公开记录
软件健康报告模式 0.27.0 · 指标 1.13.0 · 2026-07-25 10:11 UTC

wagoodman / syft

CLI tool and library for generating a Software Bill of Materials from container images and filesystems

GoApache-2.0★ 3 星标⑂ 1 复刻始于 2021年12月复刻在 GitHub 上查看 ↗

wagoodman/syft 的健康指数为 100 分中的 40 分，处于「存在风险」区间。 其得分最高的类别是AI Readiness（67/100），最低的是Community & Adoption（14/100）。 最近一次更新在 196 天前。 近期的大部分工作由 2 位贡献者完成。

40
总分 / 100
存在风险

软件健康指数

指标归入加权类别，统一采用 1–100 量表。总体分先取类别加权平均；当公开证据触发高风险司法辖区政策时，评级会按政策调整，并设置 49（有风险）的上限。AI 就绪度不计入总体分。

40
优秀85-100堪称典范；基本满足所有检验标准
良好70-84健康；仅有轻微不足
中等50-69可接受，但存在明显不足；建议进行审查
存在风险30-49存在重大薄弱环节；采用时应保持审慎
危急1-29问题严重（项目被弃置、仅有单一维护者、缺乏基本工程规范）
活力社区与采用可持续性与治理工程质量安全AI 就绪度

评分画像

每条轴代表一个类别。形状比平均值更重要——健康的对象会填满整个图形，而“一峰一谷”式画像意味着某一维度的优势正掩盖另一维度的风险。

所有权

Alex Goodman个人账户
1,675 关注者110 个公开仓库始于 2011年1月@anchore

该仓库由个人账户拥有。相较于组织支持的项目，单一所有者项目的延续性风险更高。

软件包生态系统

注册表软件包版本月下载量版本数最近发布
Gogithub.com/anchore/syft指向其他仓库——不计分v1.49.0-2684 天前

按类别列示的指标

活力

项目是否仍有生命——是否仍在编写代码，是否仍在发布版本？

42存在风险 · 占总体的 22%

开发活跃度

38存在风险
评分方式
3.6/36推送新近度 — 最近一次推送于 196 天前
15.9/36提交节奏 — 52 周中有 23 周有提交
18/18提交量 — 最近一年 293 次提交
0/10OpenSSF Scorecard：Maintained — 0 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 0
所用输入
commits_last_year293
human_commit_share0.4
days_since_last_push196
active_weeks_last_year23

发布纪律

47存在风险
评分方式
27/27有发布版本 — 已发布 1 个发布版本
7.2/36发布时效 — 最近一次发布版本于 611 天前
12.6/27发布节奏 — 节奏未知（仅一次发布）
0/10OpenSSF Scorecard：Signed-Releases — Project has not signed or included provenance with any releases.
所用输入
releases_count1
latest_release_tagv0.0.0
releases_from_tags否
days_since_latest_release611
mean_days_between_releases—

社区与采用

项目是否拥有用户、下载量与关注度，并具备欢迎贡献者参与的配置？

14危急 · 占总体的 18%

流行度与采用

5危急
评分方式
4.9/60星标 — 3 个星标
0/25复刻 — 1 个复刻
0/15关注者 — 0 位关注者
所用输入
forks1
stars3
watchers0
growth_stateunverified
growth_factor_pct100
growth_unverified_reasonno_history

社区健康

25危急
评分方式
0/22.5README
22.5/22.5许可证 — 可识别的许可证（Apache-2.0）
0/18CONTRIBUTING 指南
0/13.5行为准则
0/7.2议题模板
0/6.3PR 模板
所用输入
has_readme否
has_license否
has_contributing否
has_issue_template否
has_code_of_conduct否
has_pull_request_template否

可持续性与治理

项目能否在其成员之外延续——巴士系数、响应能力、由谁支持，以及软件包的维护状况？

46存在风险 · 占总体的 24%

维护者韧性（巴士系数）

61中等
评分方式
25.2/54巴士系数 — 2 位贡献者贡献了半数提交
12.6/22.5提交分布 — 头号贡献者编写了 44% 的提交
13.5/13.5贡献者广度 — 98 位贡献者
10/10OpenSSF Scorecard：Contributors — project has 35 contributing companies or organizations
所用输入
bus_factor2
contributors_sampled98
top_contributor_share0.44

议题与 PR 响应能力

1危急
评分方式
0/46.8议题解决 — 没有议题或无数据
0/38.3PR 接受 — 已裁定的 PR 中 0/4 已合并
0/15OpenSSF Scorecard：Code-Review — Found 0/30 approved changesets -- score normalized to 0
所用输入
merged_prs0
open_issues0
closed_issues0
issue_closed_ratio—
closed_unmerged_prs4
已排除计分（无数据或不适用）：议题解决。 其余权重已重新归一化。

所有权与托管责任

73良好
评分方式
10/30所有权背书 — 个人（用户）账户
0/20已验证域名 — 不适用于个人账户
23.2/25所有者影响力 — wagoodman 有 1,675 位关注者
25/25既往记录 — 110 个公开仓库，账户约 15 年
所用输入
followers1,675
owner_typeUser
is_verified—
owner_loginwagoodman
public_repos110
account_age_days5,655
已排除计分（无数据或不适用）：已验证域名。 其余权重已重新归一化。

工程质量

基础的工程与文档实践是否到位？

52中等 · 占总体的 20%

工程实践

80良好
评分方式
24/24CI 工作流 — 13 个工作流
24/24存在测试
16/16Linter 配置 — .golangci.yaml
0/9.6Pre-commit 钩子
0/6.4.editorconfig
0/20OpenSSF Scorecard：CI-Tests — 无数据
所用输入
has_ci是
has_tests是
has_editorconfig否
has_linter_config是
has_precommit_config否
已排除计分（无数据或不适用）：OpenSSF Scorecard：CI-Tests。 其余权重已重新归一化。

文档

10危急
评分方式
0/30README
0/25文档目录
0/15文档 / 主页站点
0/10仓库描述
0/10主题标签
10/10Wiki
所用输入
topics—
has_wiki是
homepage—
has_readme否
has_docs_dir否
has_description否

安全

可见的安全与供应链实践是否稳固，且不存在未解决的高风险司法辖区暴露？

42存在风险 · 占总体的 16%

安全态势

43存在风险
评分方式
0/7.5Binary-Artifacts — binaries present in source code
0/7.5Branch-Protection — branch protection not enabled on development/release branches
0/2.5CI-Tests — 无数据
0/2.5CII-Best-Practices — no effort to earn an OpenSSF best practices badge detected
0/7.5Code-Review — Found 0/30 approved changesets -- score normalized to 0
2.5/2.5Contributors — project has 35 contributing companies or organizations
10/10Dangerous-Workflow — no dangerous workflow patterns detected
7.5/7.5Dependency-Update-Tool — update tool detected
0/5Fuzzing — project is not fuzzed
2.5/2.5许可证 — license file detected
0/7.5Maintained — 0 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 0
0/5Packaging — 无数据
3/5Pinned-Dependencies — dependency not pinned by hash detected -- score normalized to 6
5/5SAST — SAST tool detected: CodeQL
5/5Security-Policy — security policy file detected
0/7.5Signed-Releases — Project has not signed or included provenance with any releases.
6.8/7.5Token-Permissions — detected GitHub workflow tokens with excessive permissions
0/7.5Vulnerabilities — 319 existing vulnerabilities detected
所用输入
sourceopenssf_scorecard
checks_evaluated16
scorecard_versionv5.5.0
checks_inconclusive2
scorecard_aggregate4.3
已排除计分（无数据或不适用）：ci_tests, packaging。 其余权重已重新归一化。

依赖安全公告

39存在风险
评分方式
6.5/35直接依赖不含已知公告 — 7 个受影响：github.com/go-git/go-billy/v5 v5.7.0 (high 8.1), github.com/hashicorp/go-getter v1.8.4 (high 7.5), github.com/anchore/stereoscope v0.0.0-20200706164556-7cf39d7f4639 (moderate 5.3)，另有 4 个
0/25间接依赖不含已知公告 — 在此范围内，传递依赖集合无法与开发和测试依赖区分
22.9/40没有长期未处理的公告 — 5 个携带公告的软件包超过 90 天未处理；最早一条发布于 905 天前
所用输入
sourceosv
advisories195
affected_packages43
assessed_packages428
unassessed_packages1
affected_by_severitycritical 4, high 18, moderate 14, low 3, unknown 4
direct_affected_packages7
已排除计分（无数据或不适用）：间接依赖不含已知公告。 其余权重已重新归一化。 已将 428 个已解析依赖与 OSV 比对。 有 1 项无法评估——没有已解析的版本、生态系统不受支持，或超出所报告的软件包清单。 该仓库未发布任何索引可解析的软件包，因此改为评估仓库依赖图。该图将开发与测试版本固定同交付的依赖混在一起，因此仅对声明的运行时依赖计分；传递性发现仅作为背景信息列出，不计入评分。 未对可达性进行分析。

AI 就绪度

该仓库在多大程度上具备与 AI 编码代理协同开发与维护的条件？这是一枚独立的实验性徽章——权重为 0.0，因此单独呈现，不影响总体健康评分。

67中等 · 占总体的 0%

AI 代理上下文与指引

40存在风险
评分方式
0/45代理指令 — 没有 CLAUDE.md / AGENTS.md / 编辑器规则
0/15机器可读文档（llms.txt）
40/40可读的提交历史 — 40 次人类提交中有 40 次说明了意图（结构化标题或解释性正文）
所用输入
has_llms_txt否
legible_history_share1
agent_instruction_files—
agent_instruction_max_bytes—

验证循环（构建 / 测试 / 类型检查）

86优秀
评分方式
18/18一条命令的引导启动 — Makefile, Taskfile.yaml, cmd/syft/internal/test/integration/test-fixtures/Makefile, schema/cyclonedx/Makefile, syft/file/cataloger/executable/test-fixtures/Makefile, syft/file/cataloger/executable/test-fixtures/elf/Makefile, syft/file/cataloger/executable/test-fixtures/elf/project/Makefile, syft/file/cataloger/executable/test-fixtures/shared-info/Makefile, syft/file/cataloger/executable/test-fixtures/shared-info/project/Makefile, syft/file/cataloger/executable/test-fixtures/shared-info/project/hello/Makefile, syft/file/cataloger/executable/test-fixtures/shared-info/project/libhello/Makefile, syft/pkg/cataloger/binary/test-fixtures/Makefile, syft/pkg/cataloger/binary/test-fixtures/elf-test-fixtures/elfbinwithcorrupt/elfsrc/makefile, syft/pkg/cataloger/binary/test-fixtures/elf-test-fixtures/elfbinwithcorrupt/makefile, syft/pkg/cataloger/binary/test-fixtures/elf-test-fixtures/elfbinwithnestedlib/elfsrc/makefile, syft/pkg/cataloger/binary/test-fixtures/elf-test-fixtures/elfbinwithnestedlib/makefile, syft/pkg/cataloger/binary/test-fixtures/elf-test-fixtures/elfbinwithsisterlib/elfsrc1/makefile, syft/pkg/cataloger/binary/test-fixtures/elf-test-fixtures/elfbinwithsisterlib/elfsrc2/makefile, syft/pkg/cataloger/binary/test-fixtures/elf-test-fixtures/elfbinwithsisterlib/makefile, syft/pkg/cataloger/dotnet/test-fixtures/Makefile, syft/pkg/cataloger/golang/test-fixtures/Makefile, syft/pkg/cataloger/golang/test-fixtures/archs/Makefile, syft/pkg/cataloger/internal/pe/test-fixtures/Makefile, syft/pkg/cataloger/java/test-fixtures/Makefile, syft/pkg/cataloger/java/test-fixtures/jar-metadata/Makefile, syft/pkg/cataloger/java/test-fixtures/java-builds/Makefile, syft/pkg/cataloger/kernel/test-fixtures/Makefile, syft/pkg/cataloger/redhat/test-fixtures/Makefile, test/cli/test-fixtures/Makefile, test/cli/test-fixtures/image-java-spdx-tools/Makefile, test/cli/test-fixtures/registry/Makefile, test/install/Makefile
22/22自动化测试
11/11Lint / 格式化配置 — .golangci.yaml
11/11静态类型检查 — Go（静态类型）
10/10可复现环境 — Dockerfile, lockfile
0/10已体现的代理实践 — 最近 100 次提交中没有代理编写的提交
8/8自动化维护 — 最近 100 次提交中有 47 次为自动依赖更新
6/10OpenSSF Scorecard：Pinned-Dependencies — dependency not pinned by hash detected -- score normalized to 6
所用输入
has_nix否
has_tests是
lockfilesCargo.lock, Gemfile.lock, Pipfile.lock, composer.lock, go.sum, mix.lock, package-lock.json, packages.lock.json, pdm.lock, pnpm-lock.yaml, poetry.lock, uv.lock, yarn.lock
has_dockerfile是
typed_language是
bootstrap_filesMakefile, Taskfile.yaml, cmd/syft/internal/test/integration/test-fixtures/Makefile, schema/cyclonedx/Makefile, syft/file/cataloger/executable/test-fixtures/Makefile, syft/file/cataloger/executable/test-fixtures/elf/Makefile, syft/file/cataloger/executable/test-fixtures/elf/project/Makefile, syft/file/cataloger/executable/test-fixtures/shared-info/Makefile, syft/file/cataloger/executable/test-fixtures/shared-info/project/Makefile, syft/file/cataloger/executable/test-fixtures/shared-info/project/hello/Makefile, syft/file/cataloger/executable/test-fixtures/shared-info/project/libhello/Makefile, syft/pkg/cataloger/binary/test-fixtures/Makefile, syft/pkg/cataloger/binary/test-fixtures/elf-test-fixtures/elfbinwithcorrupt/elfsrc/makefile, syft/pkg/cataloger/binary/test-fixtures/elf-test-fixtures/elfbinwithcorrupt/makefile, syft/pkg/cataloger/binary/test-fixtures/elf-test-fixtures/elfbinwithnestedlib/elfsrc/makefile, syft/pkg/cataloger/binary/test-fixtures/elf-test-fixtures/elfbinwithnestedlib/makefile, syft/pkg/cataloger/binary/test-fixtures/elf-test-fixtures/elfbinwithsisterlib/elfsrc1/makefile, syft/pkg/cataloger/binary/test-fixtures/elf-test-fixtures/elfbinwithsisterlib/elfsrc2/makefile, syft/pkg/cataloger/binary/test-fixtures/elf-test-fixtures/elfbinwithsisterlib/makefile, syft/pkg/cataloger/dotnet/test-fixtures/Makefile, syft/pkg/cataloger/golang/test-fixtures/Makefile, syft/pkg/cataloger/golang/test-fixtures/archs/Makefile, syft/pkg/cataloger/internal/pe/test-fixtures/Makefile, syft/pkg/cataloger/java/test-fixtures/Makefile, syft/pkg/cataloger/java/test-fixtures/jar-metadata/Makefile, syft/pkg/cataloger/java/test-fixtures/java-builds/Makefile, syft/pkg/cataloger/kernel/test-fixtures/Makefile, syft/pkg/cataloger/redhat/test-fixtures/Makefile, test/cli/test-fixtures/Makefile, test/cli/test-fixtures/image-java-spdx-tools/Makefile, test/cli/test-fixtures/registry/Makefile, test/install/Makefile
has_devcontainer否
has_linter_config是
typecheck_configs—
agent_commit_share0
toolchain_manifestscmd/syft/internal/test/integration/test-fixtures/image-go-bin-arch-coverage/go.mod, cmd/syft/internal/test/integration/test-fixtures/image-pkg-coverage/pkgs/go/go.mod, cmd/syft/internal/test/integration/test-fixtures/image-pkg-coverage/pkgs/java/pom.xml, cmd/syft/internal/test/integration/test-fixtures/image-sbom-cataloger/go.mod, go.mod, syft/pkg/cataloger/dotnet/test-fixtures/image-net2-app/src/helloworld.csproj, syft/pkg/cataloger/dotnet/test-fixtures/image-net6-asp-libman/src/LibManSample.csproj, syft/pkg/cataloger/dotnet/test-fixtures/image-net8-app-no-depjson/src/dotnetapp.csproj, syft/pkg/cataloger/dotnet/test-fixtures/image-net8-app-self-contained/src/dotnetapp.csproj, syft/pkg/cataloger/dotnet/test-fixtures/image-net8-app-single-file/src/dotnetapp.csproj, syft/pkg/cataloger/dotnet/test-fixtures/image-net8-app-with-runtime-nodepsjson/src/dotnetapp.csproj, syft/pkg/cataloger/dotnet/test-fixtures/image-net8-app-with-runtime/src/dotnetapp.csproj, syft/pkg/cataloger/dotnet/test-fixtures/image-net8-app/src/dotnetapp.csproj, syft/pkg/cataloger/dotnet/test-fixtures/image-net8-compile-target/src/helloworld.csproj, syft/pkg/cataloger/dotnet/test-fixtures/image-net8-ilrepack/src/dotnetapp.csproj, syft/pkg/cataloger/dotnet/test-fixtures/image-net8-privateassets/src/dotnetapp.csproj, syft/pkg/cataloger/golang/test-fixtures/archs/src/go.mod, syft/pkg/cataloger/golang/test-fixtures/corrupt/go.mod, syft/pkg/cataloger/golang/test-fixtures/glob-paths/src/go.mod, syft/pkg/cataloger/golang/test-fixtures/go-mod-fixtures/many-packages/go.mod, syft/pkg/cataloger/golang/test-fixtures/go-mod-fixtures/one-package/go.mod, syft/pkg/cataloger/golang/test-fixtures/go-mod-fixtures/relative-replace/go.mod, syft/pkg/cataloger/golang/test-fixtures/go-source/go.mod, syft/pkg/cataloger/golang/test-fixtures/go-sum-hashes/go.mod, syft/pkg/cataloger/golang/test-fixtures/image-not-a-module/go.mod, syft/pkg/cataloger/golang/test-fixtures/image-small-upx/go.mod, syft/pkg/cataloger/golang/test-fixtures/image-small/go.mod, syft/pkg/cataloger/internal/pe/test-fixtures/image-dotnet31-single-file/src/hello.csproj, syft/pkg/cataloger/internal/pe/test-fixtures/image-dotnet5-single-file/src/hello.csproj, syft/pkg/cataloger/internal/pe/test-fixtures/image-dotnet6-single-file/src/hello.csproj, syft/pkg/cataloger/java/internal/maven/test-fixtures/local/child-1/pom.xml, syft/pkg/cataloger/java/internal/maven/test-fixtures/local/child-2/pom.xml, syft/pkg/cataloger/java/internal/maven/test-fixtures/local/child-3/pom.xml, syft/pkg/cataloger/java/internal/maven/test-fixtures/local/circular-1/pom.xml, syft/pkg/cataloger/java/internal/maven/test-fixtures/local/circular-2/pom.xml, syft/pkg/cataloger/java/internal/maven/test-fixtures/local/contains-child-1/pom.xml, syft/pkg/cataloger/java/internal/maven/test-fixtures/local/parent-1/pom.xml, syft/pkg/cataloger/java/internal/maven/test-fixtures/local/parent-2/pom.xml, syft/pkg/cataloger/java/internal/maven/test-fixtures/local/parent-3/pom.xml, syft/pkg/cataloger/java/test-fixtures/corrupt/pom.xml, syft/pkg/cataloger/java/test-fixtures/glob-paths/src/pom.xml, syft/pkg/cataloger/java/test-fixtures/gradle/build.gradle, syft/pkg/cataloger/java/test-fixtures/jar-metadata/api-all-2.0.0-sources/META-INF/maven/org.apache.directory.api/api-all/pom.xml, syft/pkg/cataloger/java/test-fixtures/jar-metadata/api-all-2.0.0-sources/META-INF/maven/org.apache.directory.api/api-asn1-api/pom.xml, syft/pkg/cataloger/java/test-fixtures/jar-metadata/com.fasterxml.jackson.core.jackson-core-2.15.2/META-INF/maven/com.fasterxml.jackson.core/jackson-core/pom.xml, syft/pkg/cataloger/java/test-fixtures/jar-metadata/commons-lang3-3.12.0/META-INF/maven/org.apache.commons-lang3/pom.xml, syft/pkg/cataloger/java/test-fixtures/jar-metadata/jackson-core-2.15.2/META-INF/maven/com.fasterxml.jackson.core/jackson-core/pom.xml, syft/pkg/cataloger/java/test-fixtures/jar-metadata/micronaut-aop-4.9.11/META-INF/maven/io.micronaut/micronaut-aop/pom.xml, syft/pkg/cataloger/java/test-fixtures/jar-metadata/multiple-matching-2.11.5/META-INF/maven/org.multiple/multiple-matching-1/pom.xml, syft/pkg/cataloger/java/test-fixtures/jar-metadata/multiple-matching-2.11.5/META-INF/maven/org.multiple/multiple-matching-2/pom.xml, syft/pkg/cataloger/java/test-fixtures/jar-metadata/multiple-matching-2.11.5/META-INF/maven/org.multiple/multiple-matching-3/pom.xml, syft/pkg/cataloger/java/test-fixtures/jar-metadata/opensaml-core-3.4.6/META-INF/maven/org.opensaml/opensaml-core/pom.xml, syft/pkg/cataloger/java/test-fixtures/jar-metadata/org.multiple-thename/META-INF/maven/com.multiple/thename/pom.xml, syft/pkg/cataloger/java/test-fixtures/jar-metadata/org.multiple-thename/META-INF/maven/org.multiple/thename/pom.xml, syft/pkg/cataloger/java/test-fixtures/java-builds/example-java-app/build.gradle, syft/pkg/cataloger/java/test-fixtures/java-builds/example-java-app/pom.xml, syft/pkg/cataloger/java/test-fixtures/java-builds/example-jenkins-plugin/pom.xml, syft/pkg/cataloger/java/test-fixtures/java-builds/example-sb-app/pom.xml, syft/pkg/cataloger/java/test-fixtures/pom/commons-text-1.10.0/pom.xml, syft/pkg/cataloger/java/test-fixtures/pom/example-java-app-maven/pom.xml, syft/pkg/cataloger/java/test-fixtures/pom/transitive-top-level/pom.xml, syft/pkg/cataloger/rust/test-fixtures/image-audit/Cargo.toml
dependency_bot_commit_share0.47

面向模型的代码可读性

100优秀
评分方式
45/45可类型检查的代码 — Go（静态类型）
54.7/55可控的文件大小 — 采样的 1,181 个源文件中有 6 个超过 60KB
所用输入
primary_languageGo
largest_source_bytes212,636
source_files_sampled1,181
oversized_source_files6

机器可读接口

40存在风险
评分方式
0/40API 模式（OpenAPI/GraphQL/proto）
0/20MCP 服务器
40/40可运行示例 — example, examples, sample
所用输入
example_dirsexample, examples, sample
has_mcp_signal否
api_schema_files—

关键数据

3GitHub 星标
98贡献者
293最近 12 个月提交数
196距最近推送天数
1发布版本数
2巴士系数（bus factor）
0开放议题
Go软件包生态系统数

数据采集警告

  • Star history unavailable: GitHub GraphQL error: Resource not accessible by personal access token
  • Community profile unavailable
  • go package 'github.com/anchore/syft' points at a different repository (https://github.com/anchore/syft); excluded from ecosystem scoring

更多细节

OpenSSF Scorecard 4.3 / 10
4.3综合

来自开源项目 OpenSSF Scorecard 的独立、工具无关的安全评估。每项检查奖励的是安全实践本身，而非特定供应商的工具。Scorecard 无法判定的检查项标记为 不适用，并从安全评分中剔除（绝不按零分计）。Scorecard v5.5.0 · 2026-07-25 10:11 UTC

0Binary-Artifactsbinaries present in source code
0Branch-Protectionbranch protection not enabled on development/release branches
不适用CI-Testsno pull request found
0CII-Best-Practicesno effort to earn an OpenSSF best practices badge detected
0Code-ReviewFound 0/30 approved changesets -- score normalized to 0
10Contributorsproject has 35 contributing companies or organizations
10Dangerous-Workflowno dangerous workflow patterns detected
10Dependency-Update-Toolupdate tool detected
0Fuzzingproject is not fuzzed
10Licenselicense file detected
0Maintained0 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 0
不适用Packagingpackaging workflow not detected
6Pinned-Dependenciesdependency not pinned by hash detected -- score normalized to 6
10SASTSAST tool detected: CodeQL
10Security-Policysecurity policy file detected
0Signed-ReleasesProject has not signed or included provenance with any releases.
9Token-Permissionsdetected GitHub workflow tokens with excessive permissions
0Vulnerabilities319 existing vulnerabilities detected
直接依赖 96
注册表软件包版本约束清单文件
Gogithub.com/BurntSushi/tomlv1.6.0go.mod
Gogithub.com/CycloneDX/cyclonedx-gov0.9.3go.mod
Gogithub.com/Masterminds/semver/v3v3.4.0go.mod
Gogithub.com/Masterminds/sprig/v3v3.3.0go.mod
Gogithub.com/OneOfOne/xxhashv1.2.8go.mod
Gogithub.com/acarl005/stripansiv0.0.0-20180116102854-5a71ef0e047dgo.mod
Gogithub.com/acobaugh/osreleasev0.1.0go.mod
Gogithub.com/adrg/xdgv0.5.3go.mod
Gogithub.com/anchore/bubblyv0.0.0-20231115134915-def0aba654a9go.mod
Gogithub.com/anchore/cliov0.0.0-20250319180342-2cfe4b0cb716go.mod
Gogithub.com/anchore/fangsv0.0.0-20250319222917-446a1e748ec2go.mod
Gogithub.com/anchore/go-collectionsv0.0.0-20251016125210-a3c352120e8cgo.mod
Gogithub.com/anchore/go-homedirv0.0.0-20250319154043-c29668562e4dgo.mod
Gogithub.com/anchore/go-loggerv0.0.0-20250318195838-07ae343dd722go.mod
Gogithub.com/anchore/go-macholibrev0.0.0-20220308212642-53e6d0aaf6fbgo.mod
Gogithub.com/anchore/go-rpmdbv0.0.0-20250516171929-f77691e1faecgo.mod
Gogithub.com/anchore/go-syncv0.0.0-20250326131806-4eda43a485b6go.mod
Gogithub.com/anchore/go-testutilsv0.0.0-20200925183923-d5f45b0d3c04go.mod
Gogithub.com/anchore/go-versionv1.2.2-0.20200701162849-18adb9c92b9bgo.mod
Gogithub.com/anchore/packageurl-gov0.1.1-0.20250220190351-d62adb6e1115go.mod
Gogithub.com/anchore/stereoscopev0.1.17go.mod
Gogithub.com/anmitsu/go-shlexv0.0.0-20200514113438-38f4b401e2bego.mod
Gogithub.com/aquasecurity/go-pep440-versionv0.0.1go.mod
Gogithub.com/bitnami/go-versionv0.0.0-20250131085805-b1f57a8634efgo.mod
Gogithub.com/blakesmith/arv0.0.0-20190502131153-809d4375e1fbgo.mod
Gogithub.com/bmatcuk/doublestar/v4v4.9.1go.mod
Gogithub.com/charmbracelet/bubblesv0.21.0go.mod
Gogithub.com/charmbracelet/bubbleteav1.3.10go.mod
Gogithub.com/charmbracelet/lipglossv1.1.0go.mod
Gogithub.com/dave/jenniferv1.7.1go.mod
Gogithub.com/deitch/magicv0.0.0-20230404182410-1ff89d7342dago.mod
Gogithub.com/diskfs/go-diskfsv1.7.0go.mod
Gogithub.com/distribution/referencev0.6.0go.mod
Gogithub.com/dustin/go-humanizev1.0.1go.mod
Gogithub.com/elliotchance/phpserializev1.4.0go.mod
Gogithub.com/facebookincubator/nvdtoolsv0.1.5go.mod
Gogithub.com/github/go-spdx/v2v2.3.5go.mod
Gogithub.com/gkampitakis/go-snapsv0.5.19go.mod
Gogithub.com/go-git/go-billy/v5v5.7.0go.mod
Gogithub.com/go-git/go-git/v5v5.16.4go.mod
Gogithub.com/go-test/deepv1.1.1go.mod
Gogithub.com/go-viper/mapstructure/v2v2.4.0go.mod
Gogithub.com/gohugoio/hashstructurev0.6.0go.mod
Gogithub.com/google/go-cmpv0.7.0go.mod
Gogithub.com/google/go-containerregistryv0.20.7go.mod
Gogithub.com/google/licensecheckv0.3.1go.mod
Gogithub.com/google/uuidv1.6.0go.mod
Gogithub.com/gookit/colorv1.6.0go.mod
Gogithub.com/hashicorp/go-cleanhttpv0.5.2go.mod
Gogithub.com/hashicorp/go-getterv1.8.4go.mod
Gogithub.com/hashicorp/go-multierrorv1.1.1go.mod
Gogithub.com/hashicorp/hcl/v2v2.24.0go.mod
Gogithub.com/iancoleman/strcasev0.3.0go.mod
Gogithub.com/invopop/jsonschemav0.13.0go.mod
Gogithub.com/jedib0t/go-pretty/v6v6.7.8go.mod
Gogithub.com/jinzhu/copierv0.4.0go.mod
Gogithub.com/kastenhq/goversionv0.0.0-20230811215019-93b2f8823953go.mod
Gogithub.com/magiconair/propertiesv1.8.10go.mod
Gogithub.com/mholt/archivesv0.1.5go.mod
Gogithub.com/moby/sys/mountinfov0.7.2go.mod
Gogithub.com/nix-community/go-nixv0.0.0-20250101154619-4bdde671e0a1go.mod
Gogithub.com/olekukonko/tablewriterv1.1.2go.mod
Gogithub.com/opencontainers/go-digestv1.0.0go.mod
Gogithub.com/pelletier/go-tomlv1.9.5go.mod
Gogithub.com/quasilyte/go-ruleguard/dslv0.3.23go.mod
Gogithub.com/rust-secure-code/go-rustauditv0.0.0-20250226111315-e20ec32e963cgo.mod
Gogithub.com/saintfish/chardetv0.0.0-20230101081208-5e3ef4b5456dgo.mod
Gogithub.com/sanity-io/litterv1.5.8go.mod
Gogithub.com/sassoftware/go-rpmutilsv0.4.0go.mod
Gogithub.com/scylladb/go-setv1.0.3-0.20200225121959-cc7b2070d91ego.mod
Gogithub.com/sergi/go-diffv1.4.0go.mod
Gogithub.com/spdx/gordfv0.0.0-20201111095634-7098f93598fbgo.mod
Gogithub.com/spdx/tools-golangv0.5.6go.mod
Gogithub.com/spf13/aferov1.15.0go.mod
Gogithub.com/spf13/cobrav1.10.2go.mod
Gogithub.com/stretchr/testifyv1.11.1go.mod
Gogithub.com/vbatts/go-mtreev0.7.0go.mod
Gogithub.com/vifraa/gopomv1.0.0go.mod
Gogithub.com/wagoodman/go-partybusv0.0.0-20230516145632-8ccac152c651go.mod
Gogithub.com/wagoodman/go-progressv0.0.0-20230925121702-07e42b3cdba0go.mod
Gogithub.com/xeipuuv/gojsonschemav1.2.0go.mod
Gogithub.com/zyedidia/genericv1.2.2-0.20230320175451-4410d2372cb1go.mod
Gogo.uber.org/goleakv1.3.0go.mod
Gogo.yaml.in/yaml/v3v3.0.4go.mod
Gogolang.org/x/expv0.0.0-20250620022241-b7579e27df2bgo.mod
Gogolang.org/x/modv0.31.0go.mod
Gogolang.org/x/netv0.48.0go.mod
Gomodernc.org/sqlitev1.43.0go.mod
Gogithub.com/goccy/go-yamlv1.19.2go.mod
Gogithub.com/ulikunitz/xzv0.5.15go.mod
Gogolang.org/x/timev0.14.0go.mod
Gogolang.org/x/toolsv0.40.0go.mod
Gogopkg.in/yaml.v3v3.0.1go.mod
Gogithub.com/cespare/xxhash/v2v2.3.0go.mod
Gogithub.com/gpustack/gguf-parser-gov0.23.1go.mod
Gogithub.com/wk8/go-ordered-map/v2v2.1.8go.mod
全部依赖 429

来自 GitHub 依赖图的完整解析依赖集合：104 个直接依赖与 325 个间接（传递）软件包。仓库提交锁文件时，传递闭包才是完整的。

注册表软件包版本关系
Gogithub.com/acarl005/stripansiv0.0.0-20180116102854-5a71ef0e047d直接
Gogithub.com/acobaugh/osreleasev0.1.0直接
Gogithub.com/adrg/xdgv0.2.1直接
Gogithub.com/adrg/xdgv0.5.3直接
Gogithub.com/anchore/bubblyv0.0.0-20231115134915-def0aba654a9直接
Gogithub.com/anchore/cliov0.0.0-20250319180342-2cfe4b0cb716直接
Gogithub.com/anchore/fangsv0.0.0-20250319222917-446a1e748ec2直接
Gogithub.com/anchore/go-collectionsv0.0.0-20251016125210-a3c352120e8c直接
Gogithub.com/anchore/go-homedirv0.0.0-20250319154043-c29668562e4d直接
Gogithub.com/anchore/go-loggerv0.0.0-20250318195838-07ae343dd722直接
Gogithub.com/anchore/go-macholibrev0.0.0-20220308212642-53e6d0aaf6fb直接
Gogithub.com/anchore/go-rpmdbv0.0.0-20250516171929-f77691e1faec直接
Gogithub.com/anchore/go-syncv0.0.0-20250326131806-4eda43a485b6直接
Gogithub.com/anchore/go-testutilsv0.0.0-20200624184116-66aa578126db直接
Gogithub.com/anchore/go-testutilsv0.0.0-20200925183923-d5f45b0d3c04直接
Gogithub.com/anchore/go-versionv1.2.2-0.20200701162849-18adb9c92b9b直接
Gogithub.com/anchore/packageurl-gov0.1.1-0.20250220190351-d62adb6e1115直接
Gogithub.com/anchore/stereoscopev0.0.0-20200706164556-7cf39d7f4639直接
Gogithub.com/anchore/stereoscopev0.1.17直接
Gogithub.com/anmitsu/go-shlexv0.0.0-20200514113438-38f4b401e2be直接
Gogithub.com/aquasecurity/go-pep440-versionv0.0.1直接
Gogithub.com/bitnami/go-versionv0.0.0-20250131085805-b1f57a8634ef直接
Gogithub.com/blakesmith/arv0.0.0-20190502131153-809d4375e1fb直接
Gogithub.com/bmatcuk/doublestar/v4v4.9.1直接
Gogithub.com/burntsushi/tomlv1.6.0直接
Gogithub.com/cespare/xxhash/v2v2.3.0直接
Gogithub.com/charmbracelet/bubblesv0.21.0直接
Gogithub.com/charmbracelet/bubbleteav1.3.10直接
Gogithub.com/charmbracelet/lipglossv1.1.0直接
Gogithub.com/cyclonedx/cyclonedx-gov0.9.3直接
Gogithub.com/dave/jenniferv1.7.1直接
Gogithub.com/deitch/magicv0.0.0-20230404182410-1ff89d7342da直接
Gogithub.com/diskfs/go-diskfsv1.7.0直接
Gogithub.com/distribution/referencev0.6.0直接
Gogithub.com/dustin/go-humanizev1.0.1直接
Gogithub.com/elliotchance/phpserializev1.4.0直接
Gogithub.com/facebookincubator/nvdtoolsv0.1.5直接
Gogithub.com/github/go-spdx/v2v2.3.5直接
Gogithub.com/gkampitakis/go-snapsv0.5.19直接
Gogithub.com/go-git/go-billy/v5v5.7.0直接
Gogithub.com/go-git/go-git/v5v5.16.4直接
Gogithub.com/go-test/deepv1.0.6直接
Gogithub.com/go-test/deepv1.1.1直接
Gogithub.com/go-viper/mapstructure/v2v2.2.1直接
Gogithub.com/go-viper/mapstructure/v2v2.4.0直接
Gogithub.com/goccy/go-yamlv1.19.2直接
Gogithub.com/gohugoio/hashstructurev0.6.0直接
Gogithub.com/google/go-cmpv0.7.0直接
Gogithub.com/google/go-containerregistryv0.20.7直接
Gogithub.com/google/licensecheckv0.3.1直接
Gogithub.com/google/uuidv1.6.0直接
Gogithub.com/gookit/colorv1.6.0直接
Gogithub.com/gpustack/gguf-parser-gov0.23.1直接
Gogithub.com/hashicorp/go-cleanhttpv0.5.2直接
Gogithub.com/hashicorp/go-getterv1.8.4直接
Gogithub.com/hashicorp/go-multierrorv1.1.1直接
Gogithub.com/hashicorp/hcl/v2v2.24.0直接
Gogithub.com/iancoleman/strcasev0.3.0直接
Gogithub.com/invopop/jsonschemav0.13.0直接
Gogithub.com/jedib0t/go-pretty/v6v6.7.8直接
Gogithub.com/jinzhu/copierv0.4.0直接
Gogithub.com/kastenhq/goversionv0.0.0-20230811215019-93b2f8823953直接
Gogithub.com/magiconair/propertiesv1.8.10直接
Gogithub.com/masterminds/semver/v3v3.4.0直接
Gogithub.com/masterminds/sprig/v3v3.3.0直接
Gogithub.com/mholt/archivesv0.1.5直接
Gogithub.com/moby/sys/mountinfov0.7.2直接
Gogithub.com/nix-community/go-nixv0.0.0-20250101154619-4bdde671e0a1直接
Gogithub.com/olekukonko/tablewriterv1.1.2直接
Gogithub.com/oneofone/xxhashv1.2.8直接
Gogithub.com/opencontainers/go-digestv1.0.0直接
Gogithub.com/pelletier/go-tomlv1.9.5直接
Gogithub.com/quasilyte/go-ruleguard/dslv0.3.23直接
Gogithub.com/rust-secure-code/go-rustauditv0.0.0-20250226111315-e20ec32e963c直接
Gogithub.com/saintfish/chardetv0.0.0-20230101081208-5e3ef4b5456d直接
Gogithub.com/sanity-io/litterv1.5.8直接
Gogithub.com/sassoftware/go-rpmutilsv0.4.0直接
Gogithub.com/scylladb/go-setv1.0.3-0.20200225121959-cc7b2070d91e直接
Gogithub.com/sergi/go-diffv1.4.0直接
Gogithub.com/spdx/gordfv0.0.0-20201111095634-7098f93598fb直接
Gogithub.com/spdx/tools-golangv0.5.6直接
Gogithub.com/spf13/aferov1.12.0直接
Gogithub.com/spf13/aferov1.15.0直接
Gogithub.com/spf13/cobrav1.10.2直接
Gogithub.com/stretchr/testifyv1.10.0直接
Gogithub.com/stretchr/testifyv1.11.1直接
Gogithub.com/ulikunitz/xzv0.5.12直接
Gogithub.com/ulikunitz/xzv0.5.15直接
Gogithub.com/vbatts/go-mtreev0.7.0直接
Gogithub.com/vifraa/gopomv1.0.0直接
Gogithub.com/wagoodman/go-partybusv0.0.0-20230516145632-8ccac152c651直接
Gogithub.com/wagoodman/go-progressv0.0.0-20230925121702-07e42b3cdba0直接
Gogithub.com/wk8/go-ordered-map/v2v2.1.8直接
Gogithub.com/xeipuuv/gojsonschemav1.2.0直接
Gogithub.com/zyedidia/genericv1.2.2-0.20230320175451-4410d2372cb1直接
Gogo.uber.org/goleakv1.3.0直接
Gogo.yaml.in/yaml/v3v3.0.4直接
Gogolang.org/x/expv0.0.0-20250620022241-b7579e27df2b直接
Gogolang.org/x/modv0.31.0直接
Gogolang.org/x/netv0.48.0直接
Gogolang.org/x/timev0.14.0直接
Gogolang.org/x/toolsv0.40.0直接
Gogopkg.in/yaml.v3v3.0.1直接
Gomodernc.org/sqlitev1.43.0直接
Gocel.dev/exprv0.24.0间接
Gocloud.google.com/gov0.123.0间接
Gocloud.google.com/go/authv0.17.0间接
Gocloud.google.com/go/auth/oauth2adaptv0.2.8间接
Gocloud.google.com/go/compute/metadatav0.9.0间接
Gocloud.google.com/go/iamv1.5.3间接
Gocloud.google.com/go/monitoringv1.24.2间接
Gocloud.google.com/go/storagev1.58.0间接
Gocyphar.com/go-pathrsv0.2.1间接
Godario.cat/mergov1.0.1间接
Gogithub.com/adalogics/go-fuzz-headersv0.0.0-20230811130428-ced1acdcaa24间接
Gogithub.com/adamkorcz/go-118-fuzz-buildv0.0.0-20230306123547-8075edf89bb0间接
Gogithub.com/agext/levenshteinv1.2.1间接
Gogithub.com/anchore/archiver/v3v3.5.3-0.20241210171143-5b1d8d1c7c51间接
Gogithub.com/anchore/go-lzov0.1.0间接
Gogithub.com/anchore/go-struct-converterv0.1.0间接
Gogithub.com/andybalholm/brotliv1.1.1间接
Gogithub.com/andybalholm/brotliv1.2.0间接
Gogithub.com/apparentlymart/go-textseg/v15v15.0.0间接
Gogithub.com/aquasecurity/go-versionv0.0.1间接
Gogithub.com/atotto/clipboardv0.1.4间接
Gogithub.com/aws/aws-sdk-go-v2v1.41.0间接
Gogithub.com/aws/aws-sdk-go-v2/aws/protocol/eventstreamv1.7.4间接
Gogithub.com/aws/aws-sdk-go-v2/configv1.32.6间接
Gogithub.com/aws/aws-sdk-go-v2/credentialsv1.19.6间接
Gogithub.com/aws/aws-sdk-go-v2/feature/ec2/imdsv1.18.16间接
Gogithub.com/aws/aws-sdk-go-v2/internal/configsourcesv1.4.16间接
Gogithub.com/aws/aws-sdk-go-v2/internal/endpoints/v2v2.7.16间接
Gogithub.com/aws/aws-sdk-go-v2/internal/iniv1.8.4间接
Gogithub.com/aws/aws-sdk-go-v2/internal/v4av1.4.16间接
Gogithub.com/aws/aws-sdk-go-v2/service/internal/accept-encodingv1.13.4间接
Gogithub.com/aws/aws-sdk-go-v2/service/internal/checksumv1.9.7间接
Gogithub.com/aws/aws-sdk-go-v2/service/internal/presigned-urlv1.13.16间接
Gogithub.com/aws/aws-sdk-go-v2/service/internal/s3sharedv1.19.16间接
Gogithub.com/aws/aws-sdk-go-v2/service/s3v1.95.0间接
Gogithub.com/aws/aws-sdk-go-v2/service/signinv1.0.4间接
Gogithub.com/aws/aws-sdk-go-v2/service/ssov1.30.8间接
Gogithub.com/aws/aws-sdk-go-v2/service/ssooidcv1.35.12间接
Gogithub.com/aws/aws-sdk-go-v2/service/stsv1.41.5间接
Gogithub.com/aws/smithy-gov1.24.0间接
Gogithub.com/aymanbagabas/go-osc52/v2v2.0.1间接
Gogithub.com/bahlo/generic-list-gov0.2.0间接
Gogithub.com/becheran/wildmatch-gov1.0.0间接
Gogithub.com/bgentry/go-netrcv0.0.0-20140422174119-9fd32a8b3d3d间接
Gogithub.com/bmatcuk/doublestarv1.3.1间接
Gogithub.com/bodgit/plumbingv1.3.0间接
Gogithub.com/bodgit/sevenzipv1.6.1间接
Gogithub.com/bodgit/windowsv1.0.1间接
Gogithub.com/buger/jsonparserv1.1.1间接
Gogithub.com/charmbracelet/colorprofilev0.2.3-0.20250311203215-f60798e515dc间接
Gogithub.com/charmbracelet/harmonicav0.2.0间接
Gogithub.com/charmbracelet/x/ansiv0.10.1间接
Gogithub.com/charmbracelet/x/cellbufv0.0.13-0.20250311204145-2c3ea96c31dd间接
Gogithub.com/charmbracelet/x/termv0.2.1间接
Gogithub.com/clipperhouse/displaywidthv0.6.0间接
Gogithub.com/clipperhouse/stringishv0.1.1间接
Gogithub.com/clipperhouse/uax29/v2v2.3.0间接
Gogithub.com/cloudflare/circlv1.6.1间接
Gogithub.com/cncf/xds/gov0.0.0-20250501225837-2ac532fd4443间接
Gogithub.com/containerd/cgroupsv1.1.0间接
Gogithub.com/containerd/containerdv1.7.30间接
Gogithub.com/containerd/containerd/apiv1.8.0间接
Gogithub.com/containerd/continuityv0.4.4间接
Gogithub.com/containerd/errdefsv1.0.0间接
Gogithub.com/containerd/errdefs/pkgv0.3.0间接
Gogithub.com/containerd/fifov1.1.0间接
Gogithub.com/containerd/logv0.1.0间接
Gogithub.com/containerd/platformsv0.2.1间接
Gogithub.com/containerd/stargz-snapshotter/estargzv0.18.1间接
Gogithub.com/containerd/ttrpcv1.2.7间接
Gogithub.com/containerd/typeurl/v2v2.2.0间接
Gogithub.com/cyphar/filepath-securejoinv0.6.0间接
Gogithub.com/datadog/zstdv1.5.5间接
Gogithub.com/davecgh/go-spewv1.1.1间接
Gogithub.com/davecgh/go-spewv1.1.2-0.20180830191138-d8f796af33cc间接
Gogithub.com/docker/cliv29.1.3+incompatible间接
Gogithub.com/docker/distributionv2.8.3+incompatible间接
Gogithub.com/docker/dockerv28.5.2+incompatible间接
Gogithub.com/docker/docker-credential-helpersv0.9.4间接
Gogithub.com/docker/go-connectionsv0.6.0间接
Gogithub.com/docker/go-eventsv0.0.0-20190806004212-e31b211e4f1c间接
Gogithub.com/docker/go-unitsv0.5.0间接
Gogithub.com/dsnet/compressv0.0.2-0.20210315054119-f66993602bf5间接
Gogithub.com/dsnet/compressv0.0.2-0.20230904184137-39efe44ab707间接
Gogithub.com/emirpasic/godsv1.18.1间接
Gogithub.com/envoyproxy/go-control-plane/envoyv1.32.4间接
Gogithub.com/envoyproxy/protoc-gen-validatev1.2.1间接
Gogithub.com/erikgeiser/coninputv0.0.0-20211004153227-1c3628e74d0f间接
Gogithub.com/fatih/colorv1.18.0间接
Gogithub.com/felixge/fgprofv0.9.5间接
Gogithub.com/felixge/httpsnoopv1.0.4间接
Gogithub.com/fsnotify/fsnotifyv1.8.0间接
Gogithub.com/gabriel-vasile/mimetypev1.4.12间接
Gogithub.com/gkampitakis/ciinfov0.3.2间接
Gogithub.com/go-git/gcfgv1.5.1-0.20230307220236-3a3c6141e376间接
Gogithub.com/go-jose/go-jose/v4v4.1.2间接
Gogithub.com/go-logr/logrv1.4.3间接
Gogithub.com/go-logr/stdrv1.2.2间接
Gogithub.com/go-restruct/restructv1.2.0-alpha间接
Gogithub.com/gogo/protobufv1.3.2间接
Gogithub.com/golang/groupcachev0.0.0-20241129210726-2c02b8208cf8间接
Gogithub.com/golang/snappyv0.0.4间接
Gogithub.com/google/pprofv0.0.0-20250317173921-a4b03ec1a45e间接
Gogithub.com/google/s2a-gov0.1.9间接
Gogithub.com/googleapis/enterprise-certificate-proxyv0.3.7间接
Gogithub.com/googleapis/gax-go/v2v2.15.0间接
Gogithub.com/googlecloudplatform/opentelemetry-operations-go/detectors/gcpv1.29.0间接
Gogithub.com/googlecloudplatform/opentelemetry-operations-go/exporter/metricv0.54.0间接
Gogithub.com/googlecloudplatform/opentelemetry-operations-go/internal/resourcemappingv0.54.0间接
Gogithub.com/hashicorp/aws-sdk-go-base/v2v2.0.0-beta.70间接
Gogithub.com/hashicorp/errwrapv1.1.0间接
Gogithub.com/hashicorp/go-versionv1.8.0间接
Gogithub.com/hashicorp/golang-lru/v2v2.0.7间接
Gogithub.com/henvic/httprettyv0.1.4间接
Gogithub.com/huandu/xstringsv1.5.0间接
Gogithub.com/inconshreveable/mousetrapv1.1.0间接
Gogithub.com/jbenet/go-contextv0.0.0-20150711004518-d14ea06fba99间接
Gogithub.com/json-iterator/gov1.1.12间接
Gogithub.com/kevinburke/ssh_configv1.2.0间接
Gogithub.com/klauspost/compressv1.17.11间接
Gogithub.com/klauspost/compressv1.18.2间接
Gogithub.com/klauspost/pgzipv1.2.6间接
Gogithub.com/kr/prettyv0.3.1间接
Gogithub.com/kr/textv0.2.0间接
Gogithub.com/logrusorgru/aurorav2.0.3+incompatible间接
Gogithub.com/lucasb-eyer/go-colorfulv1.2.0间接
Gogithub.com/mailru/easyjsonv0.7.7间接
Gogithub.com/maruel/naturalv1.1.1间接
Gogithub.com/masterminds/goutilsv1.1.1间接
Gogithub.com/mattn/go-colorablev0.1.14间接
Gogithub.com/mattn/go-isattyv0.0.20间接
Gogithub.com/mattn/go-localereaderv0.0.2-0.20220822084749-2491eb6c1c75间接
Gogithub.com/mattn/go-runewidthv0.0.19间接
Gogithub.com/mgutz/ansiv0.0.0-20200706080929-d51e80ef957d间接
Gogithub.com/microsoft/go-winiov0.6.2间接
Gogithub.com/microsoft/hcsshimv0.11.7间接
Gogithub.com/mikelolasagasti/xzv1.0.1间接
Gogithub.com/minio/minlzv1.0.1间接
Gogithub.com/mitchellh/copystructurev1.2.0间接
Gogithub.com/mitchellh/go-homedirv1.1.0间接
Gogithub.com/mitchellh/go-wordwrapv1.0.1间接
Gogithub.com/mitchellh/reflectwalkv1.0.2间接
Gogithub.com/moby/docker-image-specv1.3.1间接
Gogithub.com/moby/lockerv1.0.1间接
Gogithub.com/moby/sys/sequentialv0.6.0间接
Gogithub.com/moby/sys/signalv0.7.0间接
Gogithub.com/moby/sys/userv0.3.0间接
Gogithub.com/moby/sys/usernsv0.1.0间接
Gogithub.com/modern-go/concurrentv0.0.0-20180306012644-bacd9c7ef1dd间接
Gogithub.com/modern-go/reflect2v1.0.2间接
Gogithub.com/muesli/ansiv0.0.0-20230316100256-276c6243b2f6间接
Gogithub.com/muesli/cancelreaderv0.2.2间接
Gogithub.com/muesli/termenvv0.16.0间接
Gogithub.com/ncruces/go-strftimev0.1.9间接
Gogithub.com/nwaples/rardecodev1.1.3间接
Gogithub.com/nwaples/rardecode/v2v2.2.0间接
Gogithub.com/olekukonko/catv0.0.0-20250911104152-50322a0618f6间接
Gogithub.com/olekukonko/errorsv1.1.0间接
Gogithub.com/olekukonko/llv0.1.3间接
Gogithub.com/opencontainers/image-specv1.1.1间接
Gogithub.com/opencontainers/runtime-specv1.1.0间接
Gogithub.com/opencontainers/selinuxv1.13.1间接
Gogithub.com/pborman/indentv1.2.1间接
Gogithub.com/pelletier/go-toml/v2v2.2.3间接
Gogithub.com/pierrec/lz4/v4v4.1.21间接
Gogithub.com/pierrec/lz4/v4v4.1.22间接
Gogithub.com/pjbgf/sha1cdv0.3.2间接
Gogithub.com/pkg/errorsv0.9.1间接
Gogithub.com/pkg/profilev1.7.0间接
Gogithub.com/pkg/xattrv0.4.9间接
Gogithub.com/planetscale/vtprotobufv0.6.1-0.20240319094008-0393e58bdf10间接
Gogithub.com/pmezard/go-difflibv1.0.0间接
Gogithub.com/pmezard/go-difflibv1.0.1-0.20181226105442-5d4384ee4fb2间接
Gogithub.com/protonmail/go-cryptov1.3.0间接
Gogithub.com/remyoudompheng/bigfftv0.0.0-20230129092748-24d4a6f8daec间接
Gogithub.com/rivo/unisegv0.4.7间接
Gogithub.com/rogpeppe/go-internalv1.14.1间接
Gogithub.com/sagikazarmark/locaferov0.7.0间接
Gogithub.com/sahilm/fuzzyv0.1.1间接
Gogithub.com/shopspring/decimalv1.4.0间接
Gogithub.com/sirupsen/logrusv1.9.3间接
Gogithub.com/sirupsen/logrusv1.9.4-0.20230606125235-dd1b4c2e81af间接
Gogithub.com/skeema/knownhostsv1.3.1间接
Gogithub.com/smallnest/ringbufferv0.0.0-20241116012123-461381446e3d间接
Gogithub.com/sorairolake/lzip-gov0.3.8间接
Gogithub.com/sourcegraph/concv0.3.0间接
Gogithub.com/spf13/castv1.7.1间接
Gogithub.com/spf13/pflagv1.0.6间接
Gogithub.com/spf13/pflagv1.0.9间接
Gogithub.com/spf13/viperv1.20.0间接
Gogithub.com/spf13/viperv1.20.1间接
Gogithub.com/spiffe/go-spiffe/v2v2.5.0间接
Gogithub.com/starry-s/zipv0.2.3间接
Gogithub.com/stretchr/objxv0.5.2间接
Gogithub.com/subosito/gotenvv1.6.0间接
Gogithub.com/sylabs/sif/v2v2.22.0间接
Gogithub.com/sylabs/squashfsv1.0.6间接
Gogithub.com/therootcompany/xzv1.0.1间接
Gogithub.com/tidwall/gjsonv1.18.0间接
Gogithub.com/tidwall/matchv1.1.1间接
Gogithub.com/tidwall/prettyv1.2.1间接
Gogithub.com/tidwall/sjsonv1.2.5间接
Gogithub.com/vbatts/tar-splitv0.12.2间接
Gogithub.com/xanzy/ssh-agentv0.3.3间接
Gogithub.com/xeipuuv/gojsonpointerv0.0.0-20190905194746-02993c407bfb间接
Gogithub.com/xeipuuv/gojsonreferencev0.0.0-20180127040603-bd5ef7bd5415间接
Gogithub.com/xi2/xzv0.0.0-20171230120015-48954b6210f8间接
Gogithub.com/xo/terminfov0.0.0-20220910002029-abceb7e1c41e间接
Gogithub.com/zclconf/go-ctyv1.16.3间接
Gogithub.com/zeebo/errsv1.4.0间接
Gogo.opencensus.iov0.24.0间接
Gogo.opentelemetry.io/auto/sdkv1.2.1间接
Gogo.opentelemetry.io/contrib/detectors/gcpv1.36.0间接
Gogo.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpcv0.63.0间接
Gogo.opentelemetry.io/contrib/instrumentation/net/http/otelhttpv0.61.0间接
Gogo.opentelemetry.io/otelv1.39.0间接
Gogo.opentelemetry.io/otel/metricv1.39.0间接
Gogo.opentelemetry.io/otel/sdkv1.39.0间接
Gogo.opentelemetry.io/otel/sdk/metricv1.39.0间接
Gogo.opentelemetry.io/otel/tracev1.39.0间接
Gogo.uber.org/atomicv1.9.0间接
Gogo.uber.org/multierrv1.10.0间接
Gogo.uber.org/multierrv1.9.0间接
Gogo.uber.org/zapv1.27.0间接
Gogo4.orgv0.0.0-20230225012048-214862532bf5间接
Gogolang.org/x/cryptov0.46.0间接
Gogolang.org/x/oauth2v0.33.0间接
Gogolang.org/x/syncv0.19.0间接
Gogolang.org/x/sysv0.33.0间接
Gogolang.org/x/sysv0.39.0间接
Gogolang.org/x/termv0.38.0间接
Gogolang.org/x/textv0.21.0间接
Gogolang.org/x/textv0.32.0间接
Gogolang.org/x/xerrorsv0.0.0-20231012003039-104605ab7028间接
Gogonum.org/v1/gonumv0.16.0间接
Gogoogle.golang.org/apiv0.256.0间接
Gogoogle.golang.org/genprotov0.0.0-20250922171735-9219d122eba9间接
Gogoogle.golang.org/genproto/googleapis/apiv0.0.0-20251111163417-95abcf5c77ba间接
Gogoogle.golang.org/genproto/googleapis/rpcv0.0.0-20251111163417-95abcf5c77ba间接
Gogoogle.golang.org/grpcv1.76.0间接
Gogoogle.golang.org/protobufv1.36.10间接
Gogopkg.in/warnings.v0v0.1.2间接
Gomodernc.org/libcv1.66.10间接
Gomodernc.org/mathutilv1.7.1间接
Gomodernc.org/memoryv1.11.0间接
Mavenorg.junit.vintage:junit-vintage-engine—间接
npm@babel/code-frame7.10.4间接
npm@types/minimatch3.0.3间接
npm@types/qs6.9.4间接
npmajv6.12.3间接
npmasn1.js4.10.1间接
npmasync0.9.2间接
npmasync3.2.3间接
npmatob2.1.2间接
npmaws-sdk2.706.0间接
npmc0n-fab_u.laTION7.7.7间接
npmcross-spawn7.0.6间接
npmisexe2.0.0间接
npmjhipster-core7.3.4间接
npmmerge-objects1.0.5间接
npmnanoid3.3.4间接
npmpath-key3.1.1间接
npmresize-observer-polyfill1.5.2间接
npmshebang-command2.0.0间接
npmshebang-regex3.0.0间接
npmwhich2.0.2间接
PyPIannotated-types0.7.0间接
PyPIanyio4.6.2.post1间接
PyPIanyio4.9.0间接
PyPIbrotli1.1.0间接
PyPIbrotlicffi1.1.0.0间接
PyPIcertifi2025.1.31间接
PyPIcertifi2025.10.5间接
PyPIcffi1.17.1间接
PyPIcharset-normalizer3.4.1间接
PyPIclick7.1.2间接
PyPIclick8.1.8间接
PyPIcolorama0.4.6间接
PyPIdnspython2.7.0间接
PyPIemail-validator2.2.0间接
PyPIfastapi0.111.1间接
PyPIfastapi-cli0.0.7间接
PyPIh110.14.0间接
PyPIh24.2.0间接
PyPIhpack4.1.0间接
PyPIhttpcore1.0.7间接
PyPIhttptools0.6.4间接
PyPIhttpx0.28.1间接
PyPIhyperframe6.1.0间接
PyPIidna3.10间接
PyPIitsdangerous2.2.0间接
PyPIjinja23.1.6间接
PyPImarkdown-it-py3.0.0间接
PyPImarkupsafe3.0.2间接
PyPImdurl0.1.2间接
PyPIorjson3.10.16间接
PyPIpprintpp0.4.0间接
PyPIpycparser2.22间接
PyPIpydantic2.11.0间接
PyPIpydantic-core2.33.0间接
PyPIpydantic-extra-types2.10.3间接
PyPIpydantic-settings2.8.1间接
PyPIpygments1.6间接
PyPIpygments2.19.1间接
PyPIpython-dotenv1.1.0间接
PyPIpython-multipart0.0.20间接
PyPIpyyaml6.0.2间接
PyPIrequests2.32.3间接
PyPIrich0.3.3间接
PyPIrich13.9.4间接
PyPIrich-toolkit0.14.0间接
PyPIshellingham1.5.4间接
PyPIsniffio1.3.1间接
PyPIsocksio1.0.0间接
PyPIstarlette0.37.2间接
PyPItyper0.15.2间接
PyPItyping-extensions3.10.0.2间接
PyPItyping-extensions4.13.0间接
PyPItyping-inspection0.4.0间接
PyPIujson5.10.0间接
PyPIurllib32.3.0间接
PyPIuvicorn0.34.0间接
PyPIuvloop0.21.0间接
PyPIwatchfiles1.0.4间接
PyPIwebsockets15.0.1间接
依赖安全公告 43

该仓库未发布可被索引解析的包，因此评估的是其自身的依赖图——共 428 个包，其中也包含从不交付的开发与测试版本固定：43 个存在已知公告，7 个为直接依赖。 有 1 个无法评估——没有已解析的版本、生态系统不受支持，或不在所列包清单之内。

软件包版本关系严重程度公告数修复版本
golang.org/x/cryptov0.46.0间接严重270.52.0
google.golang.org/grpcv1.76.0间接严重31.82.1
h110.14.0间接严重20.16.0
pygments1.6间接严重102.20.0
github.com/go-git/go-billy/v5v5.7.0直接高46.0.0-alpha.1
github.com/hashicorp/go-getterv1.8.4直接高21.8.6
aws-sdk2.706.0间接高22.814.0
brotli1.1.0间接高22.13.4
click7.1.2间接高18.3.3
click8.1.8间接高18.3.3
github.com/buger/jsonparserv1.1.1间接高21.1.2
github.com/containerd/containerdv1.7.30间接高92.3.2
github.com/docker/cliv29.1.3+incompatible间接高229.2.0+incompatible
github.com/docker/dockerv28.5.2+incompatible间接高1029.3.1
github.com/go-jose/go-jose/v4v4.1.2间接高24.1.4
go.opentelemetry.io/otelv1.39.0间接高21.41.0
go.opentelemetry.io/otel/sdkv1.39.0间接高41.43.0
orjson3.10.16间接高23.11.6
python-multipart0.0.20间接高140.0.31
starlette0.37.2间接高141.3.1
ujson5.10.0间接高85.13.0
urllib32.3.0间接高122.7.0
github.com/anchore/stereoscopev0.0.0-20200706164556-7cf39d7f4639直接中20.0.1
github.com/go-git/go-git/v5v5.16.4直接中166.0.0-alpha.4
github.com/go-viper/mapstructure/v2v2.2.1直接中42.4.0
github.com/ulikunitz/xzv0.5.12直接中20.5.15
golang.org/x/netv0.48.0直接中91.26.3
ajv6.12.3间接中18.18.0
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstreamv1.7.4间接中21.97.3
github.com/aws/aws-sdk-go-v2/service/s3v1.95.0间接中21.97.3
github.com/cloudflare/circlv1.6.1间接中21.6.3
github.com/nwaples/rardecodev1.1.3间接中22.2.0
idna3.10间接中23.15
nanoid3.3.4间接中15.0.9
python-dotenv1.1.0间接中21.2.2
requests2.32.3间接中42.33.0
h24.2.0间接低24.3.0
merge-objects1.0.5间接低1—
pygments2.19.1间接低22.20.0
golang.org/x/sysv0.33.0间接未知10.44.0
golang.org/x/sysv0.39.0间接未知10.44.0
golang.org/x/textv0.21.0间接未知10.39.0
golang.org/x/textv0.32.0间接未知10.39.0

公告表示依赖图中记录的版本落入某条公告的受影响范围。可达性未经分析，且依赖图包含开发与测试的版本固定——某项发现可能只涉及工具链而非交付的软件。

原始 JSON 报告 机器可读
{
  "data": {
    "repo": {
      "topics": [],
      "is_fork": true,
      "size_kb": 19491,
      "has_wiki": true,
      "homepage": null,
      "languages": {
        "C": 4597,
        "C#": 13279,
        "Go": 5396743,
        "C++": 1017,
        "Lua": 82633,
        "PHP": 1637,
        "HTML": 132,
        "Java": 6170,
        "Perl": 5,
        "Roff": 360,
        "Ruby": 31370,
        "Rust": 281,
        "Shell": 63334,
        "Elixir": 9158,
        "Erlang": 5893,
        "Prolog": 764,
        "Python": 41585,
        "Makefile": 37896,
        "Dockerfile": 45421,
        "Vim Script": 89
      },
      "pushed_at": "2026-01-09T21:17:09Z",
      "created_at": "2021-12-12T12:13:05Z",
      "owner_type": "User",
      "updated_at": "2026-01-09T20:44:47Z",
      "description": "CLI tool and library for generating a Software Bill of Materials from container images and filesystems",
      "is_archived": false,
      "is_disabled": false,
      "license_spdx": "Apache-2.0",
      "default_branch": "main",
      "license_spdx_raw": "Apache-2.0",
      "primary_language": "Go",
      "significant_languages": [
        "Go"
      ]
    },
    "owner": {
      "blog": null,
      "name": "Alex Goodman",
      "type": "User",
      "login": "wagoodman",
      "company": "@anchore ",
      "location": "Alexandria, VA",
      "followers": 1675,
      "avatar_url": "https://avatars.githubusercontent.com/u/590471?v=4",
      "created_at": "2011-01-29T22:06:39Z",
      "is_verified": null,
      "public_repos": 110,
      "account_age_days": 5655
    },
    "license": {
      "state": "standard",
      "spdx_id": "Apache-2.0",
      "raw_spdx": "Apache-2.0",
      "file_present": true,
      "scorecard_found": true,
      "profile_has_license": false
    },
    "activity": {
      "releases": [
        {
          "tag": "v0.0.0",
          "kind": "major",
          "published_at": "2024-11-20T14:13:53Z"
        }
      ],
      "recent_commits": [
        {
          "oid": "55a190aed1608103733d4f75c6454658fa69da22",
          "body": "Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>\nCo-authored-by: spiffcs <32073428+spiffcs@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): update tools to latest versions (#4542)",
          "author_name": "anchore-actions-token-generator[bot]",
          "author_login": "anchore-actions-token-generator[bot]",
          "committed_at": "2026-01-09T18:14:13Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "695bbcc4f9c686030f20a19ed8a8f7f64ffb816e",
          "body": "Bumps the go-minor-patch group with 4 updates: [github.com/vbatts/go-mtree](https://github.com/vbatts/go-mtree), [modernc.org/sqlite](https://gitlab.com/cznic/sqlite), [github.com/goccy/go-yaml](https://github.com/goccy/go-yaml) and [github.com/gpustack/gguf-parser-go](https://github.com/gpustack/gg\n[…]\nsion-update:semver-minor\n  dependency-group: go-minor-patch\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump the go-minor-patch group with 4 updates (#4543)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-01-09T18:13:56Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "6d206910f04b65cb47e1d89a82fddb8fb08bac97",
          "body": "Bumps the actions-minor-patch group with 1 update in the / directory: [anchore/sbom-action](https://github.com/anchore/sbom-action).\n\n\nUpdates `anchore/sbom-action` from 0.21.0 to 0.21.1\n- [Release notes](https://github.com/anchore/sbom-action/releases)\n- [Changelog](https://github.com/anchore/sbom-\n[…]\nupdate:semver-patch\n  dependency-group: actions-minor-patch\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump anchore/sbom-action (#4544)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-01-09T18:13:44Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "2f3a504acfba83982351fff32f78d19d5c31bbf4",
          "body": "* fixed #4550, catalog mongodb bin\n\nSigned-off-by: Rez Moss <hi@rezmoss.com>\n\n* fixed #4550, catalog mongodb bin\n\nSigned-off-by: Rez Moss <hi@rezmoss.com>\n\n---------\n\nSigned-off-by: Rez Moss <hi@rezmoss.com>",
          "is_bot": false,
          "headline": "Feat/catalog mongodb bin (#4541)",
          "author_name": "Rez Moss",
          "author_login": "rezmoss",
          "committed_at": "2026-01-08T17:18:51Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "d24e843c45c97c3ca4601ed6bdc2c9370900b452",
          "body": "Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>\nCo-authored-by: spiffcs <32073428+spiffcs@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): update tools to latest versions (#4537)",
          "author_name": "anchore-actions-token-generator[bot]",
          "author_login": "anchore-actions-token-generator[bot]",
          "committed_at": "2026-01-08T16:56:50Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "83a4528fff72da874958ba6d0ea7fe012552e408",
          "body": "A CI failure was observed where a generated file was only partly written\nwhen the CI job immediately tried to read it. Put in an fs.Sync call to\neliminate this flakiness.\n\nSigned-off-by: Will Murphy <willmurphyscode@users.noreply.github.com>",
          "is_bot": false,
          "headline": "chore: sync generated file immediately (#4538)",
          "author_name": "Will Murphy",
          "author_login": "willmurphyscode",
          "committed_at": "2026-01-08T14:01:17Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "11e871566b35765fe69da439fa3beaef123bc143",
          "body": "Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>\nCo-authored-by: willmurphyscode <12529630+willmurphyscode@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): update anchore dependencies (#4535)",
          "author_name": "anchore-actions-token-generator[bot]",
          "author_login": "anchore-actions-token-generator[bot]",
          "committed_at": "2026-01-08T12:16:49Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "cc1a7dfae896b46616d0885de4b93328aa5f0734",
          "body": "Signed-off-by: promalert <promalert@outlook.com>",
          "is_bot": false,
          "headline": "chore: fix some comments to improve readability (#4533)",
          "author_name": "promalert",
          "author_login": "promalert",
          "committed_at": "2026-01-07T15:48:40Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "3a3a86eb017bc3ccd290e38cfed2fa2ae8396830",
          "body": "* fixed #4430 exclude dev pnpm pkg\n\nSigned-off-by: Rez Moss <hi@rezmoss.com>\n\n* use existing dev deps option\n\nSigned-off-by: Alex Goodman <wagoodman@users.noreply.github.com>\n\n* fixed #4430 exclude dev pnpm pkg, add test\n\nSigned-off-by: Rez Moss <hi@rezmoss.com>\n\n* fixed #4430 exclude dev pnpm pkg, \n[…]\n<hi@rezmoss.com>\n\n---------\n\nSigned-off-by: Rez Moss <hi@rezmoss.com>\nSigned-off-by: Alex Goodman <wagoodman@users.noreply.github.com>\nCo-authored-by: Alex Goodman <wagoodman@users.noreply.github.com>",
          "is_bot": false,
          "headline": "fixed #4430 exclude dev pnpm pkg (#4487)",
          "author_name": "Rez Moss",
          "author_login": "rezmoss",
          "committed_at": "2026-01-07T15:39:16Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "6509b7079ee2ce7f2efc31ba35426c6d4ffb25b5",
          "body": "Signed-off-by: witchcraze <witchcraze@gmail.com>",
          "is_bot": false,
          "headline": "add istio classifier (#4521)",
          "author_name": "witchcraze",
          "author_login": "witchcraze",
          "committed_at": "2026-01-07T15:36:39Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "7f1d57d06fde14ec26566832dff44828ab5a4da9",
          "body": "Signed-off-by: Rez Moss <hi@rezmoss.com>",
          "is_bot": false,
          "headline": "feat: detect older bitnami img packages (#4532)",
          "author_name": "Rez Moss",
          "author_login": "rezmoss",
          "committed_at": "2026-01-07T15:07:33Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "ed339e4fed10912d7ed9b98c588ec38241fb020b",
          "body": "---------\nSigned-off-by: Alex Goodman <wagoodman@users.noreply.github.com>",
          "is_bot": false,
          "headline": "fix: ensure java image build failures stop the build (#4531)",
          "author_name": "Alex Goodman",
          "author_login": "wagoodman",
          "committed_at": "2026-01-06T16:43:51Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "3ea6a03cd060096fd67841759008bb2efc215371",
          "body": "* chore(deps): bump the go-minor-patch group with 3 updates\n\nBumps the go-minor-patch group with 3 updates: [github.com/BurntSushi/toml](https://github.com/BurntSushi/toml), [github.com/go-git/go-git/v5](https://github.com/go-git/go-git) and [github.com/invopop/jsonschema](https://github.com/invopop\n[…]\n Alex Goodman <wagoodman@users.noreply.github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>\nCo-authored-by: Alex Goodman <wagoodman@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump the go-minor-patch group with 3 updates (#4524)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-01-06T15:25:43Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "81dd9558714639a848d6a843988106c6ddb5d943",
          "body": "* add envoy classifier\nSigned-off-by: witchcraze <witchcraze@gmail.com>\n\n* add envoy classifier\nSigned-off-by: witchcraze <witchcraze@gmail.com>",
          "is_bot": false,
          "headline": "add envoy binary classifier (#4530)",
          "author_name": "witchcraze",
          "author_login": "witchcraze",
          "committed_at": "2026-01-06T13:45:01Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "48948ddb8fa886631fc920f4a66999e9eaba5634",
          "body": "Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>",
          "is_bot": false,
          "headline": "add container support for graalvm fixture (#4528)",
          "author_name": "Alex Goodman",
          "author_login": "wagoodman",
          "committed_at": "2026-01-05T19:18:12Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "63273b1b00da98af439be767505484ee61e5c5a5",
          "body": "…th 2 updates (#4525)\n\nBumps the actions-minor-patch group with 2 updates in the / directory: [docker/login-action](https://github.com/docker/login-action) and [zizmorcore/zizmor-action](https://github.com/zizmorcore/zizmor-action).\n\n\nUpdates `docker/login-action` from 3.5.0 to 3.6.0\n- [Release note\n[…]\nupdate:semver-minor\n  dependency-group: actions-minor-patch\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump the actions-minor-patch group across 1 directory wi…",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-01-05T17:48:30Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "92e523caa61d863bcb8d36205eb9ef90dd00f4c8",
          "body": "Bumps [actions/download-artifact](https://github.com/actions/download-artifact) from 6.0.0 to 7.0.0.\n- [Release notes](https://github.com/actions/download-artifact/releases)\n- [Commits](https://github.com/actions/download-artifact/compare/018cc2cf5baa6db3ef3c5f8a56943fffe632ef53...37930b1c2abaa49bbe\n[…]\nirect:production\n  update-type: version-update:semver-major\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump actions/download-artifact from 6.0.0 to 7.0.0 (#4526)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-01-05T17:48:20Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "9b33b8a3d61be74b65e6df790ab5199118f7b010",
          "body": "Bumps [actions/upload-artifact](https://github.com/actions/upload-artifact) from 4.4.3 to 6.0.0.\n- [Release notes](https://github.com/actions/upload-artifact/releases)\n- [Commits](https://github.com/actions/upload-artifact/compare/b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882...b7c566a772e6b6bfb58ed0dc25\n[…]\nirect:production\n  update-type: version-update:semver-major\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump actions/upload-artifact from 4.4.3 to 6.0.0 (#4527)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-01-05T17:48:13Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "29a0b19a213778fe2cbed6f007fdd3f012adb347",
          "body": "* group dependabot updates\n\nSigned-off-by: Alex Goodman <wagoodman@users.noreply.github.com>\n\n* use directories key\n\nSigned-off-by: Alex Goodman <wagoodman@users.noreply.github.com>\n\n---------\n\nSigned-off-by: Alex Goodman <wagoodman@users.noreply.github.com>",
          "is_bot": false,
          "headline": "Group dependabot updates (#4522)",
          "author_name": "Alex Goodman",
          "author_login": "wagoodman",
          "committed_at": "2026-01-05T16:57:38Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "ea4350619651ab5ad10c2aabca142c6d8089e8e9",
          "body": "---------\nSigned-off-by: Luis M. Santos <luis.santos2@nih.gov>\nCo-authored-by: Luis M. Santos <luis.santos2@nih.gov>",
          "is_bot": false,
          "headline": "fix: corrects handling of UNC root paths in windows.",
          "author_name": "Luis Miguel Santos",
          "author_login": "luissantosHCIT",
          "committed_at": "2026-01-05T16:32:07Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "2c96279df99fb3ba9c9d38cce3fe0e1f74eabb4a",
          "body": "Signed-off-by: Rez Moss <hi@rezmoss.com>",
          "is_bot": false,
          "headline": "fix: traefik binary classifier (#4499)",
          "author_name": "Rez Moss",
          "author_login": "rezmoss",
          "committed_at": "2026-01-05T16:14:00Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "488511f69dd16a6d29e34855a181ddd631fde40f",
          "body": "Bumps [modernc.org/sqlite](https://gitlab.com/cznic/sqlite) from 1.41.0 to 1.42.2.\n- [Commits](https://gitlab.com/cznic/sqlite/compare/v1.41.0...v1.42.2)\n\n---\nupdated-dependencies:\n- dependency-name: modernc.org/sqlite\n  dependency-version: 1.42.2\n  dependency-type: direct:production\n  update-type: version-update:semver-minor\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump modernc.org/sqlite from 1.41.0 to 1.42.2 (#4513)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-01-05T15:46:39Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "11fed9007561ad4f3f1d72fbaaa2810e20846181",
          "body": "* migrate to runs-on runners\n\nSigned-off-by: Alex Goodman <wagoodman@users.noreply.github.com>\n\n* keep validations on x64\n\nSigned-off-by: Alex Goodman <wagoodman@users.noreply.github.com>\n\n* correct ubuntu arm refs\n\nSigned-off-by: Alex Goodman <wagoodman@users.noreply.github.com>\n\n* bust cache\n\nSign\n[…]\nwagoodman@users.noreply.github.com>\n\n* remove parallelism\n\nSigned-off-by: Alex Goodman <wagoodman@users.noreply.github.com>\n\n---------\n\nSigned-off-by: Alex Goodman <wagoodman@users.noreply.github.com>",
          "is_bot": false,
          "headline": "Migrate CI to runs-on (#4351)",
          "author_name": "Alex Goodman",
          "author_login": "wagoodman",
          "committed_at": "2026-01-05T14:53:06Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "c8184bdb4c3e9f800c8ffa6dd4f37145893cae4a",
          "body": "Signed-off-by: witchcraze <witchcraze@gmail.com>",
          "is_bot": false,
          "headline": "add grafana classifier (#4516)",
          "author_name": "witchcraze",
          "author_login": "witchcraze",
          "committed_at": "2026-01-05T14:51:41Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "15af992225b8f046de9459a019de7e39f5525fbb",
          "body": "* add valkey classifier\nSigned-off-by: witchcraze <witchcraze@gmail.com>\n\n* fix test path\nSigned-off-by: witchcraze <witchcraze@gmail.com>\n\n* Run 'go generate ./internal/capabilities'\nSigned-off-by: witchcraze <witchcraze@gmail.com>",
          "is_bot": false,
          "headline": "add valkey classifier (#4509)",
          "author_name": "witchcraze",
          "author_login": "witchcraze",
          "committed_at": "2026-01-05T14:40:35Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "1e15428c6f6271bae148388d1fec5b7cd11f041a",
          "body": "Bumps [anchore/sbom-action](https://github.com/anchore/sbom-action) from 0.20.11 to 0.21.0.\n- [Release notes](https://github.com/anchore/sbom-action/releases)\n- [Changelog](https://github.com/anchore/sbom-action/blob/main/RELEASE.md)\n- [Commits](https://github.com/anchore/sbom-action/compare/43a17d6\n[…]\nirect:production\n  update-type: version-update:semver-minor\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump anchore/sbom-action from 0.20.11 to 0.21.0 (#4501)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-01-05T14:19:40Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "d1adfdc3a6fee4011eb00554e0542bcbc8d826ea",
          "body": "… (#4502)\n\nBumps [github.com/jedib0t/go-pretty/v6](https://github.com/jedib0t/go-pretty) from 6.7.7 to 6.7.8.\n- [Release notes](https://github.com/jedib0t/go-pretty/releases)\n- [Commits](https://github.com/jedib0t/go-pretty/compare/v6.7.7...v6.7.8)\n\n---\nupdated-dependencies:\n- dependency-name: githu\n[…]\nirect:production\n  update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump github.com/jedib0t/go-pretty/v6 from 6.7.7 to 6.7.8…",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-01-05T14:19:34Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "00281650627c9357a2807815c89d0ff6a3240316",
          "body": "…4503)\n\nBumps [github.com/spdx/tools-golang](https://github.com/spdx/tools-golang) from 0.5.5 to 0.5.6.\n- [Release notes](https://github.com/spdx/tools-golang/releases)\n- [Changelog](https://github.com/spdx/tools-golang/blob/main/RELEASE-NOTES.md)\n- [Commits](https://github.com/spdx/tools-golang/com\n[…]\nirect:production\n  update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump github.com/spdx/tools-golang from 0.5.5 to 0.5.6 (#…",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-01-05T14:19:29Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "997a76712ff6c1a89c9a9e42dcc312ee4e878c1f",
          "body": "Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>\nCo-authored-by: spiffcs <32073428+spiffcs@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): update tools to latest versions (#4504)",
          "author_name": "anchore-actions-token-generator[bot]",
          "author_login": "anchore-actions-token-generator[bot]",
          "committed_at": "2026-01-05T14:19:24Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "e44ef53489f04917605428c0e0051ddfdfb0edec",
          "body": "…(#4518)\n\nBumps [github.com/hashicorp/go-getter](https://github.com/hashicorp/go-getter) from 1.8.3 to 1.8.4.\n- [Release notes](https://github.com/hashicorp/go-getter/releases)\n- [Commits](https://github.com/hashicorp/go-getter/compare/v1.8.3...v1.8.4)\n\n---\nupdated-dependencies:\n- dependency-name: g\n[…]\nirect:production\n  update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump github.com/hashicorp/go-getter from 1.8.3 to 1.8.4 …",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-01-05T14:17:46Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "e0708e725f9544535e72de76011d47f9ebcb49b5",
          "body": "…19 (#4520)\n\nBumps [github.com/gkampitakis/go-snaps](https://github.com/gkampitakis/go-snaps) from 0.5.18 to 0.5.19.\n- [Release notes](https://github.com/gkampitakis/go-snaps/releases)\n- [Commits](https://github.com/gkampitakis/go-snaps/compare/0.5.18...v0.5.19)\n\n---\nupdated-dependencies:\n- dependen\n[…]\nirect:production\n  update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump github.com/gkampitakis/go-snaps from 0.5.18 to 0.5.…",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-01-05T14:17:39Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "e9e34948534ab945c7e750376235cfe0c442f532",
          "body": "Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>",
          "is_bot": false,
          "headline": "remove debug output (#4496)",
          "author_name": "Alex Goodman",
          "author_login": "wagoodman",
          "committed_at": "2025-12-22T19:51:39Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "b3c70da3ea0aec25829d7ddb55c19881c3c7168f",
          "body": "* add info command from generated capabilities\n\nSigned-off-by: Alex Goodman <wagoodman@users.noreply.github.com>\n\n* correct gentoo and arch ecosystems\n\nSigned-off-by: Alex Goodman <wagoodman@users.noreply.github.com>\n\n* rename os pkg types\n\nSigned-off-by: Alex Goodman <wagoodman@users.noreply.github\n[…]\ngmail.com>\nSigned-off-by: Will Murphy <willmurphyscode@users.noreply.github.com>\nCo-authored-by: Keith Zantow <kzantow@gmail.com>\nCo-authored-by: Will Murphy <willmurphyscode@users.noreply.github.com>",
          "is_bot": false,
          "headline": "Add experimental cataloger capabilities command (#4317)",
          "author_name": "Alex Goodman",
          "author_login": "wagoodman",
          "committed_at": "2025-12-22T19:34:10Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "ae1a247f3de7ad222a4d2946de685aff96d73125",
          "body": "* unpin dependencies for package dedup case\n\nSigned-off-by: Alex Goodman <wagoodman@users.noreply.github.com>\n\n* prevent make from blocking tests\n\nSigned-off-by: Alex Goodman <wagoodman@users.noreply.github.com>\n\n* add check\n\nSigned-off-by: Alex Goodman <wagoodman@users.noreply.github.com>\n\n---------\n\nSigned-off-by: Alex Goodman <wagoodman@users.noreply.github.com>",
          "is_bot": false,
          "headline": "Unpin fixture dependencies that will always float (#4495)",
          "author_name": "Alex Goodman",
          "author_login": "wagoodman",
          "committed_at": "2025-12-22T19:17:58Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "0ea920ba6db187f84f95f0a74c26eb3db11719dc",
          "body": "…atted binaries with lzma method only) (#4480)\n\n* decompress upx packed binaries\n\nSigned-off-by: Alex Goodman <wagoodman@users.noreply.github.com>\n\n* fix linting and remove dead code\n\nSigned-off-by: Alex Goodman <wagoodman@users.noreply.github.com>\n\n---------\n\nSigned-off-by: Alex Goodman <wagoodman@users.noreply.github.com>",
          "is_bot": false,
          "headline": "Decompress UPX packed binaries to extract golang build info (ELF form…",
          "author_name": "Alex Goodman",
          "author_login": "wagoodman",
          "committed_at": "2025-12-22T14:17:38Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "7ef4703454abc809eec52a80ff58a9c49f8bb9a5",
          "body": "Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>\nCo-authored-by: spiffcs <32073428+spiffcs@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): update tools to latest versions (#4491)",
          "author_name": "anchore-actions-token-generator[bot]",
          "author_login": "anchore-actions-token-generator[bot]",
          "committed_at": "2025-12-22T14:15:51Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "8334fb04eccdf5314cc2c9dbf64566fe4112f0bd",
          "body": "Bumps [modernc.org/sqlite](https://gitlab.com/cznic/sqlite) from 1.40.1 to 1.41.0.\n- [Commits](https://gitlab.com/cznic/sqlite/compare/v1.40.1...v1.41.0)\n\n---\nupdated-dependencies:\n- dependency-name: modernc.org/sqlite\n  dependency-version: 1.41.0\n  dependency-type: direct:production\n  update-type: version-update:semver-minor\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump modernc.org/sqlite from 1.40.1 to 1.41.0 (#4489)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2025-12-19T16:00:31Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "c9760d234164a3a51a0102ed3f0ff9ab5d73b956",
          "body": "…439)\n\n---------\nSigned-off-by: Yuntao Hu <victorhu493@gmail.com>",
          "is_bot": false,
          "headline": "feat: snap can be queried by revision and ```track/risk/branch``` (#4…",
          "author_name": "VictorHuu",
          "author_login": "VictorHuu",
          "committed_at": "2025-12-18T20:41:36Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "74c9380248c63bad87d1c3d54151eb2b49c206a9",
          "body": "---------\nSigned-off-by: Rez Moss <hi@rezmoss.com>\nSigned-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com>\nSigned-off-by: Christopher Angelo Phillips <32073428+spiffcs@users.noreply.github.com>\nCo-authored-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com>",
          "is_bot": false,
          "headline": "fix: 4423 dotnet-deps cataloger skips project type by def",
          "author_name": "Rez Moss",
          "author_login": "rezmoss",
          "committed_at": "2025-12-18T18:38:47Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "7ed733c3fbd9bab33ec59171a1170db1553e8a52",
          "body": "Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>",
          "is_bot": false,
          "headline": "signpost to docs site (#4483)",
          "author_name": "Alex Goodman",
          "author_login": "wagoodman",
          "committed_at": "2025-12-17T18:00:38Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "a39c60091357ff0d566db30e92d2a1ce3faa7759",
          "body": "Bumps [github/codeql-action](https://github.com/github/codeql-action) from 4.31.8 to 4.31.9.\n- [Release notes](https://github.com/github/codeql-action/releases)\n- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)\n- [Commits](https://github.com/github/codeql-action/compare/1\n[…]\nirect:production\n  update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump github/codeql-action from 4.31.8 to 4.31.9 (#4481)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2025-12-17T15:20:52Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "a2020fe1c7bc6f37e78cc1f34060cae1bbec701a",
          "body": "Bumps [github.com/goccy/go-yaml](https://github.com/goccy/go-yaml) from 1.19.0 to 1.19.1.\n- [Release notes](https://github.com/goccy/go-yaml/releases)\n- [Changelog](https://github.com/goccy/go-yaml/blob/master/CHANGELOG.md)\n- [Commits](https://github.com/goccy/go-yaml/compare/v1.19.0...v1.19.1)\n\n---\n[…]\nirect:production\n  update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump github.com/goccy/go-yaml from 1.19.0 to 1.19.1 (#4482)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2025-12-17T15:20:43Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "c79a57b6a1e00c413bfd02269bbcd46133ecf7f7",
          "body": "* syft detect embedded deps.json,dotnet , fixed #4344\n\nSigned-off-by: Rez Moss <hi@rezmoss.com>\n\n* [wip] have pe utils process embedded dep.json\n\nSigned-off-by: Alex Goodman <wagoodman@users.noreply.github.com>\n\n* [wip] add PoC bundler processing\n\nSigned-off-by: Alex Goodman <wagoodman@users.noreply\n[…]\neply.github.com>\n\n---------\n\nSigned-off-by: Rez Moss <hi@rezmoss.com>\nSigned-off-by: Alex Goodman <wagoodman@users.noreply.github.com>\nCo-authored-by: Alex Goodman <wagoodman@users.noreply.github.com>",
          "is_bot": false,
          "headline": "Detect embedded deps.json in .NET binaries (#4375)",
          "author_name": "Rez Moss",
          "author_login": "rezmoss",
          "committed_at": "2025-12-16T13:35:19Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "2c97ff1b2448049a9b75bb19b1f425a774bbfcb4",
          "body": "Bumps [actions/cache](https://github.com/actions/cache) from 5.0.0 to 5.0.1.\n- [Release notes](https://github.com/actions/cache/releases)\n- [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md)\n- [Commits](https://github.com/actions/cache/compare/a7833574556fa59680c1b7cb190c1735db73ebf\n[…]\nirect:production\n  update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump actions/cache from 5.0.0 to 5.0.1 (#4476)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2025-12-16T13:28:51Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "e760a7cad494b33e8c6a42920b58d61c78ac640a",
          "body": "Bumps [actions/cache](https://github.com/actions/cache) from 5.0.0 to 5.0.1.\n- [Release notes](https://github.com/actions/cache/releases)\n- [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md)\n- [Commits](https://github.com/actions/cache/compare/a7833574556fa59680c1b7cb190c1735db73ebf\n[…]\nirect:production\n  update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump actions/cache in /.github/actions/bootstrap (#4477)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2025-12-16T13:28:48Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "e1ae4e1112fed981025646698fa484999d49b756",
          "body": "Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>\nCo-authored-by: spiffcs <32073428+spiffcs@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): update tools to latest versions (#4473)",
          "author_name": "anchore-actions-token-generator[bot]",
          "author_login": "anchore-actions-token-generator[bot]",
          "committed_at": "2025-12-16T13:28:44Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "beb70891e5599f1175b90027fdaaf8ffdfb9a584",
          "body": "Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>",
          "is_bot": false,
          "headline": "unapply base path for resolver inbound requests (#4478)",
          "author_name": "Alex Goodman",
          "author_login": "wagoodman",
          "committed_at": "2025-12-16T13:28:12Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "e0b61a3ae34ed93e017b7db90e2b05f8556738c5",
          "body": "* fixed #4316 go mod with ver purl\n\nSigned-off-by: Rez Moss <hi@rezmoss.com>\n\n* go mod purl fixed, added func to handle go.mod\n\nSigned-off-by: Rez Moss <hi@rezmoss.com>\n\n* fix: use module name in PURL string everywhere\n\nSigned-off-by: Keith Zantow <kzantow@gmail.com>\n\n---------\n\nSigned-off-by: Rez Moss <hi@rezmoss.com>\nSigned-off-by: Keith Zantow <kzantow@gmail.com>\nCo-authored-by: Keith Zantow <kzantow@gmail.com>",
          "is_bot": false,
          "headline": "fix: golang PURL should include full module (#4395)",
          "author_name": "Rez Moss",
          "author_login": "rezmoss",
          "committed_at": "2025-12-12T19:19:26Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "4c38ee1932b9d4892ab69c5034393d84f9450026",
          "body": "* fix:the os of an elf binary should be detected even when the os version is empty\n\nSigned-off-by: Yuntao Hu <victorhu493@gmail.com>\n\n* chore:revoke the update of appCpe\n\nSigned-off-by: Yuntao Hu <victorhu493@gmail.com>\n\n* chore:resume the testcase\n\nSigned-off-by: Yuntao Hu <victorhu493@gmail.com>\n\n\n[…]\nhub.com>\n\n---------\n\nSigned-off-by: Yuntao Hu <victorhu493@gmail.com>\nSigned-off-by: Alex Goodman <wagoodman@users.noreply.github.com>\nCo-authored-by: Alex Goodman <wagoodman@users.noreply.github.com>",
          "is_bot": false,
          "headline": "fix:best effort to get the os info of an ELF binary (#4438)",
          "author_name": "VictorHuu",
          "author_login": "VictorHuu",
          "committed_at": "2025-12-12T19:13:59Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "6be0a9abc42646429f0ff98dd826e9db4443685c",
          "body": "* improve pr template\n\nSigned-off-by: Alex Goodman <wagoodman@users.noreply.github.com>\n\n* incorporate feedback\n\nSigned-off-by: Alex Goodman <wagoodman@users.noreply.github.com>\n\n---------\n\nSigned-off-by: Alex Goodman <wagoodman@users.noreply.github.com>",
          "is_bot": false,
          "headline": "Improve PR template (#4472)",
          "author_name": "Alex Goodman",
          "author_login": "wagoodman",
          "committed_at": "2025-12-12T15:45:29Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "ea1f4cba389ec86ea7f7d9ed0463ecaa991d1a08",
          "body": "Signed-off-by: Alexandre Steppé <alexandre.steppe@gmail.com>",
          "is_bot": false,
          "headline": "feat: add support for Gemfile.next.lock (#4457)",
          "author_name": "Alexandre Steppé",
          "author_login": "HatiCode",
          "committed_at": "2025-12-12T15:20:53Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "c8982b887dab6f9653e9611b6958ca3aec694503",
          "body": "Signed-off-by: VictorHuu <victorhu493@gmail.com>",
          "is_bot": false,
          "headline": "chore:cancel in-progress workflows for new commits on same PR (#4465)",
          "author_name": "VictorHuu",
          "author_login": "VictorHuu",
          "committed_at": "2025-12-12T15:20:20Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "6ad4873a33536f8cf226823eeb6255af50d2f1d1",
          "body": "Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>\nCo-authored-by: spiffcs <32073428+spiffcs@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): update tools to latest versions (#4466)",
          "author_name": "anchore-actions-token-generator[bot]",
          "author_login": "anchore-actions-token-generator[bot]",
          "committed_at": "2025-12-12T13:49:02Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "052e4ca9a3200c7087b66c7ce9ff5afc331341a0",
          "body": "Bumps [github/codeql-action](https://github.com/github/codeql-action) from 4.31.7 to 4.31.8.\n- [Release notes](https://github.com/github/codeql-action/releases)\n- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)\n- [Commits](https://github.com/github/codeql-action/compare/c\n[…]\nirect:production\n  update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump github/codeql-action from 4.31.7 to 4.31.8 (#4468)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2025-12-12T13:48:36Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "41e133e2cf660b06536c0109bd95d88dbe503a81",
          "body": "Bumps [actions/cache](https://github.com/actions/cache) from 4.3.0 to 5.0.0.\n- [Release notes](https://github.com/actions/cache/releases)\n- [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md)\n- [Commits](https://github.com/actions/cache/compare/0057852bfaa89a56745cba8c7296529d2fc3983\n[…]\nirect:production\n  update-type: version-update:semver-major\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump actions/cache from 4.3.0 to 5.0.0 (#4469)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2025-12-12T13:48:32Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "a85e034afc22cb76ecdd0e1e0e8020f4b25415fb",
          "body": "…6 (#4470)\n\nBumps [github.com/anchore/stereoscope](https://github.com/anchore/stereoscope) from 0.1.14 to 0.1.16.\n- [Release notes](https://github.com/anchore/stereoscope/releases)\n- [Changelog](https://github.com/anchore/stereoscope/blob/main/RELEASE.md)\n- [Commits](https://github.com/anchore/stere\n[…]\nirect:production\n  update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump github.com/anchore/stereoscope from 0.1.14 to 0.1.1…",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2025-12-12T13:48:28Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "d5380013ae73d34376277e8fa1b3a2beca7794ba",
          "body": "Bumps [actions/cache](https://github.com/actions/cache) from 4.3.0 to 5.0.0.\n- [Release notes](https://github.com/actions/cache/releases)\n- [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md)\n- [Commits](https://github.com/actions/cache/compare/0057852bfaa89a56745cba8c7296529d2fc3983\n[…]\nirect:production\n  update-type: version-update:semver-major\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump actions/cache in /.github/actions/bootstrap (#4471)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2025-12-12T13:48:22Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "5ea3387cbc3515d3f246deb880459e25be32c11c",
          "body": "Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>\nCo-authored-by: spiffcs <32073428+spiffcs@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): update tools to latest versions (#4462)",
          "author_name": "anchore-actions-token-generator[bot]",
          "author_login": "anchore-actions-token-generator[bot]",
          "committed_at": "2025-12-11T14:55:34Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "568b7601bb4c1845be548e29074b1d0d81f0d90c",
          "body": "…4412)\n\nRemoves an accidental `fmt.Println(\"error\", err)` that was left in\nthe javascript dependency parser. This causes noisy output to stdout\nwhen parsing npm package-lock.json files that contain dependency\nspecifiers that aren't valid PURLs.\n\nSigned-off-by: Chris Greeno <chris@fresha.com>",
          "is_bot": false,
          "headline": "fix(javascript): remove debug print statement in dependency parser (#…",
          "author_name": "Chris Greeno",
          "author_login": "cgreeno",
          "committed_at": "2025-12-10T18:42:09Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "7fdb08c0b61134ab7d85337de69a96dc3e72cd6f",
          "body": "…ssary  (#4390)\n\n* Adding a second function to validate/correct urls that are just github repositories\n\nSigned-off-by: Kendrick <kmartinix@gmail.com>\n\n* Adding test case to capture github repositories\n\nSigned-off-by: Kendrick <kmartinix@gmail.com>\n\n---------\n\nSigned-off-by: Kendrick <kmartinix@gmail.com>",
          "is_bot": false,
          "headline": "Validating download_url for github repositories, and updating if nece…",
          "author_name": "Kendrick",
          "author_login": "kendrickm",
          "committed_at": "2025-12-10T18:41:00Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "47e1cee5a55b5d0ea63dc13a26b3d1acab2181e3",
          "body": "Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>\nCo-authored-by: spiffcs <32073428+spiffcs@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): update tools to latest versions (#4456)",
          "author_name": "anchore-actions-token-generator[bot]",
          "author_login": "anchore-actions-token-generator[bot]",
          "committed_at": "2025-12-10T18:34:42Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "a0c5b8aa8daf5a3c47bfcd53a2284e90f610e081",
          "body": "… (#4460)\n\nBumps [github.com/jedib0t/go-pretty/v6](https://github.com/jedib0t/go-pretty) from 6.7.5 to 6.7.7.\n- [Release notes](https://github.com/jedib0t/go-pretty/releases)\n- [Commits](https://github.com/jedib0t/go-pretty/compare/v6.7.5...v6.7.7)\n\n---\nupdated-dependencies:\n- dependency-name: githu\n[…]\nirect:production\n  update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump github.com/jedib0t/go-pretty/v6 from 6.7.5 to 6.7.7…",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2025-12-10T18:32:56Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "ab5fa0a664280cd1234cb1acccbfd9ffe1111f56",
          "body": "…0 (#4459)\n\nBumps [peter-evans/create-pull-request](https://github.com/peter-evans/create-pull-request) from 7.0.11 to 8.0.0.\n- [Release notes](https://github.com/peter-evans/create-pull-request/releases)\n- [Commits](https://github.com/peter-evans/create-pull-request/compare/22a9089034f40e5a961c8808\n[…]\nirect:production\n  update-type: version-update:semver-major\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump peter-evans/create-pull-request from 7.0.11 to 8.0.…",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2025-12-10T18:32:51Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "07ad8a55734e047d5c870e27c412153a6c9ae268",
          "body": "Bumps [anchore/sbom-action](https://github.com/anchore/sbom-action) from 0.20.10 to 0.20.11.\n- [Release notes](https://github.com/anchore/sbom-action/releases)\n- [Changelog](https://github.com/anchore/sbom-action/blob/main/RELEASE.md)\n- [Commits](https://github.com/anchore/sbom-action/compare/fbfd9c\n[…]\nirect:production\n  update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump anchore/sbom-action from 0.20.10 to 0.20.11 (#4458)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2025-12-10T18:32:47Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "bfe63f83dbaea88e22a5cfcd7d704c034c953730",
          "body": "Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>\nCo-authored-by: willmurphyscode <12529630+willmurphyscode@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): update anchore dependencies (#4440)",
          "author_name": "anchore-actions-token-generator[bot]",
          "author_login": "anchore-actions-token-generator[bot]",
          "committed_at": "2025-12-09T20:56:03Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "f01056d111b66978d0de23762cf77130953e3c18",
          "body": "* chore(deps): update tools to latest versions\n\nSigned-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>\n\n* chore: suppress revive on internal/os package name\n\ngolangci-lint has started flagging internal/os package name for\nshadowing the stdlib package named \"os\". S\n[…]\nff-by: Will Murphy <willmurphyscode@users.noreply.github.com>\nCo-authored-by: spiffcs <32073428+spiffcs@users.noreply.github.com>\nCo-authored-by: Will Murphy <willmurphyscode@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): update tools to latest versions (#4442)",
          "author_name": "anchore-actions-token-generator[bot]",
          "author_login": "anchore-actions-token-generator[bot]",
          "committed_at": "2025-12-09T16:00:08Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "09b24bdb471eebd345c0d1cd4f43eaa2a0ca74fe",
          "body": "…1 (#4447)\n\nBumps [peter-evans/create-pull-request](https://github.com/peter-evans/create-pull-request) from 7.0.8 to 7.0.11.\n- [Release notes](https://github.com/peter-evans/create-pull-request/releases)\n- [Commits](https://github.com/peter-evans/create-pull-request/compare/271a8d0340265f705b14b6d3\n[…]\nirect:production\n  update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump peter-evans/create-pull-request from 7.0.8 to 7.0.1…",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2025-12-09T14:59:32Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "ae1fa09e02e5f845b52b8994beb008b387892879",
          "body": "… (#4445)\n\nBumps [actions/create-github-app-token](https://github.com/actions/create-github-app-token) from 2.1.4 to 2.2.1.\n- [Release notes](https://github.com/actions/create-github-app-token/releases)\n- [Commits](https://github.com/actions/create-github-app-token/compare/67018539274d69449ef7c02e8e\n[…]\nirect:production\n  update-type: version-update:semver-minor\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump actions/create-github-app-token from 2.1.4 to 2.2.1…",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2025-12-09T14:57:48Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "6b0f9244261ee03cda016e6a20f196f529e7792d",
          "body": "…#4448)\n\nBumps [github.com/go-git/go-billy/v5](https://github.com/go-git/go-billy) from 5.6.2 to 5.7.0.\n- [Release notes](https://github.com/go-git/go-billy/releases)\n- [Commits](https://github.com/go-git/go-billy/compare/v5.6.2...v5.7.0)\n\n---\nupdated-dependencies:\n- dependency-name: github.com/go-g\n[…]\nirect:production\n  update-type: version-update:semver-minor\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump github.com/go-git/go-billy/v5 from 5.6.2 to 5.7.0 (…",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2025-12-09T14:56:00Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "6d56087289bd614a74677dd5263b9108fc2b5f5a",
          "body": "Bumps [github/codeql-action](https://github.com/github/codeql-action) from 4.31.6 to 4.31.7.\n- [Release notes](https://github.com/github/codeql-action/releases)\n- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)\n- [Commits](https://github.com/github/codeql-action/compare/f\n[…]\nirect:production\n  update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump github/codeql-action from 4.31.6 to 4.31.7 (#4446)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2025-12-09T14:47:52Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "1d718f3311b38d721661d2e678811f5935bff249",
          "body": "Bumps [golang.org/x/tools](https://github.com/golang/tools) from 0.39.0 to 0.40.0.\n- [Release notes](https://github.com/golang/tools/releases)\n- [Commits](https://github.com/golang/tools/compare/v0.39.0...v0.40.0)\n\n---\nupdated-dependencies:\n- dependency-name: golang.org/x/tools\n  dependency-version:\n[…]\nirect:production\n  update-type: version-update:semver-minor\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump golang.org/x/tools from 0.39.0 to 0.40.0 (#4453)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2025-12-09T14:46:52Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "9e3150b7ee5a7d1ae0a15d6d12c0f3ab410be447",
          "body": "…449)\n\nSigned-off-by: Keith Zantow <kzantow@gmail.com>",
          "is_bot": false,
          "headline": "fix: java archives excluded due to incorrect license glob results (#4…",
          "author_name": "Keith Zantow",
          "author_login": "kzantow",
          "committed_at": "2025-12-08T20:58:13Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "d950ac1fae22f86fc777a47ac9300369333a0c65",
          "body": "The recent react / next CVE uses \"vercel\" as the vendor, see\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-55182\n\nSigned-off-by: Will Murphy <willmurphyscode@users.noreply.github.com>",
          "is_bot": false,
          "headline": "fix: use vercel for vendor in nextjs CPE (#4450)",
          "author_name": "Will Murphy",
          "author_login": "willmurphyscode",
          "committed_at": "2025-12-08T20:23:36Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "baca32f04ae767d0829c6a3bab47cd6d7edc644c",
          "body": "… one should be omitted  (#4419)\n\n---------\nSigned-off-by: Yuntao Hu <victorhu493@gmail.com>",
          "is_bot": false,
          "headline": "fix:after compliance applied,the relationship concerning the original…",
          "author_name": "VictorHuu",
          "author_login": "VictorHuu",
          "committed_at": "2025-12-04T20:30:16Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "155738aba72e4f169ce7b5dd24bb0a610c68e565",
          "body": "…4434)\n\nBumps [github.com/github/go-spdx/v2](https://github.com/github/go-spdx) from 2.3.4 to 2.3.5.\n- [Release notes](https://github.com/github/go-spdx/releases)\n- [Commits](https://github.com/github/go-spdx/compare/v2.3.4...v2.3.5)\n\n---\nupdated-dependencies:\n- dependency-name: github.com/github/go\n[…]\nirect:production\n  update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump github.com/github/go-spdx/v2 from 2.3.4 to 2.3.5 (#…",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2025-12-04T18:42:59Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "2b72158b0b333f341db2cca33a415f2ed6a5ce79",
          "body": "Bumps [github.com/spf13/cobra](https://github.com/spf13/cobra) from 1.10.1 to 1.10.2.\n- [Release notes](https://github.com/spf13/cobra/releases)\n- [Commits](https://github.com/spf13/cobra/compare/v1.10.1...v1.10.2)\n\n---\nupdated-dependencies:\n- dependency-name: github.com/spf13/cobra\n  dependency-ver\n[…]\nirect:production\n  update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump github.com/spf13/cobra from 1.10.1 to 1.10.2 (#4435)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2025-12-04T18:42:50Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "a80679beba595ed9f454c9c20bfef2ff4900eb12",
          "body": "Bumps [actions/checkout](https://github.com/actions/checkout) from 6.0.0 to 6.0.1.\n- [Release notes](https://github.com/actions/checkout/releases)\n- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)\n- [Commits](https://github.com/actions/checkout/compare/1af3b93b6815bc44a9784bd\n[…]\nirect:production\n  update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump actions/checkout from 6.0.0 to 6.0.1 (#4431)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2025-12-04T01:18:45Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "b0c74d4104c76dafa25c3494910ed6b743fb54b1",
          "body": "…18 (#4432)\n\nBumps [github.com/gkampitakis/go-snaps](https://github.com/gkampitakis/go-snaps) from 0.5.17 to 0.5.18.\n- [Release notes](https://github.com/gkampitakis/go-snaps/releases)\n- [Commits](https://github.com/gkampitakis/go-snaps/compare/0.5.17...0.5.18)\n\n---\nupdated-dependencies:\n- dependenc\n[…]\nirect:production\n  update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump github.com/gkampitakis/go-snaps from 0.5.17 to 0.5.…",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2025-12-03T18:20:11Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "afe28a2fc0198abe83c350d4de3647d8b73ab318",
          "body": "…(#4421)\n\n---------\nSigned-off-by: Yuntao Hu <victorhu493@gmail.com>\nSigned-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com>\nCo-authored-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com>",
          "is_bot": false,
          "headline": "fix:handle compound aliases like ```.tgz``` when cataloging archives …",
          "author_name": "VictorHuu",
          "author_login": "VictorHuu",
          "committed_at": "2025-12-02T21:55:32Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "d37ed567a821483a00fa414bb46cab038a5bd4ab",
          "body": "Signed-off-by: Will Murphy <willmurphyscode@users.noreply.github.com>",
          "is_bot": false,
          "headline": "chore: use git ls-files instead of find to list files (#4425)",
          "author_name": "Will Murphy",
          "author_login": "willmurphyscode",
          "committed_at": "2025-12-01T21:46:42Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "e556ceb4a8324b2ac143535b19c73ffdc995ae8e",
          "body": "…17 (#4413)\n\nBumps [github.com/gkampitakis/go-snaps](https://github.com/gkampitakis/go-snaps) from 0.5.15 to 0.5.17.\n- [Release notes](https://github.com/gkampitakis/go-snaps/releases)\n- [Commits](https://github.com/gkampitakis/go-snaps/compare/v0.5.15...0.5.17)\n\n---\nupdated-dependencies:\n- dependen\n[…]\nirect:production\n  update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump github.com/gkampitakis/go-snaps from 0.5.15 to 0.5.…",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2025-12-01T21:34:38Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "d8538e7d8b21bc59db417e4dc2753e9e97586418",
          "body": "Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>\nCo-authored-by: spiffcs <32073428+spiffcs@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): update tools to latest versions (#4420)",
          "author_name": "anchore-actions-token-generator[bot]",
          "author_login": "anchore-actions-token-generator[bot]",
          "committed_at": "2025-12-01T21:34:18Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "cd19ac956cc524c32d8637c67b0fe95289d73d74",
          "body": "….2 (#4427)\n\nBumps [github.com/olekukonko/tablewriter](https://github.com/olekukonko/tablewriter) from 1.1.1 to 1.1.2.\n- [Commits](https://github.com/olekukonko/tablewriter/compare/v1.1.1...v1.1.2)\n\n---\nupdated-dependencies:\n- dependency-name: github.com/olekukonko/tablewriter\n  dependency-version: \n[…]\nirect:production\n  update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump github.com/olekukonko/tablewriter from 1.1.1 to 1.1…",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2025-12-01T21:34:07Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "d1a523fef52dbde71b2c0570471becab26daed48",
          "body": "Bumps [github/codeql-action](https://github.com/github/codeql-action) from 4.31.4 to 4.31.6.\n- [Release notes](https://github.com/github/codeql-action/releases)\n- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)\n- [Commits](https://github.com/github/codeql-action/compare/e\n[…]\nirect:production\n  update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump github/codeql-action from 4.31.4 to 4.31.6 (#4424)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2025-12-01T21:34:03Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "e1e3d002bcc5b758e37f1b922bf91e6938c0d255",
          "body": "Bumps [github.com/goccy/go-yaml](https://github.com/goccy/go-yaml) from 1.18.0 to 1.19.0.\n- [Release notes](https://github.com/goccy/go-yaml/releases)\n- [Changelog](https://github.com/goccy/go-yaml/blob/master/CHANGELOG.md)\n- [Commits](https://github.com/goccy/go-yaml/compare/v1.18.0...v1.19.0)\n\n---\n[…]\nirect:production\n  update-type: version-update:semver-minor\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump github.com/goccy/go-yaml from 1.18.0 to 1.19.0 (#4426)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2025-12-01T21:33:48Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "a0f71486080af21fe537096f9b90a954805aec47",
          "body": "Otherwise, we get test failures on macOS if macOS has decided to put\n.DS_Store entries in the test fixtures.\n\nSigned-off-by: Will Murphy <willmurphyscode@users.noreply.github.com>",
          "is_bot": false,
          "headline": "chore: ignore .DS_Store in test fixtures (#4422)",
          "author_name": "Will Murphy",
          "author_login": "willmurphyscode",
          "committed_at": "2025-12-01T15:15:35Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "5b96d1d69d76098778be0f8556d1a63d1050239f",
          "body": "Signed-off-by: Adam Chovanec <git@adamchovanec.cz>\nCo-authored-by: Adam Chovanec <git@adamchovanec.cz>",
          "is_bot": false,
          "headline": "chore: rename test func for CPE decoder (#4379)",
          "author_name": "Adam Chovanec",
          "author_login": "chovanecadam",
          "committed_at": "2025-11-26T04:05:31Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "6c666383e7ee605ef606d96bc7e18fca35876588",
          "body": "Bumps [anchore/sbom-action](https://github.com/anchore/sbom-action) from 0.20.9 to 0.20.10.\n- [Release notes](https://github.com/anchore/sbom-action/releases)\n- [Changelog](https://github.com/anchore/sbom-action/blob/main/RELEASE.md)\n- [Commits](https://github.com/anchore/sbom-action/compare/8e94d75\n[…]\nirect:production\n  update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump anchore/sbom-action from 0.20.9 to 0.20.10 (#4381)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2025-11-26T04:05:05Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "b9710a1e79c73562d64f4f8da703a69e06541c8f",
          "body": "Bumps [modernc.org/sqlite](https://gitlab.com/cznic/sqlite) from 1.40.0 to 1.40.1.\n- [Commits](https://gitlab.com/cznic/sqlite/compare/v1.40.0...v1.40.1)\n\n---\nupdated-dependencies:\n- dependency-name: modernc.org/sqlite\n  dependency-version: 1.40.1\n  dependency-type: direct:production\n  update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump modernc.org/sqlite from 1.40.0 to 1.40.1 (#4382)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2025-11-26T04:04:56Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "023a14f869a97d44d0148e2de5fcacbdbf40e133",
          "body": "Bumps [actions/checkout](https://github.com/actions/checkout) from 5.0.0 to 6.0.0.\n- [Release notes](https://github.com/actions/checkout/releases)\n- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)\n- [Commits](https://github.com/actions/checkout/compare/08c6903cd8c0fde910a37f8\n[…]\nirect:production\n  update-type: version-update:semver-major\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump actions/checkout from 5.0.0 to 6.0.0 (#4396)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2025-11-26T04:03:02Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "439a063d08c7b6bb6d82ffa8a46f7cb93167843f",
          "body": "… (#4397)\n\nBumps [github.com/jedib0t/go-pretty/v6](https://github.com/jedib0t/go-pretty) from 6.7.3 to 6.7.5.\n- [Release notes](https://github.com/jedib0t/go-pretty/releases)\n- [Commits](https://github.com/jedib0t/go-pretty/compare/v6.7.3...v6.7.5)\n\n---\nupdated-dependencies:\n- dependency-name: githu\n[…]\nirect:production\n  update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump github.com/jedib0t/go-pretty/v6 from 6.7.3 to 6.7.5…",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2025-11-25T15:20:59Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "c95893209d7870bcbc7015cc96b840400162db1a",
          "body": "Because package names in METADATA files may have upper case like\nWerkzeug or Jinja2, but Syft artifacts have normalized names and are\nlower case, like werkzeug or jinja2, Syft would miss emitting dependency\nrelationships. Therefore, normalize dependency names before comparing\nwith existing artifacts.\n\nSigned-off-by: Will Murphy <willmurphyscode@users.noreply.github.com>",
          "is_bot": false,
          "headline": "fix: normalize python package names from dependency lists (#4408)",
          "author_name": "Will Murphy",
          "author_login": "willmurphyscode",
          "committed_at": "2025-11-25T15:20:21Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "7e02bdfe45a4418a3842adc32a73537565df7aeb",
          "body": "Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>\nCo-authored-by: spiffcs <32073428+spiffcs@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): update tools to latest versions (#4398)",
          "author_name": "anchore-actions-token-generator[bot]",
          "author_login": "anchore-actions-token-generator[bot]",
          "committed_at": "2025-11-25T15:17:33Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "479cf5aff23b8b13ddd480d0e8082f09c10a3aec",
          "body": "Bumps [github.com/google/go-containerregistry](https://github.com/google/go-containerregistry) from 0.20.6 to 0.20.7.\n- [Release notes](https://github.com/google/go-containerregistry/releases)\n- [Changelog](https://github.com/google/go-containerregistry/blob/main/.goreleaser.yml)\n- [Commits](https:/\n[…]\nirect:production\n  update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump github.com/google/go-containerregistry (#4409)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2025-11-25T15:16:54Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "f12788da786ab83ee383722c8cbc6cdbc753a565",
          "body": "Bumps [github/codeql-action](https://github.com/github/codeql-action) from 4.31.3 to 4.31.4.\n- [Release notes](https://github.com/github/codeql-action/releases)\n- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)\n- [Commits](https://github.com/github/codeql-action/compare/0\n[…]\nirect:production\n  update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump github/codeql-action from 4.31.3 to 4.31.4 (#4386)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2025-11-20T17:40:21Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "67709362b686a08c798ca7caee36792831b0855a",
          "body": "… (#4387)\n\nBumps [github.com/jedib0t/go-pretty/v6](https://github.com/jedib0t/go-pretty) from 6.7.2 to 6.7.3.\n- [Release notes](https://github.com/jedib0t/go-pretty/releases)\n- [Commits](https://github.com/jedib0t/go-pretty/compare/v6.7.2...v6.7.3)\n\n---\nupdated-dependencies:\n- dependency-name: githu\n[…]\nirect:production\n  update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump github.com/jedib0t/go-pretty/v6 from 6.7.2 to 6.7.3…",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2025-11-20T17:01:21Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "55526dbde0a420e418f6c3809b0f10d48fbc331c",
          "body": "Bumps [golang.org/x/crypto](https://github.com/golang/crypto) from 0.44.0 to 0.45.0.\n- [Commits](https://github.com/golang/crypto/compare/v0.44.0...v0.45.0)\n\n---\nupdated-dependencies:\n- dependency-name: golang.org/x/crypto\n  dependency-version: 0.45.0\n  dependency-type: indirect\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump golang.org/x/crypto from 0.44.0 to 0.45.0 (#4391)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2025-11-20T17:01:05Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "af167ba0c127459dfefa6e83779ed6ddd5604ee4",
          "body": "Bumps [actions/setup-go](https://github.com/actions/setup-go) from 6.0.0 to 6.1.0.\n- [Release notes](https://github.com/actions/setup-go/releases)\n- [Commits](https://github.com/actions/setup-go/compare/44694675825211faa026b3c33043df3e48a5fa00...4dc6199c7b1a012772edbd06daecab0f50c9053c)\n\n---\nupdated\n[…]\nirect:production\n  update-type: version-update:semver-minor\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump actions/setup-go from 6.0.0 to 6.1.0 (#4392)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2025-11-20T17:00:56Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "00e1329bd1e47c818fc71c5bbfa936d52f5dfe3f",
          "body": "Bumps [actions/setup-go](https://github.com/actions/setup-go) from 6.0.0 to 6.1.0.\n- [Release notes](https://github.com/actions/setup-go/releases)\n- [Commits](https://github.com/actions/setup-go/compare/44694675825211faa026b3c33043df3e48a5fa00...4dc6199c7b1a012772edbd06daecab0f50c9053c)\n\n---\nupdated\n[…]\nirect:production\n  update-type: version-update:semver-minor\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump actions/setup-go in /.github/actions/bootstrap (#4393)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2025-11-20T17:00:44Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "9aca8167b8530bc951e9570c9f4bb53955dda225",
          "body": "---------\nSigned-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com>",
          "is_bot": false,
          "headline": "chore: drop cpe from gguf (#4383)",
          "author_name": "Christopher Angelo Phillips",
          "author_login": "spiffcs",
          "committed_at": "2025-11-19T10:37:40Z",
          "body_truncated": false,
          "is_coding_agent": false
        }
      ],
      "releases_count": 1,
      "commits_last_year": 293,
      "latest_release_at": "2024-11-20T14:13:53Z",
      "latest_release_tag": "v0.0.0",
      "releases_from_tags": false,
      "days_since_last_push": 196,
      "active_weeks_last_year": 23,
      "days_since_latest_release": 611,
      "mean_days_between_releases": null
    },
    "community": {
      "has_readme": false,
      "has_license": false,
      "has_description": false,
      "has_contributing": false,
      "health_percentage": null,
      "has_issue_template": false,
      "has_code_of_conduct": false,
      "has_pull_request_template": false
    },
    "ecosystem": {
      "packages": [
        {
          "name": "github.com/anchore/syft",
          "exists": true,
          "license": null,
          "keywords": [],
          "ecosystem": "go",
          "matches_repo": false,
          "registry_url": "https://pkg.go.dev/github.com/anchore/syft",
          "is_deprecated": false,
          "latest_version": "v1.49.0",
          "repository_url": "https://github.com/anchore/syft",
          "versions_count": 268,
          "total_downloads": null,
          "dependents_count": null,
          "deprecation_note": null,
          "maintainers_count": null,
          "monthly_downloads": null,
          "first_published_at": null,
          "latest_published_at": "2026-07-20T18:04:57Z",
          "latest_version_yanked": null,
          "days_since_latest_publish": 4
        }
      ]
    },
    "popularity": {
      "forks": 1,
      "stars": 3,
      "watchers": 0,
      "fork_history": {
        "days": [
          {
            "date": "2021-12-13",
            "count": 1
          }
        ],
        "complete": true,
        "collected": 1,
        "total_forks": 1
      },
      "star_history": null,
      "open_issues_and_prs": 0
    },
    "ai_readiness": {
      "has_nix": false,
      "example_dirs": [
        "example",
        "examples",
        "sample"
      ],
      "has_llms_txt": false,
      "has_dockerfile": true,
      "has_mcp_signal": false,
      "bootstrap_files": [
        "Makefile",
        "Taskfile.yaml",
        "cmd/syft/internal/test/integration/test-fixtures/Makefile",
        "schema/cyclonedx/Makefile",
        "syft/file/cataloger/executable/test-fixtures/Makefile",
        "syft/file/cataloger/executable/test-fixtures/elf/Makefile",
        "syft/file/cataloger/executable/test-fixtures/elf/project/Makefile",
        "syft/file/cataloger/executable/test-fixtures/shared-info/Makefile",
        "syft/file/cataloger/executable/test-fixtures/shared-info/project/Makefile",
        "syft/file/cataloger/executable/test-fixtures/shared-info/project/hello/Makefile",
        "syft/file/cataloger/executable/test-fixtures/shared-info/project/libhello/Makefile",
        "syft/pkg/cataloger/binary/test-fixtures/Makefile",
        "syft/pkg/cataloger/binary/test-fixtures/elf-test-fixtures/elfbinwithcorrupt/elfsrc/makefile",
        "syft/pkg/cataloger/binary/test-fixtures/elf-test-fixtures/elfbinwithcorrupt/makefile",
        "syft/pkg/cataloger/binary/test-fixtures/elf-test-fixtures/elfbinwithnestedlib/elfsrc/makefile",
        "syft/pkg/cataloger/binary/test-fixtures/elf-test-fixtures/elfbinwithnestedlib/makefile",
        "syft/pkg/cataloger/binary/test-fixtures/elf-test-fixtures/elfbinwithsisterlib/elfsrc1/makefile",
        "syft/pkg/cataloger/binary/test-fixtures/elf-test-fixtures/elfbinwithsisterlib/elfsrc2/makefile",
        "syft/pkg/cataloger/binary/test-fixtures/elf-test-fixtures/elfbinwithsisterlib/makefile",
        "syft/pkg/cataloger/dotnet/test-fixtures/Makefile",
        "syft/pkg/cataloger/golang/test-fixtures/Makefile",
        "syft/pkg/cataloger/golang/test-fixtures/archs/Makefile",
        "syft/pkg/cataloger/internal/pe/test-fixtures/Makefile",
        "syft/pkg/cataloger/java/test-fixtures/Makefile",
        "syft/pkg/cataloger/java/test-fixtures/jar-metadata/Makefile",
        "syft/pkg/cataloger/java/test-fixtures/java-builds/Makefile",
        "syft/pkg/cataloger/kernel/test-fixtures/Makefile",
        "syft/pkg/cataloger/redhat/test-fixtures/Makefile",
        "test/cli/test-fixtures/Makefile",
        "test/cli/test-fixtures/image-java-spdx-tools/Makefile",
        "test/cli/test-fixtures/registry/Makefile",
        "test/install/Makefile"
      ],
      "api_schema_files": [],
      "has_devcontainer": false,
      "typecheck_configs": [],
      "toolchain_manifests": [
        "cmd/syft/internal/test/integration/test-fixtures/image-go-bin-arch-coverage/go.mod",
        "cmd/syft/internal/test/integration/test-fixtures/image-pkg-coverage/pkgs/go/go.mod",
        "cmd/syft/internal/test/integration/test-fixtures/image-pkg-coverage/pkgs/java/pom.xml",
        "cmd/syft/internal/test/integration/test-fixtures/image-sbom-cataloger/go.mod",
        "go.mod",
        "syft/pkg/cataloger/dotnet/test-fixtures/image-net2-app/src/helloworld.csproj",
        "syft/pkg/cataloger/dotnet/test-fixtures/image-net6-asp-libman/src/LibManSample.csproj",
        "syft/pkg/cataloger/dotnet/test-fixtures/image-net8-app-no-depjson/src/dotnetapp.csproj",
        "syft/pkg/cataloger/dotnet/test-fixtures/image-net8-app-self-contained/src/dotnetapp.csproj",
        "syft/pkg/cataloger/dotnet/test-fixtures/image-net8-app-single-file/src/dotnetapp.csproj",
        "syft/pkg/cataloger/dotnet/test-fixtures/image-net8-app-with-runtime-nodepsjson/src/dotnetapp.csproj",
        "syft/pkg/cataloger/dotnet/test-fixtures/image-net8-app-with-runtime/src/dotnetapp.csproj",
        "syft/pkg/cataloger/dotnet/test-fixtures/image-net8-app/src/dotnetapp.csproj",
        "syft/pkg/cataloger/dotnet/test-fixtures/image-net8-compile-target/src/helloworld.csproj",
        "syft/pkg/cataloger/dotnet/test-fixtures/image-net8-ilrepack/src/dotnetapp.csproj",
        "syft/pkg/cataloger/dotnet/test-fixtures/image-net8-privateassets/src/dotnetapp.csproj",
        "syft/pkg/cataloger/golang/test-fixtures/archs/src/go.mod",
        "syft/pkg/cataloger/golang/test-fixtures/corrupt/go.mod",
        "syft/pkg/cataloger/golang/test-fixtures/glob-paths/src/go.mod",
        "syft/pkg/cataloger/golang/test-fixtures/go-mod-fixtures/many-packages/go.mod",
        "syft/pkg/cataloger/golang/test-fixtures/go-mod-fixtures/one-package/go.mod",
        "syft/pkg/cataloger/golang/test-fixtures/go-mod-fixtures/relative-replace/go.mod",
        "syft/pkg/cataloger/golang/test-fixtures/go-source/go.mod",
        "syft/pkg/cataloger/golang/test-fixtures/go-sum-hashes/go.mod",
        "syft/pkg/cataloger/golang/test-fixtures/image-not-a-module/go.mod",
        "syft/pkg/cataloger/golang/test-fixtures/image-small-upx/go.mod",
        "syft/pkg/cataloger/golang/test-fixtures/image-small/go.mod",
        "syft/pkg/cataloger/internal/pe/test-fixtures/image-dotnet31-single-file/src/hello.csproj",
        "syft/pkg/cataloger/internal/pe/test-fixtures/image-dotnet5-single-file/src/hello.csproj",
        "syft/pkg/cataloger/internal/pe/test-fixtures/image-dotnet6-single-file/src/hello.csproj",
        "syft/pkg/cataloger/java/internal/maven/test-fixtures/local/child-1/pom.xml",
        "syft/pkg/cataloger/java/internal/maven/test-fixtures/local/child-2/pom.xml",
        "syft/pkg/cataloger/java/internal/maven/test-fixtures/local/child-3/pom.xml",
        "syft/pkg/cataloger/java/internal/maven/test-fixtures/local/circular-1/pom.xml",
        "syft/pkg/cataloger/java/internal/maven/test-fixtures/local/circular-2/pom.xml",
        "syft/pkg/cataloger/java/internal/maven/test-fixtures/local/contains-child-1/pom.xml",
        "syft/pkg/cataloger/java/internal/maven/test-fixtures/local/parent-1/pom.xml",
        "syft/pkg/cataloger/java/internal/maven/test-fixtures/local/parent-2/pom.xml",
        "syft/pkg/cataloger/java/internal/maven/test-fixtures/local/parent-3/pom.xml",
        "syft/pkg/cataloger/java/test-fixtures/corrupt/pom.xml",
        "syft/pkg/cataloger/java/test-fixtures/glob-paths/src/pom.xml",
        "syft/pkg/cataloger/java/test-fixtures/gradle/build.gradle",
        "syft/pkg/cataloger/java/test-fixtures/jar-metadata/api-all-2.0.0-sources/META-INF/maven/org.apache.directory.api/api-all/pom.xml",
        "syft/pkg/cataloger/java/test-fixtures/jar-metadata/api-all-2.0.0-sources/META-INF/maven/org.apache.directory.api/api-asn1-api/pom.xml",
        "syft/pkg/cataloger/java/test-fixtures/jar-metadata/com.fasterxml.jackson.core.jackson-core-2.15.2/META-INF/maven/com.fasterxml.jackson.core/jackson-core/pom.xml",
        "syft/pkg/cataloger/java/test-fixtures/jar-metadata/commons-lang3-3.12.0/META-INF/maven/org.apache.commons-lang3/pom.xml",
        "syft/pkg/cataloger/java/test-fixtures/jar-metadata/jackson-core-2.15.2/META-INF/maven/com.fasterxml.jackson.core/jackson-core/pom.xml",
        "syft/pkg/cataloger/java/test-fixtures/jar-metadata/micronaut-aop-4.9.11/META-INF/maven/io.micronaut/micronaut-aop/pom.xml",
        "syft/pkg/cataloger/java/test-fixtures/jar-metadata/multiple-matching-2.11.5/META-INF/maven/org.multiple/multiple-matching-1/pom.xml",
        "syft/pkg/cataloger/java/test-fixtures/jar-metadata/multiple-matching-2.11.5/META-INF/maven/org.multiple/multiple-matching-2/pom.xml",
        "syft/pkg/cataloger/java/test-fixtures/jar-metadata/multiple-matching-2.11.5/META-INF/maven/org.multiple/multiple-matching-3/pom.xml",
        "syft/pkg/cataloger/java/test-fixtures/jar-metadata/opensaml-core-3.4.6/META-INF/maven/org.opensaml/opensaml-core/pom.xml",
        "syft/pkg/cataloger/java/test-fixtures/jar-metadata/org.multiple-thename/META-INF/maven/com.multiple/thename/pom.xml",
        "syft/pkg/cataloger/java/test-fixtures/jar-metadata/org.multiple-thename/META-INF/maven/org.multiple/thename/pom.xml",
        "syft/pkg/cataloger/java/test-fixtures/java-builds/example-java-app/build.gradle",
        "syft/pkg/cataloger/java/test-fixtures/java-builds/example-java-app/pom.xml",
        "syft/pkg/cataloger/java/test-fixtures/java-builds/example-jenkins-plugin/pom.xml",
        "syft/pkg/cataloger/java/test-fixtures/java-builds/example-sb-app/pom.xml",
        "syft/pkg/cataloger/java/test-fixtures/pom/commons-text-1.10.0/pom.xml",
        "syft/pkg/cataloger/java/test-fixtures/pom/example-java-app-maven/pom.xml",
        "syft/pkg/cataloger/java/test-fixtures/pom/transitive-top-level/pom.xml",
        "syft/pkg/cataloger/rust/test-fixtures/image-audit/Cargo.toml"
      ],
      "largest_source_bytes": 212636,
      "source_files_sampled": 1181,
      "oversized_source_files": 6,
      "agent_instruction_files": [],
      "agent_instruction_max_bytes": null
    },
    "dependencies": {
      "manifests": [
        "go.mod"
      ],
      "advisories": {
        "error": null,
        "scope": "repository_graph",
        "source": "osv",
        "findings": [
          {
            "name": "golang.org/x/crypto",
            "direct": false,
            "version": "v0.46.0",
            "severity": "critical",
            "ecosystem": "go",
            "cvss_score": 10,
            "advisory_ids": [
              "GHSA-45gg-vh54-h5m9",
              "GHSA-5cgq-3rg8-m6cv",
              "GHSA-78mq-xcr3-xm33",
              "GHSA-89gr-r52h-f8rx",
              "GHSA-9m57-25v3-79x9",
              "GHSA-f5wc-c3c7-36mc",
              "GHSA-jppx-rxg9-jmrx",
              "GHSA-q4h4-gmj2-qvw2",
              "GHSA-qpw4-5x99-6vjp",
              "GHSA-rm3j-f69w-wqmq"
            ],
            "fixed_version": "0.52.0",
            "advisory_count": 27,
            "oldest_advisory_days": 64
          },
          {
            "name": "google.golang.org/grpc",
            "direct": false,
            "version": "v1.76.0",
            "severity": "critical",
            "ecosystem": "go",
            "cvss_score": 9.1,
            "advisory_ids": [
              "GHSA-hrxh-6v49-42gf",
              "GHSA-p77j-4mvh-x3m3",
              "GO-2026-4762"
            ],
            "fixed_version": "1.82.1",
            "advisory_count": 3,
            "oldest_advisory_days": 128
          },
          {
            "name": "h11",
            "direct": false,
            "version": "0.14.0",
            "severity": "critical",
            "ecosystem": "pypi",
            "cvss_score": 9.1,
            "advisory_ids": [
              "GHSA-vqfr-h8mv-ghfj",
              "PYSEC-2026-348"
            ],
            "fixed_version": "0.16.0",
            "advisory_count": 2,
            "oldest_advisory_days": 456
          },
          {
            "name": "pygments",
            "direct": false,
            "version": "1.6",
            "severity": "critical",
            "ecosystem": "pypi",
            "cvss_score": 9.8,
            "advisory_ids": [
              "GHSA-5239-wwwm-4pmq",
              "GHSA-9w8r-397f-prfh",
              "GHSA-fff8-4w9p-7v76",
              "GHSA-mrwq-x4v8-fh7p",
              "GHSA-pq64-v7f5-gqh8",
              "PYSEC-2016-32",
              "PYSEC-2021-140",
              "PYSEC-2021-141",
              "PYSEC-2023-117",
              "PYSEC-2026-2987"
            ],
            "fixed_version": "2.20.0",
            "advisory_count": 10,
            "oldest_advisory_days": 3850
          },
          {
            "name": "github.com/go-git/go-billy/v5",
            "direct": true,
            "version": "v5.7.0",
            "severity": "high",
            "ecosystem": "go",
            "cvss_score": 8.1,
            "advisory_ids": [
              "GHSA-m3xc-h892-ggx6",
              "GHSA-qw64-3x98-g7q2",
              "GO-2026-5490",
              "GO-2026-5597"
            ],
            "fixed_version": "6.0.0-alpha.1",
            "advisory_count": 4,
            "oldest_advisory_days": 72
          },
          {
            "name": "github.com/hashicorp/go-getter",
            "direct": true,
            "version": "v1.8.4",
            "severity": "high",
            "ecosystem": "go",
            "cvss_score": 7.5,
            "advisory_ids": [
              "GHSA-92mm-2pjq-r785",
              "GO-2026-5058"
            ],
            "fixed_version": "1.8.6",
            "advisory_count": 2,
            "oldest_advisory_days": 106
          },
          {
            "name": "aws-sdk",
            "direct": false,
            "version": "2.706.0",
            "severity": "high",
            "ecosystem": "npm",
            "cvss_score": 7.3,
            "advisory_ids": [
              "GHSA-j965-2qgj-vjmq",
              "GHSA-rrc9-gqf8-8rwg"
            ],
            "fixed_version": "2.814.0",
            "advisory_count": 2,
            "oldest_advisory_days": 1711
          },
          {
            "name": "brotli",
            "direct": false,
            "version": "1.1.0",
            "severity": "high",
            "ecosystem": "pypi",
            "cvss_score": 7.5,
            "advisory_ids": [
              "GHSA-2qfp-q593-8484",
              "PYSEC-2026-2401"
            ],
            "fixed_version": "2.13.4",
            "advisory_count": 2,
            "oldest_advisory_days": 267
          },
          {
            "name": "click",
            "direct": false,
            "version": "7.1.2",
            "severity": "high",
            "ecosystem": "pypi",
            "cvss_score": 7.2,
            "advisory_ids": [
              "PYSEC-2026-2132"
            ],
            "fixed_version": "8.3.3",
            "advisory_count": 1,
            "oldest_advisory_days": 85
          },
          {
            "name": "click",
            "direct": false,
            "version": "8.1.8",
            "severity": "high",
            "ecosystem": "pypi",
            "cvss_score": 7.2,
            "advisory_ids": [
              "PYSEC-2026-2132"
            ],
            "fixed_version": "8.3.3",
            "advisory_count": 1,
            "oldest_advisory_days": 85
          },
          {
            "name": "github.com/buger/jsonparser",
            "direct": false,
            "version": "v1.1.1",
            "severity": "high",
            "ecosystem": "go",
            "cvss_score": 7.5,
            "advisory_ids": [
              "GHSA-6g7g-w4f8-9c9x",
              "GO-2026-4514"
            ],
            "fixed_version": "1.1.2",
            "advisory_count": 2,
            "oldest_advisory_days": 130
          },
          {
            "name": "github.com/containerd/containerd",
            "direct": false,
            "version": "v1.7.30",
            "severity": "high",
            "ecosystem": "go",
            "cvss_score": 8.8,
            "advisory_ids": [
              "GHSA-fqw6-gf59-qr4w",
              "GHSA-jpcc-p29g-p8mq",
              "GHSA-xhf5-7wjv-pqxp",
              "GO-2026-5064",
              "GO-2026-5338",
              "GO-2026-5378",
              "GO-2026-5475",
              "GO-2026-5622",
              "GO-2026-5758"
            ],
            "fixed_version": "2.3.2",
            "advisory_count": 9,
            "oldest_advisory_days": 64
          },
          {
            "name": "github.com/docker/cli",
            "direct": false,
            "version": "v29.1.3+incompatible",
            "severity": "high",
            "ecosystem": "go",
            "cvss_score": null,
            "advisory_ids": [
              "GHSA-p436-gjf2-799p",
              "GO-2026-4610"
            ],
            "fixed_version": "29.2.0+incompatible",
            "advisory_count": 2,
            "oldest_advisory_days": 142
          },
          {
            "name": "github.com/docker/docker",
            "direct": false,
            "version": "v28.5.2+incompatible",
            "severity": "high",
            "ecosystem": "go",
            "cvss_score": 8.8,
            "advisory_ids": [
              "GHSA-pxq6-2prw-chj9",
              "GHSA-rg2x-37c3-w2rh",
              "GHSA-vp62-88p7-qqf5",
              "GHSA-x744-4wpc-v9h2",
              "GHSA-x86f-5xw2-fm2r",
              "GO-2026-4883",
              "GO-2026-4887",
              "GO-2026-5617",
              "GO-2026-5668",
              "GO-2026-5746"
            ],
            "fixed_version": "29.3.1",
            "advisory_count": 10,
            "oldest_advisory_days": 119
          },
          {
            "name": "github.com/go-jose/go-jose/v4",
            "direct": false,
            "version": "v4.1.2",
            "severity": "high",
            "ecosystem": "go",
            "cvss_score": 7.5,
            "advisory_ids": [
              "GHSA-78h2-9frx-2jm8",
              "GO-2026-4945"
            ],
            "fixed_version": "4.1.4",
            "advisory_count": 2,
            "oldest_advisory_days": 113
          },
          {
            "name": "go.opentelemetry.io/otel",
            "direct": false,
            "version": "v1.39.0",
            "severity": "high",
            "ecosystem": "go",
            "cvss_score": 7.5,
            "advisory_ids": [
              "GHSA-mh2q-q3fh-2475",
              "GO-2026-5506"
            ],
            "fixed_version": "1.41.0",
            "advisory_count": 2,
            "oldest_advisory_days": 108
          },
          {
            "name": "go.opentelemetry.io/otel/sdk",
            "direct": false,
            "version": "v1.39.0",
            "severity": "high",
            "ecosystem": "go",
            "cvss_score": 7,
            "advisory_ids": [
              "GHSA-9h8m-3fm2-qjrq",
              "GHSA-hfvc-g4fc-pqhx",
              "GO-2026-4394",
              "GO-2026-5426"
            ],
            "fixed_version": "1.43.0",
            "advisory_count": 4,
            "oldest_advisory_days": 172
          },
          {
            "name": "orjson",
            "direct": false,
            "version": "3.10.16",
            "severity": "high",
            "ecosystem": "pypi",
            "cvss_score": 7.5,
            "advisory_ids": [
              "GHSA-hx9q-6w63-j58v",
              "PYSEC-2026-107"
            ],
            "fixed_version": "3.11.6",
            "advisory_count": 2,
            "oldest_advisory_days": 183
          },
          {
            "name": "python-multipart",
            "direct": false,
            "version": "0.0.20",
            "severity": "high",
            "ecosystem": "pypi",
            "cvss_score": 8.6,
            "advisory_ids": [
              "GHSA-5rvq-cxj2-64vf",
              "GHSA-6jv3-5f52-599m",
              "GHSA-mj87-hwqh-73pj",
              "GHSA-pp6c-gr5w-3c5g",
              "GHSA-v9pg-7xvm-68hf",
              "GHSA-vffw-93wf-4j4q",
              "GHSA-wp53-j4wj-2cfg",
              "PYSEC-2026-1852",
              "PYSEC-2026-3036",
              "PYSEC-2026-3037"
            ],
            "fixed_version": "0.0.31",
            "advisory_count": 14,
            "oldest_advisory_days": 179
          },
          {
            "name": "starlette",
            "direct": false,
            "version": "0.37.2",
            "severity": "high",
            "ecosystem": "pypi",
            "cvss_score": 7.5,
            "advisory_ids": [
              "GHSA-2c2j-9gv5-cj73",
              "GHSA-82w8-qh3p-5jfq",
              "GHSA-86qp-5c8j-p5mr",
              "GHSA-f96h-pmfr-66vw",
              "GHSA-jp82-jpqv-5vv3",
              "GHSA-wqp7-x3pw-xc5r",
              "GHSA-x746-7m8f-x49c",
              "PYSEC-2026-161",
              "PYSEC-2026-1941",
              "PYSEC-2026-1943"
            ],
            "fixed_version": "1.3.1",
            "advisory_count": 14,
            "oldest_advisory_days": 647
          },
          {
            "name": "ujson",
            "direct": false,
            "version": "5.10.0",
            "severity": "high",
            "ecosystem": "pypi",
            "cvss_score": 7.5,
            "advisory_ids": [
              "GHSA-3j69-69wj-xqx2",
              "GHSA-c38f-wx89-p2xg",
              "GHSA-c8rr-9gxc-jprv",
              "GHSA-wgvc-ghv9-3pmm",
              "PYSEC-2026-2291",
              "PYSEC-2026-2292",
              "PYSEC-2026-2293",
              "PYSEC-2026-2294"
            ],
            "fixed_version": "5.13.0",
            "advisory_count": 8,
            "oldest_advisory_days": 128
          },
          {
            "name": "urllib3",
            "direct": false,
            "version": "2.3.0",
            "severity": "high",
            "ecosystem": "pypi",
            "cvss_score": 7.5,
            "advisory_ids": [
              "GHSA-2xpw-w6gg-jr37",
              "GHSA-38jv-5279-wg99",
              "GHSA-48p4-8xcf-vxj5",
              "GHSA-gm62-xv2j-4w53",
              "GHSA-pq67-6m6q-mj2v",
              "GHSA-qccp-gfcp-xxvc",
              "PYSEC-2026-141",
              "PYSEC-2026-1994",
              "PYSEC-2026-1996",
              "PYSEC-2026-1997"
            ],
            "fixed_version": "2.7.0",
            "advisory_count": 12,
            "oldest_advisory_days": 401
          },
          {
            "name": "github.com/anchore/stereoscope",
            "direct": true,
            "version": "v0.0.0-20200706164556-7cf39d7f4639",
            "severity": "moderate",
            "ecosystem": "go",
            "cvss_score": 5.3,
            "advisory_ids": [
              "GHSA-hpxr-w9w7-g4gv",
              "GO-2024-2490"
            ],
            "fixed_version": "0.0.1",
            "advisory_count": 2,
            "oldest_advisory_days": 905
          },
          {
            "name": "github.com/go-git/go-git/v5",
            "direct": true,
            "version": "v5.16.4",
            "severity": "moderate",
            "ecosystem": "go",
            "cvss_score": 6.5,
            "advisory_ids": [
              "GHSA-37cx-329c-33x3",
              "GHSA-389r-gv7p-r3rp",
              "GHSA-3xc5-wrhm-f963",
              "GHSA-crhj-59gh-8x96",
              "GHSA-gm2x-2g9h-ccm8",
              "GHSA-jhf3-xxhw-2wpp",
              "GHSA-m7cr-m3pv-hgrp",
              "GHSA-w5pp-99ch-qj29",
              "GO-2026-4473",
              "GO-2026-4909"
            ],
            "fixed_version": "6.0.0-alpha.4",
            "advisory_count": 16,
            "oldest_advisory_days": 165
          },
          {
            "name": "github.com/go-viper/mapstructure/v2",
            "direct": true,
            "version": "v2.2.1",
            "severity": "moderate",
            "ecosystem": "go",
            "cvss_score": 5.3,
            "advisory_ids": [
              "GHSA-2464-8j7c-4cjm",
              "GHSA-fv92-fjc5-jj9h",
              "GO-2025-3787",
              "GO-2025-3900"
            ],
            "fixed_version": "2.4.0",
            "advisory_count": 4,
            "oldest_advisory_days": 392
          },
          {
            "name": "github.com/ulikunitz/xz",
            "direct": true,
            "version": "v0.5.12",
            "severity": "moderate",
            "ecosystem": "go",
            "cvss_score": 5.3,
            "advisory_ids": [
              "GHSA-jc7w-c686-c4v9",
              "GO-2025-3922"
            ],
            "fixed_version": "0.5.15",
            "advisory_count": 2,
            "oldest_advisory_days": 330
          },
          {
            "name": "golang.org/x/net",
            "direct": true,
            "version": "v0.48.0",
            "severity": "moderate",
            "ecosystem": "go",
            "cvss_score": 6.5,
            "advisory_ids": [
              "GHSA-5cv4-jp36-h3mw",
              "GO-2026-4918",
              "GO-2026-5025",
              "GO-2026-5026",
              "GO-2026-5027",
              "GO-2026-5028",
              "GO-2026-5029",
              "GO-2026-5030",
              "GO-2026-5942"
            ],
            "fixed_version": "1.26.3",
            "advisory_count": 9,
            "oldest_advisory_days": 78
          },
          {
            "name": "ajv",
            "direct": false,
            "version": "6.12.3",
            "severity": "moderate",
            "ecosystem": "npm",
            "cvss_score": 5.3,
            "advisory_ids": [
              "GHSA-2g4f-4pwh-qvx6"
            ],
            "fixed_version": "8.18.0",
            "advisory_count": 1,
            "oldest_advisory_days": 163
          },
          {
            "name": "github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream",
            "direct": false,
            "version": "v1.7.4",
            "severity": "moderate",
            "ecosystem": "go",
            "cvss_score": 5.9,
            "advisory_ids": [
              "GHSA-xmrv-pmrh-hhx2",
              "GO-2026-5764"
            ],
            "fixed_version": "1.97.3",
            "advisory_count": 2,
            "oldest_advisory_days": 108
          },
          {
            "name": "github.com/aws/aws-sdk-go-v2/service/s3",
            "direct": false,
            "version": "v1.95.0",
            "severity": "moderate",
            "ecosystem": "go",
            "cvss_score": 5.9,
            "advisory_ids": [
              "GHSA-xmrv-pmrh-hhx2",
              "GO-2026-5764"
            ],
            "fixed_version": "1.97.3",
            "advisory_count": 2,
            "oldest_advisory_days": 108
          },
          {
            "name": "github.com/cloudflare/circl",
            "direct": false,
            "version": "v1.6.1",
            "severity": "moderate",
            "ecosystem": "go",
            "cvss_score": 5.6,
            "advisory_ids": [
              "GHSA-q9hv-hpm4-hj6x",
              "GO-2026-4550"
            ],
            "fixed_version": "1.6.3",
            "advisory_count": 2,
            "oldest_advisory_days": 149
          },
          {
            "name": "github.com/nwaples/rardecode",
            "direct": false,
            "version": "v1.1.3",
            "severity": "moderate",
            "ecosystem": "go",
            "cvss_score": 5.3,
            "advisory_ids": [
              "GHSA-rwvp-r38j-9rgg",
              "GO-2025-4020"
            ],
            "fixed_version": "2.2.0",
            "advisory_count": 2,
            "oldest_advisory_days": 287
          },
          {
            "name": "idna",
            "direct": false,
            "version": "3.10",
            "severity": "moderate",
            "ecosystem": "pypi",
            "cvss_score": 5.3,
            "advisory_ids": [
              "GHSA-65pc-fj4g-8rjx",
              "PYSEC-2026-215"
            ],
            "fixed_version": "3.15",
            "advisory_count": 2,
            "oldest_advisory_days": 66
          },
          {
            "name": "nanoid",
            "direct": false,
            "version": "3.3.4",
            "severity": "moderate",
            "ecosystem": "npm",
            "cvss_score": 4.3,
            "advisory_ids": [
              "GHSA-mwcw-c2x4-8c55"
            ],
            "fixed_version": "5.0.9",
            "advisory_count": 1,
            "oldest_advisory_days": 593
          },
          {
            "name": "python-dotenv",
            "direct": false,
            "version": "1.1.0",
            "severity": "moderate",
            "ecosystem": "pypi",
            "cvss_score": 6.6,
            "advisory_ids": [
              "GHSA-mf9w-mj56-hr94",
              "PYSEC-2026-2270"
            ],
            "fixed_version": "1.2.2",
            "advisory_count": 2,
            "oldest_advisory_days": 95
          },
          {
            "name": "requests",
            "direct": false,
            "version": "2.32.3",
            "severity": "moderate",
            "ecosystem": "pypi",
            "cvss_score": 5.5,
            "advisory_ids": [
              "GHSA-9hjg-9r4m-mvj7",
              "GHSA-gc5v-m9x4-r6x2",
              "PYSEC-2026-1872",
              "PYSEC-2026-2275"
            ],
            "fixed_version": "2.33.0",
            "advisory_count": 4,
            "oldest_advisory_days": 410
          },
          {
            "name": "h2",
            "direct": false,
            "version": "4.2.0",
            "severity": "low",
            "ecosystem": "pypi",
            "cvss_score": 0,
            "advisory_ids": [
              "GHSA-847f-9342-265h",
              "PYSEC-2026-1435"
            ],
            "fixed_version": "4.3.0",
            "advisory_count": 2,
            "oldest_advisory_days": 333
          },
          {
            "name": "merge-objects",
            "direct": false,
            "version": "1.0.5",
            "severity": "low",
            "ecosystem": "npm",
            "cvss_score": null,
            "advisory_ids": [
              "GHSA-992f-wf4w-x36v"
            ],
            "fixed_version": null,
            "advisory_count": 1,
            "oldest_advisory_days": 2152
          },
          {
            "name": "pygments",
            "direct": false,
            "version": "2.19.1",
            "severity": "low",
            "ecosystem": "pypi",
            "cvss_score": 3.3,
            "advisory_ids": [
              "GHSA-5239-wwwm-4pmq",
              "PYSEC-2026-2987"
            ],
            "fixed_version": "2.20.0",
            "advisory_count": 2,
            "oldest_advisory_days": 125
          },
          {
            "name": "golang.org/x/sys",
            "direct": false,
            "version": "v0.33.0",
            "severity": "unknown",
            "ecosystem": "go",
            "cvss_score": null,
            "advisory_ids": [
              "GO-2026-5024"
            ],
            "fixed_version": "0.44.0",
            "advisory_count": 1,
            "oldest_advisory_days": 63
          },
          {
            "name": "golang.org/x/sys",
            "direct": false,
            "version": "v0.39.0",
            "severity": "unknown",
            "ecosystem": "go",
            "cvss_score": null,
            "advisory_ids": [
              "GO-2026-5024"
            ],
            "fixed_version": "0.44.0",
            "advisory_count": 1,
            "oldest_advisory_days": 63
          },
          {
            "name": "golang.org/x/text",
            "direct": false,
            "version": "v0.21.0",
            "severity": "unknown",
            "ecosystem": "go",
            "cvss_score": null,
            "advisory_ids": [
              "GO-2026-5970"
            ],
            "fixed_version": "0.39.0",
            "advisory_count": 1,
            "oldest_advisory_days": 10
          },
          {
            "name": "golang.org/x/text",
            "direct": false,
            "version": "v0.32.0",
            "severity": "unknown",
            "ecosystem": "go",
            "cvss_score": null,
            "advisory_ids": [
              "GO-2026-5970"
            ],
            "fixed_version": "0.39.0",
            "advisory_count": 1,
            "oldest_advisory_days": 10
          }
        ],
        "collected": true,
        "malicious": [],
        "truncated": false,
        "by_severity": {
          "low": 3,
          "high": 18,
          "unknown": 4,
          "critical": 4,
          "moderate": 14
        },
        "advisory_count": 195,
        "affected_count": 43,
        "assessed_count": 428,
        "malicious_count": 0,
        "assessed_package": null,
        "unassessed_count": 1,
        "direct_affected_count": 7
      },
      "ecosystems": [
        "go"
      ],
      "dependencies": [
        {
          "name": "github.com/BurntSushi/toml",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.6.0"
        },
        {
          "name": "github.com/CycloneDX/cyclonedx-go",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.9.3"
        },
        {
          "name": "github.com/Masterminds/semver/v3",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v3.4.0"
        },
        {
          "name": "github.com/Masterminds/sprig/v3",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v3.3.0"
        },
        {
          "name": "github.com/OneOfOne/xxhash",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.2.8"
        },
        {
          "name": "github.com/acarl005/stripansi",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.0.0-20180116102854-5a71ef0e047d"
        },
        {
          "name": "github.com/acobaugh/osrelease",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.1.0"
        },
        {
          "name": "github.com/adrg/xdg",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.5.3"
        },
        {
          "name": "github.com/anchore/bubbly",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.0.0-20231115134915-def0aba654a9"
        },
        {
          "name": "github.com/anchore/clio",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.0.0-20250319180342-2cfe4b0cb716"
        },
        {
          "name": "github.com/anchore/fangs",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.0.0-20250319222917-446a1e748ec2"
        },
        {
          "name": "github.com/anchore/go-collections",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.0.0-20251016125210-a3c352120e8c"
        },
        {
          "name": "github.com/anchore/go-homedir",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.0.0-20250319154043-c29668562e4d"
        },
        {
          "name": "github.com/anchore/go-logger",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.0.0-20250318195838-07ae343dd722"
        },
        {
          "name": "github.com/anchore/go-macholibre",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.0.0-20220308212642-53e6d0aaf6fb"
        },
        {
          "name": "github.com/anchore/go-rpmdb",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.0.0-20250516171929-f77691e1faec"
        },
        {
          "name": "github.com/anchore/go-sync",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.0.0-20250326131806-4eda43a485b6"
        },
        {
          "name": "github.com/anchore/go-testutils",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.0.0-20200925183923-d5f45b0d3c04"
        },
        {
          "name": "github.com/anchore/go-version",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.2.2-0.20200701162849-18adb9c92b9b"
        },
        {
          "name": "github.com/anchore/packageurl-go",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.1.1-0.20250220190351-d62adb6e1115"
        },
        {
          "name": "github.com/anchore/stereoscope",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.1.17"
        },
        {
          "name": "github.com/anmitsu/go-shlex",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.0.0-20200514113438-38f4b401e2be"
        },
        {
          "name": "github.com/aquasecurity/go-pep440-version",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.0.1"
        },
        {
          "name": "github.com/bitnami/go-version",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.0.0-20250131085805-b1f57a8634ef"
        },
        {
          "name": "github.com/blakesmith/ar",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.0.0-20190502131153-809d4375e1fb"
        },
        {
          "name": "github.com/bmatcuk/doublestar/v4",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v4.9.1"
        },
        {
          "name": "github.com/charmbracelet/bubbles",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.21.0"
        },
        {
          "name": "github.com/charmbracelet/bubbletea",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.3.10"
        },
        {
          "name": "github.com/charmbracelet/lipgloss",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.1.0"
        },
        {
          "name": "github.com/dave/jennifer",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.7.1"
        },
        {
          "name": "github.com/deitch/magic",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.0.0-20230404182410-1ff89d7342da"
        },
        {
          "name": "github.com/diskfs/go-diskfs",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.7.0"
        },
        {
          "name": "github.com/distribution/reference",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.6.0"
        },
        {
          "name": "github.com/dustin/go-humanize",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.0.1"
        },
        {
          "name": "github.com/elliotchance/phpserialize",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.4.0"
        },
        {
          "name": "github.com/facebookincubator/nvdtools",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.1.5"
        },
        {
          "name": "github.com/github/go-spdx/v2",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v2.3.5"
        },
        {
          "name": "github.com/gkampitakis/go-snaps",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.5.19"
        },
        {
          "name": "github.com/go-git/go-billy/v5",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v5.7.0"
        },
        {
          "name": "github.com/go-git/go-git/v5",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v5.16.4"
        },
        {
          "name": "github.com/go-test/deep",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.1.1"
        },
        {
          "name": "github.com/go-viper/mapstructure/v2",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v2.4.0"
        },
        {
          "name": "github.com/gohugoio/hashstructure",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.6.0"
        },
        {
          "name": "github.com/google/go-cmp",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.7.0"
        },
        {
          "name": "github.com/google/go-containerregistry",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.20.7"
        },
        {
          "name": "github.com/google/licensecheck",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.3.1"
        },
        {
          "name": "github.com/google/uuid",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.6.0"
        },
        {
          "name": "github.com/gookit/color",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.6.0"
        },
        {
          "name": "github.com/hashicorp/go-cleanhttp",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.5.2"
        },
        {
          "name": "github.com/hashicorp/go-getter",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.8.4"
        },
        {
          "name": "github.com/hashicorp/go-multierror",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.1.1"
        },
        {
          "name": "github.com/hashicorp/hcl/v2",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v2.24.0"
        },
        {
          "name": "github.com/iancoleman/strcase",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.3.0"
        },
        {
          "name": "github.com/invopop/jsonschema",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.13.0"
        },
        {
          "name": "github.com/jedib0t/go-pretty/v6",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v6.7.8"
        },
        {
          "name": "github.com/jinzhu/copier",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.4.0"
        },
        {
          "name": "github.com/kastenhq/goversion",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.0.0-20230811215019-93b2f8823953"
        },
        {
          "name": "github.com/magiconair/properties",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.8.10"
        },
        {
          "name": "github.com/mholt/archives",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.1.5"
        },
        {
          "name": "github.com/moby/sys/mountinfo",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.7.2"
        },
        {
          "name": "github.com/nix-community/go-nix",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.0.0-20250101154619-4bdde671e0a1"
        },
        {
          "name": "github.com/olekukonko/tablewriter",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.1.2"
        },
        {
          "name": "github.com/opencontainers/go-digest",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.0.0"
        },
        {
          "name": "github.com/pelletier/go-toml",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.9.5"
        },
        {
          "name": "github.com/quasilyte/go-ruleguard/dsl",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.3.23"
        },
        {
          "name": "github.com/rust-secure-code/go-rustaudit",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.0.0-20250226111315-e20ec32e963c"
        },
        {
          "name": "github.com/saintfish/chardet",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.0.0-20230101081208-5e3ef4b5456d"
        },
        {
          "name": "github.com/sanity-io/litter",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.5.8"
        },
        {
          "name": "github.com/sassoftware/go-rpmutils",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.4.0"
        },
        {
          "name": "github.com/scylladb/go-set",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.0.3-0.20200225121959-cc7b2070d91e"
        },
        {
          "name": "github.com/sergi/go-diff",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.4.0"
        },
        {
          "name": "github.com/spdx/gordf",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.0.0-20201111095634-7098f93598fb"
        },
        {
          "name": "github.com/spdx/tools-golang",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.5.6"
        },
        {
          "name": "github.com/spf13/afero",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.15.0"
        },
        {
          "name": "github.com/spf13/cobra",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.10.2"
        },
        {
          "name": "github.com/stretchr/testify",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.11.1"
        },
        {
          "name": "github.com/vbatts/go-mtree",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.7.0"
        },
        {
          "name": "github.com/vifraa/gopom",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.0.0"
        },
        {
          "name": "github.com/wagoodman/go-partybus",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.0.0-20230516145632-8ccac152c651"
        },
        {
          "name": "github.com/wagoodman/go-progress",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.0.0-20230925121702-07e42b3cdba0"
        },
        {
          "name": "github.com/xeipuuv/gojsonschema",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.2.0"
        },
        {
          "name": "github.com/zyedidia/generic",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.2.2-0.20230320175451-4410d2372cb1"
        },
        {
          "name": "go.uber.org/goleak",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.3.0"
        },
        {
          "name": "go.yaml.in/yaml/v3",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v3.0.4"
        },
        {
          "name": "golang.org/x/exp",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.0.0-20250620022241-b7579e27df2b"
        },
        {
          "name": "golang.org/x/mod",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.31.0"
        },
        {
          "name": "golang.org/x/net",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.48.0"
        },
        {
          "name": "modernc.org/sqlite",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.43.0"
        },
        {
          "name": "github.com/goccy/go-yaml",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.19.2"
        },
        {
          "name": "github.com/ulikunitz/xz",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.5.15"
        },
        {
          "name": "golang.org/x/time",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.14.0"
        },
        {
          "name": "golang.org/x/tools",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.40.0"
        },
        {
          "name": "gopkg.in/yaml.v3",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v3.0.1"
        },
        {
          "name": "github.com/cespare/xxhash/v2",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v2.3.0"
        },
        {
          "name": "github.com/gpustack/gguf-parser-go",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.23.1"
        },
        {
          "name": "github.com/wk8/go-ordered-map/v2",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v2.1.8"
        }
      ],
      "all_dependencies": {
        "error": null,
        "source": "github-sbom",
        "packages": [
          {
            "name": "github.com/acarl005/stripansi",
            "direct": true,
            "version": "v0.0.0-20180116102854-5a71ef0e047d",
            "ecosystem": "go"
          },
          {
            "name": "github.com/acobaugh/osrelease",
            "direct": true,
            "version": "v0.1.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/adrg/xdg",
            "direct": true,
            "version": "v0.2.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/adrg/xdg",
            "direct": true,
            "version": "v0.5.3",
            "ecosystem": "go"
          },
          {
            "name": "github.com/anchore/bubbly",
            "direct": true,
            "version": "v0.0.0-20231115134915-def0aba654a9",
            "ecosystem": "go"
          },
          {
            "name": "github.com/anchore/clio",
            "direct": true,
            "version": "v0.0.0-20250319180342-2cfe4b0cb716",
            "ecosystem": "go"
          },
          {
            "name": "github.com/anchore/fangs",
            "direct": true,
            "version": "v0.0.0-20250319222917-446a1e748ec2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/anchore/go-collections",
            "direct": true,
            "version": "v0.0.0-20251016125210-a3c352120e8c",
            "ecosystem": "go"
          },
          {
            "name": "github.com/anchore/go-homedir",
            "direct": true,
            "version": "v0.0.0-20250319154043-c29668562e4d",
            "ecosystem": "go"
          },
          {
            "name": "github.com/anchore/go-logger",
            "direct": true,
            "version": "v0.0.0-20250318195838-07ae343dd722",
            "ecosystem": "go"
          },
          {
            "name": "github.com/anchore/go-macholibre",
            "direct": true,
            "version": "v0.0.0-20220308212642-53e6d0aaf6fb",
            "ecosystem": "go"
          },
          {
            "name": "github.com/anchore/go-rpmdb",
            "direct": true,
            "version": "v0.0.0-20250516171929-f77691e1faec",
            "ecosystem": "go"
          },
          {
            "name": "github.com/anchore/go-sync",
            "direct": true,
            "version": "v0.0.0-20250326131806-4eda43a485b6",
            "ecosystem": "go"
          },
          {
            "name": "github.com/anchore/go-testutils",
            "direct": true,
            "version": "v0.0.0-20200624184116-66aa578126db",
            "ecosystem": "go"
          },
          {
            "name": "github.com/anchore/go-testutils",
            "direct": true,
            "version": "v0.0.0-20200925183923-d5f45b0d3c04",
            "ecosystem": "go"
          },
          {
            "name": "github.com/anchore/go-version",
            "direct": true,
            "version": "v1.2.2-0.20200701162849-18adb9c92b9b",
            "ecosystem": "go"
          },
          {
            "name": "github.com/anchore/packageurl-go",
            "direct": true,
            "version": "v0.1.1-0.20250220190351-d62adb6e1115",
            "ecosystem": "go"
          },
          {
            "name": "github.com/anchore/stereoscope",
            "direct": true,
            "version": "v0.0.0-20200706164556-7cf39d7f4639",
            "ecosystem": "go"
          },
          {
            "name": "github.com/anchore/stereoscope",
            "direct": true,
            "version": "v0.1.17",
            "ecosystem": "go"
          },
          {
            "name": "github.com/anmitsu/go-shlex",
            "direct": true,
            "version": "v0.0.0-20200514113438-38f4b401e2be",
            "ecosystem": "go"
          },
          {
            "name": "github.com/aquasecurity/go-pep440-version",
            "direct": true,
            "version": "v0.0.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/bitnami/go-version",
            "direct": true,
            "version": "v0.0.0-20250131085805-b1f57a8634ef",
            "ecosystem": "go"
          },
          {
            "name": "github.com/blakesmith/ar",
            "direct": true,
            "version": "v0.0.0-20190502131153-809d4375e1fb",
            "ecosystem": "go"
          },
          {
            "name": "github.com/bmatcuk/doublestar/v4",
            "direct": true,
            "version": "v4.9.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/burntsushi/toml",
            "direct": true,
            "version": "v1.6.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/cespare/xxhash/v2",
            "direct": true,
            "version": "v2.3.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/charmbracelet/bubbles",
            "direct": true,
            "version": "v0.21.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/charmbracelet/bubbletea",
            "direct": true,
            "version": "v1.3.10",
            "ecosystem": "go"
          },
          {
            "name": "github.com/charmbracelet/lipgloss",
            "direct": true,
            "version": "v1.1.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/cyclonedx/cyclonedx-go",
            "direct": true,
            "version": "v0.9.3",
            "ecosystem": "go"
          },
          {
            "name": "github.com/dave/jennifer",
            "direct": true,
            "version": "v1.7.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/deitch/magic",
            "direct": true,
            "version": "v0.0.0-20230404182410-1ff89d7342da",
            "ecosystem": "go"
          },
          {
            "name": "github.com/diskfs/go-diskfs",
            "direct": true,
            "version": "v1.7.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/distribution/reference",
            "direct": true,
            "version": "v0.6.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/dustin/go-humanize",
            "direct": true,
            "version": "v1.0.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/elliotchance/phpserialize",
            "direct": true,
            "version": "v1.4.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/facebookincubator/nvdtools",
            "direct": true,
            "version": "v0.1.5",
            "ecosystem": "go"
          },
          {
            "name": "github.com/github/go-spdx/v2",
            "direct": true,
            "version": "v2.3.5",
            "ecosystem": "go"
          },
          {
            "name": "github.com/gkampitakis/go-snaps",
            "direct": true,
            "version": "v0.5.19",
            "ecosystem": "go"
          },
          {
            "name": "github.com/go-git/go-billy/v5",
            "direct": true,
            "version": "v5.7.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/go-git/go-git/v5",
            "direct": true,
            "version": "v5.16.4",
            "ecosystem": "go"
          },
          {
            "name": "github.com/go-test/deep",
            "direct": true,
            "version": "v1.0.6",
            "ecosystem": "go"
          },
          {
            "name": "github.com/go-test/deep",
            "direct": true,
            "version": "v1.1.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/go-viper/mapstructure/v2",
            "direct": true,
            "version": "v2.2.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/go-viper/mapstructure/v2",
            "direct": true,
            "version": "v2.4.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/goccy/go-yaml",
            "direct": true,
            "version": "v1.19.2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/gohugoio/hashstructure",
            "direct": true,
            "version": "v0.6.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/google/go-cmp",
            "direct": true,
            "version": "v0.7.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/google/go-containerregistry",
            "direct": true,
            "version": "v0.20.7",
            "ecosystem": "go"
          },
          {
            "name": "github.com/google/licensecheck",
            "direct": true,
            "version": "v0.3.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/google/uuid",
            "direct": true,
            "version": "v1.6.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/gookit/color",
            "direct": true,
            "version": "v1.6.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/gpustack/gguf-parser-go",
            "direct": true,
            "version": "v0.23.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/hashicorp/go-cleanhttp",
            "direct": true,
            "version": "v0.5.2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/hashicorp/go-getter",
            "direct": true,
            "version": "v1.8.4",
            "ecosystem": "go"
          },
          {
            "name": "github.com/hashicorp/go-multierror",
            "direct": true,
            "version": "v1.1.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/hashicorp/hcl/v2",
            "direct": true,
            "version": "v2.24.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/iancoleman/strcase",
            "direct": true,
            "version": "v0.3.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/invopop/jsonschema",
            "direct": true,
            "version": "v0.13.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/jedib0t/go-pretty/v6",
            "direct": true,
            "version": "v6.7.8",
            "ecosystem": "go"
          },
          {
            "name": "github.com/jinzhu/copier",
            "direct": true,
            "version": "v0.4.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/kastenhq/goversion",
            "direct": true,
            "version": "v0.0.0-20230811215019-93b2f8823953",
            "ecosystem": "go"
          },
          {
            "name": "github.com/magiconair/properties",
            "direct": true,
            "version": "v1.8.10",
            "ecosystem": "go"
          },
          {
            "name": "github.com/masterminds/semver/v3",
            "direct": true,
            "version": "v3.4.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/masterminds/sprig/v3",
            "direct": true,
            "version": "v3.3.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/mholt/archives",
            "direct": true,
            "version": "v0.1.5",
            "ecosystem": "go"
          },
          {
            "name": "github.com/moby/sys/mountinfo",
            "direct": true,
            "version": "v0.7.2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/nix-community/go-nix",
            "direct": true,
            "version": "v0.0.0-20250101154619-4bdde671e0a1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/olekukonko/tablewriter",
            "direct": true,
            "version": "v1.1.2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/oneofone/xxhash",
            "direct": true,
            "version": "v1.2.8",
            "ecosystem": "go"
          },
          {
            "name": "github.com/opencontainers/go-digest",
            "direct": true,
            "version": "v1.0.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/pelletier/go-toml",
            "direct": true,
            "version": "v1.9.5",
            "ecosystem": "go"
          },
          {
            "name": "github.com/quasilyte/go-ruleguard/dsl",
            "direct": true,
            "version": "v0.3.23",
            "ecosystem": "go"
          },
          {
            "name": "github.com/rust-secure-code/go-rustaudit",
            "direct": true,
            "version": "v0.0.0-20250226111315-e20ec32e963c",
            "ecosystem": "go"
          },
          {
            "name": "github.com/saintfish/chardet",
            "direct": true,
            "version": "v0.0.0-20230101081208-5e3ef4b5456d",
            "ecosystem": "go"
          },
          {
            "name": "github.com/sanity-io/litter",
            "direct": true,
            "version": "v1.5.8",
            "ecosystem": "go"
          },
          {
            "name": "github.com/sassoftware/go-rpmutils",
            "direct": true,
            "version": "v0.4.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/scylladb/go-set",
            "direct": true,
            "version": "v1.0.3-0.20200225121959-cc7b2070d91e",
            "ecosystem": "go"
          },
          {
            "name": "github.com/sergi/go-diff",
            "direct": true,
            "version": "v1.4.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/spdx/gordf",
            "direct": true,
            "version": "v0.0.0-20201111095634-7098f93598fb",
            "ecosystem": "go"
          },
          {
            "name": "github.com/spdx/tools-golang",
            "direct": true,
            "version": "v0.5.6",
            "ecosystem": "go"
          },
          {
            "name": "github.com/spf13/afero",
            "direct": true,
            "version": "v1.12.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/spf13/afero",
            "direct": true,
            "version": "v1.15.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/spf13/cobra",
            "direct": true,
            "version": "v1.10.2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/stretchr/testify",
            "direct": true,
            "version": "v1.10.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/stretchr/testify",
            "direct": true,
            "version": "v1.11.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/ulikunitz/xz",
            "direct": true,
            "version": "v0.5.12",
            "ecosystem": "go"
          },
          {
            "name": "github.com/ulikunitz/xz",
            "direct": true,
            "version": "v0.5.15",
            "ecosystem": "go"
          },
          {
            "name": "github.com/vbatts/go-mtree",
            "direct": true,
            "version": "v0.7.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/vifraa/gopom",
            "direct": true,
            "version": "v1.0.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/wagoodman/go-partybus",
            "direct": true,
            "version": "v0.0.0-20230516145632-8ccac152c651",
            "ecosystem": "go"
          },
          {
            "name": "github.com/wagoodman/go-progress",
            "direct": true,
            "version": "v0.0.0-20230925121702-07e42b3cdba0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/wk8/go-ordered-map/v2",
            "direct": true,
            "version": "v2.1.8",
            "ecosystem": "go"
          },
          {
            "name": "github.com/xeipuuv/gojsonschema",
            "direct": true,
            "version": "v1.2.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/zyedidia/generic",
            "direct": true,
            "version": "v1.2.2-0.20230320175451-4410d2372cb1",
            "ecosystem": "go"
          },
          {
            "name": "go.uber.org/goleak",
            "direct": true,
            "version": "v1.3.0",
            "ecosystem": "go"
          },
          {
            "name": "go.yaml.in/yaml/v3",
            "direct": true,
            "version": "v3.0.4",
            "ecosystem": "go"
          },
          {
            "name": "golang.org/x/exp",
            "direct": true,
            "version": "v0.0.0-20250620022241-b7579e27df2b",
            "ecosystem": "go"
          },
          {
            "name": "golang.org/x/mod",
            "direct": true,
            "version": "v0.31.0",
            "ecosystem": "go"
          },
          {
            "name": "golang.org/x/net",
            "direct": true,
            "version": "v0.48.0",
            "ecosystem": "go"
          },
          {
            "name": "golang.org/x/time",
            "direct": true,
            "version": "v0.14.0",
            "ecosystem": "go"
          },
          {
            "name": "golang.org/x/tools",
            "direct": true,
            "version": "v0.40.0",
            "ecosystem": "go"
          },
          {
            "name": "gopkg.in/yaml.v3",
            "direct": true,
            "version": "v3.0.1",
            "ecosystem": "go"
          },
          {
            "name": "modernc.org/sqlite",
            "direct": true,
            "version": "v1.43.0",
            "ecosystem": "go"
          },
          {
            "name": "cel.dev/expr",
            "direct": false,
            "version": "v0.24.0",
            "ecosystem": "go"
          },
          {
            "name": "cloud.google.com/go",
            "direct": false,
            "version": "v0.123.0",
            "ecosystem": "go"
          },
          {
            "name": "cloud.google.com/go/auth",
            "direct": false,
            "version": "v0.17.0",
            "ecosystem": "go"
          },
          {
            "name": "cloud.google.com/go/auth/oauth2adapt",
            "direct": false,
            "version": "v0.2.8",
            "ecosystem": "go"
          },
          {
            "name": "cloud.google.com/go/compute/metadata",
            "direct": false,
            "version": "v0.9.0",
            "ecosystem": "go"
          },
          {
            "name": "cloud.google.com/go/iam",
            "direct": false,
            "version": "v1.5.3",
            "ecosystem": "go"
          },
          {
            "name": "cloud.google.com/go/monitoring",
            "direct": false,
            "version": "v1.24.2",
            "ecosystem": "go"
          },
          {
            "name": "cloud.google.com/go/storage",
            "direct": false,
            "version": "v1.58.0",
            "ecosystem": "go"
          },
          {
            "name": "cyphar.com/go-pathrs",
            "direct": false,
            "version": "v0.2.1",
            "ecosystem": "go"
          },
          {
            "name": "dario.cat/mergo",
            "direct": false,
            "version": "v1.0.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/adalogics/go-fuzz-headers",
            "direct": false,
            "version": "v0.0.0-20230811130428-ced1acdcaa24",
            "ecosystem": "go"
          },
          {
            "name": "github.com/adamkorcz/go-118-fuzz-build",
            "direct": false,
            "version": "v0.0.0-20230306123547-8075edf89bb0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/agext/levenshtein",
            "direct": false,
            "version": "v1.2.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/anchore/archiver/v3",
            "direct": false,
            "version": "v3.5.3-0.20241210171143-5b1d8d1c7c51",
            "ecosystem": "go"
          },
          {
            "name": "github.com/anchore/go-lzo",
            "direct": false,
            "version": "v0.1.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/anchore/go-struct-converter",
            "direct": false,
            "version": "v0.1.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/andybalholm/brotli",
            "direct": false,
            "version": "v1.1.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/andybalholm/brotli",
            "direct": false,
            "version": "v1.2.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/apparentlymart/go-textseg/v15",
            "direct": false,
            "version": "v15.0.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/aquasecurity/go-version",
            "direct": false,
            "version": "v0.0.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/atotto/clipboard",
            "direct": false,
            "version": "v0.1.4",
            "ecosystem": "go"
          },
          {
            "name": "github.com/aws/aws-sdk-go-v2",
            "direct": false,
            "version": "v1.41.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream",
            "direct": false,
            "version": "v1.7.4",
            "ecosystem": "go"
          },
          {
            "name": "github.com/aws/aws-sdk-go-v2/config",
            "direct": false,
            "version": "v1.32.6",
            "ecosystem": "go"
          },
          {
            "name": "github.com/aws/aws-sdk-go-v2/credentials",
            "direct": false,
            "version": "v1.19.6",
            "ecosystem": "go"
          },
          {
            "name": "github.com/aws/aws-sdk-go-v2/feature/ec2/imds",
            "direct": false,
            "version": "v1.18.16",
            "ecosystem": "go"
          },
          {
            "name": "github.com/aws/aws-sdk-go-v2/internal/configsources",
            "direct": false,
            "version": "v1.4.16",
            "ecosystem": "go"
          },
          {
            "name": "github.com/aws/aws-sdk-go-v2/internal/endpoints/v2",
            "direct": false,
            "version": "v2.7.16",
            "ecosystem": "go"
          },
          {
            "name": "github.com/aws/aws-sdk-go-v2/internal/ini",
            "direct": false,
            "version": "v1.8.4",
            "ecosystem": "go"
          },
          {
            "name": "github.com/aws/aws-sdk-go-v2/internal/v4a",
            "direct": false,
            "version": "v1.4.16",
            "ecosystem": "go"
          },
          {
            "name": "github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding",
            "direct": false,
            "version": "v1.13.4",
            "ecosystem": "go"
          },
          {
            "name": "github.com/aws/aws-sdk-go-v2/service/internal/checksum",
            "direct": false,
            "version": "v1.9.7",
            "ecosystem": "go"
          },
          {
            "name": "github.com/aws/aws-sdk-go-v2/service/internal/presigned-url",
            "direct": false,
            "version": "v1.13.16",
            "ecosystem": "go"
          },
          {
            "name": "github.com/aws/aws-sdk-go-v2/service/internal/s3shared",
            "direct": false,
            "version": "v1.19.16",
            "ecosystem": "go"
          },
          {
            "name": "github.com/aws/aws-sdk-go-v2/service/s3",
            "direct": false,
            "version": "v1.95.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/aws/aws-sdk-go-v2/service/signin",
            "direct": false,
            "version": "v1.0.4",
            "ecosystem": "go"
          },
          {
            "name": "github.com/aws/aws-sdk-go-v2/service/sso",
            "direct": false,
            "version": "v1.30.8",
            "ecosystem": "go"
          },
          {
            "name": "github.com/aws/aws-sdk-go-v2/service/ssooidc",
            "direct": false,
            "version": "v1.35.12",
            "ecosystem": "go"
          },
          {
            "name": "github.com/aws/aws-sdk-go-v2/service/sts",
            "direct": false,
            "version": "v1.41.5",
            "ecosystem": "go"
          },
          {
            "name": "github.com/aws/smithy-go",
            "direct": false,
            "version": "v1.24.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/aymanbagabas/go-osc52/v2",
            "direct": false,
            "version": "v2.0.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/bahlo/generic-list-go",
            "direct": false,
            "version": "v0.2.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/becheran/wildmatch-go",
            "direct": false,
            "version": "v1.0.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/bgentry/go-netrc",
            "direct": false,
            "version": "v0.0.0-20140422174119-9fd32a8b3d3d",
            "ecosystem": "go"
          },
          {
            "name": "github.com/bmatcuk/doublestar",
            "direct": false,
            "version": "v1.3.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/bodgit/plumbing",
            "direct": false,
            "version": "v1.3.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/bodgit/sevenzip",
            "direct": false,
            "version": "v1.6.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/bodgit/windows",
            "direct": false,
            "version": "v1.0.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/buger/jsonparser",
            "direct": false,
            "version": "v1.1.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/charmbracelet/colorprofile",
            "direct": false,
            "version": "v0.2.3-0.20250311203215-f60798e515dc",
            "ecosystem": "go"
          },
          {
            "name": "github.com/charmbracelet/harmonica",
            "direct": false,
            "version": "v0.2.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/charmbracelet/x/ansi",
            "direct": false,
            "version": "v0.10.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/charmbracelet/x/cellbuf",
            "direct": false,
            "version": "v0.0.13-0.20250311204145-2c3ea96c31dd",
            "ecosystem": "go"
          },
          {
            "name": "github.com/charmbracelet/x/term",
            "direct": false,
            "version": "v0.2.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/clipperhouse/displaywidth",
            "direct": false,
            "version": "v0.6.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/clipperhouse/stringish",
            "direct": false,
            "version": "v0.1.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/clipperhouse/uax29/v2",
            "direct": false,
            "version": "v2.3.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/cloudflare/circl",
            "direct": false,
            "version": "v1.6.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/cncf/xds/go",
            "direct": false,
            "version": "v0.0.0-20250501225837-2ac532fd4443",
            "ecosystem": "go"
          },
          {
            "name": "github.com/containerd/cgroups",
            "direct": false,
            "version": "v1.1.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/containerd/containerd",
            "direct": false,
            "version": "v1.7.30",
            "ecosystem": "go"
          },
          {
            "name": "github.com/containerd/containerd/api",
            "direct": false,
            "version": "v1.8.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/containerd/continuity",
            "direct": false,
            "version": "v0.4.4",
            "ecosystem": "go"
          },
          {
            "name": "github.com/containerd/errdefs",
            "direct": false,
            "version": "v1.0.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/containerd/errdefs/pkg",
            "direct": false,
            "version": "v0.3.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/containerd/fifo",
            "direct": false,
            "version": "v1.1.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/containerd/log",
            "direct": false,
            "version": "v0.1.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/containerd/platforms",
            "direct": false,
            "version": "v0.2.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/containerd/stargz-snapshotter/estargz",
            "direct": false,
            "version": "v0.18.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/containerd/ttrpc",
            "direct": false,
            "version": "v1.2.7",
            "ecosystem": "go"
          },
          {
            "name": "github.com/containerd/typeurl/v2",
            "direct": false,
            "version": "v2.2.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/cyphar/filepath-securejoin",
            "direct": false,
            "version": "v0.6.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/datadog/zstd",
            "direct": false,
            "version": "v1.5.5",
            "ecosystem": "go"
          },
          {
            "name": "github.com/davecgh/go-spew",
            "direct": false,
            "version": "v1.1.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/davecgh/go-spew",
            "direct": false,
            "version": "v1.1.2-0.20180830191138-d8f796af33cc",
            "ecosystem": "go"
          },
          {
            "name": "github.com/docker/cli",
            "direct": false,
            "version": "v29.1.3+incompatible",
            "ecosystem": "go"
          },
          {
            "name": "github.com/docker/distribution",
            "direct": false,
            "version": "v2.8.3+incompatible",
            "ecosystem": "go"
          },
          {
            "name": "github.com/docker/docker",
            "direct": false,
            "version": "v28.5.2+incompatible",
            "ecosystem": "go"
          },
          {
            "name": "github.com/docker/docker-credential-helpers",
            "direct": false,
            "version": "v0.9.4",
            "ecosystem": "go"
          },
          {
            "name": "github.com/docker/go-connections",
            "direct": false,
            "version": "v0.6.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/docker/go-events",
            "direct": false,
            "version": "v0.0.0-20190806004212-e31b211e4f1c",
            "ecosystem": "go"
          },
          {
            "name": "github.com/docker/go-units",
            "direct": false,
            "version": "v0.5.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/dsnet/compress",
            "direct": false,
            "version": "v0.0.2-0.20210315054119-f66993602bf5",
            "ecosystem": "go"
          },
          {
            "name": "github.com/dsnet/compress",
            "direct": false,
            "version": "v0.0.2-0.20230904184137-39efe44ab707",
            "ecosystem": "go"
          },
          {
            "name": "github.com/emirpasic/gods",
            "direct": false,
            "version": "v1.18.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/envoyproxy/go-control-plane/envoy",
            "direct": false,
            "version": "v1.32.4",
            "ecosystem": "go"
          },
          {
            "name": "github.com/envoyproxy/protoc-gen-validate",
            "direct": false,
            "version": "v1.2.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/erikgeiser/coninput",
            "direct": false,
            "version": "v0.0.0-20211004153227-1c3628e74d0f",
            "ecosystem": "go"
          },
          {
            "name": "github.com/fatih/color",
            "direct": false,
            "version": "v1.18.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/felixge/fgprof",
            "direct": false,
            "version": "v0.9.5",
            "ecosystem": "go"
          },
          {
            "name": "github.com/felixge/httpsnoop",
            "direct": false,
            "version": "v1.0.4",
            "ecosystem": "go"
          },
          {
            "name": "github.com/fsnotify/fsnotify",
            "direct": false,
            "version": "v1.8.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/gabriel-vasile/mimetype",
            "direct": false,
            "version": "v1.4.12",
            "ecosystem": "go"
          },
          {
            "name": "github.com/gkampitakis/ciinfo",
            "direct": false,
            "version": "v0.3.2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/go-git/gcfg",
            "direct": false,
            "version": "v1.5.1-0.20230307220236-3a3c6141e376",
            "ecosystem": "go"
          },
          {
            "name": "github.com/go-jose/go-jose/v4",
            "direct": false,
            "version": "v4.1.2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/go-logr/logr",
            "direct": false,
            "version": "v1.4.3",
            "ecosystem": "go"
          },
          {
            "name": "github.com/go-logr/stdr",
            "direct": false,
            "version": "v1.2.2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/go-restruct/restruct",
            "direct": false,
            "version": "v1.2.0-alpha",
            "ecosystem": "go"
          },
          {
            "name": "github.com/gogo/protobuf",
            "direct": false,
            "version": "v1.3.2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/golang/groupcache",
            "direct": false,
            "version": "v0.0.0-20241129210726-2c02b8208cf8",
            "ecosystem": "go"
          },
          {
            "name": "github.com/golang/snappy",
            "direct": false,
            "version": "v0.0.4",
            "ecosystem": "go"
          },
          {
            "name": "github.com/google/pprof",
            "direct": false,
            "version": "v0.0.0-20250317173921-a4b03ec1a45e",
            "ecosystem": "go"
          },
          {
            "name": "github.com/google/s2a-go",
            "direct": false,
            "version": "v0.1.9",
            "ecosystem": "go"
          },
          {
            "name": "github.com/googleapis/enterprise-certificate-proxy",
            "direct": false,
            "version": "v0.3.7",
            "ecosystem": "go"
          },
          {
            "name": "github.com/googleapis/gax-go/v2",
            "direct": false,
            "version": "v2.15.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/googlecloudplatform/opentelemetry-operations-go/detectors/gcp",
            "direct": false,
            "version": "v1.29.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/googlecloudplatform/opentelemetry-operations-go/exporter/metric",
            "direct": false,
            "version": "v0.54.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/googlecloudplatform/opentelemetry-operations-go/internal/resourcemapping",
            "direct": false,
            "version": "v0.54.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/hashicorp/aws-sdk-go-base/v2",
            "direct": false,
            "version": "v2.0.0-beta.70",
            "ecosystem": "go"
          },
          {
            "name": "github.com/hashicorp/errwrap",
            "direct": false,
            "version": "v1.1.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/hashicorp/go-version",
            "direct": false,
            "version": "v1.8.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/hashicorp/golang-lru/v2",
            "direct": false,
            "version": "v2.0.7",
            "ecosystem": "go"
          },
          {
            "name": "github.com/henvic/httpretty",
            "direct": false,
            "version": "v0.1.4",
            "ecosystem": "go"
          },
          {
            "name": "github.com/huandu/xstrings",
            "direct": false,
            "version": "v1.5.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/inconshreveable/mousetrap",
            "direct": false,
            "version": "v1.1.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/jbenet/go-context",
            "direct": false,
            "version": "v0.0.0-20150711004518-d14ea06fba99",
            "ecosystem": "go"
          },
          {
            "name": "github.com/json-iterator/go",
            "direct": false,
            "version": "v1.1.12",
            "ecosystem": "go"
          },
          {
            "name": "github.com/kevinburke/ssh_config",
            "direct": false,
            "version": "v1.2.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/klauspost/compress",
            "direct": false,
            "version": "v1.17.11",
            "ecosystem": "go"
          },
          {
            "name": "github.com/klauspost/compress",
            "direct": false,
            "version": "v1.18.2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/klauspost/pgzip",
            "direct": false,
            "version": "v1.2.6",
            "ecosystem": "go"
          },
          {
            "name": "github.com/kr/pretty",
            "direct": false,
            "version": "v0.3.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/kr/text",
            "direct": false,
            "version": "v0.2.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/logrusorgru/aurora",
            "direct": false,
            "version": "v2.0.3+incompatible",
            "ecosystem": "go"
          },
          {
            "name": "github.com/lucasb-eyer/go-colorful",
            "direct": false,
            "version": "v1.2.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/mailru/easyjson",
            "direct": false,
            "version": "v0.7.7",
            "ecosystem": "go"
          },
          {
            "name": "github.com/maruel/natural",
            "direct": false,
            "version": "v1.1.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/masterminds/goutils",
            "direct": false,
            "version": "v1.1.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/mattn/go-colorable",
            "direct": false,
            "version": "v0.1.14",
            "ecosystem": "go"
          },
          {
            "name": "github.com/mattn/go-isatty",
            "direct": false,
            "version": "v0.0.20",
            "ecosystem": "go"
          },
          {
            "name": "github.com/mattn/go-localereader",
            "direct": false,
            "version": "v0.0.2-0.20220822084749-2491eb6c1c75",
            "ecosystem": "go"
          },
          {
            "name": "github.com/mattn/go-runewidth",
            "direct": false,
            "version": "v0.0.19",
            "ecosystem": "go"
          },
          {
            "name": "github.com/mgutz/ansi",
            "direct": false,
            "version": "v0.0.0-20200706080929-d51e80ef957d",
            "ecosystem": "go"
          },
          {
            "name": "github.com/microsoft/go-winio",
            "direct": false,
            "version": "v0.6.2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/microsoft/hcsshim",
            "direct": false,
            "version": "v0.11.7",
            "ecosystem": "go"
          },
          {
            "name": "github.com/mikelolasagasti/xz",
            "direct": false,
            "version": "v1.0.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/minio/minlz",
            "direct": false,
            "version": "v1.0.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/mitchellh/copystructure",
            "direct": false,
            "version": "v1.2.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/mitchellh/go-homedir",
            "direct": false,
            "version": "v1.1.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/mitchellh/go-wordwrap",
            "direct": false,
            "version": "v1.0.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/mitchellh/reflectwalk",
            "direct": false,
            "version": "v1.0.2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/moby/docker-image-spec",
            "direct": false,
            "version": "v1.3.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/moby/locker",
            "direct": false,
            "version": "v1.0.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/moby/sys/sequential",
            "direct": false,
            "version": "v0.6.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/moby/sys/signal",
            "direct": false,
            "version": "v0.7.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/moby/sys/user",
            "direct": false,
            "version": "v0.3.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/moby/sys/userns",
            "direct": false,
            "version": "v0.1.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/modern-go/concurrent",
            "direct": false,
            "version": "v0.0.0-20180306012644-bacd9c7ef1dd",
            "ecosystem": "go"
          },
          {
            "name": "github.com/modern-go/reflect2",
            "direct": false,
            "version": "v1.0.2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/muesli/ansi",
            "direct": false,
            "version": "v0.0.0-20230316100256-276c6243b2f6",
            "ecosystem": "go"
          },
          {
            "name": "github.com/muesli/cancelreader",
            "direct": false,
            "version": "v0.2.2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/muesli/termenv",
            "direct": false,
            "version": "v0.16.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/ncruces/go-strftime",
            "direct": false,
            "version": "v0.1.9",
            "ecosystem": "go"
          },
          {
            "name": "github.com/nwaples/rardecode",
            "direct": false,
            "version": "v1.1.3",
            "ecosystem": "go"
          },
          {
            "name": "github.com/nwaples/rardecode/v2",
            "direct": false,
            "version": "v2.2.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/olekukonko/cat",
            "direct": false,
            "version": "v0.0.0-20250911104152-50322a0618f6",
            "ecosystem": "go"
          },
          {
            "name": "github.com/olekukonko/errors",
            "direct": false,
            "version": "v1.1.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/olekukonko/ll",
            "direct": false,
            "version": "v0.1.3",
            "ecosystem": "go"
          },
          {
            "name": "github.com/opencontainers/image-spec",
            "direct": false,
            "version": "v1.1.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/opencontainers/runtime-spec",
            "direct": false,
            "version": "v1.1.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/opencontainers/selinux",
            "direct": false,
            "version": "v1.13.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/pborman/indent",
            "direct": false,
            "version": "v1.2.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/pelletier/go-toml/v2",
            "direct": false,
            "version": "v2.2.3",
            "ecosystem": "go"
          },
          {
            "name": "github.com/pierrec/lz4/v4",
            "direct": false,
            "version": "v4.1.21",
            "ecosystem": "go"
          },
          {
            "name": "github.com/pierrec/lz4/v4",
            "direct": false,
            "version": "v4.1.22",
            "ecosystem": "go"
          },
          {
            "name": "github.com/pjbgf/sha1cd",
            "direct": false,
            "version": "v0.3.2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/pkg/errors",
            "direct": false,
            "version": "v0.9.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/pkg/profile",
            "direct": false,
            "version": "v1.7.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/pkg/xattr",
            "direct": false,
            "version": "v0.4.9",
            "ecosystem": "go"
          },
          {
            "name": "github.com/planetscale/vtprotobuf",
            "direct": false,
            "version": "v0.6.1-0.20240319094008-0393e58bdf10",
            "ecosystem": "go"
          },
          {
            "name": "github.com/pmezard/go-difflib",
            "direct": false,
            "version": "v1.0.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/pmezard/go-difflib",
            "direct": false,
            "version": "v1.0.1-0.20181226105442-5d4384ee4fb2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/protonmail/go-crypto",
            "direct": false,
            "version": "v1.3.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/remyoudompheng/bigfft",
            "direct": false,
            "version": "v0.0.0-20230129092748-24d4a6f8daec",
            "ecosystem": "go"
          },
          {
            "name": "github.com/rivo/uniseg",
            "direct": false,
            "version": "v0.4.7",
            "ecosystem": "go"
          },
          {
            "name": "github.com/rogpeppe/go-internal",
            "direct": false,
            "version": "v1.14.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/sagikazarmark/locafero",
            "direct": false,
            "version": "v0.7.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/sahilm/fuzzy",
            "direct": false,
            "version": "v0.1.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/shopspring/decimal",
            "direct": false,
            "version": "v1.4.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/sirupsen/logrus",
            "direct": false,
            "version": "v1.9.3",
            "ecosystem": "go"
          },
          {
            "name": "github.com/sirupsen/logrus",
            "direct": false,
            "version": "v1.9.4-0.20230606125235-dd1b4c2e81af",
            "ecosystem": "go"
          },
          {
            "name": "github.com/skeema/knownhosts",
            "direct": false,
            "version": "v1.3.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/smallnest/ringbuffer",
            "direct": false,
            "version": "v0.0.0-20241116012123-461381446e3d",
            "ecosystem": "go"
          },
          {
            "name": "github.com/sorairolake/lzip-go",
            "direct": false,
            "version": "v0.3.8",
            "ecosystem": "go"
          },
          {
            "name": "github.com/sourcegraph/conc",
            "direct": false,
            "version": "v0.3.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/spf13/cast",
            "direct": false,
            "version": "v1.7.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/spf13/pflag",
            "direct": false,
            "version": "v1.0.6",
            "ecosystem": "go"
          },
          {
            "name": "github.com/spf13/pflag",
            "direct": false,
            "version": "v1.0.9",
            "ecosystem": "go"
          },
          {
            "name": "github.com/spf13/viper",
            "direct": false,
            "version": "v1.20.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/spf13/viper",
            "direct": false,
            "version": "v1.20.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/spiffe/go-spiffe/v2",
            "direct": false,
            "version": "v2.5.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/starry-s/zip",
            "direct": false,
            "version": "v0.2.3",
            "ecosystem": "go"
          },
          {
            "name": "github.com/stretchr/objx",
            "direct": false,
            "version": "v0.5.2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/subosito/gotenv",
            "direct": false,
            "version": "v1.6.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/sylabs/sif/v2",
            "direct": false,
            "version": "v2.22.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/sylabs/squashfs",
            "direct": false,
            "version": "v1.0.6",
            "ecosystem": "go"
          },
          {
            "name": "github.com/therootcompany/xz",
            "direct": false,
            "version": "v1.0.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/tidwall/gjson",
            "direct": false,
            "version": "v1.18.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/tidwall/match",
            "direct": false,
            "version": "v1.1.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/tidwall/pretty",
            "direct": false,
            "version": "v1.2.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/tidwall/sjson",
            "direct": false,
            "version": "v1.2.5",
            "ecosystem": "go"
          },
          {
            "name": "github.com/vbatts/tar-split",
            "direct": false,
            "version": "v0.12.2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/xanzy/ssh-agent",
            "direct": false,
            "version": "v0.3.3",
            "ecosystem": "go"
          },
          {
            "name": "github.com/xeipuuv/gojsonpointer",
            "direct": false,
            "version": "v0.0.0-20190905194746-02993c407bfb",
            "ecosystem": "go"
          },
          {
            "name": "github.com/xeipuuv/gojsonreference",
            "direct": false,
            "version": "v0.0.0-20180127040603-bd5ef7bd5415",
            "ecosystem": "go"
          },
          {
            "name": "github.com/xi2/xz",
            "direct": false,
            "version": "v0.0.0-20171230120015-48954b6210f8",
            "ecosystem": "go"
          },
          {
            "name": "github.com/xo/terminfo",
            "direct": false,
            "version": "v0.0.0-20220910002029-abceb7e1c41e",
            "ecosystem": "go"
          },
          {
            "name": "github.com/zclconf/go-cty",
            "direct": false,
            "version": "v1.16.3",
            "ecosystem": "go"
          },
          {
            "name": "github.com/zeebo/errs",
            "direct": false,
            "version": "v1.4.0",
            "ecosystem": "go"
          },
          {
            "name": "go.opencensus.io",
            "direct": false,
            "version": "v0.24.0",
            "ecosystem": "go"
          },
          {
            "name": "go.opentelemetry.io/auto/sdk",
            "direct": false,
            "version": "v1.2.1",
            "ecosystem": "go"
          },
          {
            "name": "go.opentelemetry.io/contrib/detectors/gcp",
            "direct": false,
            "version": "v1.36.0",
            "ecosystem": "go"
          },
          {
            "name": "go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc",
            "direct": false,
            "version": "v0.63.0",
            "ecosystem": "go"
          },
          {
            "name": "go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp",
            "direct": false,
            "version": "v0.61.0",
            "ecosystem": "go"
          },
          {
            "name": "go.opentelemetry.io/otel",
            "direct": false,
            "version": "v1.39.0",
            "ecosystem": "go"
          },
          {
            "name": "go.opentelemetry.io/otel/metric",
            "direct": false,
            "version": "v1.39.0",
            "ecosystem": "go"
          },
          {
            "name": "go.opentelemetry.io/otel/sdk",
            "direct": false,
            "version": "v1.39.0",
            "ecosystem": "go"
          },
          {
            "name": "go.opentelemetry.io/otel/sdk/metric",
            "direct": false,
            "version": "v1.39.0",
            "ecosystem": "go"
          },
          {
            "name": "go.opentelemetry.io/otel/trace",
            "direct": false,
            "version": "v1.39.0",
            "ecosystem": "go"
          },
          {
            "name": "go.uber.org/atomic",
            "direct": false,
            "version": "v1.9.0",
            "ecosystem": "go"
          },
          {
            "name": "go.uber.org/multierr",
            "direct": false,
            "version": "v1.10.0",
            "ecosystem": "go"
          },
          {
            "name": "go.uber.org/multierr",
            "direct": false,
            "version": "v1.9.0",
            "ecosystem": "go"
          },
          {
            "name": "go.uber.org/zap",
            "direct": false,
            "version": "v1.27.0",
            "ecosystem": "go"
          },
          {
            "name": "go4.org",
            "direct": false,
            "version": "v0.0.0-20230225012048-214862532bf5",
            "ecosystem": "go"
          },
          {
            "name": "golang.org/x/crypto",
            "direct": false,
            "version": "v0.46.0",
            "ecosystem": "go"
          },
          {
            "name": "golang.org/x/oauth2",
            "direct": false,
            "version": "v0.33.0",
            "ecosystem": "go"
          },
          {
            "name": "golang.org/x/sync",
            "direct": false,
            "version": "v0.19.0",
            "ecosystem": "go"
          },
          {
            "name": "golang.org/x/sys",
            "direct": false,
            "version": "v0.33.0",
            "ecosystem": "go"
          },
          {
            "name": "golang.org/x/sys",
            "direct": false,
            "version": "v0.39.0",
            "ecosystem": "go"
          },
          {
            "name": "golang.org/x/term",
            "direct": false,
            "version": "v0.38.0",
            "ecosystem": "go"
          },
          {
            "name": "golang.org/x/text",
            "direct": false,
            "version": "v0.21.0",
            "ecosystem": "go"
          },
          {
            "name": "golang.org/x/text",
            "direct": false,
            "version": "v0.32.0",
            "ecosystem": "go"
          },
          {
            "name": "golang.org/x/xerrors",
            "direct": false,
            "version": "v0.0.0-20231012003039-104605ab7028",
            "ecosystem": "go"
          },
          {
            "name": "gonum.org/v1/gonum",
            "direct": false,
            "version": "v0.16.0",
            "ecosystem": "go"
          },
          {
            "name": "google.golang.org/api",
            "direct": false,
            "version": "v0.256.0",
            "ecosystem": "go"
          },
          {
            "name": "google.golang.org/genproto",
            "direct": false,
            "version": "v0.0.0-20250922171735-9219d122eba9",
            "ecosystem": "go"
          },
          {
            "name": "google.golang.org/genproto/googleapis/api",
            "direct": false,
            "version": "v0.0.0-20251111163417-95abcf5c77ba",
            "ecosystem": "go"
          },
          {
            "name": "google.golang.org/genproto/googleapis/rpc",
            "direct": false,
            "version": "v0.0.0-20251111163417-95abcf5c77ba",
            "ecosystem": "go"
          },
          {
            "name": "google.golang.org/grpc",
            "direct": false,
            "version": "v1.76.0",
            "ecosystem": "go"
          },
          {
            "name": "google.golang.org/protobuf",
            "direct": false,
            "version": "v1.36.10",
            "ecosystem": "go"
          },
          {
            "name": "gopkg.in/warnings.v0",
            "direct": false,
            "version": "v0.1.2",
            "ecosystem": "go"
          },
          {
            "name": "modernc.org/libc",
            "direct": false,
            "version": "v1.66.10",
            "ecosystem": "go"
          },
          {
            "name": "modernc.org/mathutil",
            "direct": false,
            "version": "v1.7.1",
            "ecosystem": "go"
          },
          {
            "name": "modernc.org/memory",
            "direct": false,
            "version": "v1.11.0",
            "ecosystem": "go"
          },
          {
            "name": "org.junit.vintage:junit-vintage-engine",
            "direct": false,
            "version": null,
            "ecosystem": "maven"
          },
          {
            "name": "@babel/code-frame",
            "direct": false,
            "version": "7.10.4",
            "ecosystem": "npm"
          },
          {
            "name": "@types/minimatch",
            "direct": false,
            "version": "3.0.3",
            "ecosystem": "npm"
          },
          {
            "name": "@types/qs",
            "direct": false,
            "version": "6.9.4",
            "ecosystem": "npm"
          },
          {
            "name": "ajv",
            "direct": false,
            "version": "6.12.3",
            "ecosystem": "npm"
          },
          {
            "name": "asn1.js",
            "direct": false,
            "version": "4.10.1",
            "ecosystem": "npm"
          },
          {
            "name": "async",
            "direct": false,
            "version": "0.9.2",
            "ecosystem": "npm"
          },
          {
            "name": "async",
            "direct": false,
            "version": "3.2.3",
            "ecosystem": "npm"
          },
          {
            "name": "atob",
            "direct": false,
            "version": "2.1.2",
            "ecosystem": "npm"
          },
          {
            "name": "aws-sdk",
            "direct": false,
            "version": "2.706.0",
            "ecosystem": "npm"
          },
          {
            "name": "c0n-fab_u.laTION",
            "direct": false,
            "version": "7.7.7",
            "ecosystem": "npm"
          },
          {
            "name": "cross-spawn",
            "direct": false,
            "version": "7.0.6",
            "ecosystem": "npm"
          },
          {
            "name": "isexe",
            "direct": false,
            "version": "2.0.0",
            "ecosystem": "npm"
          },
          {
            "name": "jhipster-core",
            "direct": false,
            "version": "7.3.4",
            "ecosystem": "npm"
          },
          {
            "name": "merge-objects",
            "direct": false,
            "version": "1.0.5",
            "ecosystem": "npm"
          },
          {
            "name": "nanoid",
            "direct": false,
            "version": "3.3.4",
            "ecosystem": "npm"
          },
          {
            "name": "path-key",
            "direct": false,
            "version": "3.1.1",
            "ecosystem": "npm"
          },
          {
            "name": "resize-observer-polyfill",
            "direct": false,
            "version": "1.5.2",
            "ecosystem": "npm"
          },
          {
            "name": "shebang-command",
            "direct": false,
            "version": "2.0.0",
            "ecosystem": "npm"
          },
          {
            "name": "shebang-regex",
            "direct": false,
            "version": "3.0.0",
            "ecosystem": "npm"
          },
          {
            "name": "which",
            "direct": false,
            "version": "2.0.2",
            "ecosystem": "npm"
          },
          {
            "name": "annotated-types",
            "direct": false,
            "version": "0.7.0",
            "ecosystem": "pypi"
          },
          {
            "name": "anyio",
            "direct": false,
            "version": "4.6.2.post1",
            "ecosystem": "pypi"
          },
          {
            "name": "anyio",
            "direct": false,
            "version": "4.9.0",
            "ecosystem": "pypi"
          },
          {
            "name": "brotli",
            "direct": false,
            "version": "1.1.0",
            "ecosystem": "pypi"
          },
          {
            "name": "brotlicffi",
            "direct": false,
            "version": "1.1.0.0",
            "ecosystem": "pypi"
          },
          {
            "name": "certifi",
            "direct": false,
            "version": "2025.1.31",
            "ecosystem": "pypi"
          },
          {
            "name": "certifi",
            "direct": false,
            "version": "2025.10.5",
            "ecosystem": "pypi"
          },
          {
            "name": "cffi",
            "direct": false,
            "version": "1.17.1",
            "ecosystem": "pypi"
          },
          {
            "name": "charset-normalizer",
            "direct": false,
            "version": "3.4.1",
            "ecosystem": "pypi"
          },
          {
            "name": "click",
            "direct": false,
            "version": "7.1.2",
            "ecosystem": "pypi"
          },
          {
            "name": "click",
            "direct": false,
            "version": "8.1.8",
            "ecosystem": "pypi"
          },
          {
            "name": "colorama",
            "direct": false,
            "version": "0.4.6",
            "ecosystem": "pypi"
          },
          {
            "name": "dnspython",
            "direct": false,
            "version": "2.7.0",
            "ecosystem": "pypi"
          },
          {
            "name": "email-validator",
            "direct": false,
            "version": "2.2.0",
            "ecosystem": "pypi"
          },
          {
            "name": "fastapi",
            "direct": false,
            "version": "0.111.1",
            "ecosystem": "pypi"
          },
          {
            "name": "fastapi-cli",
            "direct": false,
            "version": "0.0.7",
            "ecosystem": "pypi"
          },
          {
            "name": "h11",
            "direct": false,
            "version": "0.14.0",
            "ecosystem": "pypi"
          },
          {
            "name": "h2",
            "direct": false,
            "version": "4.2.0",
            "ecosystem": "pypi"
          },
          {
            "name": "hpack",
            "direct": false,
            "version": "4.1.0",
            "ecosystem": "pypi"
          },
          {
            "name": "httpcore",
            "direct": false,
            "version": "1.0.7",
            "ecosystem": "pypi"
          },
          {
            "name": "httptools",
            "direct": false,
            "version": "0.6.4",
            "ecosystem": "pypi"
          },
          {
            "name": "httpx",
            "direct": false,
            "version": "0.28.1",
            "ecosystem": "pypi"
          },
          {
            "name": "hyperframe",
            "direct": false,
            "version": "6.1.0",
            "ecosystem": "pypi"
          },
          {
            "name": "idna",
            "direct": false,
            "version": "3.10",
            "ecosystem": "pypi"
          },
          {
            "name": "itsdangerous",
            "direct": false,
            "version": "2.2.0",
            "ecosystem": "pypi"
          },
          {
            "name": "jinja2",
            "direct": false,
            "version": "3.1.6",
            "ecosystem": "pypi"
          },
          {
            "name": "markdown-it-py",
            "direct": false,
            "version": "3.0.0",
            "ecosystem": "pypi"
          },
          {
            "name": "markupsafe",
            "direct": false,
            "version": "3.0.2",
            "ecosystem": "pypi"
          },
          {
            "name": "mdurl",
            "direct": false,
            "version": "0.1.2",
            "ecosystem": "pypi"
          },
          {
            "name": "orjson",
            "direct": false,
            "version": "3.10.16",
            "ecosystem": "pypi"
          },
          {
            "name": "pprintpp",
            "direct": false,
            "version": "0.4.0",
            "ecosystem": "pypi"
          },
          {
            "name": "pycparser",
            "direct": false,
            "version": "2.22",
            "ecosystem": "pypi"
          },
          {
            "name": "pydantic",
            "direct": false,
            "version": "2.11.0",
            "ecosystem": "pypi"
          },
          {
            "name": "pydantic-core",
            "direct": false,
            "version": "2.33.0",
            "ecosystem": "pypi"
          },
          {
            "name": "pydantic-extra-types",
            "direct": false,
            "version": "2.10.3",
            "ecosystem": "pypi"
          },
          {
            "name": "pydantic-settings",
            "direct": false,
            "version": "2.8.1",
            "ecosystem": "pypi"
          },
          {
            "name": "pygments",
            "direct": false,
            "version": "1.6",
            "ecosystem": "pypi"
          },
          {
            "name": "pygments",
            "direct": false,
            "version": "2.19.1",
            "ecosystem": "pypi"
          },
          {
            "name": "python-dotenv",
            "direct": false,
            "version": "1.1.0",
            "ecosystem": "pypi"
          },
          {
            "name": "python-multipart",
            "direct": false,
            "version": "0.0.20",
            "ecosystem": "pypi"
          },
          {
            "name": "pyyaml",
            "direct": false,
            "version": "6.0.2",
            "ecosystem": "pypi"
          },
          {
            "name": "requests",
            "direct": false,
            "version": "2.32.3",
            "ecosystem": "pypi"
          },
          {
            "name": "rich",
            "direct": false,
            "version": "0.3.3",
            "ecosystem": "pypi"
          },
          {
            "name": "rich",
            "direct": false,
            "version": "13.9.4",
            "ecosystem": "pypi"
          },
          {
            "name": "rich-toolkit",
            "direct": false,
            "version": "0.14.0",
            "ecosystem": "pypi"
          },
          {
            "name": "shellingham",
            "direct": false,
            "version": "1.5.4",
            "ecosystem": "pypi"
          },
          {
            "name": "sniffio",
            "direct": false,
            "version": "1.3.1",
            "ecosystem": "pypi"
          },
          {
            "name": "socksio",
            "direct": false,
            "version": "1.0.0",
            "ecosystem": "pypi"
          },
          {
            "name": "starlette",
            "direct": false,
            "version": "0.37.2",
            "ecosystem": "pypi"
          },
          {
            "name": "typer",
            "direct": false,
            "version": "0.15.2",
            "ecosystem": "pypi"
          },
          {
            "name": "typing-extensions",
            "direct": false,
            "version": "3.10.0.2",
            "ecosystem": "pypi"
          },
          {
            "name": "typing-extensions",
            "direct": false,
            "version": "4.13.0",
            "ecosystem": "pypi"
          },
          {
            "name": "typing-inspection",
            "direct": false,
            "version": "0.4.0",
            "ecosystem": "pypi"
          },
          {
            "name": "ujson",
            "direct": false,
            "version": "5.10.0",
            "ecosystem": "pypi"
          },
          {
            "name": "urllib3",
            "direct": false,
            "version": "2.3.0",
            "ecosystem": "pypi"
          },
          {
            "name": "uvicorn",
            "direct": false,
            "version": "0.34.0",
            "ecosystem": "pypi"
          },
          {
            "name": "uvloop",
            "direct": false,
            "version": "0.21.0",
            "ecosystem": "pypi"
          },
          {
            "name": "watchfiles",
            "direct": false,
            "version": "1.0.4",
            "ecosystem": "pypi"
          },
          {
            "name": "websockets",
            "direct": false,
            "version": "15.0.1",
            "ecosystem": "pypi"
          }
        ],
        "collected": true,
        "truncated": false,
        "total_count": 429,
        "direct_count": 104,
        "indirect_count": 325
      }
    },
    "maintainership": {
      "issues": {
        "open_prs": 0,
        "merged_prs": 0,
        "open_issues": 0,
        "closed_ratio": null,
        "closed_issues": 0,
        "closed_unmerged_prs": 4
      },
      "bus_factor": 2,
      "bot_contributors": 2,
      "top_contributors": [
        {
          "type": "User",
          "login": "wagoodman",
          "commits": 794,
          "avatar_url": "https://avatars.githubusercontent.com/u/590471?v=4"
        },
        {
          "type": "User",
          "login": "spiffcs",
          "commits": 206,
          "avatar_url": "https://avatars.githubusercontent.com/u/32073428?v=4"
        },
        {
          "type": "User",
          "login": "kzantow",
          "commits": 185,
          "avatar_url": "https://avatars.githubusercontent.com/u/3009477?v=4"
        },
        {
          "type": "User",
          "login": "luhring",
          "commits": 113,
          "avatar_url": "https://avatars.githubusercontent.com/u/5199289?v=4"
        },
        {
          "type": "User",
          "login": "westonsteimel",
          "commits": 83,
          "avatar_url": "https://avatars.githubusercontent.com/u/1593939?v=4"
        },
        {
          "type": "User",
          "login": "willmurphyscode",
          "commits": 67,
          "avatar_url": "https://avatars.githubusercontent.com/u/12529630?v=4"
        },
        {
          "type": "User",
          "login": "LaurentGoderre",
          "commits": 37,
          "avatar_url": "https://avatars.githubusercontent.com/u/1090826?v=4"
        },
        {
          "type": "User",
          "login": "jonasagx",
          "commits": 28,
          "avatar_url": "https://avatars.githubusercontent.com/u/774704?v=4"
        },
        {
          "type": "User",
          "login": "witchcraze",
          "commits": 22,
          "avatar_url": "https://avatars.githubusercontent.com/u/67056980?v=4"
        },
        {
          "type": "User",
          "login": "coheigea",
          "commits": 20,
          "avatar_url": "https://avatars.githubusercontent.com/u/472162?v=4"
        }
      ],
      "contributors_sampled": 98,
      "top_contributor_share": 0.44
    },
    "quality_signals": {
      "has_ci": true,
      "has_tests": true,
      "ci_workflows": [
        "codeql-analysis.yml",
        "dependabot-automation.yaml",
        "detect-schema-changes.yaml",
        "oss-project-board-add.yaml",
        "release.yaml",
        "remove-awaiting-response-label.yaml",
        "test-fixture-cache-publish.yaml",
        "update-anchore-dependencies.yml",
        "update-bootstrap-tools.yml",
        "update-cpe-dictionary-index.yml",
        "update-spdx-license-list.yaml",
        "validate-github-actions.yaml",
        "validations.yaml"
      ],
      "has_docs_dir": false,
      "linter_configs": [
        ".golangci.yaml"
      ],
      "has_editorconfig": false,
      "has_linter_config": true,
      "has_precommit_config": false
    },
    "security_signals": {
      "lockfiles": [
        "Cargo.lock",
        "Gemfile.lock",
        "Pipfile.lock",
        "composer.lock",
        "go.sum",
        "mix.lock",
        "package-lock.json",
        "packages.lock.json",
        "pdm.lock",
        "pnpm-lock.yaml",
        "poetry.lock",
        "uv.lock",
        "yarn.lock"
      ],
      "scorecard": {
        "checks": [
          {
            "name": "Binary-Artifacts",
            "score": 0,
            "reason": "binaries present in source code",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#binary-artifacts"
          },
          {
            "name": "Branch-Protection",
            "score": 0,
            "reason": "branch protection not enabled on development/release branches",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#branch-protection"
          },
          {
            "name": "CI-Tests",
            "score": null,
            "reason": "no pull request found",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#ci-tests"
          },
          {
            "name": "CII-Best-Practices",
            "score": 0,
            "reason": "no effort to earn an OpenSSF best practices badge detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#cii-best-practices"
          },
          {
            "name": "Code-Review",
            "score": 0,
            "reason": "Found 0/30 approved changesets -- score normalized to 0",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#code-review"
          },
          {
            "name": "Contributors",
            "score": 10,
            "reason": "project has 35 contributing companies or organizations",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#contributors"
          },
          {
            "name": "Dangerous-Workflow",
            "score": 10,
            "reason": "no dangerous workflow patterns detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dangerous-workflow"
          },
          {
            "name": "Dependency-Update-Tool",
            "score": 10,
            "reason": "update tool detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dependency-update-tool"
          },
          {
            "name": "Fuzzing",
            "score": 0,
            "reason": "project is not fuzzed",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#fuzzing"
          },
          {
            "name": "License",
            "score": 10,
            "reason": "license file detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#license"
          },
          {
            "name": "Maintained",
            "score": 0,
            "reason": "0 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 0",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#maintained"
          },
          {
            "name": "Packaging",
            "score": null,
            "reason": "packaging workflow not detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#packaging"
          },
          {
            "name": "Pinned-Dependencies",
            "score": 6,
            "reason": "dependency not pinned by hash detected -- score normalized to 6",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#pinned-dependencies"
          },
          {
            "name": "SAST",
            "score": 10,
            "reason": "SAST tool detected: CodeQL",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#sast"
          },
          {
            "name": "Security-Policy",
            "score": 10,
            "reason": "security policy file detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#security-policy"
          },
          {
            "name": "Signed-Releases",
            "score": 0,
            "reason": "Project has not signed or included provenance with any releases.",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#signed-releases"
          },
          {
            "name": "Token-Permissions",
            "score": 9,
            "reason": "detected GitHub workflow tokens with excessive permissions",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#token-permissions"
          },
          {
            "name": "Vulnerabilities",
            "score": 0,
            "reason": "319 existing vulnerabilities detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#vulnerabilities"
          }
        ],
        "commit": "55a190aed1608103733d4f75c6454658fa69da22",
        "ran_at": "2026-07-25T10:11:27Z",
        "aggregate_score": 4.3,
        "scorecard_version": "v5.5.0"
      },
      "has_codeql_workflow": true,
      "has_security_policy": true,
      "has_dependabot_config": true
    },
    "contribution_flow": {
      "collected": true,
      "ci_last_run_at": "2026-03-16T07:18:33Z",
      "oldest_open_prs": [],
      "last_merged_pr_at": null,
      "ci_last_conclusion": "SKIPPED",
      "oldest_open_issues": []
    }
  },
  "config": {
    "disabled_metrics": [],
    "disabled_categories": [],
    "disabled_components": {}
  },
  "source": {
    "url": "https://github.com/wagoodman/syft",
    "host": "github.com",
    "name": "syft",
    "owner": "wagoodman"
  },
  "metrics": {
    "overall": {
      "key": "overall",
      "band": "at_risk",
      "name": "Overall health",
      "note": null,
      "notes": [],
      "value": 40,
      "inputs": {
        "security": 42,
        "vitality": 42,
        "community": 14,
        "governance": 46,
        "engineering": 52
      },
      "components": []
    },
    "categories": [
      {
        "key": "vitality",
        "band": "at_risk",
        "name": "Vitality",
        "value": 42,
        "weight": 0.22,
        "metrics": [
          {
            "key": "development_activity",
            "band": "at_risk",
            "name": "Development activity",
            "note": null,
            "notes": [],
            "value": 38,
            "inputs": {
              "commits_last_year": 293,
              "human_commit_share": 0.4,
              "days_since_last_push": 196,
              "active_weeks_last_year": 23
            },
            "components": [
              {
                "key": "push_recency",
                "name": "Push recency",
                "detail": "last push 196 days ago",
                "points": 3.6,
                "status": "partial",
                "details": [
                  {
                    "code": "push_recency",
                    "params": {
                      "days": 196
                    }
                  }
                ],
                "max_points": 36
              },
              {
                "key": "commit_cadence",
                "name": "Commit cadence",
                "detail": "23/52 weeks with commits",
                "points": 15.9,
                "status": "partial",
                "details": [
                  {
                    "code": "commit_cadence_weeks",
                    "params": {
                      "weeks": 23
                    }
                  }
                ],
                "max_points": 36
              },
              {
                "key": "commit_volume",
                "name": "Commit volume",
                "detail": "293 commits in the last year",
                "points": 18,
                "status": "met",
                "details": [
                  {
                    "code": "commits_last_year",
                    "params": {
                      "count": 293
                    }
                  }
                ],
                "max_points": 18
              },
              {
                "key": "openssf_scorecard_maintained",
                "name": "OpenSSF Scorecard: Maintained",
                "detail": "0 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 0",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 10
              }
            ]
          },
          {
            "key": "release_discipline",
            "band": "at_risk",
            "name": "Release discipline",
            "note": null,
            "notes": [],
            "value": 47,
            "inputs": {
              "releases_count": 1,
              "latest_release_tag": "v0.0.0",
              "releases_from_tags": false,
              "days_since_latest_release": 611,
              "mean_days_between_releases": null
            },
            "components": [
              {
                "key": "ships_releases",
                "name": "Ships releases",
                "detail": "1 releases published",
                "points": 27,
                "status": "met",
                "details": [
                  {
                    "code": "releases_published",
                    "params": {
                      "count": 1
                    }
                  }
                ],
                "max_points": 27
              },
              {
                "key": "release_recency",
                "name": "Release recency",
                "detail": "latest release 611 days ago",
                "points": 7.2,
                "status": "partial",
                "details": [
                  {
                    "code": "release_recency",
                    "params": {
                      "days": 611
                    }
                  }
                ],
                "max_points": 36
              },
              {
                "key": "release_cadence",
                "name": "Release cadence",
                "detail": "cadence unknown (single release)",
                "points": 12.6,
                "status": "partial",
                "details": [
                  {
                    "code": "release_cadence_unknown",
                    "params": {}
                  }
                ],
                "max_points": 27
              },
              {
                "key": "openssf_scorecard_signed_releases",
                "name": "OpenSSF Scorecard: Signed-Releases",
                "detail": "Project has not signed or included provenance with any releases.",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 10
              }
            ]
          },
          {
            "key": "abandonment",
            "band": "excellent",
            "name": "Abandonment",
            "note": null,
            "notes": [],
            "value": 100,
            "inputs": {
              "cap": null,
              "state": "dormant",
              "guards": [
                "no_open_demand"
              ],
              "signals": [
                "unfixed_advisory",
                "scorecard_unmaintained"
              ],
              "red_flag": false,
              "multiplier_pct": 100,
              "declared_reason": null,
              "unverified_reason": null,
              "unanswered_open_prs": 0,
              "unanswered_open_issues": 0,
              "days_since_last_merged_pr": null,
              "days_since_last_human_commit": 197,
              "days_since_last_human_commit_is_floor": false
            },
            "components": [
              {
                "key": "project_is_still_maintained",
                "name": "Project is still maintained",
                "detail": "no human commit for 197 days, with nothing left unanswered; held at dormant by nothing open to answer",
                "points": 100,
                "status": "met",
                "details": [
                  {
                    "code": "abandonment_quiet",
                    "params": {
                      "days": 197
                    }
                  },
                  {
                    "code": "abandonment_guarded",
                    "params": {
                      "guards": "nothing open to answer"
                    }
                  }
                ],
                "max_points": 100
              }
            ]
          }
        ],
        "description": "Is the project alive — is code being written and are releases shipping?"
      },
      {
        "key": "community",
        "band": "critical",
        "name": "Community & Adoption",
        "value": 14,
        "weight": 0.18,
        "metrics": [
          {
            "key": "popularity",
            "band": "critical",
            "name": "Popularity & adoption",
            "note": null,
            "notes": [],
            "value": 5,
            "inputs": {
              "forks": 1,
              "stars": 3,
              "watchers": 0,
              "growth_state": "unverified",
              "growth_factor_pct": 100,
              "growth_unverified_reason": "no_history"
            },
            "components": [
              {
                "key": "stars",
                "name": "Stars",
                "detail": "3 stars",
                "points": 4.9,
                "status": "partial",
                "details": [
                  {
                    "code": "stars",
                    "params": {
                      "count": 3
                    }
                  }
                ],
                "max_points": 60
              },
              {
                "key": "forks",
                "name": "Forks",
                "detail": "1 forks",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "forks",
                    "params": {
                      "count": 1
                    }
                  }
                ],
                "max_points": 25
              },
              {
                "key": "watchers",
                "name": "Watchers",
                "detail": "0 watchers",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "watchers",
                    "params": {
                      "count": 0
                    }
                  }
                ],
                "max_points": 15
              }
            ]
          },
          {
            "key": "community_health",
            "band": "critical",
            "name": "Community health",
            "note": null,
            "notes": [],
            "value": 25,
            "inputs": {
              "has_readme": false,
              "has_license": false,
              "has_contributing": false,
              "has_issue_template": false,
              "has_code_of_conduct": false,
              "has_pull_request_template": false
            },
            "components": [
              {
                "key": "readme",
                "name": "README",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 22.5
              },
              {
                "key": "license",
                "name": "License",
                "detail": "recognized license (Apache-2.0)",
                "points": 22.5,
                "status": "met",
                "details": [
                  {
                    "code": "license_standard",
                    "params": {}
                  },
                  {
                    "code": "license_spdx",
                    "params": {
                      "spdx": "Apache-2.0"
                    }
                  }
                ],
                "max_points": 22.5
              },
              {
                "key": "contributing_guide",
                "name": "CONTRIBUTING guide",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 18
              },
              {
                "key": "code_of_conduct",
                "name": "Code of conduct",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 13.5
              },
              {
                "key": "issue_template",
                "name": "Issue template",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.2
              },
              {
                "key": "pr_template",
                "name": "PR template",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 6.3
              }
            ]
          }
        ],
        "description": "Does the project have users, downloads, attention, and a welcoming setup for contributors?"
      },
      {
        "key": "governance",
        "band": "at_risk",
        "name": "Sustainability & Governance",
        "value": 46,
        "weight": 0.24,
        "metrics": [
          {
            "key": "maintainer_resilience",
            "band": "moderate",
            "name": "Maintainer resilience (bus factor)",
            "note": null,
            "notes": [],
            "value": 61,
            "inputs": {
              "bus_factor": 2,
              "contributors_sampled": 98,
              "top_contributor_share": 0.44
            },
            "components": [
              {
                "key": "bus_factor",
                "name": "Bus factor",
                "detail": "2 contributor(s) cover half of all commits",
                "points": 25.2,
                "status": "partial",
                "details": [
                  {
                    "code": "bus_factor",
                    "params": {
                      "count": 2
                    }
                  }
                ],
                "max_points": 54
              },
              {
                "key": "commit_distribution",
                "name": "Commit distribution",
                "detail": "top contributor authored 44% of commits",
                "points": 12.6,
                "status": "partial",
                "details": [
                  {
                    "code": "top_contributor_share",
                    "params": {
                      "share": 44
                    }
                  }
                ],
                "max_points": 22.5
              },
              {
                "key": "contributor_breadth",
                "name": "Contributor breadth",
                "detail": "98 contributors",
                "points": 13.5,
                "status": "met",
                "details": [
                  {
                    "code": "contributors_sampled",
                    "params": {
                      "count": 98
                    }
                  }
                ],
                "max_points": 13.5
              },
              {
                "key": "openssf_scorecard_contributors",
                "name": "OpenSSF Scorecard: Contributors",
                "detail": "project has 35 contributing companies or organizations",
                "points": 10,
                "status": "met",
                "details": [],
                "max_points": 10
              }
            ]
          },
          {
            "key": "responsiveness",
            "band": "critical",
            "name": "Issue & PR responsiveness",
            "note": "Excluded from scoring (no data or not applicable): Issue resolution. Remaining weights renormalized.",
            "notes": [
              {
                "code": "excluded_no_data",
                "params": {
                  "components": [
                    "issue_resolution"
                  ]
                }
              },
              {
                "code": "weights_renormalized",
                "params": {}
              }
            ],
            "value": 1,
            "inputs": {
              "merged_prs": 0,
              "open_issues": 0,
              "closed_issues": 0,
              "issue_closed_ratio": null,
              "closed_unmerged_prs": 4
            },
            "components": [
              {
                "key": "issue_resolution",
                "name": "Issue resolution",
                "detail": "no issues or no data",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "no_issues_or_data",
                    "params": {}
                  }
                ],
                "max_points": 46.75
              },
              {
                "key": "pr_acceptance",
                "name": "PR acceptance",
                "detail": "0/4 decided PRs merged",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "decided_prs_merged",
                    "params": {
                      "merged": 0,
                      "decided": 4
                    }
                  }
                ],
                "max_points": 38.25
              },
              {
                "key": "openssf_scorecard_code_review",
                "name": "OpenSSF Scorecard: Code-Review",
                "detail": "Found 0/30 approved changesets -- score normalized to 0",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 15
              }
            ]
          },
          {
            "key": "stewardship",
            "band": "good",
            "name": "Ownership & stewardship",
            "note": "Excluded from scoring (no data or not applicable): Verified domain. Remaining weights renormalized.",
            "notes": [
              {
                "code": "excluded_no_data",
                "params": {
                  "components": [
                    "verified_domain"
                  ]
                }
              },
              {
                "code": "weights_renormalized",
                "params": {}
              }
            ],
            "value": 73,
            "inputs": {
              "followers": 1675,
              "owner_type": "User",
              "is_verified": null,
              "owner_login": "wagoodman",
              "public_repos": 110,
              "account_age_days": 5655
            },
            "components": [
              {
                "key": "ownership_backing",
                "name": "Ownership backing",
                "detail": "personal (user) account",
                "points": 10,
                "status": "partial",
                "details": [
                  {
                    "code": "owner_personal",
                    "params": {}
                  }
                ],
                "max_points": 30
              },
              {
                "key": "verified_domain",
                "name": "Verified domain",
                "detail": "not applicable to user accounts",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "not_applicable_to_user_accounts",
                    "params": {}
                  }
                ],
                "max_points": 20
              },
              {
                "key": "owner_reach",
                "name": "Owner reach",
                "detail": "1,675 followers of wagoodman",
                "points": 23.2,
                "status": "partial",
                "details": [
                  {
                    "code": "owner_followers",
                    "params": {
                      "count": 1675,
                      "login": "wagoodman"
                    }
                  }
                ],
                "max_points": 25
              },
              {
                "key": "track_record",
                "name": "Track record",
                "detail": "110 public repos, account ~15 yr old",
                "points": 25,
                "status": "met",
                "details": [
                  {
                    "code": "public_repos",
                    "params": {
                      "count": 110
                    }
                  },
                  {
                    "code": "account_age_years",
                    "params": {
                      "years": 15
                    }
                  }
                ],
                "max_points": 25
              }
            ]
          }
        ],
        "description": "Will the project survive its people — bus factor, responsiveness, who backs it, and package upkeep?"
      },
      {
        "key": "engineering",
        "band": "moderate",
        "name": "Engineering Quality",
        "value": 52,
        "weight": 0.2,
        "metrics": [
          {
            "key": "engineering_practices",
            "band": "good",
            "name": "Engineering practices",
            "note": "Excluded from scoring (no data or not applicable): OpenSSF Scorecard: CI-Tests. Remaining weights renormalized.",
            "notes": [
              {
                "code": "excluded_no_data",
                "params": {
                  "components": [
                    "openssf_scorecard_ci_tests"
                  ]
                }
              },
              {
                "code": "weights_renormalized",
                "params": {}
              }
            ],
            "value": 80,
            "inputs": {
              "has_ci": true,
              "has_tests": true,
              "has_editorconfig": false,
              "has_linter_config": true,
              "has_precommit_config": false
            },
            "components": [
              {
                "key": "ci_workflows",
                "name": "CI workflows",
                "detail": "13 workflow(s)",
                "points": 24,
                "status": "met",
                "details": [
                  {
                    "code": "ci_workflows",
                    "params": {
                      "count": 13
                    }
                  }
                ],
                "max_points": 24
              },
              {
                "key": "tests_present",
                "name": "Tests present",
                "detail": null,
                "points": 24,
                "status": "met",
                "details": [],
                "max_points": 24
              },
              {
                "key": "linter_config",
                "name": "Linter config",
                "detail": ".golangci.yaml",
                "points": 16,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": ".golangci.yaml"
                    }
                  }
                ],
                "max_points": 16
              },
              {
                "key": "pre_commit_hooks",
                "name": "Pre-commit hooks",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 9.6
              },
              {
                "key": "editorconfig",
                "name": ".editorconfig",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 6.4
              },
              {
                "key": "openssf_scorecard_ci_tests",
                "name": "OpenSSF Scorecard: CI-Tests",
                "detail": "no pull request found",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "no_data",
                    "params": {}
                  }
                ],
                "max_points": 20
              }
            ]
          },
          {
            "key": "documentation",
            "band": "critical",
            "name": "Documentation",
            "note": null,
            "notes": [],
            "value": 10,
            "inputs": {
              "topics": [],
              "has_wiki": true,
              "homepage": null,
              "has_readme": false,
              "has_docs_dir": false,
              "has_description": false
            },
            "components": [
              {
                "key": "readme",
                "name": "README",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 30
              },
              {
                "key": "documentation_directory",
                "name": "Documentation directory",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 25
              },
              {
                "key": "documentation_homepage_site",
                "name": "Documentation / homepage site",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 15
              },
              {
                "key": "repository_description",
                "name": "Repository description",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 10
              },
              {
                "key": "topics",
                "name": "Topics",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 10
              },
              {
                "key": "wiki",
                "name": "Wiki",
                "detail": null,
                "points": 10,
                "status": "met",
                "details": [],
                "max_points": 10
              }
            ]
          }
        ],
        "description": "Are baseline engineering and documentation practices in place?"
      },
      {
        "key": "security",
        "band": "at_risk",
        "name": "Security",
        "value": 42,
        "weight": 0.16,
        "metrics": [
          {
            "key": "security_posture",
            "band": "at_risk",
            "name": "Security posture",
            "note": "Excluded from scoring (no data or not applicable): CI-Tests, Packaging. Remaining weights renormalized.",
            "notes": [
              {
                "code": "excluded_no_data",
                "params": {
                  "components": [
                    "ci_tests",
                    "packaging"
                  ]
                }
              },
              {
                "code": "weights_renormalized",
                "params": {}
              }
            ],
            "value": 43,
            "inputs": {
              "source": "openssf_scorecard",
              "checks_evaluated": 16,
              "scorecard_version": "v5.5.0",
              "checks_inconclusive": 2,
              "scorecard_aggregate": 4.3
            },
            "components": [
              {
                "key": "binary_artifacts",
                "name": "Binary-Artifacts",
                "detail": "binaries present in source code",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "branch_protection",
                "name": "Branch-Protection",
                "detail": "branch protection not enabled on development/release branches",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "ci_tests",
                "name": "CI-Tests",
                "detail": "no pull request found",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "no_data",
                    "params": {}
                  }
                ],
                "max_points": 2.5
              },
              {
                "key": "cii_best_practices",
                "name": "CII-Best-Practices",
                "detail": "no effort to earn an OpenSSF best practices badge detected",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 2.5
              },
              {
                "key": "code_review",
                "name": "Code-Review",
                "detail": "Found 0/30 approved changesets -- score normalized to 0",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "contributors",
                "name": "Contributors",
                "detail": "project has 35 contributing companies or organizations",
                "points": 2.5,
                "status": "met",
                "details": [],
                "max_points": 2.5
              },
              {
                "key": "dangerous_workflow",
                "name": "Dangerous-Workflow",
                "detail": "no dangerous workflow patterns detected",
                "points": 10,
                "status": "met",
                "details": [],
                "max_points": 10
              },
              {
                "key": "dependency_update_tool",
                "name": "Dependency-Update-Tool",
                "detail": "update tool detected",
                "points": 7.5,
                "status": "met",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "fuzzing",
                "name": "Fuzzing",
                "detail": "project is not fuzzed",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 5
              },
              {
                "key": "license",
                "name": "License",
                "detail": "license file detected",
                "points": 2.5,
                "status": "met",
                "details": [],
                "max_points": 2.5
              },
              {
                "key": "maintained",
                "name": "Maintained",
                "detail": "0 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 0",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "packaging",
                "name": "Packaging",
                "detail": "packaging workflow not detected",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "no_data",
                    "params": {}
                  }
                ],
                "max_points": 5
              },
              {
                "key": "pinned_dependencies",
                "name": "Pinned-Dependencies",
                "detail": "dependency not pinned by hash detected -- score normalized to 6",
                "points": 3,
                "status": "partial",
                "details": [],
                "max_points": 5
              },
              {
                "key": "sast",
                "name": "SAST",
                "detail": "SAST tool detected: CodeQL",
                "points": 5,
                "status": "met",
                "details": [],
                "max_points": 5
              },
              {
                "key": "security_policy",
                "name": "Security-Policy",
                "detail": "security policy file detected",
                "points": 5,
                "status": "met",
                "details": [],
                "max_points": 5
              },
              {
                "key": "signed_releases",
                "name": "Signed-Releases",
                "detail": "Project has not signed or included provenance with any releases.",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "token_permissions",
                "name": "Token-Permissions",
                "detail": "detected GitHub workflow tokens with excessive permissions",
                "points": 6.8,
                "status": "partial",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "vulnerabilities",
                "name": "Vulnerabilities",
                "detail": "319 existing vulnerabilities detected",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.5
              }
            ]
          },
          {
            "key": "dependency_advisories",
            "band": "at_risk",
            "name": "Dependency advisories",
            "note": "Excluded from scoring (no data or not applicable): Indirect dependencies free of known advisories. Remaining weights renormalized. Matched 428 resolved dependencies against OSV; 1 could not be assessed (no resolved version, an unsupported ecosystem, or beyond the reported package list). This repository publishes no package the index resolves, so the repository dependency graph was assessed instead. That graph mixes development and test pins with shipped dependencies, so only the declared runtime dependencies are scored; transitive findings are reported as context and excluded from the score. Reachability is not analyzed.",
            "notes": [
              {
                "code": "excluded_no_data",
                "params": {
                  "components": [
                    "indirect_dependencies_free_of_known_advisories"
                  ]
                }
              },
              {
                "code": "weights_renormalized",
                "params": {}
              },
              {
                "code": "advisories_scope_repository",
                "params": {
                  "assessed": 428
                }
              },
              {
                "code": "advisories_unassessed",
                "params": {
                  "count": 1
                }
              },
              {
                "code": "advisories_repo_graph_caveat",
                "params": {}
              },
              {
                "code": "advisories_reachability",
                "params": {}
              }
            ],
            "value": 39,
            "inputs": {
              "source": "osv",
              "advisories": 195,
              "affected_packages": 43,
              "assessed_packages": 428,
              "unassessed_packages": 1,
              "affected_by_severity": "critical 4, high 18, moderate 14, low 3, unknown 4",
              "direct_affected_packages": 7
            },
            "components": [
              {
                "key": "direct_dependencies_free_of_known_advisories",
                "name": "Direct dependencies free of known advisories",
                "detail": "7 affected: github.com/go-git/go-billy/v5 v5.7.0 (high 8.1), github.com/hashicorp/go-getter v1.8.4 (high 7.5), github.com/anchore/stereoscope v0.0.0-20200706164556-7cf39d7f4639 (moderate 5.3), +4 more",
                "points": 6.5,
                "status": "partial",
                "details": [
                  {
                    "code": "advisories_affected",
                    "params": {
                      "count": 7,
                      "packages": "github.com/go-git/go-billy/v5 v5.7.0 (high 8.1), github.com/hashicorp/go-getter v1.8.4 (high 7.5), github.com/anchore/stereoscope v0.0.0-20200706164556-7cf39d7f4639 (moderate 5.3)"
                    }
                  },
                  {
                    "code": "advisories_affected_more",
                    "params": {
                      "count": 4
                    }
                  }
                ],
                "max_points": 35
              },
              {
                "key": "indirect_dependencies_free_of_known_advisories",
                "name": "Indirect dependencies free of known advisories",
                "detail": "transitive set not separable from development and test dependencies in this scope",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "advisories_scope_not_separable",
                    "params": {}
                  }
                ],
                "max_points": 25
              },
              {
                "key": "no_advisories_left_outstanding",
                "name": "No advisories left outstanding",
                "detail": "5 advisory-carrying package(s) unaddressed past 90 days; oldest published 905 days ago",
                "points": 22.9,
                "status": "partial",
                "details": [
                  {
                    "code": "advisories_stale",
                    "params": {
                      "days": 90,
                      "count": 5,
                      "oldest": 905
                    }
                  }
                ],
                "max_points": 40
              }
            ]
          },
          {
            "key": "malicious_dependencies",
            "band": "excellent",
            "name": "Malicious dependencies",
            "note": null,
            "notes": [],
            "value": 100,
            "inputs": {
              "source": "osv",
              "meaning": "reported as a malicious package by the OpenSSF corpus; the remedy is removal or moving off the compromised name, never an upgrade of the same artifact. Versions the registry has since pulled are listed but not scored",
              "packages": [],
              "red_flag": false,
              "assessed_packages": 428,
              "malicious_packages": 0,
              "direct_malicious_packages": 0,
              "withdrawn_malicious_packages": 0,
              "installable_malicious_packages": 0
            },
            "components": [
              {
                "key": "no_dependency_reported_as_a_malicious_package",
                "name": "No dependency reported as a malicious package",
                "detail": "no dependency is reported as a malicious package",
                "points": 100,
                "status": "met",
                "details": [
                  {
                    "code": "no_malicious_dependencies",
                    "params": {}
                  }
                ],
                "max_points": 100
              }
            ]
          },
          {
            "key": "high_risk_jurisdiction_exposure",
            "band": "excellent",
            "name": "High-Risk Jurisdiction Exposure",
            "note": "Only high-confidence self-published location evidence affects this multiplier. Ambiguous matches are review-only; country evidence is not proof of nationality, citizenship, legal registration, malicious intent, or sanctions status.",
            "notes": [
              {
                "code": "jurisdiction_evidence_limits",
                "params": {}
              }
            ],
            "value": 100,
            "inputs": {
              "meaning": "self-published location evidence; not nationality or citizenship",
              "red_flag": false,
              "exposures": [],
              "policy_countries": [
                "Russia",
                "Iran",
                "North Korea"
              ],
              "review_only_matches": 0,
              "assessed_self_published_locations": 11
            },
            "components": [
              {
                "key": "policy_exposure_multiplier",
                "name": "Policy exposure multiplier",
                "detail": "no confirmed policy-scope location match",
                "points": 100,
                "status": "met",
                "details": [
                  {
                    "code": "jurisdiction_no_match",
                    "params": {}
                  }
                ],
                "max_points": 100
              }
            ]
          }
        ],
        "description": "Are visible security and supply-chain practices strong, with no malicious dependency and no unresolved high-risk jurisdiction exposure?"
      },
      {
        "key": "ai_readiness",
        "band": "moderate",
        "name": "AI Readiness",
        "value": 67,
        "weight": 0,
        "metrics": [
          {
            "key": "ai_agent_context",
            "band": "at_risk",
            "name": "Agent context & guidance",
            "note": null,
            "notes": [],
            "value": 40,
            "inputs": {
              "has_llms_txt": false,
              "legible_history_share": 1,
              "agent_instruction_files": [],
              "agent_instruction_max_bytes": null
            },
            "components": [
              {
                "key": "agent_instructions",
                "name": "Agent instructions",
                "detail": "no CLAUDE.md / AGENTS.md / editor rules",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "no_agent_instructions",
                    "params": {}
                  }
                ],
                "max_points": 45
              },
              {
                "key": "machine_readable_docs_llms_txt",
                "name": "Machine-readable docs (llms.txt)",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 15
              },
              {
                "key": "legible_commit_history",
                "name": "Legible commit history",
                "detail": "40 of 40 human commits state their intent (structured subject or explanatory body)",
                "points": 40,
                "status": "met",
                "details": [
                  {
                    "code": "legible_history",
                    "params": {
                      "legible": 40,
                      "sampled": 40
                    }
                  }
                ],
                "max_points": 40
              }
            ]
          },
          {
            "key": "ai_verify_loop",
            "band": "excellent",
            "name": "Verify loop (build / test / typecheck)",
            "note": null,
            "notes": [],
            "value": 86,
            "inputs": {
              "has_nix": false,
              "has_tests": true,
              "lockfiles": [
                "Cargo.lock",
                "Gemfile.lock",
                "Pipfile.lock",
                "composer.lock",
                "go.sum",
                "mix.lock",
                "package-lock.json",
                "packages.lock.json",
                "pdm.lock",
                "pnpm-lock.yaml",
                "poetry.lock",
                "uv.lock",
                "yarn.lock"
              ],
              "has_dockerfile": true,
              "typed_language": true,
              "bootstrap_files": [
                "Makefile",
                "Taskfile.yaml",
                "cmd/syft/internal/test/integration/test-fixtures/Makefile",
                "schema/cyclonedx/Makefile",
                "syft/file/cataloger/executable/test-fixtures/Makefile",
                "syft/file/cataloger/executable/test-fixtures/elf/Makefile",
                "syft/file/cataloger/executable/test-fixtures/elf/project/Makefile",
                "syft/file/cataloger/executable/test-fixtures/shared-info/Makefile",
                "syft/file/cataloger/executable/test-fixtures/shared-info/project/Makefile",
                "syft/file/cataloger/executable/test-fixtures/shared-info/project/hello/Makefile",
                "syft/file/cataloger/executable/test-fixtures/shared-info/project/libhello/Makefile",
                "syft/pkg/cataloger/binary/test-fixtures/Makefile",
                "syft/pkg/cataloger/binary/test-fixtures/elf-test-fixtures/elfbinwithcorrupt/elfsrc/makefile",
                "syft/pkg/cataloger/binary/test-fixtures/elf-test-fixtures/elfbinwithcorrupt/makefile",
                "syft/pkg/cataloger/binary/test-fixtures/elf-test-fixtures/elfbinwithnestedlib/elfsrc/makefile",
                "syft/pkg/cataloger/binary/test-fixtures/elf-test-fixtures/elfbinwithnestedlib/makefile",
                "syft/pkg/cataloger/binary/test-fixtures/elf-test-fixtures/elfbinwithsisterlib/elfsrc1/makefile",
                "syft/pkg/cataloger/binary/test-fixtures/elf-test-fixtures/elfbinwithsisterlib/elfsrc2/makefile",
                "syft/pkg/cataloger/binary/test-fixtures/elf-test-fixtures/elfbinwithsisterlib/makefile",
                "syft/pkg/cataloger/dotnet/test-fixtures/Makefile",
                "syft/pkg/cataloger/golang/test-fixtures/Makefile",
                "syft/pkg/cataloger/golang/test-fixtures/archs/Makefile",
                "syft/pkg/cataloger/internal/pe/test-fixtures/Makefile",
                "syft/pkg/cataloger/java/test-fixtures/Makefile",
                "syft/pkg/cataloger/java/test-fixtures/jar-metadata/Makefile",
                "syft/pkg/cataloger/java/test-fixtures/java-builds/Makefile",
                "syft/pkg/cataloger/kernel/test-fixtures/Makefile",
                "syft/pkg/cataloger/redhat/test-fixtures/Makefile",
                "test/cli/test-fixtures/Makefile",
                "test/cli/test-fixtures/image-java-spdx-tools/Makefile",
                "test/cli/test-fixtures/registry/Makefile",
                "test/install/Makefile"
              ],
              "has_devcontainer": false,
              "has_linter_config": true,
              "typecheck_configs": [],
              "agent_commit_share": 0,
              "toolchain_manifests": [
                "cmd/syft/internal/test/integration/test-fixtures/image-go-bin-arch-coverage/go.mod",
                "cmd/syft/internal/test/integration/test-fixtures/image-pkg-coverage/pkgs/go/go.mod",
                "cmd/syft/internal/test/integration/test-fixtures/image-pkg-coverage/pkgs/java/pom.xml",
                "cmd/syft/internal/test/integration/test-fixtures/image-sbom-cataloger/go.mod",
                "go.mod",
                "syft/pkg/cataloger/dotnet/test-fixtures/image-net2-app/src/helloworld.csproj",
                "syft/pkg/cataloger/dotnet/test-fixtures/image-net6-asp-libman/src/LibManSample.csproj",
                "syft/pkg/cataloger/dotnet/test-fixtures/image-net8-app-no-depjson/src/dotnetapp.csproj",
                "syft/pkg/cataloger/dotnet/test-fixtures/image-net8-app-self-contained/src/dotnetapp.csproj",
                "syft/pkg/cataloger/dotnet/test-fixtures/image-net8-app-single-file/src/dotnetapp.csproj",
                "syft/pkg/cataloger/dotnet/test-fixtures/image-net8-app-with-runtime-nodepsjson/src/dotnetapp.csproj",
                "syft/pkg/cataloger/dotnet/test-fixtures/image-net8-app-with-runtime/src/dotnetapp.csproj",
                "syft/pkg/cataloger/dotnet/test-fixtures/image-net8-app/src/dotnetapp.csproj",
                "syft/pkg/cataloger/dotnet/test-fixtures/image-net8-compile-target/src/helloworld.csproj",
                "syft/pkg/cataloger/dotnet/test-fixtures/image-net8-ilrepack/src/dotnetapp.csproj",
                "syft/pkg/cataloger/dotnet/test-fixtures/image-net8-privateassets/src/dotnetapp.csproj",
                "syft/pkg/cataloger/golang/test-fixtures/archs/src/go.mod",
                "syft/pkg/cataloger/golang/test-fixtures/corrupt/go.mod",
                "syft/pkg/cataloger/golang/test-fixtures/glob-paths/src/go.mod",
                "syft/pkg/cataloger/golang/test-fixtures/go-mod-fixtures/many-packages/go.mod",
                "syft/pkg/cataloger/golang/test-fixtures/go-mod-fixtures/one-package/go.mod",
                "syft/pkg/cataloger/golang/test-fixtures/go-mod-fixtures/relative-replace/go.mod",
                "syft/pkg/cataloger/golang/test-fixtures/go-source/go.mod",
                "syft/pkg/cataloger/golang/test-fixtures/go-sum-hashes/go.mod",
                "syft/pkg/cataloger/golang/test-fixtures/image-not-a-module/go.mod",
                "syft/pkg/cataloger/golang/test-fixtures/image-small-upx/go.mod",
                "syft/pkg/cataloger/golang/test-fixtures/image-small/go.mod",
                "syft/pkg/cataloger/internal/pe/test-fixtures/image-dotnet31-single-file/src/hello.csproj",
                "syft/pkg/cataloger/internal/pe/test-fixtures/image-dotnet5-single-file/src/hello.csproj",
                "syft/pkg/cataloger/internal/pe/test-fixtures/image-dotnet6-single-file/src/hello.csproj",
                "syft/pkg/cataloger/java/internal/maven/test-fixtures/local/child-1/pom.xml",
                "syft/pkg/cataloger/java/internal/maven/test-fixtures/local/child-2/pom.xml",
                "syft/pkg/cataloger/java/internal/maven/test-fixtures/local/child-3/pom.xml",
                "syft/pkg/cataloger/java/internal/maven/test-fixtures/local/circular-1/pom.xml",
                "syft/pkg/cataloger/java/internal/maven/test-fixtures/local/circular-2/pom.xml",
                "syft/pkg/cataloger/java/internal/maven/test-fixtures/local/contains-child-1/pom.xml",
                "syft/pkg/cataloger/java/internal/maven/test-fixtures/local/parent-1/pom.xml",
                "syft/pkg/cataloger/java/internal/maven/test-fixtures/local/parent-2/pom.xml",
                "syft/pkg/cataloger/java/internal/maven/test-fixtures/local/parent-3/pom.xml",
                "syft/pkg/cataloger/java/test-fixtures/corrupt/pom.xml",
                "syft/pkg/cataloger/java/test-fixtures/glob-paths/src/pom.xml",
                "syft/pkg/cataloger/java/test-fixtures/gradle/build.gradle",
                "syft/pkg/cataloger/java/test-fixtures/jar-metadata/api-all-2.0.0-sources/META-INF/maven/org.apache.directory.api/api-all/pom.xml",
                "syft/pkg/cataloger/java/test-fixtures/jar-metadata/api-all-2.0.0-sources/META-INF/maven/org.apache.directory.api/api-asn1-api/pom.xml",
                "syft/pkg/cataloger/java/test-fixtures/jar-metadata/com.fasterxml.jackson.core.jackson-core-2.15.2/META-INF/maven/com.fasterxml.jackson.core/jackson-core/pom.xml",
                "syft/pkg/cataloger/java/test-fixtures/jar-metadata/commons-lang3-3.12.0/META-INF/maven/org.apache.commons-lang3/pom.xml",
                "syft/pkg/cataloger/java/test-fixtures/jar-metadata/jackson-core-2.15.2/META-INF/maven/com.fasterxml.jackson.core/jackson-core/pom.xml",
                "syft/pkg/cataloger/java/test-fixtures/jar-metadata/micronaut-aop-4.9.11/META-INF/maven/io.micronaut/micronaut-aop/pom.xml",
                "syft/pkg/cataloger/java/test-fixtures/jar-metadata/multiple-matching-2.11.5/META-INF/maven/org.multiple/multiple-matching-1/pom.xml",
                "syft/pkg/cataloger/java/test-fixtures/jar-metadata/multiple-matching-2.11.5/META-INF/maven/org.multiple/multiple-matching-2/pom.xml",
                "syft/pkg/cataloger/java/test-fixtures/jar-metadata/multiple-matching-2.11.5/META-INF/maven/org.multiple/multiple-matching-3/pom.xml",
                "syft/pkg/cataloger/java/test-fixtures/jar-metadata/opensaml-core-3.4.6/META-INF/maven/org.opensaml/opensaml-core/pom.xml",
                "syft/pkg/cataloger/java/test-fixtures/jar-metadata/org.multiple-thename/META-INF/maven/com.multiple/thename/pom.xml",
                "syft/pkg/cataloger/java/test-fixtures/jar-metadata/org.multiple-thename/META-INF/maven/org.multiple/thename/pom.xml",
                "syft/pkg/cataloger/java/test-fixtures/java-builds/example-java-app/build.gradle",
                "syft/pkg/cataloger/java/test-fixtures/java-builds/example-java-app/pom.xml",
                "syft/pkg/cataloger/java/test-fixtures/java-builds/example-jenkins-plugin/pom.xml",
                "syft/pkg/cataloger/java/test-fixtures/java-builds/example-sb-app/pom.xml",
                "syft/pkg/cataloger/java/test-fixtures/pom/commons-text-1.10.0/pom.xml",
                "syft/pkg/cataloger/java/test-fixtures/pom/example-java-app-maven/pom.xml",
                "syft/pkg/cataloger/java/test-fixtures/pom/transitive-top-level/pom.xml",
                "syft/pkg/cataloger/rust/test-fixtures/image-audit/Cargo.toml"
              ],
              "dependency_bot_commit_share": 0.47
            },
            "components": [
              {
                "key": "one_command_bootstrap",
                "name": "One-command bootstrap",
                "detail": "Makefile, Taskfile.yaml, cmd/syft/internal/test/integration/test-fixtures/Makefile, schema/cyclonedx/Makefile, syft/file/cataloger/executable/test-fixtures/Makefile, syft/file/cataloger/executable/test-fixtures/elf/Makefile, syft/file/cataloger/executable/test-fixtures/elf/project/Makefile, syft/file/cataloger/executable/test-fixtures/shared-info/Makefile, syft/file/cataloger/executable/test-fixtures/shared-info/project/Makefile, syft/file/cataloger/executable/test-fixtures/shared-info/project/hello/Makefile, syft/file/cataloger/executable/test-fixtures/shared-info/project/libhello/Makefile, syft/pkg/cataloger/binary/test-fixtures/Makefile, syft/pkg/cataloger/binary/test-fixtures/elf-test-fixtures/elfbinwithcorrupt/elfsrc/makefile, syft/pkg/cataloger/binary/test-fixtures/elf-test-fixtures/elfbinwithcorrupt/makefile, syft/pkg/cataloger/binary/test-fixtures/elf-test-fixtures/elfbinwithnestedlib/elfsrc/makefile, syft/pkg/cataloger/binary/test-fixtures/elf-test-fixtures/elfbinwithnestedlib/makefile, syft/pkg/cataloger/binary/test-fixtures/elf-test-fixtures/elfbinwithsisterlib/elfsrc1/makefile, syft/pkg/cataloger/binary/test-fixtures/elf-test-fixtures/elfbinwithsisterlib/elfsrc2/makefile, syft/pkg/cataloger/binary/test-fixtures/elf-test-fixtures/elfbinwithsisterlib/makefile, syft/pkg/cataloger/dotnet/test-fixtures/Makefile, syft/pkg/cataloger/golang/test-fixtures/Makefile, syft/pkg/cataloger/golang/test-fixtures/archs/Makefile, syft/pkg/cataloger/internal/pe/test-fixtures/Makefile, syft/pkg/cataloger/java/test-fixtures/Makefile, syft/pkg/cataloger/java/test-fixtures/jar-metadata/Makefile, syft/pkg/cataloger/java/test-fixtures/java-builds/Makefile, syft/pkg/cataloger/kernel/test-fixtures/Makefile, syft/pkg/cataloger/redhat/test-fixtures/Makefile, test/cli/test-fixtures/Makefile, test/cli/test-fixtures/image-java-spdx-tools/Makefile, test/cli/test-fixtures/registry/Makefile, test/install/Makefile",
                "points": 18,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": "Makefile, Taskfile.yaml, cmd/syft/internal/test/integration/test-fixtures/Makefile, schema/cyclonedx/Makefile, syft/file/cataloger/executable/test-fixtures/Makefile, syft/file/cataloger/executable/test-fixtures/elf/Makefile, syft/file/cataloger/executable/test-fixtures/elf/project/Makefile, syft/file/cataloger/executable/test-fixtures/shared-info/Makefile, syft/file/cataloger/executable/test-fixtures/shared-info/project/Makefile, syft/file/cataloger/executable/test-fixtures/shared-info/project/hello/Makefile, syft/file/cataloger/executable/test-fixtures/shared-info/project/libhello/Makefile, syft/pkg/cataloger/binary/test-fixtures/Makefile, syft/pkg/cataloger/binary/test-fixtures/elf-test-fixtures/elfbinwithcorrupt/elfsrc/makefile, syft/pkg/cataloger/binary/test-fixtures/elf-test-fixtures/elfbinwithcorrupt/makefile, syft/pkg/cataloger/binary/test-fixtures/elf-test-fixtures/elfbinwithnestedlib/elfsrc/makefile, syft/pkg/cataloger/binary/test-fixtures/elf-test-fixtures/elfbinwithnestedlib/makefile, syft/pkg/cataloger/binary/test-fixtures/elf-test-fixtures/elfbinwithsisterlib/elfsrc1/makefile, syft/pkg/cataloger/binary/test-fixtures/elf-test-fixtures/elfbinwithsisterlib/elfsrc2/makefile, syft/pkg/cataloger/binary/test-fixtures/elf-test-fixtures/elfbinwithsisterlib/makefile, syft/pkg/cataloger/dotnet/test-fixtures/Makefile, syft/pkg/cataloger/golang/test-fixtures/Makefile, syft/pkg/cataloger/golang/test-fixtures/archs/Makefile, syft/pkg/cataloger/internal/pe/test-fixtures/Makefile, syft/pkg/cataloger/java/test-fixtures/Makefile, syft/pkg/cataloger/java/test-fixtures/jar-metadata/Makefile, syft/pkg/cataloger/java/test-fixtures/java-builds/Makefile, syft/pkg/cataloger/kernel/test-fixtures/Makefile, syft/pkg/cataloger/redhat/test-fixtures/Makefile, test/cli/test-fixtures/Makefile, test/cli/test-fixtures/image-java-spdx-tools/Makefile, test/cli/test-fixtures/registry/Makefile, test/install/Makefile"
                    }
                  }
                ],
                "max_points": 18
              },
              {
                "key": "automated_tests",
                "name": "Automated tests",
                "detail": null,
                "points": 22,
                "status": "met",
                "details": [],
                "max_points": 22
              },
              {
                "key": "lint_format_config",
                "name": "Lint / format config",
                "detail": ".golangci.yaml",
                "points": 11,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": ".golangci.yaml"
                    }
                  }
                ],
                "max_points": 11
              },
              {
                "key": "static_type_checking",
                "name": "Static type checking",
                "detail": "Go (statically typed)",
                "points": 11,
                "status": "met",
                "details": [
                  {
                    "code": "statically_typed_language",
                    "params": {
                      "language": "Go"
                    }
                  }
                ],
                "max_points": 11
              },
              {
                "key": "reproducible_environment",
                "name": "Reproducible environment",
                "detail": "Dockerfile, lockfile",
                "points": 10,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": "Dockerfile, lockfile"
                    }
                  }
                ],
                "max_points": 10
              },
              {
                "key": "demonstrated_agent_practice",
                "name": "Demonstrated agent practice",
                "detail": "no agent-authored commits among the last 100",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "no_agent_authored_commits",
                    "params": {
                      "sampled": 100
                    }
                  }
                ],
                "max_points": 10
              },
              {
                "key": "automated_maintenance",
                "name": "Automated maintenance",
                "detail": "47 of the last 100 commits are automated dependency updates",
                "points": 8,
                "status": "met",
                "details": [
                  {
                    "code": "dependency_bot_commits",
                    "params": {
                      "count": 47,
                      "sampled": 100
                    }
                  }
                ],
                "max_points": 8
              },
              {
                "key": "openssf_scorecard_pinned_dependencies",
                "name": "OpenSSF Scorecard: Pinned-Dependencies",
                "detail": "dependency not pinned by hash detected -- score normalized to 6",
                "points": 6,
                "status": "partial",
                "details": [],
                "max_points": 10
              }
            ]
          },
          {
            "key": "ai_code_legibility",
            "band": "excellent",
            "name": "Code legibility for models",
            "note": null,
            "notes": [],
            "value": 100,
            "inputs": {
              "primary_language": "Go",
              "largest_source_bytes": 212636,
              "source_files_sampled": 1181,
              "oversized_source_files": 6
            },
            "components": [
              {
                "key": "type_checkable_code",
                "name": "Type-checkable code",
                "detail": "Go (statically typed)",
                "points": 45,
                "status": "met",
                "details": [
                  {
                    "code": "statically_typed_language",
                    "params": {
                      "language": "Go"
                    }
                  }
                ],
                "max_points": 45
              },
              {
                "key": "manageable_file_sizes",
                "name": "Manageable file sizes",
                "detail": "6/1181 source files over 60KB",
                "points": 54.7,
                "status": "partial",
                "details": [
                  {
                    "code": "oversized_source_files",
                    "params": {
                      "kb": 60,
                      "sampled": 1181,
                      "oversized": 6
                    }
                  }
                ],
                "max_points": 55
              }
            ]
          },
          {
            "key": "ai_interfaces",
            "band": "at_risk",
            "name": "Machine-readable interfaces",
            "note": null,
            "notes": [],
            "value": 40,
            "inputs": {
              "example_dirs": [
                "example",
                "examples",
                "sample"
              ],
              "has_mcp_signal": false,
              "api_schema_files": []
            },
            "components": [
              {
                "key": "api_schema_openapi_graphql_proto",
                "name": "API schema (OpenAPI/GraphQL/proto)",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 40
              },
              {
                "key": "mcp_server",
                "name": "MCP server",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 20
              },
              {
                "key": "runnable_examples",
                "name": "Runnable examples",
                "detail": "example, examples, sample",
                "points": 40,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": "example, examples, sample"
                    }
                  }
                ],
                "max_points": 40
              }
            ]
          }
        ],
        "description": "How well is the repo equipped to be developed and maintained with AI coding agents? An independent, experimental badge — weight 0.0, so it is surfaced on its own and does not affect the overall health score."
      }
    ],
    "metrics_version": "1.13.0"
  },
  "warnings": [
    "Star history unavailable: GitHub GraphQL error: Resource not accessible by personal access token",
    "Community profile unavailable",
    "go package 'github.com/anchore/syft' points at a different repository (https://github.com/anchore/syft); excluded from ecosystem scoring"
  ],
  "report_type": "repository",
  "generated_at": "2026-07-25T10:11:49.329453Z",
  "schema_version": "0.27.0",
  "badge_url": "https://raw.githubusercontent.com/inspect-software/badges/main/v1/w/wagoodman/syft.svg",
  "full_name": "wagoodman/syft",
  "license_state": "standard",
  "license_spdx": "Apache-2.0"
}

相关记录

与 wagoodman/syft 共享目录标签或生态系统的已检测仓库。 并排阅读 →

94wandb/wandbThe AI developer platform. Use Weights & Biases to train and fine-tune models, and manage models from experimentation to production.优秀93apache/airflowApache Airflow - A platform to programmatically author, schedule, and monitor workflows优秀92envoyproxy/envoyCloud-native high-performance edge/middle/service proxy优秀92moby/mobyThe Moby Project - a collaborative project for the container ecosystem to assemble container-based systems优秀91hashicorp/consulConsul is a distributed, highly available, and data center aware solution to connect and configure applications across dynamic, distributed infrastructure.优秀91Elastic/beats:tropical_fish: Beats - Lightweight shippers for Elasticsearch & Logstash优秀

评分是信号，而非担保。 评分反映的是 GitHub 上公开可见的实践——不是代码审计，也不是安全保证。

缺失数据将被剔除并重新归一化权重，绝不按零分计。方法论已版本化并公开：指标 v1.13.0、模式 v0.27.0—— 完整方法论 · 指标知识库.

单项结果在整体记录中的位置： 汇总统计 — Go.