
        },
        {
          "tag": "v0.12.1",
          "kind": "patch",
          "published_at": "2021-01-05T00:45:03Z"
        },
        {
          "tag": "v0.12.0",
          "kind": "minor",
          "published_at": "2021-01-04T21:50:35Z"
        },
        {
          "tag": "v0.11.1",
          "kind": "patch",
          "published_at": "2020-12-23T18:23:01Z"
        },
        {
          "tag": "v0.11.0",
          "kind": "minor",
          "published_at": "2020-12-18T21:59:30Z"
        },
        {
          "tag": "v0.10.0",
          "kind": "minor",
          "published_at": "2020-12-10T03:20:53Z"
        },
        {
          "tag": "v0.9.2",
          "kind": "patch",
          "published_at": "2020-12-03T21:32:24Z"
        },
        {
          "tag": "v0.9.1",
          "kind": "patch",
          "published_at": "2020-12-02T12:50:31Z"
        },
        {
          "tag": "v0.9.0",
          "kind": "minor",
          "published_at": "2020-11-30T16:37:44Z"
        },
        {
          "tag": "v0.8.0",
          "kind": "minor",
          "published_at": "2020-11-17T18:21:57Z"
        },
        {
          "tag": "v0.7.1",
          "kind": "patch",
          "published_at": "2020-11-12T14:36:20Z"
        },
        {
          "tag": "v0.7.0",
          "kind": "minor",
          "published_at": "2020-11-11T20:15:12Z"
        },
        {
          "tag": "v0.6.0",
          "kind": "minor",
          "published_at": "2020-11-09T19:18:48Z"
        },
        {
          "tag": "v0.5.1",
          "kind": "patch",
          "published_at": "2020-11-04T20:47:55Z"
        },
        {
          "tag": "v0.5.0",
          "kind": "minor",
          "published_at": "2020-10-30T19:14:32Z"
        },
        {
          "tag": "v0.4.1",
          "kind": "patch",
          "published_at": "2020-10-26T15:19:25Z"
        },
        {
          "tag": "v0.4.0",
          "kind": "minor",
          "published_at": "2020-10-23T15:06:51Z"
        },
        {
          "tag": "v0.3.0",
          "kind": "minor",
          "published_at": "2020-10-15T18:41:28Z"
        },
        {
          "tag": "v0.2.0",
          "kind": "minor",
          "published_at": "2020-10-08T18:37:06Z"
        },
        {
          "tag": "v0.1.0",
          "kind": "minor",
          "published_at": "2020-09-29T20:33:40Z"
        },
        {
          "tag": "v0.1.0-beta.5",
          "kind": "prerelease",
          "published_at": "2020-09-26T02:59:19Z"
        },
        {
          "tag": "v0.1.0-beta.4",
          "kind": "prerelease",
          "published_at": "2020-08-10T22:28:43Z"
        },
        {
          "tag": "v0.1.0-beta.3",
          "kind": "prerelease",
          "published_at": "2020-08-10T14:33:44Z"
        },
        {
          "tag": "v0.1.0-beta.2",
          "kind": "prerelease",
          "published_at": "2020-07-27T19:13:41Z"
        },
        {
          "tag": "v0.1.0-beta.1",
          "kind": "prerelease",
          "published_at": "2020-07-27T13:55:11Z"
        }
      ],
      "recent_commits": [
        {
          "oid": "d71b747cd1600ce4eefbfc2d449496c89e07aaef",
          "body": "…4684)\n\nBumps [slackapi/slack-github-action](https://github.com/slackapi/slack-github-action) from 2.1.1 to 3.0.1.\n- [Release notes](https://github.com/slackapi/slack-github-action/releases)\n- [Commits](https://github.com/slackapi/slack-github-action/compare/91efab103c0de0a537f72a35f6b8cda0ee76bf0a.\n[…]\nirect:production\n  update-type: version-update:semver-major\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump slackapi/slack-github-action from 2.1.1 to 3.0.1 (#…",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-03-26T15:12:33Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "58a8a95e26b20d08acc7d242fdb9b7490d4cc0ab",
          "body": "Bumps [marocchino/sticky-pull-request-comment](https://github.com/marocchino/sticky-pull-request-comment) from 2.9.4 to 3.0.2.\n- [Release notes](https://github.com/marocchino/sticky-pull-request-comment/releases)\n- [Commits](https://github.com/marocchino/sticky-pull-request-comment/compare/773744901\n[…]\nirect:production\n  update-type: version-update:semver-major\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump marocchino/sticky-pull-request-comment (#4685)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-03-25T23:27:59Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "78a21b9c88bd21f0eadfe4f0467b9052fb4fdb27",
          "body": "Bumps the go-minor-patch group with 2 updates: [github.com/gkampitakis/go-snaps](https://github.com/gkampitakis/go-snaps) and [modernc.org/sqlite](https://gitlab.com/cznic/sqlite).\n\n\nUpdates `github.com/gkampitakis/go-snaps` from 0.5.20 to 0.5.21\n- [Release notes](https://github.com/gkampitakis/go-s\n[…]\nsion-update:semver-patch\n  dependency-group: go-minor-patch\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump the go-minor-patch group with 2 updates (#4697)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-03-25T23:27:50Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "7d3882a4253dc46cca1d2a9f133bc73a260c96a0",
          "body": "… (#4699)\n\nBumps [actions/create-github-app-token](https://github.com/actions/create-github-app-token) from 2.2.1 to 3.0.0.\n- [Release notes](https://github.com/actions/create-github-app-token/releases)\n- [Commits](https://github.com/actions/create-github-app-token/compare/29824e69f54612133e76f7eaac\n[…]\nirect:production\n  update-type: version-update:semver-major\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump actions/create-github-app-token from 2.2.1 to 3.0.0…",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-03-25T23:27:31Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "673c85754ca0a8959bb64597e6166df526e375cc",
          "body": "Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>\nCo-authored-by: wagoodman <590471+wagoodman@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): update CPE dictionary index (#4689)",
          "author_name": "anchore-actions-token-generator[bot]",
          "author_login": "anchore-actions-token-generator[bot]",
          "committed_at": "2026-03-25T12:38:49Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "c5114fd745f51d092c2b3030e912366b2cef016a",
          "body": "Prevent some packages from being updated.\n\nSigned-off-by: Will Murphy <willmurphyscode@users.noreply.github.com>",
          "is_bot": false,
          "headline": "chore(deps): ignore some dependabot deps (#4696)",
          "author_name": "Will Murphy",
          "author_login": "willmurphyscode",
          "committed_at": "2026-03-24T12:12:50Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "f68a7cc899e2869e2ba6e13ae690430d92a2c2a8",
          "body": "Signed-off-by: Weston Steimel <author@code.w.steimel.me.uk>",
          "is_bot": false,
          "headline": "ci: further pr target code checkout assurances (#4695)",
          "author_name": "Weston Steimel",
          "author_login": "westonsteimel",
          "committed_at": "2026-03-24T11:16:16Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "7800b16529c4a52278cb5cccf57337656371ddc9",
          "body": "Signed-off-by: witchcraze <witchcraze@gmail.com>",
          "is_bot": false,
          "headline": "fix: update arangodb classifier and capture-snippet.sh (#4662)",
          "author_name": "witchcraze",
          "author_login": "witchcraze",
          "committed_at": "2026-03-23T20:29:39Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "834ddcb1c0c798db7554614f2b7236ed029dccf7",
          "body": "Signed-off-by: Keith Zantow <kzantow@gmail.com>",
          "is_bot": false,
          "headline": "fix: golang version file regex (#4694)",
          "author_name": "Keith Zantow",
          "author_login": "kzantow",
          "committed_at": "2026-03-23T19:56:29Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "f5d318d93431e9e458b8375fb58113980f8ecf58",
          "body": "…flow (#4693)\n\nSigned-off-by: Weston Steimel <author@code.w.steimel.me.uk>",
          "is_bot": false,
          "headline": "ci: add explicit ref to main and warning for pull_request_target work…",
          "author_name": "Weston Steimel",
          "author_login": "westonsteimel",
          "committed_at": "2026-03-23T16:45:18Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "8531e1917bf552197da23f4414ba0b5a69181082",
          "body": "Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>\nCo-authored-by: spiffcs <32073428+spiffcs@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): update tools to latest versions (#4690)",
          "author_name": "anchore-actions-token-generator[bot]",
          "author_login": "anchore-actions-token-generator[bot]",
          "committed_at": "2026-03-23T16:01:27Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "860126c650c2d05b63b83a3895e41268162315a3",
          "body": "Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>\nCo-authored-by: willmurphyscode <12529630+willmurphyscode@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): update anchore dependencies (#4681)",
          "author_name": "anchore-actions-token-generator[bot]",
          "author_login": "anchore-actions-token-generator[bot]",
          "committed_at": "2026-03-19T16:44:55Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "36639f136baf470505f0dfc4ef06e83249eb6d11",
          "body": "Signed-off-by: Will Murphy <willmurphyscode@users.noreply.github.com>",
          "is_bot": false,
          "headline": "chore(deps): bump github.com/buger/jsonsparser to v1.1.2 (#4680)",
          "author_name": "Will Murphy",
          "author_login": "willmurphyscode",
          "committed_at": "2026-03-19T15:08:18Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "f32238c26839b0ae2c7f7582bec8c8d332f9fdb8",
          "body": "Bumps the go-minor-patch group with 2 updates: [golang.org/x/net](https://github.com/golang/net) and [golang.org/x/tools](https://github.com/golang/tools).\n\n\nUpdates `golang.org/x/net` from 0.51.0 to 0.52.0\n- [Commits](https://github.com/golang/net/compare/v0.51.0...v0.52.0)\n\nUpdates `golang.org/x/t\n[…]\nsion-update:semver-minor\n  dependency-group: go-minor-patch\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump the go-minor-patch group with 2 updates (#4678)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-03-19T14:25:19Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "0c8eef65f0bd3720f9a8acf96e8178b77b6bdd48",
          "body": "Bumps [google.golang.org/grpc](https://github.com/grpc/grpc-go) from 1.78.0 to 1.79.3.\n- [Release notes](https://github.com/grpc/grpc-go/releases)\n- [Commits](https://github.com/grpc/grpc-go/compare/v1.78.0...v1.79.3)\n\n---\nupdated-dependencies:\n- dependency-name: google.golang.org/grpc\n  dependency-version: 1.79.3\n  dependency-type: indirect\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump google.golang.org/grpc from 1.78.0 to 1.79.3 (#4675)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-03-18T20:55:30Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "4d42f8af321629d5f8b0c5ed8607aa3d4e38378c",
          "body": "Bumps the go-minor-patch group with 2 updates: [github.com/hashicorp/go-getter](https://github.com/hashicorp/go-getter) and [golang.org/x/mod](https://github.com/golang/mod).\n\n\nUpdates `github.com/hashicorp/go-getter` from 1.8.4 to 1.8.5\n- [Release notes](https://github.com/hashicorp/go-getter/relea\n[…]\nsion-update:semver-minor\n  dependency-group: go-minor-patch\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump the go-minor-patch group with 2 updates (#4674)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-03-18T20:13:35Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "e38851143eaec96c0ca6b10a296ae10a301bff6e",
          "body": "* chore: centralize temp files and prefer streaming IO\n\nCatalogers that create temp files ad-hoc can easily forget cleanup,\nleaking files on disk. Similarly, io.ReadAll is convenient but risks\nOOM on large or malicious inputs.\n\nIntroduce internal/tmpdir to manage all cataloger temp storage under\na s\n[…]\n>\n\n* simplify supplement release to limitreader\n\nSigned-off-by: Will Murphy <willmurphyscode@users.noreply.github.com>\n\n---------\n\nSigned-off-by: Will Murphy <willmurphyscode@users.noreply.github.com>",
          "is_bot": false,
          "headline": "chore: centralize temp files and prefer streaming IO (#4668)",
          "author_name": "Will Murphy",
          "author_login": "willmurphyscode",
          "committed_at": "2026-03-18T14:53:51Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "a3dacf5ecdea6c9ccecb50deebeb9cbe06281314",
          "body": "Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>\nCo-authored-by: spiffcs <32073428+spiffcs@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): update tools to latest versions (#4663)",
          "author_name": "anchore-actions-token-generator[bot]",
          "author_login": "anchore-actions-token-generator[bot]",
          "committed_at": "2026-03-16T15:26:06Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "cccc9bf7f954bea49708da37ceb82d3be70d5039",
          "body": "Bumps the go-minor-patch group with 3 updates: [github.com/google/go-containerregistry](https://github.com/google/go-containerregistry), [github.com/olekukonko/tablewriter](https://github.com/olekukonko/tablewriter) and [golang.org/x/time](https://github.com/golang/time).\n\n\nUpdates `github.com/googl\n[…]\nsion-update:semver-minor\n  dependency-group: go-minor-patch\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump the go-minor-patch group with 3 updates (#4669)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-03-16T15:25:41Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "59f7725d0d8bfe291bfd796f2bb87277b7b45664",
          "body": "Bumps the actions-minor-patch group with 1 update in the / directory: [github/codeql-action](https://github.com/github/codeql-action).\n\n\nUpdates `github/codeql-action` from 4.32.3 to 4.32.6\n- [Release notes](https://github.com/github/codeql-action/releases)\n- [Changelog](https://github.com/github/co\n[…]\nupdate:semver-patch\n  dependency-group: actions-minor-patch\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump github/codeql-action (#4670)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-03-16T15:25:27Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "7a6b1575aee15f0f6bfbfe894c7b09ce56c12069",
          "body": "Bumps [docker/login-action](https://github.com/docker/login-action) from 3.7.0 to 4.0.0.\n- [Release notes](https://github.com/docker/login-action/releases)\n- [Commits](https://github.com/docker/login-action/compare/c94ce9fb468520275223c153574b00df6fe4bcc9...b45d80f862d83dbcd57f89517bcf500b2ab88fb2)\n\n[…]\nirect:production\n  update-type: version-update:semver-major\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump docker/login-action from 3.7.0 to 4.0.0 (#4671)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-03-16T15:25:16Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "92a6b36e890d28207acc1b98ede8e805005149cd",
          "body": "Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>\nCo-authored-by: wagoodman <590471+wagoodman@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): update CPE dictionary index (#4673)",
          "author_name": "anchore-actions-token-generator[bot]",
          "author_login": "anchore-actions-token-generator[bot]",
          "committed_at": "2026-03-16T15:25:05Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "7158535fe6f3971e1ceed0ea4e572a3bf5bced70",
          "body": "BUILDPLATFORM is automatically set to the host's platform in new Docker,\nso having it defined as an arg results in it being overridden by this\nautomatic value. Since it was always assigned to a literal string in the\ntest files, just use that string.\n\nAdditionally, image platform is better pulled fro\n[…]\ne\nimage config, in containerd store, so try that first.\n\nAdditionally, python3 is on PATH on new macs by default, but not python.\n\nSigned-off-by: Will Murphy <willmurphyscode@users.noreply.github.com>",
          "is_bot": false,
          "headline": "chore(tests): fix test fixture build on modern ARM Mac (#4666)",
          "author_name": "Will Murphy",
          "author_login": "willmurphyscode",
          "committed_at": "2026-03-11T13:37:40Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "75455f050ab028977a6b625165e2ad3644fcc845",
          "body": "Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>\nCo-authored-by: willmurphyscode <12529630+willmurphyscode@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): update anchore dependencies (#4631)",
          "author_name": "anchore-actions-token-generator[bot]",
          "author_login": "anchore-actions-token-generator[bot]",
          "committed_at": "2026-03-09T18:10:53Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "22e78c7be17479a6a03212be071894246052abb1",
          "body": "* chore(deps): update tools to latest versions\n\nSigned-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>\n\n* chore(lint): fix errors in new golangci-lint\n\nTwo fixes:\n\nFirst, replace sb.WriteString(fmt.Sprintf(...)) with fmt.Fprintf(&sb, ...)\nSecond, suppress errors w\n[…]\nff-by: Will Murphy <willmurphyscode@users.noreply.github.com>\nCo-authored-by: spiffcs <32073428+spiffcs@users.noreply.github.com>\nCo-authored-by: Will Murphy <willmurphyscode@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): update tools to latest versions (#4630)",
          "author_name": "anchore-actions-token-generator[bot]",
          "author_login": "anchore-actions-token-generator[bot]",
          "committed_at": "2026-03-09T16:17:09Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "d2461a9e0abd29e0c059a0d8cce3441f8fa64335",
          "body": "Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>\nCo-authored-by: wagoodman <590471+wagoodman@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): update SPDX license list (#4637)",
          "author_name": "anchore-actions-token-generator[bot]",
          "author_login": "anchore-actions-token-generator[bot]",
          "committed_at": "2026-03-09T15:02:47Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "01f0e332c2f12bd1d32b525fbd6e255159601573",
          "body": "Bumps [actions/download-artifact](https://github.com/actions/download-artifact) from 7.0.0 to 8.0.0.\n- [Release notes](https://github.com/actions/download-artifact/releases)\n- [Commits](https://github.com/actions/download-artifact/compare/37930b1c2abaa49bbe596cd826c3c89aef350131...70fc10c6e5e1ce46ad\n[…]\nirect:production\n  update-type: version-update:semver-major\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump actions/download-artifact from 7.0.0 to 8.0.0 (#4658)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-03-09T14:37:33Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "c88051d74ec3f1dd83fa5d04e8e910fe49c0bf1d",
          "body": "…638)\n\nBumps [github.com/cloudflare/circl](https://github.com/cloudflare/circl) from 1.6.1 to 1.6.3.\n- [Release notes](https://github.com/cloudflare/circl/releases)\n- [Commits](https://github.com/cloudflare/circl/compare/v1.6.1...v1.6.3)\n\n---\nupdated-dependencies:\n- dependency-name: github.com/cloud\n[…]\nrcl\n  dependency-version: 1.6.3\n  dependency-type: indirect\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump github.com/cloudflare/circl from 1.6.1 to 1.6.3 (#4…",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-03-09T14:34:11Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "7d3d1c6237c6bc67c609b320258a1b3c574542ed",
          "body": "…with 2 updates (#4657)\n\nBumps the actions-minor-patch group with 2 updates in the / directory: [actions/setup-go](https://github.com/actions/setup-go) and [anchore/sbom-action](https://github.com/anchore/sbom-action).\nBumps the actions-minor-patch group with 1 update in the /.github/actions/bootstr\n[…]\nupdate:semver-minor\n  dependency-group: actions-minor-patch\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump the actions-minor-patch group across 2 directories …",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-03-09T14:33:14Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "dcba765d86b5583f153c011db453f115273c44d9",
          "body": "Bumps [actions/upload-artifact](https://github.com/actions/upload-artifact) from 6.0.0 to 7.0.0.\n- [Release notes](https://github.com/actions/upload-artifact/releases)\n- [Commits](https://github.com/actions/upload-artifact/compare/b7c566a772e6b6bfb58ed0dc250532a479d7789f...bbbca2ddaa5d8feaa63e36b76f\n[…]\nirect:production\n  update-type: version-update:semver-major\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump actions/upload-artifact from 6.0.0 to 7.0.0 (#4659)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-03-09T14:32:22Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "2c201469c32eadfef87cea8263fe2cbfaf06bb1a",
          "body": "…(#4646)\n\nBumps [go.opentelemetry.io/otel/sdk](https://github.com/open-telemetry/opentelemetry-go) from 1.39.0 to 1.40.0.\n- [Release notes](https://github.com/open-telemetry/opentelemetry-go/releases)\n- [Changelog](https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md)\n- [Commits\n[…]\ndk\n  dependency-version: 1.40.0\n  dependency-type: indirect\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump go.opentelemetry.io/otel/sdk from 1.39.0 to 1.40.0 …",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-03-09T14:29:46Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "c583da1c15ebc36c5cb35d260bf3d1b31a26d1b7",
          "body": "Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>\nCo-authored-by: wagoodman <590471+wagoodman@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): update CPE dictionary index (#4647)",
          "author_name": "anchore-actions-token-generator[bot]",
          "author_login": "anchore-actions-token-generator[bot]",
          "committed_at": "2026-03-09T14:26:42Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "22014b6022a49a160dbcbdaa9c486a691ac6dafd",
          "body": "…updates (#4661)\n\nBumps the go-minor-patch group with 5 updates in the / directory:\n\n| Package | From | To |\n| --- | --- | --- |\n| [github.com/github/go-spdx/v2](https://github.com/github/go-spdx) | `2.3.6` | `2.4.0` |\n| [github.com/go-git/go-billy/v5](https://github.com/go-git/go-billy) | `5.7.0` |\n[…]\nsion-update:semver-minor\n  dependency-group: go-minor-patch\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump the go-minor-patch group across 1 directory with 5 …",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-03-09T14:20:06Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "b5e85c3ea54b7307337c3e570145ba4ec0436873",
          "body": "* migrate fixtures to testdata\n\nSigned-off-by: Alex Goodman <wagoodman@users.noreply.github.com>\n\n* fix: correct broken symlinks after testdata migration\n\nThe migration from test-fixtures to testdata broke several symlinks:\n- elf-test-fixtures symlinks pointed to old test-fixtures paths\n- elf-test-f\n[…]\nrs.noreply.github.com>\n\n* bump stereoscope commit to main\n\nSigned-off-by: Alex Goodman <wagoodman@users.noreply.github.com>\n\n---------\n\nSigned-off-by: Alex Goodman <wagoodman@users.noreply.github.com>",
          "is_bot": false,
          "headline": "chore: migrate fixtures to testdata (#4651)",
          "author_name": "Alex Goodman",
          "author_login": "wagoodman",
          "committed_at": "2026-03-06T19:42:04Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "35278f3d3d78ee9dd708c75096fc7481f491e180",
          "body": "Signed-off-by: Dimitri John Ledkov <dimitri.ledkov@surgut.co.uk>\nSigned-off-by: Keith Zantow <kzantow@gmail.com>\nCo-authored-by: Keith Zantow <kzantow@gmail.com>",
          "is_bot": false,
          "headline": "fix(java): improve lz4 detection (#4642)",
          "author_name": "Dimitri John Ledkov",
          "author_login": "xnox",
          "committed_at": "2026-02-27T19:38:05Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "db76d85d51632c5ebe077b024206fb77f182bbc8",
          "body": "Signed-off-by: Paweł Pałucha <pawel.palucha@chainguard.dev>",
          "is_bot": false,
          "headline": "fix: use correct hashes for empty files (#4620)",
          "author_name": "Paweł Pałucha",
          "author_login": "ppalucha",
          "committed_at": "2026-02-24T14:52:29Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "e9e7e20cc8ca75334403716e733ac953a5f514ec",
          "body": "Signed-off-by: witchcraze <witchcraze@gmail.com>",
          "is_bot": false,
          "headline": "fix: grafana classifier (#4635)",
          "author_name": "witchcraze",
          "author_login": "witchcraze",
          "committed_at": "2026-02-23T14:38:02Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "eb072deb9ce0395e88523654df5483c2166ce7ea",
          "body": "Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>\nCo-authored-by: wagoodman <590471+wagoodman@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): update CPE dictionary index (#4636)",
          "author_name": "anchore-actions-token-generator[bot]",
          "author_login": "anchore-actions-token-generator[bot]",
          "committed_at": "2026-02-23T13:19:30Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "f4fc2d669a1b9c38292ce94e53d2ee352df5441e",
          "body": "Bumps the actions-minor-patch group with 1 update in the / directory: [github/codeql-action](https://github.com/github/codeql-action).\n\n\nUpdates `github/codeql-action` from 4.31.10 to 4.32.3\n- [Release notes](https://github.com/github/codeql-action/releases)\n- [Changelog](https://github.com/github/c\n[…]\nupdate:semver-minor\n  dependency-group: actions-minor-patch\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump github/codeql-action (#4634)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-02-20T13:41:46Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "f5110f109a0d2682664463857fc9098df14a7441",
          "body": "….0 (#4633)\n\nBumps [github.com/charmbracelet/bubbles](https://github.com/charmbracelet/bubbles) from 0.21.1 to 1.0.0.\n- [Release notes](https://github.com/charmbracelet/bubbles/releases)\n- [Commits](https://github.com/charmbracelet/bubbles/compare/v0.21.1...v1.0.0)\n\n---\nupdated-dependencies:\n- depen\n[…]\nirect:production\n  update-type: version-update:semver-major\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump github.com/charmbracelet/bubbles from 0.21.1 to 1.0…",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-02-20T13:41:21Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "612eadb22eb4d7ec9047a063ade3974fd8487e7c",
          "body": "Bumps the go-minor-patch group with 5 updates:\n\n| Package | From | To |\n| --- | --- | --- |\n| [golang.org/x/mod](https://github.com/golang/mod) | `0.32.0` | `0.33.0` |\n| [golang.org/x/net](https://github.com/golang/net) | `0.49.0` | `0.50.0` |\n| [modernc.org/sqlite](https://gitlab.com/cznic/sqlite) \n[…]\nsion-update:semver-minor\n  dependency-group: go-minor-patch\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump the go-minor-patch group with 5 updates (#4632)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-02-20T13:40:09Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "0a3f7bb06ee168495ee54b8b66fccb22a056fe99",
          "body": "…ams (#4629)\n\n* fix(deb and snaps): prevent excess reads\n\nPreviously, Syft could allocate excess memory or tempfile space if there\nwere highly compressed objects in deb archives, or at paths where the\nkernel changelog was expected by the snap cataloger. Use io.LimitReaders\nfor extracting parts of de\n[…]\ncom>\n\n* use streaming strategy for deb archives\n\nSigned-off-by: Will Murphy <willmurphyscode@users.noreply.github.com>\n\n---------\n\nSigned-off-by: Will Murphy <willmurphyscode@users.noreply.github.com>",
          "is_bot": false,
          "headline": "chore: call cleanup on tmpfile and replace some io.ReadAlls with stre…",
          "author_name": "Will Murphy",
          "author_login": "willmurphyscode",
          "committed_at": "2026-02-17T22:32:35Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "2fe5f9c7b897f44acc23c98531283c5862ba5198",
          "body": "---------\nSigned-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com>",
          "is_bot": false,
          "headline": "fix: bumps go mod version to 1.25; ci takes latest patch (#4628)",
          "author_name": "Christopher Angelo Phillips",
          "author_login": "spiffcs",
          "committed_at": "2026-02-17T17:04:51Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "f70631a7193f597c64820ba838c5566831241959",
          "body": "* chore(deps): update tools to latest versions\n\nSigned-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>\n\n* chore: ci rules revive\n\nSigned-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com>\n\n---------\n\nSigned-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>\nSigned-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com>\nCo-authored-by: spiffcs <32073428+spiffcs@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): update tools to latest versions (#4614)",
          "author_name": "anchore-actions-token-generator[bot]",
          "author_login": "anchore-actions-token-generator[bot]",
          "committed_at": "2026-02-17T16:19:37Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "0bb3741c87788be36cbeaa5b93212fc4db8ca5c2",
          "body": "…th 2 updates (#4622)\n\nBumps the actions-minor-patch group with 2 updates in the / directory: [anchore/sbom-action](https://github.com/anchore/sbom-action) and [zizmorcore/zizmor-action](https://github.com/zizmorcore/zizmor-action).\n\n\nUpdates `anchore/sbom-action` from 0.21.1 to 0.22.2\n- [Release no\n[…]\nupdate:semver-minor\n  dependency-group: actions-minor-patch\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump the actions-minor-patch group across 1 directory wi…",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-02-17T16:16:26Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "458ebbbff823dadf00d16fe5cf1412937765d707",
          "body": "Bumps the go-minor-patch group with 2 updates: [github.com/CycloneDX/cyclonedx-go](https://github.com/CycloneDX/cyclonedx-go) and [github.com/charmbracelet/bubbles](https://github.com/charmbracelet/bubbles).\n\n\nUpdates `github.com/CycloneDX/cyclonedx-go` from 0.9.3 to 0.10.0\n- [Release notes](https:/\n[…]\nsion-update:semver-patch\n  dependency-group: go-minor-patch\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump the go-minor-patch group with 2 updates (#4621)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-02-17T15:14:13Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "fb3f560e439192ae91fa6e2885868d3462673e10",
          "body": "Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>\nCo-authored-by: wagoodman <590471+wagoodman@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): update CPE dictionary index (#4623)",
          "author_name": "anchore-actions-token-generator[bot]",
          "author_login": "anchore-actions-token-generator[bot]",
          "committed_at": "2026-02-17T14:50:12Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "89b901b20ba8d1fc5406b837ef7cf9fe72c50a2d",
          "body": "The namespace value of `redhat` signifies this as an RPM package\nproduced and distributed by Red Hat.\n\nSigned-off-by: Scott Hebert <scoheb@gmail.com>",
          "is_bot": false,
          "headline": "Use redhat as namespace for hummingbird rpms (#4615)",
          "author_name": "Scott Hebert",
          "author_login": "scoheb",
          "committed_at": "2026-02-11T19:19:20Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "9872ff36ba5881f977b6e1b46c7bb33a1147f09e",
          "body": "Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>\nCo-authored-by: willmurphyscode <12529630+willmurphyscode@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): update anchore dependencies (#4613)",
          "author_name": "anchore-actions-token-generator[bot]",
          "author_login": "anchore-actions-token-generator[bot]",
          "committed_at": "2026-02-10T17:19:56Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "31c503124f148a35f9a7510642ad8eb370d33e2a",
          "body": "…#4612)\n\nBumps [github.com/go-git/go-git/v5](https://github.com/go-git/go-git) from 5.16.4 to 5.16.5.\n- [Release notes](https://github.com/go-git/go-git/releases)\n- [Commits](https://github.com/go-git/go-git/compare/v5.16.4...v5.16.5)\n\n---\nupdated-dependencies:\n- dependency-name: github.com/go-git/g\n[…]\nndency-version: 5.16.5\n  dependency-type: direct:production\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump github.com/go-git/go-git/v5 from 5.16.4 to 5.16.5 (…",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-02-10T13:25:31Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "2c5e193f7a27217a8a25d2063874fc396f907468",
          "body": "---------\nSigned-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com>\nSigned-off-by: Alex Goodman <wagoodman@users.noreply.github.com>\nCo-authored-by: Alex Goodman <wagoodman@users.noreply.github.com>",
          "is_bot": false,
          "headline": "feat: Add support for scanning GGUF models from OCI registries (#4335)",
          "author_name": "Christopher Angelo Phillips",
          "author_login": "spiffcs",
          "committed_at": "2026-02-09T21:05:52Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "3a23cfff1d13e662c55b6e2e8b9c411018e1c471",
          "body": "Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>\nCo-authored-by: wagoodman <590471+wagoodman@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): update CPE dictionary index (#4610)",
          "author_name": "anchore-actions-token-generator[bot]",
          "author_login": "anchore-actions-token-generator[bot]",
          "committed_at": "2026-02-09T03:02:34Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "443de210ca819ab1910aa0410eb2400a3409cb36",
          "body": "Bumps the go-minor-patch group with 1 update: [github.com/bmatcuk/doublestar/v4](https://github.com/bmatcuk/doublestar).\n\n\nUpdates `github.com/bmatcuk/doublestar/v4` from 4.9.2 to 4.10.0\n- [Release notes](https://github.com/bmatcuk/doublestar/releases)\n- [Commits](https://github.com/bmatcuk/doublest\n[…]\nsion-update:semver-minor\n  dependency-group: go-minor-patch\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump github.com/bmatcuk/doublestar/v4 (#4606)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-02-06T18:20:24Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "1af8b1acaabf4d0603fe9d1c15b1a5c54bce0e1c",
          "body": "…with 2 updates (#4607)\n\nBumps the actions-minor-patch group with 1 update in the / directory: [docker/login-action](https://github.com/docker/login-action).\nBumps the actions-minor-patch group with 1 update in the /.github/actions/bootstrap directory: [actions/cache](https://github.com/actions/cach\n[…]\nupdate:semver-patch\n  dependency-group: actions-minor-patch\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump the actions-minor-patch group across 2 directories …",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-02-06T18:20:12Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "c185657d71f1786ebf40bc89ec1f448c27bb5bde",
          "body": "---------\nSigned-off-by: Rez Moss <hi@rezmoss.com>\nSigned-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com>\nCo-authored-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com>",
          "is_bot": false,
          "headline": "feat: add yarn lock dev dep detection; fixed #4548",
          "author_name": "Rez Moss",
          "author_login": "rezmoss",
          "committed_at": "2026-02-05T22:27:17Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "48ee12be0c1d7c24d91ea808a65f3eb4ff5319e8",
          "body": "Otherwise sometimes the test that reads will run during the test that\nwrites and fail because the yaml file is in a partially written state.\n\nSigned-off-by: Will Murphy <willmurphyscode@users.noreply.github.com>",
          "is_bot": false,
          "headline": "ci(generate-capabilities): serialize writing and reading yaml (#4602)",
          "author_name": "Will Murphy",
          "author_login": "willmurphyscode",
          "committed_at": "2026-02-05T16:35:45Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "0b05f0ed69fb853a465fcc0b2b9de08bad96c752",
          "body": "Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>\nCo-authored-by: willmurphyscode <12529630+willmurphyscode@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): update CPE dictionary index (#4601)",
          "author_name": "anchore-actions-token-generator[bot]",
          "author_login": "anchore-actions-token-generator[bot]",
          "committed_at": "2026-02-05T15:29:00Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "138cb1be0ef8c352e4e721827c118e755baf158f",
          "body": "* fix(cpe-generation): set start and end date\n\nPreviously, the update job was silently failing because the NVD API\nreturns a 404 with no body if a start date is specified but not an end\ndate. Further, the API returns an error if more than 120 days are in\nrange of the start and end date.\n\nUpdate the \n[…]\nmperative code to page through the API results.\n\nSigned-off-by: Will Murphy <willmurphyscode@users.noreply.github.com>\n\n---------\n\nSigned-off-by: Will Murphy <willmurphyscode@users.noreply.github.com>",
          "is_bot": false,
          "headline": "fix(cpe-generation): set start and end date (#4600)",
          "author_name": "Will Murphy",
          "author_login": "willmurphyscode",
          "committed_at": "2026-02-05T14:54:24Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "6755377554b81879a9117abc1e006fd74177a3c8",
          "body": "NVD uses \"aomedia\" as the vendor for libavif CVEs. This change adds\nlibavif to the APK package CPE candidate additions with \"aomedia\" as\nan additional vendor, enabling Syft/Grype to match CVEs like\nCVE-2025-48174 and CVE-2025-48175.\n\nSigned-off-by: Peter Bücker <peter.buecker@gmail.com>",
          "is_bot": false,
          "headline": "fix: CPE detection for APK libavif to use aomedia vendor (#4597)",
          "author_name": "Peter Bücker",
          "author_login": "naag",
          "committed_at": "2026-02-05T09:11:44Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "540c08a41b60247fed21823569dc9f825d3bcd09",
          "body": "Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>\nCo-authored-by: spiffcs <32073428+spiffcs@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): update tools to latest versions (#4594)",
          "author_name": "anchore-actions-token-generator[bot]",
          "author_login": "anchore-actions-token-generator[bot]",
          "committed_at": "2026-02-04T14:26:09Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "add262944666021711374ab977fba837cff21ad6",
          "body": "Signed-off-by: Keith Zantow <kzantow@gmail.com>",
          "is_bot": false,
          "headline": "fix: further improve go binary classifier, including windows (#4593)",
          "author_name": "Keith Zantow",
          "author_login": "kzantow",
          "committed_at": "2026-02-03T15:29:00Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "d22139ef1a7fa2da4797347bb69421a0925c847e",
          "body": "Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>\nCo-authored-by: spiffcs <32073428+spiffcs@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): update tools to latest versions (#4589)",
          "author_name": "anchore-actions-token-generator[bot]",
          "author_login": "anchore-actions-token-generator[bot]",
          "committed_at": "2026-02-02T17:59:57Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "c94d1ccf1c6219da41cf1ad01c9c8473d62fdc12",
          "body": "---------\nSigned-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com>",
          "is_bot": false,
          "headline": "fix: lookup alternate scheme on url->licenseID (#4588)",
          "author_name": "Christopher Angelo Phillips",
          "author_login": "spiffcs",
          "committed_at": "2026-01-30T19:25:27Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "69d0898918c480c87f703e55d687095c2afe26f2",
          "body": "Bumps the go-minor-patch group with 2 updates: [github.com/olekukonko/tablewriter](https://github.com/olekukonko/tablewriter) and [modernc.org/sqlite](https://gitlab.com/cznic/sqlite).\n\n\nUpdates `github.com/olekukonko/tablewriter` from 1.1.2 to 1.1.3\n- [Release notes](https://github.com/olekukonko/t\n[…]\nsion-update:semver-patch\n  dependency-group: go-minor-patch\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump the go-minor-patch group with 2 updates (#4583)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-01-30T16:24:34Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "94c80885427218e91399cafd5b498342356033eb",
          "body": "---------\nSigned-off-by: Rez Moss <hi@rezmoss.com>\nSigned-off-by: Christopher Angelo Phillips <32073428+spiffcs@users.noreply.github.com>\nCo-authored-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com>",
          "is_bot": false,
          "headline": "feat: add Qt6 binary detection (#4550)",
          "author_name": "Rez Moss",
          "author_login": "rezmoss",
          "committed_at": "2026-01-30T15:35:33Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "e136ebc44fa5d2f5311fefce268334b8b8e3b8dc",
          "body": "…th 2 updates (#4584)\n\nBumps the actions-minor-patch group with 2 updates in the / directory: [peter-evans/create-pull-request](https://github.com/peter-evans/create-pull-request) and [zizmorcore/zizmor-action](https://github.com/zizmorcore/zizmor-action).\n\n\nUpdates `peter-evans/create-pull-request`\n[…]\nupdate:semver-minor\n  dependency-group: actions-minor-patch\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump the actions-minor-patch group across 1 directory wi…",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-01-30T15:33:32Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "0bca34f98656351d8b8bfc02064df06f7fb16c26",
          "body": "…age (#4500)\n\nSigned-off-by: Alan Pope <alan@popey.com>\nSigned-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com>\nCo-authored-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com>",
          "is_bot": false,
          "headline": "fix: snap cataloger incorrectly identifies snap container as deb pack…",
          "author_name": "Alan Pope",
          "author_login": null,
          "committed_at": "2026-01-30T15:19:26Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "8d836fb8b0b80f1702c9d1c57a8655307ac85b14",
          "body": "Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>\nCo-authored-by: spiffcs <32073428+spiffcs@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): update tools to latest versions (#4577)",
          "author_name": "anchore-actions-token-generator[bot]",
          "author_login": "anchore-actions-token-generator[bot]",
          "committed_at": "2026-01-27T20:18:18Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "9a250a4b4bec1660aef5a70b91d76e46f10f7fd0",
          "body": "---------\nSigned-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com>",
          "is_bot": false,
          "headline": "fix: update mixed case dependencies in python to be normalized (#4573)",
          "author_name": "Christopher Angelo Phillips",
          "author_login": "spiffcs",
          "committed_at": "2026-01-27T20:16:32Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "e8b4527bfbb7780cd70f2541fce4dca58803fb53",
          "body": "Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>\nCo-authored-by: willmurphyscode <12529630+willmurphyscode@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): update anchore dependencies (#4575)",
          "author_name": "anchore-actions-token-generator[bot]",
          "author_login": "anchore-actions-token-generator[bot]",
          "committed_at": "2026-01-27T10:14:26Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "d0bb042d7404c43f2aae2ce0bb8952d3362274dc",
          "body": "Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>\nCo-authored-by: spiffcs <32073428+spiffcs@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): update tools to latest versions (#4570)",
          "author_name": "anchore-actions-token-generator[bot]",
          "author_login": "anchore-actions-token-generator[bot]",
          "committed_at": "2026-01-26T17:25:31Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "c65d0236681800ee5ccf9b87ed99af40d2451d77",
          "body": "Signed-off-by: Keith Zantow <kzantow@gmail.com>",
          "is_bot": false,
          "headline": "feat: detect Debian version from /etc/debian_version (#4569)",
          "author_name": "Keith Zantow",
          "author_login": "kzantow",
          "committed_at": "2026-01-23T22:52:21Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "836f358cd4c413be291c5e4e15a96e93e1739e72",
          "body": "Signed-off-by: Keith Zantow <kzantow@gmail.com>",
          "is_bot": false,
          "headline": "fix: correctly report supporting evidence for binary packages (#4558)",
          "author_name": "Keith Zantow",
          "author_login": "kzantow",
          "committed_at": "2026-01-23T18:01:12Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "27b1219e9854bdb7ad0a39d5d21cce082c45e351",
          "body": "…with 3 updates (#4568)\n\nBumps the actions-minor-patch group with 3 updates in the / directory: [actions/checkout](https://github.com/actions/checkout), [actions/setup-go](https://github.com/actions/setup-go) and [github/codeql-action](https://github.com/github/codeql-action).\nBumps the actions-mino\n[…]\nupdate:semver-minor\n  dependency-group: actions-minor-patch\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump the actions-minor-patch group across 2 directories …",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-01-23T15:37:23Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "c0e0058c86c576a542bb93bea0874b4ae4def1c9",
          "body": "Bumps the go-minor-patch group with 6 updates:\n\n| Package | From | To |\n| --- | --- | --- |\n| [github.com/github/go-spdx/v2](https://github.com/github/go-spdx) | `2.3.5` | `2.3.6` |\n| [github.com/go-viper/mapstructure/v2](https://github.com/go-viper/mapstructure) | `2.4.0` | `2.5.0` |\n| [golang.org/\n[…]\nsion-update:semver-minor\n  dependency-group: go-minor-patch\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump the go-minor-patch group with 6 updates (#4567)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-01-23T15:37:10Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "a9fabb6c0f77b512c5712680bf52feb48f99a8ba",
          "body": "Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>\nCo-authored-by: spiffcs <32073428+spiffcs@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): update tools to latest versions (#4565)",
          "author_name": "anchore-actions-token-generator[bot]",
          "author_login": "anchore-actions-token-generator[bot]",
          "committed_at": "2026-01-22T18:04:45Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "795432441754b910d4456fa982eb7df64c98b432",
          "body": "Bumps the go-minor-patch group with 1 update in the / directory: [github.com/spdx/tools-golang](https://github.com/spdx/tools-golang).\n\n\nUpdates `github.com/spdx/tools-golang` from 0.5.6 to 0.5.7\n- [Release notes](https://github.com/spdx/tools-golang/releases)\n- [Changelog](https://github.com/spdx/t\n[…]\nsion-update:semver-patch\n  dependency-group: go-minor-patch\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump github.com/spdx/tools-golang (#4557)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-01-16T18:04:13Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "3e563d90d5025ec42719f2d0bdb355563a32577d",
          "body": "* ci: enable zizmor to fail PRs\n\nEnable zizmor (gh actions yaml linter) to fail builds in PRs. Fix any\noutstanding linting errors found by this tool.\n\nSigned-off-by: Will Murphy <willmurphyscode@users.noreply.github.com>\n\n* fix outdated version comments\n\nSigned-off-by: Will Murphy <willmurphyscode@users.noreply.github.com>\n\n---------\n\nSigned-off-by: Will Murphy <willmurphyscode@users.noreply.github.com>",
          "is_bot": false,
          "headline": "ci: enable zizmor to fail PRs (#4556)",
          "author_name": "Will Murphy",
          "author_login": "willmurphyscode",
          "committed_at": "2026-01-16T15:49:00Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "5987f463533aca5afc3625cff16090207a71b742",
          "body": "* chore: new slack action\n\nSigned-off-by: Will Murphy <willmurphyscode@users.noreply.github.com>\n\n* TEMP: exit 1 to test slack notify\n\nSigned-off-by: Will Murphy <willmurphyscode@users.noreply.github.com>\n\n* new slack integration everywhere\n\nSigned-off-by: Will Murphy <willmurphyscode@users.noreply.github.com>\n\n---------\n\nSigned-off-by: Will Murphy <willmurphyscode@users.noreply.github.com>",
          "is_bot": false,
          "headline": "Chore new slack action (#4553)",
          "author_name": "Will Murphy",
          "author_login": "willmurphyscode",
          "committed_at": "2026-01-16T11:26:40Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "63927ab49feea10a7fd88191acd615667227d338",
          "body": "Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>\nCo-authored-by: willmurphyscode <12529630+willmurphyscode@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): update anchore dependencies (#4552)",
          "author_name": "anchore-actions-token-generator[bot]",
          "author_login": "anchore-actions-token-generator[bot]",
          "committed_at": "2026-01-15T21:33:35Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "308b8030e78b2b64d862a6592a777d39a3ec647d",
          "body": "Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>\nCo-authored-by: spiffcs <32073428+spiffcs@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): update tools to latest versions (#4551)",
          "author_name": "anchore-actions-token-generator[bot]",
          "author_login": "anchore-actions-token-generator[bot]",
          "committed_at": "2026-01-15T12:30:10Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "6d8a03b3759ab3c74261fa0aeec127c8a3d3ce9f",
          "body": "Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>\nCo-authored-by: spiffcs <32073428+spiffcs@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): update tools to latest versions (#4545)",
          "author_name": "anchore-actions-token-generator[bot]",
          "author_login": "anchore-actions-token-generator[bot]",
          "committed_at": "2026-01-12T16:05:17Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "55a190aed1608103733d4f75c6454658fa69da22",
          "body": "Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>\nCo-authored-by: spiffcs <32073428+spiffcs@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): update tools to latest versions (#4542)",
          "author_name": "anchore-actions-token-generator[bot]",
          "author_login": "anchore-actions-token-generator[bot]",
          "committed_at": "2026-01-09T18:14:13Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "695bbcc4f9c686030f20a19ed8a8f7f64ffb816e",
          "body": "Bumps the go-minor-patch group with 4 updates: [github.com/vbatts/go-mtree](https://github.com/vbatts/go-mtree), [modernc.org/sqlite](https://gitlab.com/cznic/sqlite), [github.com/goccy/go-yaml](https://github.com/goccy/go-yaml) and [github.com/gpustack/gguf-parser-go](https://github.com/gpustack/gg\n[…]\nsion-update:semver-minor\n  dependency-group: go-minor-patch\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump the go-minor-patch group with 4 updates (#4543)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-01-09T18:13:56Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "6d206910f04b65cb47e1d89a82fddb8fb08bac97",
          "body": "Bumps the actions-minor-patch group with 1 update in the / directory: [anchore/sbom-action](https://github.com/anchore/sbom-action).\n\n\nUpdates `anchore/sbom-action` from 0.21.0 to 0.21.1\n- [Release notes](https://github.com/anchore/sbom-action/releases)\n- [Changelog](https://github.com/anchore/sbom-\n[…]\nupdate:semver-patch\n  dependency-group: actions-minor-patch\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump anchore/sbom-action (#4544)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-01-09T18:13:44Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "2f3a504acfba83982351fff32f78d19d5c31bbf4",
          "body": "* fixed #4550, catalog mongodb bin\n\nSigned-off-by: Rez Moss <hi@rezmoss.com>\n\n* fixed #4550, catalog mongodb bin\n\nSigned-off-by: Rez Moss <hi@rezmoss.com>\n\n---------\n\nSigned-off-by: Rez Moss <hi@rezmoss.com>",
          "is_bot": false,
          "headline": "Feat/catalog mongodb bin (#4541)",
          "author_name": "Rez Moss",
          "author_login": "rezmoss",
          "committed_at": "2026-01-08T17:18:51Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "d24e843c45c97c3ca4601ed6bdc2c9370900b452",
          "body": "Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>\nCo-authored-by: spiffcs <32073428+spiffcs@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): update tools to latest versions (#4537)",
          "author_name": "anchore-actions-token-generator[bot]",
          "author_login": "anchore-actions-token-generator[bot]",
          "committed_at": "2026-01-08T16:56:50Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "83a4528fff72da874958ba6d0ea7fe012552e408",
          "body": "A CI failure was observed where a generated file was only partly written\nwhen the CI job immediately tried to read it. Put in an fs.Sync call to\neliminate this flakiness.\n\nSigned-off-by: Will Murphy <willmurphyscode@users.noreply.github.com>",
          "is_bot": false,
          "headline": "chore: sync generated file immediately (#4538)",
          "author_name": "Will Murphy",
          "author_login": "willmurphyscode",
          "committed_at": "2026-01-08T14:01:17Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "11e871566b35765fe69da439fa3beaef123bc143",
          "body": "Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>\nCo-authored-by: willmurphyscode <12529630+willmurphyscode@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): update anchore dependencies (#4535)",
          "author_name": "anchore-actions-token-generator[bot]",
          "author_login": "anchore-actions-token-generator[bot]",
          "committed_at": "2026-01-08T12:16:49Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "cc1a7dfae896b46616d0885de4b93328aa5f0734",
          "body": "Signed-off-by: promalert <promalert@outlook.com>",
          "is_bot": false,
          "headline": "chore: fix some comments to improve readability (#4533)",
          "author_name": "promalert",
          "author_login": "promalert",
          "committed_at": "2026-01-07T15:48:40Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "3a3a86eb017bc3ccd290e38cfed2fa2ae8396830",
          "body": "* fixed #4430 exclude dev pnpm pkg\n\nSigned-off-by: Rez Moss <hi@rezmoss.com>\n\n* use existing dev deps option\n\nSigned-off-by: Alex Goodman <wagoodman@users.noreply.github.com>\n\n* fixed #4430 exclude dev pnpm pkg, add test\n\nSigned-off-by: Rez Moss <hi@rezmoss.com>\n\n* fixed #4430 exclude dev pnpm pkg, \n[…]\n<hi@rezmoss.com>\n\n---------\n\nSigned-off-by: Rez Moss <hi@rezmoss.com>\nSigned-off-by: Alex Goodman <wagoodman@users.noreply.github.com>\nCo-authored-by: Alex Goodman <wagoodman@users.noreply.github.com>",
          "is_bot": false,
          "headline": "fixed #4430 exclude dev pnpm pkg (#4487)",
          "author_name": "Rez Moss",
          "author_login": "rezmoss",
          "committed_at": "2026-01-07T15:39:16Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "6509b7079ee2ce7f2efc31ba35426c6d4ffb25b5",
          "body": "Signed-off-by: witchcraze <witchcraze@gmail.com>",
          "is_bot": false,
          "headline": "add istio classifier (#4521)",
          "author_name": "witchcraze",
          "author_login": "witchcraze",
          "committed_at": "2026-01-07T15:36:39Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "7f1d57d06fde14ec26566832dff44828ab5a4da9",
          "body": "Signed-off-by: Rez Moss <hi@rezmoss.com>",
          "is_bot": false,
          "headline": "feat: detect older bitnami img packages (#4532)",
          "author_name": "Rez Moss",
          "author_login": "rezmoss",
          "committed_at": "2026-01-07T15:07:33Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "ed339e4fed10912d7ed9b98c588ec38241fb020b",
          "body": "---------\nSigned-off-by: Alex Goodman <wagoodman@users.noreply.github.com>",
          "is_bot": false,
          "headline": "fix: ensure java image build failures stop the build (#4531)",
          "author_name": "Alex Goodman",
          "author_login": "wagoodman",
          "committed_at": "2026-01-06T16:43:51Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "3ea6a03cd060096fd67841759008bb2efc215371",
          "body": "* chore(deps): bump the go-minor-patch group with 3 updates\n\nBumps the go-minor-patch group with 3 updates: [github.com/BurntSushi/toml](https://github.com/BurntSushi/toml), [github.com/go-git/go-git/v5](https://github.com/go-git/go-git) and [github.com/invopop/jsonschema](https://github.com/invopop\n[…]\n Alex Goodman <wagoodman@users.noreply.github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>\nCo-authored-by: Alex Goodman <wagoodman@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump the go-minor-patch group with 3 updates (#4524)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-01-06T15:25:43Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "81dd9558714639a848d6a843988106c6ddb5d943",
          "body": "* add envoy classifier\nSigned-off-by: witchcraze <witchcraze@gmail.com>\n\n* add envoy classifier\nSigned-off-by: witchcraze <witchcraze@gmail.com>",
          "is_bot": false,
          "headline": "add envoy binary classifier (#4530)",
          "author_name": "witchcraze",
          "author_login": "witchcraze",
          "committed_at": "2026-01-06T13:45:01Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "48948ddb8fa886631fc920f4a66999e9eaba5634",
          "body": "Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>",
          "is_bot": false,
          "headline": "add container support for graalvm fixture (#4528)",
          "author_name": "Alex Goodman",
          "author_login": "wagoodman",
          "committed_at": "2026-01-05T19:18:12Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "63273b1b00da98af439be767505484ee61e5c5a5",
          "body": "…th 2 updates (#4525)\n\nBumps the actions-minor-patch group with 2 updates in the / directory: [docker/login-action](https://github.com/docker/login-action) and [zizmorcore/zizmor-action](https://github.com/zizmorcore/zizmor-action).\n\n\nUpdates `docker/login-action` from 3.5.0 to 3.6.0\n- [Release note\n[…]\nupdate:semver-minor\n  dependency-group: actions-minor-patch\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump the actions-minor-patch group across 1 directory wi…",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-01-05T17:48:30Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "92e523caa61d863bcb8d36205eb9ef90dd00f4c8",
          "body": "Bumps [actions/download-artifact](https://github.com/actions/download-artifact) from 6.0.0 to 7.0.0.\n- [Release notes](https://github.com/actions/download-artifact/releases)\n- [Commits](https://github.com/actions/download-artifact/compare/018cc2cf5baa6db3ef3c5f8a56943fffe632ef53...37930b1c2abaa49bbe\n[…]\nirect:production\n  update-type: version-update:semver-major\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump actions/download-artifact from 6.0.0 to 7.0.0 (#4526)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-01-05T17:48:20Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "9b33b8a3d61be74b65e6df790ab5199118f7b010",
          "body": "Bumps [actions/upload-artifact](https://github.com/actions/upload-artifact) from 4.4.3 to 6.0.0.\n- [Release notes](https://github.com/actions/upload-artifact/releases)\n- [Commits](https://github.com/actions/upload-artifact/compare/b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882...b7c566a772e6b6bfb58ed0dc25\n[…]\nirect:production\n  update-type: version-update:semver-major\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump actions/upload-artifact from 4.4.3 to 6.0.0 (#4527)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-01-05T17:48:13Z",
          "body_truncated": true,
          "is_coding_agent": false
        }
      ],
      "releases_count": 49,
      "commits_last_year": 375,
      "latest_release_at": "2021-09-27T22:31:59Z",
      "latest_release_tag": "v0.24.1",
      "releases_from_tags": true,
      "days_since_last_push": 116,
      "active_weeks_last_year": 34,
      "days_since_latest_release": 1761,
      "mean_days_between_releases": 11.1
    },
    "community": {
      "has_readme": false,
      "has_license": false,
      "has_description": false,
      "has_contributing": false,
      "health_percentage": null,
      "has_issue_template": false,
      "has_code_of_conduct": false,
      "has_pull_request_template": false
    },
    "ecosystem": {
      "packages": [
        {
          "name": "github.com/anchore/syft",
          "exists": true,
          "license": null,
          "keywords": [],
          "ecosystem": "go",
          "matches_repo": false,
          "registry_url": "https://pkg.go.dev/github.com/anchore/syft",
          "is_deprecated": false,
          "latest_version": "v1.49.0",
          "repository_url": "https://github.com/anchore/syft",
          "versions_count": 268,
          "total_downloads": null,
          "dependents_count": null,
          "deprecation_note": null,
          "maintainers_count": null,
          "monthly_downloads": null,
          "first_published_at": null,
          "latest_published_at": "2026-07-20T18:04:57Z",
          "latest_version_yanked": null,
          "days_since_latest_publish": 4
        }
      ]
    },
    "popularity": {
      "forks": 0,
      "stars": 0,
      "watchers": 0,
      "fork_history": {
        "days": [],
        "complete": true,
        "collected": 0,
        "total_forks": 0
      },
      "star_history": {
        "days": [],
        "complete": true,
        "collected": 0,
        "total_stars": 0,
        "collected_at": null
      },
      "open_issues_and_prs": 0
    },
    "ai_readiness": {
      "has_nix": false,
      "example_dirs": [
        "example",
        "examples",
        "sample"
      ],
      "has_llms_txt": false,
      "has_dockerfile": true,
      "has_mcp_signal": false,
      "bootstrap_files": [
        "Makefile",
        "Taskfile.yaml",
        "cmd/syft/internal/test/integration/testdata/Makefile",
        "schema/cyclonedx/Makefile",
        "syft/file/cataloger/executable/testdata/Makefile",
        "syft/file/cataloger/executable/testdata/elf/Makefile",
        "syft/file/cataloger/executable/testdata/elf/project/Makefile",
        "syft/file/cataloger/executable/testdata/shared-info/Makefile",
        "syft/file/cataloger/executable/testdata/shared-info/project/Makefile",
        "syft/file/cataloger/executable/testdata/shared-info/project/hello/Makefile",
        "syft/file/cataloger/executable/testdata/shared-info/project/libhello/Makefile",
        "syft/pkg/cataloger/binary/testdata/Makefile",
        "syft/pkg/cataloger/binary/testdata/elf-testdata/elfbinwithcorrupt/elfsrc/makefile",
        "syft/pkg/cataloger/binary/testdata/elf-testdata/elfbinwithcorrupt/makefile",
        "syft/pkg/cataloger/binary/testdata/elf-testdata/elfbinwithnestedlib/elfsrc/makefile",
        "syft/pkg/cataloger/binary/testdata/elf-testdata/elfbinwithnestedlib/makefile",
        "syft/pkg/cataloger/binary/testdata/elf-testdata/elfbinwithsisterlib/elfsrc1/makefile",
        "syft/pkg/cataloger/binary/testdata/elf-testdata/elfbinwithsisterlib/elfsrc2/makefile",
        "syft/pkg/cataloger/binary/testdata/elf-testdata/elfbinwithsisterlib/makefile",
        "syft/pkg/cataloger/dotnet/testdata/Makefile",
        "syft/pkg/cataloger/golang/testdata/Makefile",
        "syft/pkg/cataloger/golang/testdata/archs/Makefile",
        "syft/pkg/cataloger/internal/pe/testdata/Makefile",
        "syft/pkg/cataloger/java/testdata/Makefile",
        "syft/pkg/cataloger/java/testdata/jar-metadata/Makefile",
        "syft/pkg/cataloger/java/testdata/java-builds/Makefile",
        "syft/pkg/cataloger/kernel/testdata/Makefile",
        "syft/pkg/cataloger/redhat/testdata/Makefile",
        "test/cli/testdata/Makefile",
        "test/cli/testdata/image-java-spdx-tools/Makefile",
        "test/cli/testdata/registry/Makefile",
        "test/install/Makefile"
      ],
      "api_schema_files": [],
      "has_devcontainer": false,
      "typecheck_configs": [],
      "toolchain_manifests": [
        "cmd/syft/internal/test/integration/testdata/image-go-bin-arch-coverage/go.mod",
        "cmd/syft/internal/test/integration/testdata/image-pkg-coverage/pkgs/go/go.mod",
        "cmd/syft/internal/test/integration/testdata/image-pkg-coverage/pkgs/java/pom.xml",
        "cmd/syft/internal/test/integration/testdata/image-sbom-cataloger/go.mod",
        "go.mod",
        "syft/pkg/cataloger/dotnet/testdata/image-net2-app/src/helloworld.csproj",
        "syft/pkg/cataloger/dotnet/testdata/image-net6-asp-libman/src/LibManSample.csproj",
        "syft/pkg/cataloger/dotnet/testdata/image-net8-app-no-depjson/src/dotnetapp.csproj",
        "syft/pkg/cataloger/dotnet/testdata/image-net8-app-self-contained/src/dotnetapp.csproj",
        "syft/pkg/cataloger/dotnet/testdata/image-net8-app-single-file/src/dotnetapp.csproj",
        "syft/pkg/cataloger/dotnet/testdata/image-net8-app-with-runtime-nodepsjson/src/dotnetapp.csproj",
        "syft/pkg/cataloger/dotnet/testdata/image-net8-app-with-runtime/src/dotnetapp.csproj",
        "syft/pkg/cataloger/dotnet/testdata/image-net8-app/src/dotnetapp.csproj",
        "syft/pkg/cataloger/dotnet/testdata/image-net8-compile-target/src/helloworld.csproj",
        "syft/pkg/cataloger/dotnet/testdata/image-net8-ilrepack/src/dotnetapp.csproj",
        "syft/pkg/cataloger/dotnet/testdata/image-net8-privateassets/src/dotnetapp.csproj",
        "syft/pkg/cataloger/golang/internal/gotestdata/go-source/go.mod",
        "syft/pkg/cataloger/golang/testdata/archs/src/go.mod",
        "syft/pkg/cataloger/golang/testdata/corrupt/go.mod",
        "syft/pkg/cataloger/golang/testdata/glob-paths/src/go.mod",
        "syft/pkg/cataloger/golang/testdata/go-mod-fixtures/many-packages/go.mod",
        "syft/pkg/cataloger/golang/testdata/go-mod-fixtures/one-package/go.mod",
        "syft/pkg/cataloger/golang/testdata/go-mod-fixtures/relative-replace/go.mod",
        "syft/pkg/cataloger/golang/testdata/go-sum-hashes/go.mod",
        "syft/pkg/cataloger/golang/testdata/image-not-a-module/go.mod",
        "syft/pkg/cataloger/golang/testdata/image-small-upx/go.mod",
        "syft/pkg/cataloger/golang/testdata/image-small/go.mod",
        "syft/pkg/cataloger/internal/pe/testdata/image-dotnet31-single-file/src/hello.csproj",
        "syft/pkg/cataloger/internal/pe/testdata/image-dotnet5-single-file/src/hello.csproj",
        "syft/pkg/cataloger/internal/pe/testdata/image-dotnet6-single-file/src/hello.csproj",
        "syft/pkg/cataloger/java/internal/maven/testdata/local/child-1/pom.xml",
        "syft/pkg/cataloger/java/internal/maven/testdata/local/child-2/pom.xml",
        "syft/pkg/cataloger/java/internal/maven/testdata/local/child-3/pom.xml",
        "syft/pkg/cataloger/java/internal/maven/testdata/local/circular-1/pom.xml",
        "syft/pkg/cataloger/java/internal/maven/testdata/local/circular-2/pom.xml",
        "syft/pkg/cataloger/java/internal/maven/testdata/local/contains-child-1/pom.xml",
        "syft/pkg/cataloger/java/internal/maven/testdata/local/parent-1/pom.xml",
        "syft/pkg/cataloger/java/internal/maven/testdata/local/parent-2/pom.xml",
        "syft/pkg/cataloger/java/internal/maven/testdata/local/parent-3/pom.xml",
        "syft/pkg/cataloger/java/testdata/corrupt/pom.xml",
        "syft/pkg/cataloger/java/testdata/glob-paths/src/pom.xml",
        "syft/pkg/cataloger/java/testdata/gradle/build.gradle",
        "syft/pkg/cataloger/java/testdata/jar-metadata/api-all-2.0.0-sources/META-INF/maven/org.apache.directory.api/api-all/pom.xml",
        "syft/pkg/cataloger/java/testdata/jar-metadata/api-all-2.0.0-sources/META-INF/maven/org.apache.directory.api/api-asn1-api/pom.xml",
        "syft/pkg/cataloger/java/testdata/jar-metadata/com.fasterxml.jackson.core.jackson-core-2.15.2/META-INF/maven/com.fasterxml.jackson.core/jackson-core/pom.xml",
        "syft/pkg/cataloger/java/testdata/jar-metadata/commons-lang3-3.12.0/META-INF/maven/org.apache.commons-lang3/pom.xml",
        "syft/pkg/cataloger/java/testdata/jar-metadata/jackson-core-2.15.2/META-INF/maven/com.fasterxml.jackson.core/jackson-core/pom.xml",
        "syft/pkg/cataloger/java/testdata/jar-metadata/micronaut-aop-4.9.11/META-INF/maven/io.micronaut/micronaut-aop/pom.xml",
        "syft/pkg/cataloger/java/testdata/jar-metadata/multiple-matching-2.11.5/META-INF/maven/org.multiple/multiple-matching-1/pom.xml",
        "syft/pkg/cataloger/java/testdata/jar-metadata/multiple-matching-2.11.5/META-INF/maven/org.multiple/multiple-matching-2/pom.xml",
        "syft/pkg/cataloger/java/testdata/jar-metadata/multiple-matching-2.11.5/META-INF/maven/org.multiple/multiple-matching-3/pom.xml",
        "syft/pkg/cataloger/java/testdata/jar-metadata/opensaml-core-3.4.6/META-INF/maven/org.opensaml/opensaml-core/pom.xml",
        "syft/pkg/cataloger/java/testdata/jar-metadata/org.multiple-thename/META-INF/maven/com.multiple/thename/pom.xml",
        "syft/pkg/cataloger/java/testdata/jar-metadata/org.multiple-thename/META-INF/maven/org.multiple/thename/pom.xml",
        "syft/pkg/cataloger/java/testdata/java-builds/example-java-app/build.gradle",
        "syft/pkg/cataloger/java/testdata/java-builds/example-java-app/pom.xml",
        "syft/pkg/cataloger/java/testdata/java-builds/example-jenkins-plugin/pom.xml",
        "syft/pkg/cataloger/java/testdata/java-builds/example-sb-app/pom.xml",
        "syft/pkg/cataloger/java/testdata/pom/commons-text-1.10.0/pom.xml",
        "syft/pkg/cataloger/java/testdata/pom/example-java-app-maven/pom.xml",
        "syft/pkg/cataloger/java/testdata/pom/transitive-top-level/pom.xml",
        "syft/pkg/cataloger/rust/testdata/image-audit/Cargo.toml"
      ],
      "largest_source_bytes": 202860,
      "source_files_sampled": 1197,
      "oversized_source_files": 6,
      "agent_instruction_files": [],
      "agent_instruction_max_bytes": null
    },
    "dependencies": {
      "manifests": [
        "go.mod"
      ],
      "advisories": {
        "error": null,
        "scope": "repository_graph",
        "source": "osv",
        "findings": [
          {
            "name": "github.com/containerd/containerd/v2",
            "direct": false,
            "version": "v2.2.1",
            "severity": "critical",
            "ecosystem": "go",
            "cvss_score": 9.9,
            "advisory_ids": [
              "GHSA-33vj-92qq-66hc",
              "GHSA-cvxm-645q-p574",
              "GHSA-fqw6-gf59-qr4w",
              "GHSA-jpcc-p29g-p8mq",
              "GHSA-rgh6-rfwx-v388",
              "GHSA-xhf5-7wjv-pqxp",
              "GO-2026-5064",
              "GO-2026-5338",
              "GO-2026-5378",
              "GO-2026-5475"
            ],
            "fixed_version": "2.3.2",
            "advisory_count": 12,
            "oldest_advisory_days": 64
          },
          {
            "name": "golang.org/x/crypto",
            "direct": false,
            "version": "v0.49.0",
            "severity": "critical",
            "ecosystem": "go",
            "cvss_score": 10,
            "advisory_ids": [
              "GHSA-45gg-vh54-h5m9",
              "GHSA-5cgq-3rg8-m6cv",
              "GHSA-78mq-xcr3-xm33",
              "GHSA-89gr-r52h-f8rx",
              "GHSA-9m57-25v3-79x9",
              "GHSA-f5wc-c3c7-36mc",
              "GHSA-jppx-rxg9-jmrx",
              "GHSA-q4h4-gmj2-qvw2",
              "GHSA-qpw4-5x99-6vjp",
              "GHSA-rm3j-f69w-wqmq"
            ],
            "fixed_version": "0.52.0",
            "advisory_count": 27,
            "oldest_advisory_days": 64
          },
          {
            "name": "google.golang.org/grpc",
            "direct": false,
            "version": "v1.79.3",
            "severity": "critical",
            "ecosystem": "go",
            "cvss_score": 9.1,
            "advisory_ids": [
              "GHSA-hrxh-6v49-42gf"
            ],
            "fixed_version": "1.82.1",
            "advisory_count": 1,
            "oldest_advisory_days": 3
          },
          {
            "name": "github.com/go-git/go-billy/v5",
            "direct": true,
            "version": "v5.8.0",
            "severity": "high",
            "ecosystem": "go",
            "cvss_score": 8.1,
            "advisory_ids": [
              "GHSA-m3xc-h892-ggx6",
              "GHSA-qw64-3x98-g7q2",
              "GO-2026-5490",
              "GO-2026-5597"
            ],
            "fixed_version": "6.0.0-alpha.1",
            "advisory_count": 4,
            "oldest_advisory_days": 72
          },
          {
            "name": "github.com/hashicorp/go-getter",
            "direct": true,
            "version": "v1.8.5",
            "severity": "high",
            "ecosystem": "go",
            "cvss_score": 7.5,
            "advisory_ids": [
              "GHSA-92mm-2pjq-r785",
              "GO-2026-5058"
            ],
            "fixed_version": "1.8.6",
            "advisory_count": 2,
            "oldest_advisory_days": 106
          },
          {
            "name": "github.com/go-jose/go-jose/v4",
            "direct": false,
            "version": "v4.1.3",
            "severity": "high",
            "ecosystem": "go",
            "cvss_score": 7.5,
            "advisory_ids": [
              "GHSA-78h2-9frx-2jm8",
              "GO-2026-4945"
            ],
            "fixed_version": "4.1.4",
            "advisory_count": 2,
            "oldest_advisory_days": 113
          },
          {
            "name": "go.opentelemetry.io/otel",
            "direct": false,
            "version": "v1.40.0",
            "severity": "high",
            "ecosystem": "go",
            "cvss_score": 7.5,
            "advisory_ids": [
              "GHSA-mh2q-q3fh-2475",
              "GO-2026-5506"
            ],
            "fixed_version": "1.41.0",
            "advisory_count": 2,
            "oldest_advisory_days": 108
          },
          {
            "name": "go.opentelemetry.io/otel/sdk",
            "direct": false,
            "version": "v1.40.0",
            "severity": "high",
            "ecosystem": "go",
            "cvss_score": 7,
            "advisory_ids": [
              "GHSA-hfvc-g4fc-pqhx",
              "GO-2026-5426"
            ],
            "fixed_version": "1.43.0",
            "advisory_count": 2,
            "oldest_advisory_days": 107
          },
          {
            "name": "github.com/go-git/go-git/v5",
            "direct": true,
            "version": "v5.17.0",
            "severity": "moderate",
            "ecosystem": "go",
            "cvss_score": 6.5,
            "advisory_ids": [
              "GHSA-389r-gv7p-r3rp",
              "GHSA-3xc5-wrhm-f963",
              "GHSA-crhj-59gh-8x96",
              "GHSA-gm2x-2g9h-ccm8",
              "GHSA-jhf3-xxhw-2wpp",
              "GHSA-m7cr-m3pv-hgrp",
              "GHSA-w5pp-99ch-qj29",
              "GO-2026-4909",
              "GO-2026-4910",
              "GO-2026-5074"
            ],
            "fixed_version": "6.0.0-alpha.4",
            "advisory_count": 14,
            "oldest_advisory_days": 116
          },
          {
            "name": "github.com/go-viper/mapstructure/v2",
            "direct": true,
            "version": "v2.2.1",
            "severity": "moderate",
            "ecosystem": "go",
            "cvss_score": 5.3,
            "advisory_ids": [
              "GHSA-2464-8j7c-4cjm",
              "GHSA-fv92-fjc5-jj9h",
              "GO-2025-3787",
              "GO-2025-3900"
            ],
            "fixed_version": "2.4.0",
            "advisory_count": 4,
            "oldest_advisory_days": 392
          },
          {
            "name": "golang.org/x/net",
            "direct": true,
            "version": "v0.52.0",
            "severity": "moderate",
            "ecosystem": "go",
            "cvss_score": 6.5,
            "advisory_ids": [
              "GHSA-5cv4-jp36-h3mw",
              "GO-2026-4918",
              "GO-2026-5025",
              "GO-2026-5026",
              "GO-2026-5027",
              "GO-2026-5028",
              "GO-2026-5029",
              "GO-2026-5030",
              "GO-2026-5942"
            ],
            "fixed_version": "1.26.3",
            "advisory_count": 9,
            "oldest_advisory_days": 78
          },
          {
            "name": "github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream",
            "direct": false,
            "version": "v1.7.4",
            "severity": "moderate",
            "ecosystem": "go",
            "cvss_score": 5.9,
            "advisory_ids": [
              "GHSA-xmrv-pmrh-hhx2",
              "GO-2026-5764"
            ],
            "fixed_version": "1.97.3",
            "advisory_count": 2,
            "oldest_advisory_days": 108
          },
          {
            "name": "github.com/aws/aws-sdk-go-v2/service/s3",
            "direct": false,
            "version": "v1.96.0",
            "severity": "moderate",
            "ecosystem": "go",
            "cvss_score": 5.9,
            "advisory_ids": [
              "GHSA-xmrv-pmrh-hhx2",
              "GO-2026-5764"
            ],
            "fixed_version": "1.97.3",
            "advisory_count": 2,
            "oldest_advisory_days": 108
          },
          {
            "name": "golang.org/x/sys",
            "direct": false,
            "version": "v0.33.0",
            "severity": "unknown",
            "ecosystem": "go",
            "cvss_score": null,
            "advisory_ids": [
              "GO-2026-5024"
            ],
            "fixed_version": "0.44.0",
            "advisory_count": 1,
            "oldest_advisory_days": 63
          },
          {
            "name": "golang.org/x/sys",
            "direct": false,
            "version": "v0.42.0",
            "severity": "unknown",
            "ecosystem": "go",
            "cvss_score": null,
            "advisory_ids": [
              "GO-2026-5024"
            ],
            "fixed_version": "0.44.0",
            "advisory_count": 1,
            "oldest_advisory_days": 63
          },
          {
            "name": "golang.org/x/text",
            "direct": false,
            "version": "v0.21.0",
            "severity": "unknown",
            "ecosystem": "go",
            "cvss_score": null,
            "advisory_ids": [
              "GO-2026-5970"
            ],
            "fixed_version": "0.39.0",
            "advisory_count": 1,
            "oldest_advisory_days": 10
          },
          {
            "name": "golang.org/x/text",
            "direct": false,
            "version": "v0.35.0",
            "severity": "unknown",
            "ecosystem": "go",
            "cvss_score": null,
            "advisory_ids": [
              "GO-2026-5970"
            ],
            "fixed_version": "0.39.0",
            "advisory_count": 1,
            "oldest_advisory_days": 10
          }
        ],
        "collected": true,
        "malicious": [],
        "truncated": false,
        "by_severity": {
          "high": 5,
          "unknown": 4,
          "critical": 3,
          "moderate": 5
        },
        "advisory_count": 87,
        "affected_count": 17,
        "assessed_count": 333,
        "malicious_count": 0,
        "assessed_package": null,
        "unassessed_count": 0,
        "direct_affected_count": 5
      },
      "ecosystems": [
        "go"
      ],
      "dependencies": [
        {
          "name": "github.com/BurntSushi/toml",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.6.0"
        },
        {
          "name": "github.com/CycloneDX/cyclonedx-go",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.10.0"
        },
        {
          "name": "github.com/Masterminds/semver/v3",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v3.4.0"
        },
        {
          "name": "github.com/Masterminds/sprig/v3",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v3.3.0"
        },
        {
          "name": "github.com/OneOfOne/xxhash",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.2.8"
        },
        {
          "name": "github.com/acarl005/stripansi",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.0.0-20180116102854-5a71ef0e047d"
        },
        {
          "name": "github.com/adrg/xdg",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.5.3"
        },
        {
          "name": "github.com/anchore/bubbly",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.0.0-20231115134915-def0aba654a9"
        },
        {
          "name": "github.com/anchore/clio",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.0.0-20250319180342-2cfe4b0cb716"
        },
        {
          "name": "github.com/anchore/fangs",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.0.0-20250319222917-446a1e748ec2"
        },
        {
          "name": "github.com/anchore/go-collections",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.0.0-20251016125210-a3c352120e8c"
        },
        {
          "name": "github.com/anchore/go-homedir",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.0.0-20250319154043-c29668562e4d"
        },
        {
          "name": "github.com/anchore/go-logger",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.0.0-20250318195838-07ae343dd722"
        },
        {
          "name": "github.com/anchore/go-macholibre",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.0.0-20220308212642-53e6d0aaf6fb"
        },
        {
          "name": "github.com/anchore/go-rpmdb",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.0.0-20250516171929-f77691e1faec"
        },
        {
          "name": "github.com/anchore/go-sync",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.0.0-20250326131806-4eda43a485b6"
        },
        {
          "name": "github.com/anchore/go-version",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.2.2-0.20200701162849-18adb9c92b9b"
        },
        {
          "name": "github.com/anchore/packageurl-go",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.1.1-0.20250220190351-d62adb6e1115"
        },
        {
          "name": "github.com/anchore/stereoscope",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.1.22"
        },
        {
          "name": "github.com/aquasecurity/go-pep440-version",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.0.1"
        },
        {
          "name": "github.com/bitnami/go-version",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.0.0-20250131085805-b1f57a8634ef"
        },
        {
          "name": "github.com/blakesmith/ar",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.0.0-20190502131153-809d4375e1fb"
        },
        {
          "name": "github.com/bmatcuk/doublestar/v4",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v4.10.0"
        },
        {
          "name": "github.com/charmbracelet/bubbles",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.0.0"
        },
        {
          "name": "github.com/charmbracelet/bubbletea",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.3.10"
        },
        {
          "name": "github.com/charmbracelet/lipgloss",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.1.0"
        },
        {
          "name": "github.com/dave/jennifer",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.7.1"
        },
        {
          "name": "github.com/deitch/magic",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.0.0-20230404182410-1ff89d7342da"
        },
        {
          "name": "github.com/diskfs/go-diskfs",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.7.0"
        },
        {
          "name": "github.com/distribution/reference",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.6.0"
        },
        {
          "name": "github.com/dustin/go-humanize",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.0.1"
        },
        {
          "name": "github.com/elliotchance/phpserialize",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.4.0"
        },
        {
          "name": "github.com/facebookincubator/nvdtools",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.1.5"
        },
        {
          "name": "github.com/github/go-spdx/v2",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v2.4.0"
        },
        {
          "name": "github.com/gkampitakis/go-snaps",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.5.21"
        },
        {
          "name": "github.com/go-git/go-billy/v5",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v5.8.0"
        },
        {
          "name": "github.com/go-git/go-git/v5",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v5.17.0"
        },
        {
          "name": "github.com/go-test/deep",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.1.1"
        },
        {
          "name": "github.com/go-viper/mapstructure/v2",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v2.5.0"
        },
        {
          "name": "github.com/gohugoio/hashstructure",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.6.0"
        },
        {
          "name": "github.com/google/go-cmp",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.7.0"
        },
        {
          "name": "github.com/google/go-containerregistry",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.21.2"
        },
        {
          "name": "github.com/google/licensecheck",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.3.1"
        },
        {
          "name": "github.com/google/uuid",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.6.0"
        },
        {
          "name": "github.com/gookit/color",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.6.0"
        },
        {
          "name": "github.com/hashicorp/go-cleanhttp",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.5.2"
        },
        {
          "name": "github.com/hashicorp/go-getter",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.8.5"
        },
        {
          "name": "github.com/hashicorp/go-multierror",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.1.1"
        },
        {
          "name": "github.com/hashicorp/hcl/v2",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v2.24.0"
        },
        {
          "name": "github.com/iancoleman/strcase",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.3.0"
        },
        {
          "name": "github.com/invopop/jsonschema",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.13.0"
        },
        {
          "name": "github.com/jedib0t/go-pretty/v6",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v6.7.8"
        },
        {
          "name": "github.com/jinzhu/copier",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.4.0"
        },
        {
          "name": "github.com/kastenhq/goversion",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.0.0-20230811215019-93b2f8823953"
        },
        {
          "name": "github.com/magiconair/properties",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.8.10"
        },
        {
          "name": "github.com/mholt/archives",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.1.5"
        },
        {
          "name": "github.com/moby/sys/mountinfo",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.7.2"
        },
        {
          "name": "github.com/nix-community/go-nix",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.0.0-20250101154619-4bdde671e0a1"
        },
        {
          "name": "github.com/olekukonko/tablewriter",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.1.4"
        },
        {
          "name": "github.com/opencontainers/go-digest",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.0.0"
        },
        {
          "name": "github.com/pelletier/go-toml",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.9.5"
        },
        {
          "name": "github.com/quasilyte/go-ruleguard/dsl",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.3.23"
        },
        {
          "name": "github.com/rust-secure-code/go-rustaudit",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.0.0-20250226111315-e20ec32e963c"
        },
        {
          "name": "github.com/saintfish/chardet",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.0.0-20230101081208-5e3ef4b5456d"
        },
        {
          "name": "github.com/sanity-io/litter",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.5.8"
        },
        {
          "name": "github.com/sassoftware/go-rpmutils",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.4.0"
        },
        {
          "name": "github.com/scylladb/go-set",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.0.3-0.20200225121959-cc7b2070d91e"
        },
        {
          "name": "github.com/sergi/go-diff",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.4.0"
        },
        {
          "name": "github.com/spdx/gordf",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.0.0-20201111095634-7098f93598fb"
        },
        {
          "name": "github.com/spdx/tools-golang",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.5.7"
        },
        {
          "name": "github.com/spf13/afero",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.15.0"
        },
        {
          "name": "github.com/spf13/cobra",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.10.2"
        },
        {
          "name": "github.com/stretchr/testify",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.11.1"
        },
        {
          "name": "github.com/vbatts/go-mtree",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.7.0"
        },
        {
          "name": "github.com/vifraa/gopom",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.0.0"
        },
        {
          "name": "github.com/wagoodman/go-partybus",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.0.0-20230516145632-8ccac152c651"
        },
        {
          "name": "github.com/wagoodman/go-progress",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.0.0-20260303201901-10176f79b2c0"
        },
        {
          "name": "github.com/xeipuuv/gojsonschema",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.2.0"
        },
        {
          "name": "github.com/zyedidia/generic",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.2.2-0.20230320175451-4410d2372cb1"
        },
        {
          "name": "go.uber.org/goleak",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.3.0"
        },
        {
          "name": "go.yaml.in/yaml/v3",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v3.0.4"
        },
        {
          "name": "golang.org/x/exp",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.0.0-20251023183803-a4bb9ffd2546"
        },
        {
          "name": "golang.org/x/mod",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.34.0"
        },
        {
          "name": "golang.org/x/net",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.52.0"
        },
        {
          "name": "modernc.org/sqlite",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.46.2"
        },
        {
          "name": "github.com/goccy/go-yaml",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.19.2"
        },
        {
          "name": "github.com/ulikunitz/xz",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.5.15"
        },
        {
          "name": "golang.org/x/time",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.15.0"
        },
        {
          "name": "golang.org/x/tools",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.43.0"
        },
        {
          "name": "gopkg.in/yaml.v3",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v3.0.1"
        },
        {
          "name": "github.com/acobaugh/osrelease",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.1.0"
        },
        {
          "name": "github.com/anmitsu/go-shlex",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.0.0-20200514113438-38f4b401e2be"
        },
        {
          "name": "github.com/cespare/xxhash/v2",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v2.3.0"
        },
        {
          "name": "github.com/gpustack/gguf-parser-go",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.24.0"
        },
        {
          "name": "github.com/wk8/go-ordered-map/v2",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v2.1.8"
        }
      ],
      "all_dependencies": {
        "error": null,
        "source": "github-sbom",
        "packages": [
          {
            "name": "github.com/acarl005/stripansi",
            "direct": true,
            "version": "v0.0.0-20180116102854-5a71ef0e047d",
            "ecosystem": "go"
          },
          {
            "name": "github.com/acobaugh/osrelease",
            "direct": true,
            "version": "v0.1.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/adrg/xdg",
            "direct": true,
            "version": "v0.5.3",
            "ecosystem": "go"
          },
          {
            "name": "github.com/anchore/bubbly",
            "direct": true,
            "version": "v0.0.0-20231115134915-def0aba654a9",
            "ecosystem": "go"
          },
          {
            "name": "github.com/anchore/clio",
            "direct": true,
            "version": "v0.0.0-20250319180342-2cfe4b0cb716",
            "ecosystem": "go"
          },
          {
            "name": "github.com/anchore/fangs",
            "direct": true,
            "version": "v0.0.0-20250319222917-446a1e748ec2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/anchore/go-collections",
            "direct": true,
            "version": "v0.0.0-20251016125210-a3c352120e8c",
            "ecosystem": "go"
          },
          {
            "name": "github.com/anchore/go-homedir",
            "direct": true,
            "version": "v0.0.0-20250319154043-c29668562e4d",
            "ecosystem": "go"
          },
          {
            "name": "github.com/anchore/go-logger",
            "direct": true,
            "version": "v0.0.0-20250318195838-07ae343dd722",
            "ecosystem": "go"
          },
          {
            "name": "github.com/anchore/go-macholibre",
            "direct": true,
            "version": "v0.0.0-20220308212642-53e6d0aaf6fb",
            "ecosystem": "go"
          },
          {
            "name": "github.com/anchore/go-rpmdb",
            "direct": true,
            "version": "v0.0.0-20250516171929-f77691e1faec",
            "ecosystem": "go"
          },
          {
            "name": "github.com/anchore/go-sync",
            "direct": true,
            "version": "v0.0.0-20250326131806-4eda43a485b6",
            "ecosystem": "go"
          },
          {
            "name": "github.com/anchore/go-version",
            "direct": true,
            "version": "v1.2.2-0.20200701162849-18adb9c92b9b",
            "ecosystem": "go"
          },
          {
            "name": "github.com/anchore/packageurl-go",
            "direct": true,
            "version": "v0.1.1-0.20250220190351-d62adb6e1115",
            "ecosystem": "go"
          },
          {
            "name": "github.com/anchore/stereoscope",
            "direct": true,
            "version": "v0.1.22",
            "ecosystem": "go"
          },
          {
            "name": "github.com/anmitsu/go-shlex",
            "direct": true,
            "version": "v0.0.0-20200514113438-38f4b401e2be",
            "ecosystem": "go"
          },
          {
            "name": "github.com/aquasecurity/go-pep440-version",
            "direct": true,
            "version": "v0.0.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/bitnami/go-version",
            "direct": true,
            "version": "v0.0.0-20250131085805-b1f57a8634ef",
            "ecosystem": "go"
          },
          {
            "name": "github.com/blakesmith/ar",
            "direct": true,
            "version": "v0.0.0-20190502131153-809d4375e1fb",
            "ecosystem": "go"
          },
          {
            "name": "github.com/bmatcuk/doublestar/v4",
            "direct": true,
            "version": "v4.10.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/burntsushi/toml",
            "direct": true,
            "version": "v1.6.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/cespare/xxhash/v2",
            "direct": true,
            "version": "v2.3.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/charmbracelet/bubbles",
            "direct": true,
            "version": "v1.0.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/charmbracelet/bubbletea",
            "direct": true,
            "version": "v1.3.10",
            "ecosystem": "go"
          },
          {
            "name": "github.com/charmbracelet/lipgloss",
            "direct": true,
            "version": "v1.1.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/cyclonedx/cyclonedx-go",
            "direct": true,
            "version": "v0.10.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/dave/jennifer",
            "direct": true,
            "version": "v1.7.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/deitch/magic",
            "direct": true,
            "version": "v0.0.0-20230404182410-1ff89d7342da",
            "ecosystem": "go"
          },
          {
            "name": "github.com/diskfs/go-diskfs",
            "direct": true,
            "version": "v1.7.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/distribution/reference",
            "direct": true,
            "version": "v0.6.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/dustin/go-humanize",
            "direct": true,
            "version": "v1.0.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/elliotchance/phpserialize",
            "direct": true,
            "version": "v1.4.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/facebookincubator/nvdtools",
            "direct": true,
            "version": "v0.1.5",
            "ecosystem": "go"
          },
          {
            "name": "github.com/github/go-spdx/v2",
            "direct": true,
            "version": "v2.4.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/gkampitakis/go-snaps",
            "direct": true,
            "version": "v0.5.21",
            "ecosystem": "go"
          },
          {
            "name": "github.com/go-git/go-billy/v5",
            "direct": true,
            "version": "v5.8.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/go-git/go-git/v5",
            "direct": true,
            "version": "v5.17.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/go-test/deep",
            "direct": true,
            "version": "v1.1.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/go-viper/mapstructure/v2",
            "direct": true,
            "version": "v2.2.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/go-viper/mapstructure/v2",
            "direct": true,
            "version": "v2.5.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/goccy/go-yaml",
            "direct": true,
            "version": "v1.19.2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/gohugoio/hashstructure",
            "direct": true,
            "version": "v0.6.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/google/go-cmp",
            "direct": true,
            "version": "v0.7.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/google/go-containerregistry",
            "direct": true,
            "version": "v0.21.2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/google/licensecheck",
            "direct": true,
            "version": "v0.3.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/google/uuid",
            "direct": true,
            "version": "v1.6.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/gookit/color",
            "direct": true,
            "version": "v1.6.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/gpustack/gguf-parser-go",
            "direct": true,
            "version": "v0.24.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/hashicorp/go-cleanhttp",
            "direct": true,
            "version": "v0.5.2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/hashicorp/go-getter",
            "direct": true,
            "version": "v1.8.5",
            "ecosystem": "go"
          },
          {
            "name": "github.com/hashicorp/go-multierror",
            "direct": true,
            "version": "v1.1.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/hashicorp/hcl/v2",
            "direct": true,
            "version": "v2.24.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/iancoleman/strcase",
            "direct": true,
            "version": "v0.3.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/invopop/jsonschema",
            "direct": true,
            "version": "v0.13.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/jedib0t/go-pretty/v6",
            "direct": true,
            "version": "v6.7.8",
            "ecosystem": "go"
          },
          {
            "name": "github.com/jinzhu/copier",
            "direct": true,
            "version": "v0.4.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/kastenhq/goversion",
            "direct": true,
            "version": "v0.0.0-20230811215019-93b2f8823953",
            "ecosystem": "go"
          },
          {
            "name": "github.com/magiconair/properties",
            "direct": true,
            "version": "v1.8.10",
            "ecosystem": "go"
          },
          {
            "name": "github.com/masterminds/semver/v3",
            "direct": true,
            "version": "v3.4.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/masterminds/sprig/v3",
            "direct": true,
            "version": "v3.3.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/mholt/archives",
            "direct": true,
            "version": "v0.1.5",
            "ecosystem": "go"
          },
          {
            "name": "github.com/moby/sys/mountinfo",
            "direct": true,
            "version": "v0.7.2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/nix-community/go-nix",
            "direct": true,
            "version": "v0.0.0-20250101154619-4bdde671e0a1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/olekukonko/tablewriter",
            "direct": true,
            "version": "v1.1.4",
            "ecosystem": "go"
          },
          {
            "name": "github.com/oneofone/xxhash",
            "direct": true,
            "version": "v1.2.8",
            "ecosystem": "go"
          },
          {
            "name": "github.com/opencontainers/go-digest",
            "direct": true,
            "version": "v1.0.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/pelletier/go-toml",
            "direct": true,
            "version": "v1.9.5",
            "ecosystem": "go"
          },
          {
            "name": "github.com/quasilyte/go-ruleguard/dsl",
            "direct": true,
            "version": "v0.3.23",
            "ecosystem": "go"
          },
          {
            "name": "github.com/rust-secure-code/go-rustaudit",
            "direct": true,
            "version": "v0.0.0-20250226111315-e20ec32e963c",
            "ecosystem": "go"
          },
          {
            "name": "github.com/saintfish/chardet",
            "direct": true,
            "version": "v0.0.0-20230101081208-5e3ef4b5456d",
            "ecosystem": "go"
          },
          {
            "name": "github.com/sanity-io/litter",
            "direct": true,
            "version": "v1.5.8",
            "ecosystem": "go"
          },
          {
            "name": "github.com/sassoftware/go-rpmutils",
            "direct": true,
            "version": "v0.4.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/scylladb/go-set",
            "direct": true,
            "version": "v1.0.3-0.20200225121959-cc7b2070d91e",
            "ecosystem": "go"
          },
          {
            "name": "github.com/sergi/go-diff",
            "direct": true,
            "version": "v1.4.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/spdx/gordf",
            "direct": true,
            "version": "v0.0.0-20201111095634-7098f93598fb",
            "ecosystem": "go"
          },
          {
            "name": "github.com/spdx/tools-golang",
            "direct": true,
            "version": "v0.5.7",
            "ecosystem": "go"
          },
          {
            "name": "github.com/spf13/afero",
            "direct": true,
            "version": "v1.12.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/spf13/afero",
            "direct": true,
            "version": "v1.15.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/spf13/cobra",
            "direct": true,
            "version": "v1.10.2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/stretchr/testify",
            "direct": true,
            "version": "v1.10.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/stretchr/testify",
            "direct": true,
            "version": "v1.11.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/ulikunitz/xz",
            "direct": true,
            "version": "v0.5.15",
            "ecosystem": "go"
          },
          {
            "name": "github.com/vbatts/go-mtree",
            "direct": true,
            "version": "v0.7.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/vifraa/gopom",
            "direct": true,
            "version": "v1.0.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/wagoodman/go-partybus",
            "direct": true,
            "version": "v0.0.0-20230516145632-8ccac152c651",
            "ecosystem": "go"
          },
          {
            "name": "github.com/wagoodman/go-progress",
            "direct": true,
            "version": "v0.0.0-20260303201901-10176f79b2c0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/wk8/go-ordered-map/v2",
            "direct": true,
            "version": "v2.1.8",
            "ecosystem": "go"
          },
          {
            "name": "github.com/xeipuuv/gojsonschema",
            "direct": true,
            "version": "v1.2.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/zyedidia/generic",
            "direct": true,
            "version": "v1.2.2-0.20230320175451-4410d2372cb1",
            "ecosystem": "go"
          },
          {
            "name": "go.uber.org/goleak",
            "direct": true,
            "version": "v1.3.0",
            "ecosystem": "go"
          },
          {
            "name": "go.yaml.in/yaml/v3",
            "direct": true,
            "version": "v3.0.4",
            "ecosystem": "go"
          },
          {
            "name": "golang.org/x/exp",
            "direct": true,
            "version": "v0.0.0-20251023183803-a4bb9ffd2546",
            "ecosystem": "go"
          },
          {
            "name": "golang.org/x/mod",
            "direct": true,
            "version": "v0.34.0",
            "ecosystem": "go"
          },
          {
            "name": "golang.org/x/net",
            "direct": true,
            "version": "v0.52.0",
            "ecosystem": "go"
          },
          {
            "name": "golang.org/x/time",
            "direct": true,
            "version": "v0.15.0",
            "ecosystem": "go"
          },
          {
            "name": "golang.org/x/tools",
            "direct": true,
            "version": "v0.43.0",
            "ecosystem": "go"
          },
          {
            "name": "gopkg.in/yaml.v3",
            "direct": true,
            "version": "v3.0.1",
            "ecosystem": "go"
          },
          {
            "name": "modernc.org/sqlite",
            "direct": true,
            "version": "v1.46.2",
            "ecosystem": "go"
          },
          {
            "name": "cel.dev/expr",
            "direct": false,
            "version": "v0.25.1",
            "ecosystem": "go"
          },
          {
            "name": "cloud.google.com/go",
            "direct": false,
            "version": "v0.123.0",
            "ecosystem": "go"
          },
          {
            "name": "cloud.google.com/go/auth",
            "direct": false,
            "version": "v0.18.1",
            "ecosystem": "go"
          },
          {
            "name": "cloud.google.com/go/auth/oauth2adapt",
            "direct": false,
            "version": "v0.2.8",
            "ecosystem": "go"
          },
          {
            "name": "cloud.google.com/go/compute/metadata",
            "direct": false,
            "version": "v0.9.0",
            "ecosystem": "go"
          },
          {
            "name": "cloud.google.com/go/iam",
            "direct": false,
            "version": "v1.5.3",
            "ecosystem": "go"
          },
          {
            "name": "cloud.google.com/go/monitoring",
            "direct": false,
            "version": "v1.24.3",
            "ecosystem": "go"
          },
          {
            "name": "cloud.google.com/go/storage",
            "direct": false,
            "version": "v1.60.0",
            "ecosystem": "go"
          },
          {
            "name": "cyphar.com/go-pathrs",
            "direct": false,
            "version": "v0.2.1",
            "ecosystem": "go"
          },
          {
            "name": "dario.cat/mergo",
            "direct": false,
            "version": "v1.0.2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/agext/levenshtein",
            "direct": false,
            "version": "v1.2.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/anchore/go-lzo",
            "direct": false,
            "version": "v0.1.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/anchore/go-struct-converter",
            "direct": false,
            "version": "v0.1.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/andybalholm/brotli",
            "direct": false,
            "version": "v1.2.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/apparentlymart/go-textseg/v15",
            "direct": false,
            "version": "v15.0.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/aquasecurity/go-version",
            "direct": false,
            "version": "v0.0.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/atotto/clipboard",
            "direct": false,
            "version": "v0.1.4",
            "ecosystem": "go"
          },
          {
            "name": "github.com/aws/aws-sdk-go-v2",
            "direct": false,
            "version": "v1.41.2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream",
            "direct": false,
            "version": "v1.7.4",
            "ecosystem": "go"
          },
          {
            "name": "github.com/aws/aws-sdk-go-v2/config",
            "direct": false,
            "version": "v1.32.10",
            "ecosystem": "go"
          },
          {
            "name": "github.com/aws/aws-sdk-go-v2/credentials",
            "direct": false,
            "version": "v1.19.10",
            "ecosystem": "go"
          },
          {
            "name": "github.com/aws/aws-sdk-go-v2/feature/ec2/imds",
            "direct": false,
            "version": "v1.18.18",
            "ecosystem": "go"
          },
          {
            "name": "github.com/aws/aws-sdk-go-v2/internal/configsources",
            "direct": false,
            "version": "v1.4.18",
            "ecosystem": "go"
          },
          {
            "name": "github.com/aws/aws-sdk-go-v2/internal/endpoints/v2",
            "direct": false,
            "version": "v2.7.18",
            "ecosystem": "go"
          },
          {
            "name": "github.com/aws/aws-sdk-go-v2/internal/ini",
            "direct": false,
            "version": "v1.8.4",
            "ecosystem": "go"
          },
          {
            "name": "github.com/aws/aws-sdk-go-v2/internal/v4a",
            "direct": false,
            "version": "v1.4.17",
            "ecosystem": "go"
          },
          {
            "name": "github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding",
            "direct": false,
            "version": "v1.13.5",
            "ecosystem": "go"
          },
          {
            "name": "github.com/aws/aws-sdk-go-v2/service/internal/checksum",
            "direct": false,
            "version": "v1.9.8",
            "ecosystem": "go"
          },
          {
            "name": "github.com/aws/aws-sdk-go-v2/service/internal/presigned-url",
            "direct": false,
            "version": "v1.13.18",
            "ecosystem": "go"
          },
          {
            "name": "github.com/aws/aws-sdk-go-v2/service/internal/s3shared",
            "direct": false,
            "version": "v1.19.17",
            "ecosystem": "go"
          },
          {
            "name": "github.com/aws/aws-sdk-go-v2/service/s3",
            "direct": false,
            "version": "v1.96.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/aws/aws-sdk-go-v2/service/signin",
            "direct": false,
            "version": "v1.0.6",
            "ecosystem": "go"
          },
          {
            "name": "github.com/aws/aws-sdk-go-v2/service/sso",
            "direct": false,
            "version": "v1.30.11",
            "ecosystem": "go"
          },
          {
            "name": "github.com/aws/aws-sdk-go-v2/service/ssooidc",
            "direct": false,
            "version": "v1.35.15",
            "ecosystem": "go"
          },
          {
            "name": "github.com/aws/aws-sdk-go-v2/service/sts",
            "direct": false,
            "version": "v1.41.7",
            "ecosystem": "go"
          },
          {
            "name": "github.com/aws/smithy-go",
            "direct": false,
            "version": "v1.24.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/aymanbagabas/go-osc52/v2",
            "direct": false,
            "version": "v2.0.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/bahlo/generic-list-go",
            "direct": false,
            "version": "v0.2.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/becheran/wildmatch-go",
            "direct": false,
            "version": "v1.0.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/bgentry/go-netrc",
            "direct": false,
            "version": "v0.0.0-20140422174119-9fd32a8b3d3d",
            "ecosystem": "go"
          },
          {
            "name": "github.com/bodgit/plumbing",
            "direct": false,
            "version": "v1.3.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/bodgit/sevenzip",
            "direct": false,
            "version": "v1.6.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/bodgit/windows",
            "direct": false,
            "version": "v1.0.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/buger/jsonparser",
            "direct": false,
            "version": "v1.1.2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/charmbracelet/colorprofile",
            "direct": false,
            "version": "v0.4.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/charmbracelet/harmonica",
            "direct": false,
            "version": "v0.2.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/charmbracelet/x/ansi",
            "direct": false,
            "version": "v0.11.6",
            "ecosystem": "go"
          },
          {
            "name": "github.com/charmbracelet/x/cellbuf",
            "direct": false,
            "version": "v0.0.15",
            "ecosystem": "go"
          },
          {
            "name": "github.com/charmbracelet/x/term",
            "direct": false,
            "version": "v0.2.2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/clipperhouse/displaywidth",
            "direct": false,
            "version": "v0.10.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/clipperhouse/uax29/v2",
            "direct": false,
            "version": "v2.6.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/cloudflare/circl",
            "direct": false,
            "version": "v1.6.3",
            "ecosystem": "go"
          },
          {
            "name": "github.com/cncf/xds/go",
            "direct": false,
            "version": "v0.0.0-20251210132809-ee656c7534f5",
            "ecosystem": "go"
          },
          {
            "name": "github.com/containerd/cgroups/v3",
            "direct": false,
            "version": "v3.1.2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/containerd/containerd/api",
            "direct": false,
            "version": "v1.10.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/containerd/containerd/v2",
            "direct": false,
            "version": "v2.2.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/containerd/continuity",
            "direct": false,
            "version": "v0.4.5",
            "ecosystem": "go"
          },
          {
            "name": "github.com/containerd/errdefs",
            "direct": false,
            "version": "v1.0.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/containerd/errdefs/pkg",
            "direct": false,
            "version": "v0.3.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/containerd/fifo",
            "direct": false,
            "version": "v1.1.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/containerd/log",
            "direct": false,
            "version": "v0.1.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/containerd/platforms",
            "direct": false,
            "version": "v1.0.0-rc.2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/containerd/plugin",
            "direct": false,
            "version": "v1.0.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/containerd/stargz-snapshotter/estargz",
            "direct": false,
            "version": "v0.18.2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/containerd/ttrpc",
            "direct": false,
            "version": "v1.2.7",
            "ecosystem": "go"
          },
          {
            "name": "github.com/containerd/typeurl/v2",
            "direct": false,
            "version": "v2.2.3",
            "ecosystem": "go"
          },
          {
            "name": "github.com/cyphar/filepath-securejoin",
            "direct": false,
            "version": "v0.6.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/datadog/zstd",
            "direct": false,
            "version": "v1.5.5",
            "ecosystem": "go"
          },
          {
            "name": "github.com/davecgh/go-spew",
            "direct": false,
            "version": "v1.1.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/davecgh/go-spew",
            "direct": false,
            "version": "v1.1.2-0.20180830191138-d8f796af33cc",
            "ecosystem": "go"
          },
          {
            "name": "github.com/docker/cli",
            "direct": false,
            "version": "v29.3.0+incompatible",
            "ecosystem": "go"
          },
          {
            "name": "github.com/docker/distribution",
            "direct": false,
            "version": "v2.8.3+incompatible",
            "ecosystem": "go"
          },
          {
            "name": "github.com/docker/docker-credential-helpers",
            "direct": false,
            "version": "v0.9.5",
            "ecosystem": "go"
          },
          {
            "name": "github.com/docker/go-connections",
            "direct": false,
            "version": "v0.6.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/docker/go-units",
            "direct": false,
            "version": "v0.5.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/dsnet/compress",
            "direct": false,
            "version": "v0.0.2-0.20230904184137-39efe44ab707",
            "ecosystem": "go"
          },
          {
            "name": "github.com/emirpasic/gods",
            "direct": false,
            "version": "v1.18.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/envoyproxy/go-control-plane/envoy",
            "direct": false,
            "version": "v1.36.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/envoyproxy/protoc-gen-validate",
            "direct": false,
            "version": "v1.3.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/erikgeiser/coninput",
            "direct": false,
            "version": "v0.0.0-20211004153227-1c3628e74d0f",
            "ecosystem": "go"
          },
          {
            "name": "github.com/fatih/color",
            "direct": false,
            "version": "v1.18.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/felixge/fgprof",
            "direct": false,
            "version": "v0.9.5",
            "ecosystem": "go"
          },
          {
            "name": "github.com/felixge/httpsnoop",
            "direct": false,
            "version": "v1.0.4",
            "ecosystem": "go"
          },
          {
            "name": "github.com/fsnotify/fsnotify",
            "direct": false,
            "version": "v1.8.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/fsnotify/fsnotify",
            "direct": false,
            "version": "v1.9.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/gabriel-vasile/mimetype",
            "direct": false,
            "version": "v1.4.13",
            "ecosystem": "go"
          },
          {
            "name": "github.com/gkampitakis/ciinfo",
            "direct": false,
            "version": "v0.3.2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/go-git/gcfg",
            "direct": false,
            "version": "v1.5.1-0.20230307220236-3a3c6141e376",
            "ecosystem": "go"
          },
          {
            "name": "github.com/go-jose/go-jose/v4",
            "direct": false,
            "version": "v4.1.3",
            "ecosystem": "go"
          },
          {
            "name": "github.com/go-logr/logr",
            "direct": false,
            "version": "v1.4.3",
            "ecosystem": "go"
          },
          {
            "name": "github.com/go-logr/stdr",
            "direct": false,
            "version": "v1.2.2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/go-restruct/restruct",
            "direct": false,
            "version": "v1.2.0-alpha",
            "ecosystem": "go"
          },
          {
            "name": "github.com/gogo/protobuf",
            "direct": false,
            "version": "v1.3.2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/golang/groupcache",
            "direct": false,
            "version": "v0.0.0-20241129210726-2c02b8208cf8",
            "ecosystem": "go"
          },
          {
            "name": "github.com/google/pprof",
            "direct": false,
            "version": "v0.0.0-20250317173921-a4b03ec1a45e",
            "ecosystem": "go"
          },
          {
            "name": "github.com/google/s2a-go",
            "direct": false,
            "version": "v0.1.9",
            "ecosystem": "go"
          },
          {
            "name": "github.com/googleapis/enterprise-certificate-proxy",
            "direct": false,
            "version": "v0.3.11",
            "ecosystem": "go"
          },
          {
            "name": "github.com/googleapis/gax-go/v2",
            "direct": false,
            "version": "v2.17.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/googlecloudplatform/opentelemetry-operations-go/detectors/gcp",
            "direct": false,
            "version": "v1.30.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/googlecloudplatform/opentelemetry-operations-go/exporter/metric",
            "direct": false,
            "version": "v0.55.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/googlecloudplatform/opentelemetry-operations-go/internal/resourcemapping",
            "direct": false,
            "version": "v0.55.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/hashicorp/aws-sdk-go-base/v2",
            "direct": false,
            "version": "v2.0.0-beta.70",
            "ecosystem": "go"
          },
          {
            "name": "github.com/hashicorp/errwrap",
            "direct": false,
            "version": "v1.1.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/hashicorp/go-version",
            "direct": false,
            "version": "v1.8.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/hashicorp/golang-lru/v2",
            "direct": false,
            "version": "v2.0.7",
            "ecosystem": "go"
          },
          {
            "name": "github.com/henvic/httpretty",
            "direct": false,
            "version": "v0.1.4",
            "ecosystem": "go"
          },
          {
            "name": "github.com/huandu/xstrings",
            "direct": false,
            "version": "v1.5.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/inconshreveable/mousetrap",
            "direct": false,
            "version": "v1.1.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/jbenet/go-context",
            "direct": false,
            "version": "v0.0.0-20150711004518-d14ea06fba99",
            "ecosystem": "go"
          },
          {
            "name": "github.com/json-iterator/go",
            "direct": false,
            "version": "v1.1.12",
            "ecosystem": "go"
          },
          {
            "name": "github.com/kevinburke/ssh_config",
            "direct": false,
            "version": "v1.2.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/klauspost/compress",
            "direct": false,
            "version": "v1.18.4",
            "ecosystem": "go"
          },
          {
            "name": "github.com/klauspost/pgzip",
            "direct": false,
            "version": "v1.2.6",
            "ecosystem": "go"
          },
          {
            "name": "github.com/kr/pretty",
            "direct": false,
            "version": "v0.3.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/kr/text",
            "direct": false,
            "version": "v0.2.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/lucasb-eyer/go-colorful",
            "direct": false,
            "version": "v1.3.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/mailru/easyjson",
            "direct": false,
            "version": "v0.7.7",
            "ecosystem": "go"
          },
          {
            "name": "github.com/maruel/natural",
            "direct": false,
            "version": "v1.1.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/masterminds/goutils",
            "direct": false,
            "version": "v1.1.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/mattn/go-colorable",
            "direct": false,
            "version": "v0.1.14",
            "ecosystem": "go"
          },
          {
            "name": "github.com/mattn/go-isatty",
            "direct": false,
            "version": "v0.0.20",
            "ecosystem": "go"
          },
          {
            "name": "github.com/mattn/go-localereader",
            "direct": false,
            "version": "v0.0.2-0.20220822084749-2491eb6c1c75",
            "ecosystem": "go"
          },
          {
            "name": "github.com/mattn/go-runewidth",
            "direct": false,
            "version": "v0.0.19",
            "ecosystem": "go"
          },
          {
            "name": "github.com/mgutz/ansi",
            "direct": false,
            "version": "v0.0.0-20200706080929-d51e80ef957d",
            "ecosystem": "go"
          },
          {
            "name": "github.com/microsoft/go-winio",
            "direct": false,
            "version": "v0.6.2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/microsoft/hcsshim",
            "direct": false,
            "version": "v0.14.0-rc.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/mikelolasagasti/xz",
            "direct": false,
            "version": "v1.0.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/minio/minlz",
            "direct": false,
            "version": "v1.0.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/mitchellh/copystructure",
            "direct": false,
            "version": "v1.2.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/mitchellh/go-homedir",
            "direct": false,
            "version": "v1.1.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/mitchellh/go-wordwrap",
            "direct": false,
            "version": "v1.0.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/mitchellh/reflectwalk",
            "direct": false,
            "version": "v1.0.2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/moby/docker-image-spec",
            "direct": false,
            "version": "v1.3.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/moby/locker",
            "direct": false,
            "version": "v1.0.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/moby/moby/api",
            "direct": false,
            "version": "v1.54.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/moby/moby/client",
            "direct": false,
            "version": "v0.3.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/moby/sys/sequential",
            "direct": false,
            "version": "v0.6.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/moby/sys/signal",
            "direct": false,
            "version": "v0.7.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/moby/sys/user",
            "direct": false,
            "version": "v0.4.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/moby/sys/userns",
            "direct": false,
            "version": "v0.1.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/modern-go/concurrent",
            "direct": false,
            "version": "v0.0.0-20180306012644-bacd9c7ef1dd",
            "ecosystem": "go"
          },
          {
            "name": "github.com/modern-go/reflect2",
            "direct": false,
            "version": "v1.0.3-0.20250322232337-35a7c28c31ee",
            "ecosystem": "go"
          },
          {
            "name": "github.com/muesli/ansi",
            "direct": false,
            "version": "v0.0.0-20230316100256-276c6243b2f6",
            "ecosystem": "go"
          },
          {
            "name": "github.com/muesli/cancelreader",
            "direct": false,
            "version": "v0.2.2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/muesli/termenv",
            "direct": false,
            "version": "v0.16.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/ncruces/go-strftime",
            "direct": false,
            "version": "v1.0.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/nwaples/rardecode/v2",
            "direct": false,
            "version": "v2.2.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/olekukonko/cat",
            "direct": false,
            "version": "v0.0.0-20250911104152-50322a0618f6",
            "ecosystem": "go"
          },
          {
            "name": "github.com/olekukonko/errors",
            "direct": false,
            "version": "v1.2.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/olekukonko/ll",
            "direct": false,
            "version": "v0.1.6",
            "ecosystem": "go"
          },
          {
            "name": "github.com/opencontainers/image-spec",
            "direct": false,
            "version": "v1.1.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/opencontainers/runtime-spec",
            "direct": false,
            "version": "v1.3.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/opencontainers/selinux",
            "direct": false,
            "version": "v1.13.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/pborman/indent",
            "direct": false,
            "version": "v1.2.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/pelletier/go-toml/v2",
            "direct": false,
            "version": "v2.2.3",
            "ecosystem": "go"
          },
          {
            "name": "github.com/pelletier/go-toml/v2",
            "direct": false,
            "version": "v2.2.4",
            "ecosystem": "go"
          },
          {
            "name": "github.com/pierrec/lz4/v4",
            "direct": false,
            "version": "v4.1.22",
            "ecosystem": "go"
          },
          {
            "name": "github.com/pjbgf/sha1cd",
            "direct": false,
            "version": "v0.3.2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/pkg/errors",
            "direct": false,
            "version": "v0.9.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/pkg/profile",
            "direct": false,
            "version": "v1.7.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/pkg/xattr",
            "direct": false,
            "version": "v0.4.9",
            "ecosystem": "go"
          },
          {
            "name": "github.com/planetscale/vtprotobuf",
            "direct": false,
            "version": "v0.6.1-0.20240319094008-0393e58bdf10",
            "ecosystem": "go"
          },
          {
            "name": "github.com/pmezard/go-difflib",
            "direct": false,
            "version": "v1.0.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/pmezard/go-difflib",
            "direct": false,
            "version": "v1.0.1-0.20181226105442-5d4384ee4fb2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/protonmail/go-crypto",
            "direct": false,
            "version": "v1.4.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/remyoudompheng/bigfft",
            "direct": false,
            "version": "v0.0.0-20230129092748-24d4a6f8daec",
            "ecosystem": "go"
          },
          {
            "name": "github.com/rivo/uniseg",
            "direct": false,
            "version": "v0.4.7",
            "ecosystem": "go"
          },
          {
            "name": "github.com/rogpeppe/go-internal",
            "direct": false,
            "version": "v1.14.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/sagikazarmark/locafero",
            "direct": false,
            "version": "v0.7.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/sahilm/fuzzy",
            "direct": false,
            "version": "v0.1.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/shopspring/decimal",
            "direct": false,
            "version": "v1.4.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/sirupsen/logrus",
            "direct": false,
            "version": "v1.9.3",
            "ecosystem": "go"
          },
          {
            "name": "github.com/sirupsen/logrus",
            "direct": false,
            "version": "v1.9.4",
            "ecosystem": "go"
          },
          {
            "name": "github.com/skeema/knownhosts",
            "direct": false,
            "version": "v1.3.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/smallnest/ringbuffer",
            "direct": false,
            "version": "v0.0.0-20241116012123-461381446e3d",
            "ecosystem": "go"
          },
          {
            "name": "github.com/sorairolake/lzip-go",
            "direct": false,
            "version": "v0.3.8",
            "ecosystem": "go"
          },
          {
            "name": "github.com/sourcegraph/conc",
            "direct": false,
            "version": "v0.3.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/spf13/cast",
            "direct": false,
            "version": "v1.7.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/spf13/pflag",
            "direct": false,
            "version": "v1.0.10",
            "ecosystem": "go"
          },
          {
            "name": "github.com/spf13/pflag",
            "direct": false,
            "version": "v1.0.6",
            "ecosystem": "go"
          },
          {
            "name": "github.com/spf13/viper",
            "direct": false,
            "version": "v1.20.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/spf13/viper",
            "direct": false,
            "version": "v1.20.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/spiffe/go-spiffe/v2",
            "direct": false,
            "version": "v2.6.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/starry-s/zip",
            "direct": false,
            "version": "v0.2.3",
            "ecosystem": "go"
          },
          {
            "name": "github.com/stretchr/objx",
            "direct": false,
            "version": "v0.5.2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/subosito/gotenv",
            "direct": false,
            "version": "v1.6.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/sylabs/sif/v2",
            "direct": false,
            "version": "v2.24.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/sylabs/squashfs",
            "direct": false,
            "version": "v1.0.6",
            "ecosystem": "go"
          },
          {
            "name": "github.com/therootcompany/xz",
            "direct": false,
            "version": "v1.0.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/tidwall/gjson",
            "direct": false,
            "version": "v1.18.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/tidwall/match",
            "direct": false,
            "version": "v1.1.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/tidwall/pretty",
            "direct": false,
            "version": "v1.2.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/tidwall/sjson",
            "direct": false,
            "version": "v1.2.5",
            "ecosystem": "go"
          },
          {
            "name": "github.com/vbatts/tar-split",
            "direct": false,
            "version": "v0.12.2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/xanzy/ssh-agent",
            "direct": false,
            "version": "v0.3.3",
            "ecosystem": "go"
          },
          {
            "name": "github.com/xeipuuv/gojsonpointer",
            "direct": false,
            "version": "v0.0.0-20190905194746-02993c407bfb",
            "ecosystem": "go"
          },
          {
            "name": "github.com/xeipuuv/gojsonreference",
            "direct": false,
            "version": "v0.0.0-20180127040603-bd5ef7bd5415",
            "ecosystem": "go"
          },
          {
            "name": "github.com/xi2/xz",
            "direct": false,
            "version": "v0.0.0-20171230120015-48954b6210f8",
            "ecosystem": "go"
          },
          {
            "name": "github.com/xo/terminfo",
            "direct": false,
            "version": "v0.0.0-20220910002029-abceb7e1c41e",
            "ecosystem": "go"
          },
          {
            "name": "github.com/zclconf/go-cty",
            "direct": false,
            "version": "v1.16.3",
            "ecosystem": "go"
          },
          {
            "name": "go.opencensus.io",
            "direct": false,
            "version": "v0.24.0",
            "ecosystem": "go"
          },
          {
            "name": "go.opentelemetry.io/auto/sdk",
            "direct": false,
            "version": "v1.2.1",
            "ecosystem": "go"
          },
          {
            "name": "go.opentelemetry.io/contrib/detectors/gcp",
            "direct": false,
            "version": "v1.39.0",
            "ecosystem": "go"
          },
          {
            "name": "go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc",
            "direct": false,
            "version": "v0.63.0",
            "ecosystem": "go"
          },
          {
            "name": "go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp",
            "direct": false,
            "version": "v0.61.0",
            "ecosystem": "go"
          },
          {
            "name": "go.opentelemetry.io/otel",
            "direct": false,
            "version": "v1.40.0",
            "ecosystem": "go"
          },
          {
            "name": "go.opentelemetry.io/otel/metric",
            "direct": false,
            "version": "v1.40.0",
            "ecosystem": "go"
          },
          {
            "name": "go.opentelemetry.io/otel/sdk",
            "direct": false,
            "version": "v1.40.0",
            "ecosystem": "go"
          },
          {
            "name": "go.opentelemetry.io/otel/sdk/metric",
            "direct": false,
            "version": "v1.40.0",
            "ecosystem": "go"
          },
          {
            "name": "go.opentelemetry.io/otel/trace",
            "direct": false,
            "version": "v1.40.0",
            "ecosystem": "go"
          },
          {
            "name": "go.uber.org/atomic",
            "direct": false,
            "version": "v1.9.0",
            "ecosystem": "go"
          },
          {
            "name": "go.uber.org/multierr",
            "direct": false,
            "version": "v1.10.0",
            "ecosystem": "go"
          },
          {
            "name": "go.uber.org/multierr",
            "direct": false,
            "version": "v1.9.0",
            "ecosystem": "go"
          },
          {
            "name": "go.uber.org/zap",
            "direct": false,
            "version": "v1.27.0",
            "ecosystem": "go"
          },
          {
            "name": "go4.org",
            "direct": false,
            "version": "v0.0.0-20230225012048-214862532bf5",
            "ecosystem": "go"
          },
          {
            "name": "golang.org/x/crypto",
            "direct": false,
            "version": "v0.49.0",
            "ecosystem": "go"
          },
          {
            "name": "golang.org/x/oauth2",
            "direct": false,
            "version": "v0.36.0",
            "ecosystem": "go"
          },
          {
            "name": "golang.org/x/sync",
            "direct": false,
            "version": "v0.20.0",
            "ecosystem": "go"
          },
          {
            "name": "golang.org/x/sys",
            "direct": false,
            "version": "v0.33.0",
            "ecosystem": "go"
          },
          {
            "name": "golang.org/x/sys",
            "direct": false,
            "version": "v0.42.0",
            "ecosystem": "go"
          },
          {
            "name": "golang.org/x/term",
            "direct": false,
            "version": "v0.41.0",
            "ecosystem": "go"
          },
          {
            "name": "golang.org/x/text",
            "direct": false,
            "version": "v0.21.0",
            "ecosystem": "go"
          },
          {
            "name": "golang.org/x/text",
            "direct": false,
            "version": "v0.35.0",
            "ecosystem": "go"
          },
          {
            "name": "golang.org/x/xerrors",
            "direct": false,
            "version": "v0.0.0-20231012003039-104605ab7028",
            "ecosystem": "go"
          },
          {
            "name": "gonum.org/v1/gonum",
            "direct": false,
            "version": "v0.16.0",
            "ecosystem": "go"
          },
          {
            "name": "google.golang.org/api",
            "direct": false,
            "version": "v0.267.0",
            "ecosystem": "go"
          },
          {
            "name": "google.golang.org/genproto",
            "direct": false,
            "version": "v0.0.0-20260128011058-8636f8732409",
            "ecosystem": "go"
          },
          {
            "name": "google.golang.org/genproto/googleapis/api",
            "direct": false,
            "version": "v0.0.0-20260203192932-546029d2fa20",
            "ecosystem": "go"
          },
          {
            "name": "google.golang.org/genproto/googleapis/rpc",
            "direct": false,
            "version": "v0.0.0-20260203192932-546029d2fa20",
            "ecosystem": "go"
          },
          {
            "name": "google.golang.org/grpc",
            "direct": false,
            "version": "v1.79.3",
            "ecosystem": "go"
          },
          {
            "name": "google.golang.org/protobuf",
            "direct": false,
            "version": "v1.36.11",
            "ecosystem": "go"
          },
          {
            "name": "gopkg.in/warnings.v0",
            "direct": false,
            "version": "v0.1.2",
            "ecosystem": "go"
          },
          {
            "name": "modernc.org/libc",
            "direct": false,
            "version": "v1.70.0",
            "ecosystem": "go"
          },
          {
            "name": "modernc.org/mathutil",
            "direct": false,
            "version": "v1.7.1",
            "ecosystem": "go"
          },
          {
            "name": "modernc.org/memory",
            "direct": false,
            "version": "v1.11.0",
            "ecosystem": "go"
          }
        ],
        "collected": true,
        "truncated": false,
        "total_count": 333,
        "direct_count": 98,
        "indirect_count": 235
      }
    },
    "maintainership": {
      "issues": {
        "open_prs": 0,
        "merged_prs": 0,
        "open_issues": 0,
        "closed_ratio": null,
        "closed_issues": 0,
        "closed_unmerged_prs": 0
      },
      "bus_factor": 2,
      "bot_contributors": 2,
      "top_contributors": [
        {
          "type": "User",
          "login": "wagoodman",
          "commits": 795,
          "avatar_url": "https://avatars.githubusercontent.com/u/590471?v=4"
        },
        {
          "type": "User",
          "login": "spiffcs",
          "commits": 210,
          "avatar_url": "https://avatars.githubusercontent.com/u/32073428?v=4"
        },
        {
          "type": "User",
          "login": "kzantow",
          "commits": 189,
          "avatar_url": "https://avatars.githubusercontent.com/u/3009477?v=4"
        },
        {
          "type": "User",
          "login": "luhring",
          "commits": 113,
          "avatar_url": "https://avatars.githubusercontent.com/u/5199289?v=4"
        },
        {
          "type": "User",
          "login": "westonsteimel",
          "commits": 85,
          "avatar_url": "https://avatars.githubusercontent.com/u/1593939?v=4"
        },
        {
          "type": "User",
          "login": "willmurphyscode",
          "commits": 76,
          "avatar_url": "https://avatars.githubusercontent.com/u/12529630?v=4"
        },
        {
          "type": "User",
          "login": "LaurentGoderre",
          "commits": 37,
          "avatar_url": "https://avatars.githubusercontent.com/u/1090826?v=4"
        },
        {
          "type": "User",
          "login": "jonasagx",
          "commits": 28,
          "avatar_url": "https://avatars.githubusercontent.com/u/774704?v=4"
        },
        {
          "type": "User",
          "login": "witchcraze",
          "commits": 24,
          "avatar_url": "https://avatars.githubusercontent.com/u/67056980?v=4"
        },
        {
          "type": "User",
          "login": "coheigea",
          "commits": 20,
          "avatar_url": "https://avatars.githubusercontent.com/u/472162?v=4"
        }
      ],
      "contributors_sampled": 98,
      "top_contributor_share": 0.435
    },
    "quality_signals": {
      "has_ci": true,
      "has_tests": true,
      "ci_workflows": [
        "codeql-analysis.yml",
        "dependabot-automation.yaml",
        "detect-schema-changes.yaml",
        "oss-project-board-add.yaml",
        "release.yaml",
        "remove-awaiting-response-label.yaml",
        "test-fixture-cache-publish.yaml",
        "update-anchore-dependencies.yml",
        "update-bootstrap-tools.yml",
        "update-cpe-dictionary-index.yml",
        "update-spdx-license-list.yaml",
        "validate-github-actions.yaml",
        "validations.yaml"
      ],
      "has_docs_dir": false,
      "linter_configs": [
        ".golangci.yaml"
      ],
      "has_editorconfig": false,
      "has_linter_config": true,
      "has_precommit_config": false
    },
    "security_signals": {
      "lockfiles": [
        "Cargo.lock",
        "Gemfile.lock",
        "Pipfile.lock",
        "composer.lock",
        "go.sum",
        "mix.lock",
        "package-lock.json",
        "packages.lock.json",
        "pdm.lock",
        "pnpm-lock.yaml",
        "poetry.lock",
        "uv.lock",
        "yarn.lock"
      ],
      "scorecard": {
        "checks": [
          {
            "name": "Binary-Artifacts",
            "score": 10,
            "reason": "no binaries found in the repo",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#binary-artifacts"
          },
          {
            "name": "Branch-Protection",
            "score": 0,
            "reason": "branch protection not enabled on development/release branches",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#branch-protection"
          },
          {
            "name": "CI-Tests",
            "score": null,
            "reason": "no pull request found",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#ci-tests"
          },
          {
            "name": "CII-Best-Practices",
            "score": 0,
            "reason": "no effort to earn an OpenSSF best practices badge detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#cii-best-practices"
          },
          {
            "name": "Code-Review",
            "score": 0,
            "reason": "Found 0/30 approved changesets -- score normalized to 0",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#code-review"
          },
          {
            "name": "Contributors",
            "score": 10,
            "reason": "project has 35 contributing companies or organizations",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#contributors"
          },
          {
            "name": "Dangerous-Workflow",
            "score": 10,
            "reason": "no dangerous workflow patterns detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dangerous-workflow"
          },
          {
            "name": "Dependency-Update-Tool",
            "score": 10,
            "reason": "update tool detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dependency-update-tool"
          },
          {
            "name": "Fuzzing",
            "score": 0,
            "reason": "project is not fuzzed",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#fuzzing"
          },
          {
            "name": "License",
            "score": 10,
            "reason": "license file detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#license"
          },
          {
            "name": "Maintained",
            "score": 0,
            "reason": "0 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 0",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#maintained"
          },
          {
            "name": "Packaging",
            "score": null,
            "reason": "packaging workflow not detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#packaging"
          },
          {
            "name": "Pinned-Dependencies",
            "score": 7,
            "reason": "dependency not pinned by hash detected -- score normalized to 7",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#pinned-dependencies"
          },
          {
            "name": "SAST",
            "score": 10,
            "reason": "SAST tool detected: CodeQL",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#sast"
          },
          {
            "name": "Security-Policy",
            "score": 10,
            "reason": "security policy file detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#security-policy"
          },
          {
            "name": "Signed-Releases",
            "score": null,
            "reason": "no releases found",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#signed-releases"
          },
          {
            "name": "Token-Permissions",
            "score": 9,
            "reason": "detected GitHub workflow tokens with excessive permissions",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#token-permissions"
          },
          {
            "name": "Vulnerabilities",
            "score": 0,
            "reason": "337 existing vulnerabilities detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#vulnerabilities"
          }
        ],
        "commit": "d71b747cd1600ce4eefbfc2d449496c89e07aaef",
        "ran_at": "2026-07-25T10:34:16Z",
        "aggregate_score": 5.6,
        "scorecard_version": "v5.5.0"
      },
      "has_codeql_workflow": true,
      "has_security_policy": true,
      "has_dependabot_config": true
    },
    "contribution_flow": {
      "collected": true,
      "ci_last_run_at": "2026-06-03T04:12:32Z",
      "oldest_open_prs": [],
      "last_merged_pr_at": null,
      "ci_last_conclusion": "SKIPPED",
      "oldest_open_issues": []
    }
  },
  "config": {
    "disabled_metrics": [],
    "disabled_categories": [],
    "disabled_components": {}
  },
  "source": {
    "url": "https://github.com/joshbressers/syft",
    "host": "github.com",
    "name": "syft",
    "owner": "joshbressers"
  },
  "metrics": {
    "overall": {
      "key": "overall",
      "band": "at_risk",
      "name": "Overall health",
      "note": null,
      "notes": [],
      "value": 43,
      "inputs": {
        "security": 54,
        "vitality": 50,
        "community": 12,
        "governance": 43,
        "engineering": 52
      },
      "components": []
    },
    "categories": [
      {
        "key": "vitality",
        "band": "moderate",
        "name": "Vitality",
        "value": 50,
        "weight": 0.22,
        "metrics": [
          {
            "key": "development_activity",
            "band": "moderate",
            "name": "Development activity",
            "note": null,
            "notes": [],
            "value": 51,
            "inputs": {
              "commits_last_year": 375,
              "human_commit_share": 0.38,
              "days_since_last_push": 116,
              "active_weeks_last_year": 34
            },
            "components": [
              {
                "key": "push_recency",
                "name": "Push recency",
                "detail": "last push 116 days ago",
                "points": 9.9,
                "status": "partial",
                "details": [
                  {
                    "code": "push_recency",
                    "params": {
                      "days": 116
                    }
                  }
                ],
                "max_points": 36
              },
              {
                "key": "commit_cadence",
                "name": "Commit cadence",
                "detail": "34/52 weeks with commits",
                "points": 23.5,
                "status": "partial",
                "details": [
                  {
                    "code": "commit_cadence_weeks",
                    "params": {
                      "weeks": 34
                    }
                  }
                ],
                "max_points": 36
              },
              {
                "key": "commit_volume",
                "name": "Commit volume",
                "detail": "375 commits in the last year",
                "points": 18,
                "status": "met",
                "details": [
                  {
                    "code": "commits_last_year",
                    "params": {
                      "count": 375
                    }
                  }
                ],
                "max_points": 18
              },
              {
                "key": "openssf_scorecard_maintained",
                "name": "OpenSSF Scorecard: Maintained",
                "detail": "0 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 0",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 10
              }
            ]
          },
          {
            "key": "release_discipline",
            "band": "at_risk",
            "name": "Release discipline",
            "note": "Excluded from scoring (no data or not applicable): OpenSSF Scorecard: Signed-Releases. Remaining weights renormalized.",
            "notes": [
              {
                "code": "excluded_no_data",
                "params": {
                  "components": [
                    "openssf_scorecard_signed_releases"
                  ]
                }
              },
              {
                "code": "weights_renormalized",
                "params": {}
              }
            ],
            "value": 48,
            "inputs": {
              "releases_count": 49,
              "latest_release_tag": "v0.24.1",
              "releases_from_tags": true,
              "days_since_latest_release": 1761,
              "mean_days_between_releases": 11.1
            },
            "components": [
              {
                "key": "ships_releases",
                "name": "Ships releases",
                "detail": "49 version tags (no GitHub releases)",
                "points": 16.2,
                "status": "partial",
                "details": [
                  {
                    "code": "version_tags_no_releases",
                    "params": {
                      "count": 49
                    }
                  }
                ],
                "max_points": 27
              },
              {
                "key": "release_recency",
                "name": "Release recency",
                "detail": "latest release 1761 days ago",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "release_recency",
                    "params": {
                      "days": 1761
                    }
                  }
                ],
                "max_points": 36
              },
              {
                "key": "release_cadence",
                "name": "Release cadence",
                "detail": "a release every ~11.1 days",
                "points": 27,
                "status": "met",
                "details": [
                  {
                    "code": "release_cadence",
                    "params": {
                      "gap": 11.1
                    }
                  }
                ],
                "max_points": 27
              },
              {
                "key": "openssf_scorecard_signed_releases",
                "name": "OpenSSF Scorecard: Signed-Releases",
                "detail": "no releases found",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "no_data",
                    "params": {}
                  }
                ],
                "max_points": 10
              }
            ]
          },
          {
            "key": "abandonment",
            "band": "excellent",
            "name": "Abandonment",
            "note": null,
            "notes": [],
            "value": 100,
            "inputs": {
              "cap": null,
              "state": "maintained",
              "guards": [],
              "signals": [],
              "red_flag": false,
              "multiplier_pct": 100,
              "declared_reason": null,
              "unverified_reason": null,
              "unanswered_open_prs": null,
              "unanswered_open_issues": null,
              "days_since_last_merged_pr": null,
              "days_since_last_human_commit": 122,
              "days_since_last_human_commit_is_floor": false
            },
            "components": [
              {
                "key": "project_is_still_maintained",
                "name": "Project is still maintained",
                "detail": "last human commit 122 days ago",
                "points": 100,
                "status": "met",
                "details": [
                  {
                    "code": "abandonment_maintained",
                    "params": {
                      "days": 122
                    }
                  }
                ],
                "max_points": 100
              }
            ]
          }
        ],
        "description": "Is the project alive — is code being written and are releases shipping?"
      },
      {
        "key": "community",
        "band": "critical",
        "name": "Community & Adoption",
        "value": 12,
        "weight": 0.18,
        "metrics": [
          {
            "key": "popularity",
            "band": "critical",
            "name": "Popularity & adoption",
            "note": null,
            "notes": [],
            "value": 1,
            "inputs": {
              "forks": 0,
              "stars": 0,
              "watchers": 0,
              "growth_state": "unverified",
              "growth_factor_pct": 100,
              "growth_unverified_reason": "no_history"
            },
            "components": [
              {
                "key": "stars",
                "name": "Stars",
                "detail": "0 stars",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "stars",
                    "params": {
                      "count": 0
                    }
                  }
                ],
                "max_points": 60
              },
              {
                "key": "forks",
                "name": "Forks",
                "detail": "0 forks",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "forks",
                    "params": {
                      "count": 0
                    }
                  }
                ],
                "max_points": 25
              },
              {
                "key": "watchers",
                "name": "Watchers",
                "detail": "0 watchers",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "watchers",
                    "params": {
                      "count": 0
                    }
                  }
                ],
                "max_points": 15
              }
            ]
          },
          {
            "key": "community_health",
            "band": "critical",
            "name": "Community health",
            "note": null,
            "notes": [],
            "value": 25,
            "inputs": {
              "has_readme": false,
              "has_license": false,
              "has_contributing": false,
              "has_issue_template": false,
              "has_code_of_conduct": false,
              "has_pull_request_template": false
            },
            "components": [
              {
                "key": "readme",
                "name": "README",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 22.5
              },
              {
                "key": "license",
                "name": "License",
                "detail": "recognized license (Apache-2.0)",
                "points": 22.5,
                "status": "met",
                "details": [
                  {
                    "code": "license_standard",
                    "params": {}
                  },
                  {
                    "code": "license_spdx",
                    "params": {
                      "spdx": "Apache-2.0"
                    }
                  }
                ],
                "max_points": 22.5
              },
              {
                "key": "contributing_guide",
                "name": "CONTRIBUTING guide",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 18
              },
              {
                "key": "code_of_conduct",
                "name": "Code of conduct",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 13.5
              },
              {
                "key": "issue_template",
                "name": "Issue template",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.2
              },
              {
                "key": "pr_template",
                "name": "PR template",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 6.3
              }
            ]
          }
        ],
        "description": "Does the project have users, downloads, attention, and a welcoming setup for contributors?"
      },
      {
        "key": "governance",
        "band": "at_risk",
        "name": "Sustainability & Governance",
        "value": 43,
        "weight": 0.24,
        "metrics": [
          {
            "key": "maintainer_resilience",
            "band": "moderate",
            "name": "Maintainer resilience (bus factor)",
            "note": null,
            "notes": [],
            "value": 61,
            "inputs": {
              "bus_factor": 2,
              "contributors_sampled": 98,
              "top_contributor_share": 0.435
            },
            "components": [
              {
                "key": "bus_factor",
                "name": "Bus factor",
                "detail": "2 contributor(s) cover half of all commits",
                "points": 25.2,
                "status": "partial",
                "details": [
                  {
                    "code": "bus_factor",
                    "params": {
                      "count": 2
                    }
                  }
                ],
                "max_points": 54
              },
              {
                "key": "commit_distribution",
                "name": "Commit distribution",
                "detail": "top contributor authored 44% of commits",
                "points": 12.7,
                "status": "partial",
                "details": [
                  {
                    "code": "top_contributor_share",
                    "params": {
                      "share": 44
                    }
                  }
                ],
                "max_points": 22.5
              },
              {
                "key": "contributor_breadth",
                "name": "Contributor breadth",
                "detail": "98 contributors",
                "points": 13.5,
                "status": "met",
                "details": [
                  {
                    "code": "contributors_sampled",
                    "params": {
                      "count": 98
                    }
                  }
                ],
                "max_points": 13.5
              },
              {
                "key": "openssf_scorecard_contributors",
                "name": "OpenSSF Scorecard: Contributors",
                "detail": "project has 35 contributing companies or organizations",
                "points": 10,
                "status": "met",
                "details": [],
                "max_points": 10
              }
            ]
          },
          {
            "key": "responsiveness",
            "band": "critical",
            "name": "Issue & PR responsiveness",
            "note": "Excluded from scoring (no data or not applicable): Issue resolution, PR acceptance. Remaining weights renormalized.",
            "notes": [
              {
                "code": "excluded_no_data",
                "params": {
                  "components": [
                    "issue_resolution",
                    "pr_acceptance"
                  ]
                }
              },
              {
                "code": "weights_renormalized",
                "params": {}
              }
            ],
            "value": 1,
            "inputs": {
              "merged_prs": 0,
              "open_issues": 0,
              "closed_issues": 0,
              "issue_closed_ratio": null,
              "closed_unmerged_prs": 0
            },
            "components": [
              {
                "key": "issue_resolution",
                "name": "Issue resolution",
                "detail": "no issues or no data",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "no_issues_or_data",
                    "params": {}
                  }
                ],
                "max_points": 46.75
              },
              {
                "key": "pr_acceptance",
                "name": "PR acceptance",
                "detail": "no decided pull requests or no data",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "no_decided_prs_or_data",
                    "params": {}
                  }
                ],
                "max_points": 38.25
              },
              {
                "key": "openssf_scorecard_code_review",
                "name": "OpenSSF Scorecard: Code-Review",
                "detail": "Found 0/30 approved changesets -- score normalized to 0",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 15
              }
            ]
          },
          {
            "key": "stewardship",
            "band": "moderate",
            "name": "Ownership & stewardship",
            "note": "Excluded from scoring (no data or not applicable): Verified domain. Remaining weights renormalized.",
            "notes": [
              {
                "code": "excluded_no_data",
                "params": {
                  "components": [
                    "verified_domain"
                  ]
                }
              },
              {
                "code": "weights_renormalized",
                "params": {}
              }
            ],
            "value": 62,
            "inputs": {
              "followers": 111,
              "owner_type": "User",
              "is_verified": null,
              "owner_login": "joshbressers",
              "public_repos": 109,
              "account_age_days": 5198
            },
            "components": [
              {
                "key": "ownership_backing",
                "name": "Ownership backing",
                "detail": "personal (user) account",
                "points": 10,
                "status": "partial",
                "details": [
                  {
                    "code": "owner_personal",
                    "params": {}
                  }
                ],
                "max_points": 30
              },
              {
                "key": "verified_domain",
                "name": "Verified domain",
                "detail": "not applicable to user accounts",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "not_applicable_to_user_accounts",
                    "params": {}
                  }
                ],
                "max_points": 20
              },
              {
                "key": "owner_reach",
                "name": "Owner reach",
                "detail": "111 followers of joshbressers",
                "points": 14.7,
                "status": "partial",
                "details": [
                  {
                    "code": "owner_followers",
                    "params": {
                      "count": 111,
                      "login": "joshbressers"
                    }
                  }
                ],
                "max_points": 25
              },
              {
                "key": "track_record",
                "name": "Track record",
                "detail": "109 public repos, account ~14 yr old",
                "points": 25,
                "status": "met",
                "details": [
                  {
                    "code": "public_repos",
                    "params": {
                      "count": 109
                    }
                  },
                  {
                    "code": "account_age_years",
                    "params": {
                      "years": 14
                    }
                  }
                ],
                "max_points": 25
              }
            ]
          }
        ],
        "description": "Will the project survive its people — bus factor, responsiveness, who backs it, and package upkeep?"
      },
      {
        "key": "engineering",
        "band": "moderate",
        "name": "Engineering Quality",
        "value": 52,
        "weight": 0.2,
        "metrics": [
          {
            "key": "engineering_practices",
            "band": "good",
            "name": "Engineering practices",
            "note": "Excluded from scoring (no data or not applicable): OpenSSF Scorecard: CI-Tests. Remaining weights renormalized.",
            "notes": [
              {
                "code": "excluded_no_data",
                "params": {
                  "components": [
                    "openssf_scorecard_ci_tests"
                  ]
                }
              },
              {
                "code": "weights_renormalized",
                "params": {}
              }
            ],
            "value": 80,
            "inputs": {
              "has_ci": true,
              "has_tests": true,
              "has_editorconfig": false,
              "has_linter_config": true,
              "has_precommit_config": false
            },
            "components": [
              {
                "key": "ci_workflows",
                "name": "CI workflows",
                "detail": "13 workflow(s)",
                "points": 24,
                "status": "met",
                "details": [
                  {
                    "code": "ci_workflows",
                    "params": {
                      "count": 13
                    }
                  }
                ],
                "max_points": 24
              },
              {
                "key": "tests_present",
                "name": "Tests present",
                "detail": null,
                "points": 24,
                "status": "met",
                "details": [],
                "max_points": 24
              },
              {
                "key": "linter_config",
                "name": "Linter config",
                "detail": ".golangci.yaml",
                "points": 16,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": ".golangci.yaml"
                    }
                  }
                ],
                "max_points": 16
              },
              {
                "key": "pre_commit_hooks",
                "name": "Pre-commit hooks",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 9.6
              },
              {
                "key": "editorconfig",
                "name": ".editorconfig",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 6.4
              },
              {
                "key": "openssf_scorecard_ci_tests",
                "name": "OpenSSF Scorecard: CI-Tests",
                "detail": "no pull request found",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "no_data",
                    "params": {}
                  }
                ],
                "max_points": 20
              }
            ]
          },
          {
            "key": "documentation",
            "band": "critical",
            "name": "Documentation",
            "note": null,
            "notes": [],
            "value": 10,
            "inputs": {
              "topics": [],
              "has_wiki": true,
              "homepage": null,
              "has_readme": false,
              "has_docs_dir": false,
              "has_description": false
            },
            "components": [
              {
                "key": "readme",
                "name": "README",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 30
              },
              {
                "key": "documentation_directory",
                "name": "Documentation directory",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 25
              },
              {
                "key": "documentation_homepage_site",
                "name": "Documentation / homepage site",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 15
              },
              {
                "key": "repository_description",
                "name": "Repository description",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 10
              },
              {
                "key": "topics",
                "name": "Topics",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 10
              },
              {
                "key": "wiki",
                "name": "Wiki",
                "detail": null,
                "points": 10,
                "status": "met",
                "details": [],
                "max_points": 10
              }
            ]
          }
        ],
        "description": "Are baseline engineering and documentation practices in place?"
      },
      {
        "key": "security",
        "band": "moderate",
        "name": "Security",
        "value": 54,
        "weight": 0.16,
        "metrics": [
          {
            "key": "security_posture",
            "band": "moderate",
            "name": "Security posture",
            "note": "Excluded from scoring (no data or not applicable): CI-Tests, Packaging, Signed-Releases. Remaining weights renormalized.",
            "notes": [
              {
                "code": "excluded_no_data",
                "params": {
                  "components": [
                    "ci_tests",
                    "packaging",
                    "signed_releases"
                  ]
                }
              },
              {
                "code": "weights_renormalized",
                "params": {}
              }
            ],
            "value": 56,
            "inputs": {
              "source": "openssf_scorecard",
              "checks_evaluated": 15,
              "scorecard_version": "v5.5.0",
              "checks_inconclusive": 3,
              "scorecard_aggregate": 5.6
            },
            "components": [
              {
                "key": "binary_artifacts",
                "name": "Binary-Artifacts",
                "detail": "no binaries found in the repo",
                "points": 7.5,
                "status": "met",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "branch_protection",
                "name": "Branch-Protection",
                "detail": "branch protection not enabled on development/release branches",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "ci_tests",
                "name": "CI-Tests",
                "detail": "no pull request found",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "no_data",
                    "params": {}
                  }
                ],
                "max_points": 2.5
              },
              {
                "key": "cii_best_practices",
                "name": "CII-Best-Practices",
                "detail": "no effort to earn an OpenSSF best practices badge detected",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 2.5
              },
              {
                "key": "code_review",
                "name": "Code-Review",
                "detail": "Found 0/30 approved changesets -- score normalized to 0",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "contributors",
                "name": "Contributors",
                "detail": "project has 35 contributing companies or organizations",
                "points": 2.5,
                "status": "met",
                "details": [],
                "max_points": 2.5
              },
              {
                "key": "dangerous_workflow",
                "name": "Dangerous-Workflow",
                "detail": "no dangerous workflow patterns detected",
                "points": 10,
                "status": "met",
                "details": [],
                "max_points": 10
              },
              {
                "key": "dependency_update_tool",
                "name": "Dependency-Update-Tool",
                "detail": "update tool detected",
                "points": 7.5,
                "status": "met",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "fuzzing",
                "name": "Fuzzing",
                "detail": "project is not fuzzed",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 5
              },
              {
                "key": "license",
                "name": "License",
                "detail": "license file detected",
                "points": 2.5,
                "status": "met",
                "details": [],
                "max_points": 2.5
              },
              {
                "key": "maintained",
                "name": "Maintained",
                "detail": "0 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 0",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "packaging",
                "name": "Packaging",
                "detail": "packaging workflow not detected",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "no_data",
                    "params": {}
                  }
                ],
                "max_points": 5
              },
              {
                "key": "pinned_dependencies",
                "name": "Pinned-Dependencies",
                "detail": "dependency not pinned by hash detected -- score normalized to 7",
                "points": 3.5,
                "status": "partial",
                "details": [],
                "max_points": 5
              },
              {
                "key": "sast",
                "name": "SAST",
                "detail": "SAST tool detected: CodeQL",
                "points": 5,
                "status": "met",
                "details": [],
                "max_points": 5
              },
              {
                "key": "security_policy",
                "name": "Security-Policy",
                "detail": "security policy file detected",
                "points": 5,
                "status": "met",
                "details": [],
                "max_points": 5
              },
              {
                "key": "signed_releases",
                "name": "Signed-Releases",
                "detail": "no releases found",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "no_data",
                    "params": {}
                  }
                ],
                "max_points": 7.5
              },
              {
                "key": "token_permissions",
                "name": "Token-Permissions",
                "detail": "detected GitHub workflow tokens with excessive permissions",
                "points": 6.8,
                "status": "partial",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "vulnerabilities",
                "name": "Vulnerabilities",
                "detail": "337 existing vulnerabilities detected",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.5
              }
            ]
          },
          {
            "key": "dependency_advisories",
            "band": "at_risk",
            "name": "Dependency advisories",
            "note": "Excluded from scoring (no data or not applicable): Indirect dependencies free of known advisories. Remaining weights renormalized. Matched 333 resolved dependencies against OSV. This repository publishes no package the index resolves, so the repository dependency graph was assessed instead. That graph mixes development and test pins with shipped dependencies, so only the declared runtime dependencies are scored; transitive findings are reported as context and excluded from the score. Reachability is not analyzed.",
            "notes": [
              {
                "code": "excluded_no_data",
                "params": {
                  "components": [
                    "indirect_dependencies_free_of_known_advisories"
                  ]
                }
              },
              {
                "code": "weights_renormalized",
                "params": {}
              },
              {
                "code": "advisories_scope_repository",
                "params": {
                  "assessed": 333
                }
              },
              {
                "code": "advisories_repo_graph_caveat",
                "params": {}
              },
              {
                "code": "advisories_reachability",
                "params": {}
              }
            ],
            "value": 46,
            "inputs": {
              "source": "osv",
              "advisories": 87,
              "affected_packages": 17,
              "assessed_packages": 333,
              "unassessed_packages": 0,
              "affected_by_severity": "critical 3, high 5, moderate 5, unknown 4",
              "direct_affected_packages": 5
            },
            "components": [
              {
                "key": "direct_dependencies_free_of_known_advisories",
                "name": "Direct dependencies free of known advisories",
                "detail": "5 affected: github.com/go-git/go-billy/v5 v5.8.0 (high 8.1), github.com/hashicorp/go-getter v1.8.5 (high 7.5), github.com/go-git/go-git/v5 v5.17.0 (moderate 6.5), +2 more",
                "points": 7.5,
                "status": "partial",
                "details": [
                  {
                    "code": "advisories_affected",
                    "params": {
                      "count": 5,
                      "packages": "github.com/go-git/go-billy/v5 v5.8.0 (high 8.1), github.com/hashicorp/go-getter v1.8.5 (high 7.5), github.com/go-git/go-git/v5 v5.17.0 (moderate 6.5)"
                    }
                  },
                  {
                    "code": "advisories_affected_more",
                    "params": {
                      "count": 2
                    }
                  }
                ],
                "max_points": 35
              },
              {
                "key": "indirect_dependencies_free_of_known_advisories",
                "name": "Indirect dependencies free of known advisories",
                "detail": "transitive set not separable from development and test dependencies in this scope",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "advisories_scope_not_separable",
                    "params": {}
                  }
                ],
                "max_points": 25
              },
              {
                "key": "no_advisories_left_outstanding",
                "name": "No advisories left outstanding",
                "detail": "3 advisory-carrying package(s) unaddressed past 90 days; oldest published 392 days ago",
                "points": 27,
                "status": "partial",
                "details": [
                  {
                    "code": "advisories_stale",
                    "params": {
                      "days": 90,
                      "count": 3,
                      "oldest": 392
                    }
                  }
                ],
                "max_points": 40
              }
            ]
          },
          {
            "key": "malicious_dependencies",
            "band": "excellent",
            "name": "Malicious dependencies",
            "note": null,
            "notes": [],
            "value": 100,
            "inputs": {
              "source": "osv",
              "meaning": "reported as a malicious package by the OpenSSF corpus; the remedy is removal or moving off the compromised name, never an upgrade of the same artifact. Versions the registry has since pulled are listed but not scored",
              "packages": [],
              "red_flag": false,
              "assessed_packages": 333,
              "malicious_packages": 0,
              "direct_malicious_packages": 0,
              "withdrawn_malicious_packages": 0,
              "installable_malicious_packages": 0
            },
            "components": [
              {
                "key": "no_dependency_reported_as_a_malicious_package",
                "name": "No dependency reported as a malicious package",
                "detail": "no dependency is reported as a malicious package",
                "points": 100,
                "status": "met",
                "details": [
                  {
                    "code": "no_malicious_dependencies",
                    "params": {}
                  }
                ],
                "max_points": 100
              }
            ]
          },
          {
            "key": "high_risk_jurisdiction_exposure",
            "band": "excellent",
            "name": "High-Risk Jurisdiction Exposure",
            "note": "Only high-confidence self-published location evidence affects this multiplier. Ambiguous matches are review-only; country evidence is not proof of nationality, citizenship, legal registration, malicious intent, or sanctions status.",
            "notes": [
              {
                "code": "jurisdiction_evidence_limits",
                "params": {}
              }
            ],
            "value": 100,
            "inputs": {
              "meaning": "self-published location evidence; not nationality or citizenship",
              "red_flag": false,
              "exposures": [],
              "policy_countries": [
                "Russia",
                "Iran",
                "North Korea"
              ],
              "review_only_matches": 0,
              "assessed_self_published_locations": 11
            },
            "components": [
              {
                "key": "policy_exposure_multiplier",
                "name": "Policy exposure multiplier",
                "detail": "no confirmed policy-scope location match",
                "points": 100,
                "status": "met",
                "details": [
                  {
                    "code": "jurisdiction_no_match",
                    "params": {}
                  }
                ],
                "max_points": 100
              }
            ]
          }
        ],
        "description": "Are visible security and supply-chain practices strong, with no malicious dependency and no unresolved high-risk jurisdiction exposure?"
      },
      {
        "key": "ai_readiness",
        "band": "moderate",
        "name": "AI Readiness",
        "value": 68,
        "weight": 0,
        "metrics": [
          {
            "key": "ai_agent_context",
            "band": "at_risk",
            "name": "Agent context & guidance",
            "note": null,
            "notes": [],
            "value": 40,
            "inputs": {
              "has_llms_txt": false,
              "legible_history_share": 1,
              "agent_instruction_files": [],
              "agent_instruction_max_bytes": null
            },
            "components": [
              {
                "key": "agent_instructions",
                "name": "Agent instructions",
                "detail": "no CLAUDE.md / AGENTS.md / editor rules",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "no_agent_instructions",
                    "params": {}
                  }
                ],
                "max_points": 45
              },
              {
                "key": "machine_readable_docs_llms_txt",
                "name": "Machine-readable docs (llms.txt)",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 15
              },
              {
                "key": "legible_commit_history",
                "name": "Legible commit history",
                "detail": "38 of 38 human commits state their intent (structured subject or explanatory body)",
                "points": 40,
                "status": "met",
                "details": [
                  {
                    "code": "legible_history",
                    "params": {
                      "legible": 38,
                      "sampled": 38
                    }
                  }
                ],
                "max_points": 40
              }
            ]
          },
          {
            "key": "ai_verify_loop",
            "band": "excellent",
            "name": "Verify loop (build / test / typecheck)",
            "note": null,
            "notes": [],
            "value": 87,
            "inputs": {
              "has_nix": false,
              "has_tests": true,
              "lockfiles": [
                "Cargo.lock",
                "Gemfile.lock",
                "Pipfile.lock",
                "composer.lock",
                "go.sum",
                "mix.lock",
                "package-lock.json",
                "packages.lock.json",
                "pdm.lock",
                "pnpm-lock.yaml",
                "poetry.lock",
                "uv.lock",
                "yarn.lock"
              ],
              "has_dockerfile": true,
              "typed_language": true,
              "bootstrap_files": [
                "Makefile",
                "Taskfile.yaml",
                "cmd/syft/internal/test/integration/testdata/Makefile",
                "schema/cyclonedx/Makefile",
                "syft/file/cataloger/executable/testdata/Makefile",
                "syft/file/cataloger/executable/testdata/elf/Makefile",
                "syft/file/cataloger/executable/testdata/elf/project/Makefile",
                "syft/file/cataloger/executable/testdata/shared-info/Makefile",
                "syft/file/cataloger/executable/testdata/shared-info/project/Makefile",
                "syft/file/cataloger/executable/testdata/shared-info/project/hello/Makefile",
                "syft/file/cataloger/executable/testdata/shared-info/project/libhello/Makefile",
                "syft/pkg/cataloger/binary/testdata/Makefile",
                "syft/pkg/cataloger/binary/testdata/elf-testdata/elfbinwithcorrupt/elfsrc/makefile",
                "syft/pkg/cataloger/binary/testdata/elf-testdata/elfbinwithcorrupt/makefile",
                "syft/pkg/cataloger/binary/testdata/elf-testdata/elfbinwithnestedlib/elfsrc/makefile",
                "syft/pkg/cataloger/binary/testdata/elf-testdata/elfbinwithnestedlib/makefile",
                "syft/pkg/cataloger/binary/testdata/elf-testdata/elfbinwithsisterlib/elfsrc1/makefile",
                "syft/pkg/cataloger/binary/testdata/elf-testdata/elfbinwithsisterlib/elfsrc2/makefile",
                "syft/pkg/cataloger/binary/testdata/elf-testdata/elfbinwithsisterlib/makefile",
                "syft/pkg/cataloger/dotnet/testdata/Makefile",
                "syft/pkg/cataloger/golang/testdata/Makefile",
                "syft/pkg/cataloger/golang/testdata/archs/Makefile",
                "syft/pkg/cataloger/internal/pe/testdata/Makefile",
                "syft/pkg/cataloger/java/testdata/Makefile",
                "syft/pkg/cataloger/java/testdata/jar-metadata/Makefile",
                "syft/pkg/cataloger/java/testdata/java-builds/Makefile",
                "syft/pkg/cataloger/kernel/testdata/Makefile",
                "syft/pkg/cataloger/redhat/testdata/Makefile",
                "test/cli/testdata/Makefile",
                "test/cli/testdata/image-java-spdx-tools/Makefile",
                "test/cli/testdata/registry/Makefile",
                "test/install/Makefile"
              ],
              "has_devcontainer": false,
              "has_linter_config": true,
              "typecheck_configs": [],
              "agent_commit_share": 0,
              "toolchain_manifests": [
                "cmd/syft/internal/test/integration/testdata/image-go-bin-arch-coverage/go.mod",
                "cmd/syft/internal/test/integration/testdata/image-pkg-coverage/pkgs/go/go.mod",
                "cmd/syft/internal/test/integration/testdata/image-pkg-coverage/pkgs/java/pom.xml",
                "cmd/syft/internal/test/integration/testdata/image-sbom-cataloger/go.mod",
                "go.mod",
                "syft/pkg/cataloger/dotnet/testdata/image-net2-app/src/helloworld.csproj",
                "syft/pkg/cataloger/dotnet/testdata/image-net6-asp-libman/src/LibManSample.csproj",
                "syft/pkg/cataloger/dotnet/testdata/image-net8-app-no-depjson/src/dotnetapp.csproj",
                "syft/pkg/cataloger/dotnet/testdata/image-net8-app-self-contained/src/dotnetapp.csproj",
                "syft/pkg/cataloger/dotnet/testdata/image-net8-app-single-file/src/dotnetapp.csproj",
                "syft/pkg/cataloger/dotnet/testdata/image-net8-app-with-runtime-nodepsjson/src/dotnetapp.csproj",
                "syft/pkg/cataloger/dotnet/testdata/image-net8-app-with-runtime/src/dotnetapp.csproj",
                "syft/pkg/cataloger/dotnet/testdata/image-net8-app/src/dotnetapp.csproj",
                "syft/pkg/cataloger/dotnet/testdata/image-net8-compile-target/src/helloworld.csproj",
                "syft/pkg/cataloger/dotnet/testdata/image-net8-ilrepack/src/dotnetapp.csproj",
                "syft/pkg/cataloger/dotnet/testdata/image-net8-privateassets/src/dotnetapp.csproj",
                "syft/pkg/cataloger/golang/internal/gotestdata/go-source/go.mod",
                "syft/pkg/cataloger/golang/testdata/archs/src/go.mod",
                "syft/pkg/cataloger/golang/testdata/corrupt/go.mod",
                "syft/pkg/cataloger/golang/testdata/glob-paths/src/go.mod",
                "syft/pkg/cataloger/golang/testdata/go-mod-fixtures/many-packages/go.mod",
                "syft/pkg/cataloger/golang/testdata/go-mod-fixtures/one-package/go.mod",
                "syft/pkg/cataloger/golang/testdata/go-mod-fixtures/relative-replace/go.mod",
                "syft/pkg/cataloger/golang/testdata/go-sum-hashes/go.mod",
                "syft/pkg/cataloger/golang/testdata/image-not-a-module/go.mod",
                "syft/pkg/cataloger/golang/testdata/image-small-upx/go.mod",
                "syft/pkg/cataloger/golang/testdata/image-small/go.mod",
                "syft/pkg/cataloger/internal/pe/testdata/image-dotnet31-single-file/src/hello.csproj",
                "syft/pkg/cataloger/internal/pe/testdata/image-dotnet5-single-file/src/hello.csproj",
                "syft/pkg/cataloger/internal/pe/testdata/image-dotnet6-single-file/src/hello.csproj",
                "syft/pkg/cataloger/java/internal/maven/testdata/local/child-1/pom.xml",
                "syft/pkg/cataloger/java/internal/maven/testdata/local/child-2/pom.xml",
                "syft/pkg/cataloger/java/internal/maven/testdata/local/child-3/pom.xml",
                "syft/pkg/cataloger/java/internal/maven/testdata/local/circular-1/pom.xml",
                "syft/pkg/cataloger/java/internal/maven/testdata/local/circular-2/pom.xml",
                "syft/pkg/cataloger/java/internal/maven/testdata/local/contains-child-1/pom.xml",
                "syft/pkg/cataloger/java/internal/maven/testdata/local/parent-1/pom.xml",
                "syft/pkg/cataloger/java/internal/maven/testdata/local/parent-2/pom.xml",
                "syft/pkg/cataloger/java/internal/maven/testdata/local/parent-3/pom.xml",
                "syft/pkg/cataloger/java/testdata/corrupt/pom.xml",
                "syft/pkg/cataloger/java/testdata/glob-paths/src/pom.xml",
                "syft/pkg/cataloger/java/testdata/gradle/build.gradle",
                "syft/pkg/cataloger/java/testdata/jar-metadata/api-all-2.0.0-sources/META-INF/maven/org.apache.directory.api/api-all/pom.xml",
                "syft/pkg/cataloger/java/testdata/jar-metadata/api-all-2.0.0-sources/META-INF/maven/org.apache.directory.api/api-asn1-api/pom.xml",
                "syft/pkg/cataloger/java/testdata/jar-metadata/com.fasterxml.jackson.core.jackson-core-2.15.2/META-INF/maven/com.fasterxml.jackson.core/jackson-core/pom.xml",
                "syft/pkg/cataloger/java/testdata/jar-metadata/commons-lang3-3.12.0/META-INF/maven/org.apache.commons-lang3/pom.xml",
                "syft/pkg/cataloger/java/testdata/jar-metadata/jackson-core-2.15.2/META-INF/maven/com.fasterxml.jackson.core/jackson-core/pom.xml",
                "syft/pkg/cataloger/java/testdata/jar-metadata/micronaut-aop-4.9.11/META-INF/maven/io.micronaut/micronaut-aop/pom.xml",
                "syft/pkg/cataloger/java/testdata/jar-metadata/multiple-matching-2.11.5/META-INF/maven/org.multiple/multiple-matching-1/pom.xml",
                "syft/pkg/cataloger/java/testdata/jar-metadata/multiple-matching-2.11.5/META-INF/maven/org.multiple/multiple-matching-2/pom.xml",
                "syft/pkg/cataloger/java/testdata/jar-metadata/multiple-matching-2.11.5/META-INF/maven/org.multiple/multiple-matching-3/pom.xml",
                "syft/pkg/cataloger/java/testdata/jar-metadata/opensaml-core-3.4.6/META-INF/maven/org.opensaml/opensaml-core/pom.xml",
                "syft/pkg/cataloger/java/testdata/jar-metadata/org.multiple-thename/META-INF/maven/com.multiple/thename/pom.xml",
                "syft/pkg/cataloger/java/testdata/jar-metadata/org.multiple-thename/META-INF/maven/org.multiple/thename/pom.xml",
                "syft/pkg/cataloger/java/testdata/java-builds/example-java-app/build.gradle",
                "syft/pkg/cataloger/java/testdata/java-builds/example-java-app/pom.xml",
                "syft/pkg/cataloger/java/testdata/java-builds/example-jenkins-plugin/pom.xml",
                "syft/pkg/cataloger/java/testdata/java-builds/example-sb-app/pom.xml",
                "syft/pkg/cataloger/java/testdata/pom/commons-text-1.10.0/pom.xml",
                "syft/pkg/cataloger/java/testdata/pom/example-java-app-maven/pom.xml",
                "syft/pkg/cataloger/java/testdata/pom/transitive-top-level/pom.xml",
                "syft/pkg/cataloger/rust/testdata/image-audit/Cargo.toml"
              ],
              "dependency_bot_commit_share": 0.35
            },
            "components": [
              {
                "key": "one_command_bootstrap",
                "name": "One-command bootstrap",
                "detail": "Makefile, Taskfile.yaml, cmd/syft/internal/test/integration/testdata/Makefile, schema/cyclonedx/Makefile, syft/file/cataloger/executable/testdata/Makefile, syft/file/cataloger/executable/testdata/elf/Makefile, syft/file/cataloger/executable/testdata/elf/project/Makefile, syft/file/cataloger/executable/testdata/shared-info/Makefile, syft/file/cataloger/executable/testdata/shared-info/project/Makefile, syft/file/cataloger/executable/testdata/shared-info/project/hello/Makefile, syft/file/cataloger/executable/testdata/shared-info/project/libhello/Makefile, syft/pkg/cataloger/binary/testdata/Makefile, syft/pkg/cataloger/binary/testdata/elf-testdata/elfbinwithcorrupt/elfsrc/makefile, syft/pkg/cataloger/binary/testdata/elf-testdata/elfbinwithcorrupt/makefile, syft/pkg/cataloger/binary/testdata/elf-testdata/elfbinwithnestedlib/elfsrc/makefile, syft/pkg/cataloger/binary/testdata/elf-testdata/elfbinwithnestedlib/makefile, syft/pkg/cataloger/binary/testdata/elf-testdata/elfbinwithsisterlib/elfsrc1/makefile, syft/pkg/cataloger/binary/testdata/elf-testdata/elfbinwithsisterlib/elfsrc2/makefile, syft/pkg/cataloger/binary/testdata/elf-testdata/elfbinwithsisterlib/makefile, syft/pkg/cataloger/dotnet/testdata/Makefile, syft/pkg/cataloger/golang/testdata/Makefile, syft/pkg/cataloger/golang/testdata/archs/Makefile, syft/pkg/cataloger/internal/pe/testdata/Makefile, syft/pkg/cataloger/java/testdata/Makefile, syft/pkg/cataloger/java/testdata/jar-metadata/Makefile, syft/pkg/cataloger/java/testdata/java-builds/Makefile, syft/pkg/cataloger/kernel/testdata/Makefile, syft/pkg/cataloger/redhat/testdata/Makefile, test/cli/testdata/Makefile, test/cli/testdata/image-java-spdx-tools/Makefile, test/cli/testdata/registry/Makefile, test/install/Makefile",
                "points": 18,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": "Makefile, Taskfile.yaml, cmd/syft/internal/test/integration/testdata/Makefile, schema/cyclonedx/Makefile, syft/file/cataloger/executable/testdata/Makefile, syft/file/cataloger/executable/testdata/elf/Makefile, syft/file/cataloger/executable/testdata/elf/project/Makefile, syft/file/cataloger/executable/testdata/shared-info/Makefile, syft/file/cataloger/executable/testdata/shared-info/project/Makefile, syft/file/cataloger/executable/testdata/shared-info/project/hello/Makefile, syft/file/cataloger/executable/testdata/shared-info/project/libhello/Makefile, syft/pkg/cataloger/binary/testdata/Makefile, syft/pkg/cataloger/binary/testdata/elf-testdata/elfbinwithcorrupt/elfsrc/makefile, syft/pkg/cataloger/binary/testdata/elf-testdata/elfbinwithcorrupt/makefile, syft/pkg/cataloger/binary/testdata/elf-testdata/elfbinwithnestedlib/elfsrc/makefile, syft/pkg/cataloger/binary/testdata/elf-testdata/elfbinwithnestedlib/makefile, syft/pkg/cataloger/binary/testdata/elf-testdata/elfbinwithsisterlib/elfsrc1/makefile, syft/pkg/cataloger/binary/testdata/elf-testdata/elfbinwithsisterlib/elfsrc2/makefile, syft/pkg/cataloger/binary/testdata/elf-testdata/elfbinwithsisterlib/makefile, syft/pkg/cataloger/dotnet/testdata/Makefile, syft/pkg/cataloger/golang/testdata/Makefile, syft/pkg/cataloger/golang/testdata/archs/Makefile, syft/pkg/cataloger/internal/pe/testdata/Makefile, syft/pkg/cataloger/java/testdata/Makefile, syft/pkg/cataloger/java/testdata/jar-metadata/Makefile, syft/pkg/cataloger/java/testdata/java-builds/Makefile, syft/pkg/cataloger/kernel/testdata/Makefile, syft/pkg/cataloger/redhat/testdata/Makefile, test/cli/testdata/Makefile, test/cli/testdata/image-java-spdx-tools/Makefile, test/cli/testdata/registry/Makefile, test/install/Makefile"
                    }
                  }
                ],
                "max_points": 18
              },
              {
                "key": "automated_tests",
                "name": "Automated tests",
                "detail": null,
                "points": 22,
                "status": "met",
                "details": [],
                "max_points": 22
              },
              {
                "key": "lint_format_config",
                "name": "Lint / format config",
                "detail": ".golangci.yaml",
                "points": 11,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": ".golangci.yaml"
                    }
                  }
                ],
                "max_points": 11
              },
              {
                "key": "static_type_checking",
                "name": "Static type checking",
                "detail": "Go (statically typed)",
                "points": 11,
                "status": "met",
                "details": [
                  {
                    "code": "statically_typed_language",
                    "params": {
                      "language": "Go"
                    }
                  }
                ],
                "max_points": 11
              },
              {
                "key": "reproducible_environment",
                "name": "Reproducible environment",
                "detail": "Dockerfile, lockfile",
                "points": 10,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": "Dockerfile, lockfile"
                    }
                  }
                ],
                "max_points": 10
              },
              {
                "key": "demonstrated_agent_practice",
                "name": "Demonstrated agent practice",
                "detail": "no agent-authored commits among the last 100",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "no_agent_authored_commits",
                    "params": {
                      "sampled": 100
                    }
                  }
                ],
                "max_points": 10
              },
              {
                "key": "automated_maintenance",
                "name": "Automated maintenance",
                "detail": "35 of the last 100 commits are automated dependency updates",
                "points": 8,
                "status": "met",
                "details": [
                  {
                    "code": "dependency_bot_commits",
                    "params": {
                      "count": 35,
                      "sampled": 100
                    }
                  }
                ],
                "max_points": 8
              },
              {
                "key": "openssf_scorecard_pinned_dependencies",
                "name": "OpenSSF Scorecard: Pinned-Dependencies",
                "detail": "dependency not pinned by hash detected -- score normalized to 7",
                "points": 7,
                "status": "partial",
                "details": [],
                "max_points": 10
              }
            ]
          },
          {
            "key": "ai_code_legibility",
            "band": "excellent",
            "name": "Code legibility for models",
            "note": null,
            "notes": [],
            "value": 100,
            "inputs": {
              "primary_language": "Go",
              "largest_source_bytes": 202860,
              "source_files_sampled": 1197,
              "oversized_source_files": 6
            },
            "components": [
              {
                "key": "type_checkable_code",
                "name": "Type-checkable code",
                "detail": "Go (statically typed)",
                "points": 45,
                "status": "met",
                "details": [
                  {
                    "code": "statically_typed_language",
                    "params": {
                      "language": "Go"
                    }
                  }
                ],
                "max_points": 45
              },
              {
                "key": "manageable_file_sizes",
                "name": "Manageable file sizes",
                "detail": "6/1197 source files over 60KB",
                "points": 54.7,
                "status": "partial",
                "details": [
                  {
                    "code": "oversized_source_files",
                    "params": {
                      "kb": 60,
                      "sampled": 1197,
                      "oversized": 6
                    }
                  }
                ],
                "max_points": 55
              }
            ]
          },
          {
            "key": "ai_interfaces",
            "band": "at_risk",
            "name": "Machine-readable interfaces",
            "note": null,
            "notes": [],
            "value": 40,
            "inputs": {
              "example_dirs": [
                "example",
                "examples",
                "sample"
              ],
              "has_mcp_signal": false,
              "api_schema_files": []
            },
            "components": [
              {
                "key": "api_schema_openapi_graphql_proto",
                "name": "API schema (OpenAPI/GraphQL/proto)",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 40
              },
              {
                "key": "mcp_server",
                "name": "MCP server",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 20
              },
              {
                "key": "runnable_examples",
                "name": "Runnable examples",
                "detail": "example, examples, sample",
                "points": 40,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": "example, examples, sample"
                    }
                  }
                ],
                "max_points": 40
              }
            ]
          }
        ],
        "description": "How well is the repo equipped to be developed and maintained with AI coding agents? An independent, experimental badge — weight 0.0, so it is surfaced on its own and does not affect the overall health score."
      }
    ],
    "metrics_version": "1.13.0"
  },
  "warnings": [
    "Community profile unavailable",
    "go package 'github.com/anchore/syft' points at a different repository (https://github.com/anchore/syft); excluded from ecosystem scoring"
  ],
  "report_type": "repository",
  "generated_at": "2026-07-25T10:34:35.126456Z",
  "schema_version": "0.27.0",
  "badge_url": "https://raw.githubusercontent.com/inspect-software/badges/main/v1/j/joshbressers/syft.svg",
  "full_name": "joshbressers/syft",
  "license_state": "standard",
  "license_spdx": "Apache-2.0"
}