{ "history": [ { "added": 0, "commit": "e0078793c05291a4cb4dc890d8f8f7769180beab", "date": "2026-11-01", "dependencies": 329, "errors": [], "fixable": 13, "go_version": null, "in_binary": null, "new_vulnerabilities": 0, "osv_confirmed": 13, "osv_only": 0, "ref": "v13.6.0", "release_changed": false, "release_integrity": "checksums-only", "removed": 0, "resolved_vulnerabilities": 0, "scorecard": null, "upgraded": 0, "vulnerabilities": { "Critical": 1, "High": 4, "Low": 2, "Medium": 6, "Negligible": 0, "Unknown": 0 }, "workflow": { "High": 1, "Low": 30, "Medium": 0, "files": 27 } }, { "added": 0, "commit": "e0078793c05291a4cb4dc890d8f8f7769180beab", "date": "2026-11-02", "dependencies": 329, "errors": [], "fixable": 13, "go_version": null, "in_binary": null, "kev": 0, "kev_new": 0, "new_vulnerabilities": 0, "osv_confirmed": 13, "osv_only": 0, "ref": "v13.6.0", "release_changed": false, "release_integrity": "checksums-only", "removed": 0, "resolved_vulnerabilities": 0, "scorecard": null, "scorecard_date": null, "scorecard_note": "the project is not in the OpenSSF public dataset; the Scorecard CLI fallback was skipped because this shard's weekly budget was used", "scorecard_source": null, "upgraded": 0, "vulnerabilities": { "Critical": 1, "High": 4, "Low": 2, "Medium": 6, "Negligible": 0, "Unknown": 0 }, "vulnerable_packages": 8, "workflow": { "High": 1, "Low": 30, "Medium": 0, "files": 27 } } ], "latest": { "archived": false, "category": "SBOM Generation", "changes": { "added": [], "any": false, "baseline": false, "integrity_drift": 0, "license_changes": [], "new_vulnerabilities": [], "previous_ref": "v13.6.0", "release_changed": false, "removed": [], "resolved_vulnerabilities": [], "upgraded": [], "workflow_new": 0, "workflow_resolved": 0 }, "commit": "e0078793c05291a4cb4dc890d8f8f7769180beab", "compliance": { "overall_score": 55, "standards": { "bsi_tr03183": { "failed_checks": [ "Component Creator", "Distribution Licences", "SHA-512 Hash", "Dependency Relationship", "SBOM Creator Contact" ], "passed": 4, "score": 44, "total": 9 }, "cisa": { "failed_checks": [ "Software Producer", "Dependency Relationship", "License Information", "Component Hash", "SBOM Author" ], "passed": 5, "score": 50, "total": 10 }, "ntia": { "failed_checks": [ "Supplier Name", "Dependency Relationship" ], "passed": 5, "score": 71, "total": 7 } } }, "components": [ { "ecosystem": "github", "licenses": [], "location": ".github/workflows/repotests.yml", "name": "actions/cache", "purl": "pkg:github/actions/cache@v6.1.0", "version": "v6.1.0" }, { "ecosystem": "github", "licenses": [], "location": ".github/workflows/agent-plugin.yml", "name": "actions/checkout", "purl": "pkg:github/actions/checkout@v7.0.1", "version": "v7.0.1" }, { "ecosystem": "github", "licenses": [], "location": ".github/workflows/build-image.yml", "name": "actions/github-script", "purl": "pkg:github/actions/github-script@v9.0.0", "version": "v9.0.0" }, { "ecosystem": "github", "licenses": [], "location": ".github/workflows/repotests.yml", "name": "actions/setup-dotnet", "purl": "pkg:github/actions/setup-dotnet@v6.0.0", "version": "v6.0.0" }, { "ecosystem": "github", "licenses": [], "location": ".github/workflows/repotests-quick.yml", "name": "actions/setup-go", "purl": "pkg:github/actions/setup-go@v7.0.0", "version": "v7.0.0" }, { "ecosystem": "github", "licenses": [], "location": ".github/workflows/binary-builds.yml", "name": "actions/setup-java", "purl": "pkg:github/actions/setup-java@v6.1.0", "version": "v6.1.0" }, { "ecosystem": "github", "licenses": [], "location": ".github/workflows/agent-plugin.yml", "name": "actions/setup-node", "purl": "pkg:github/actions/setup-node@v7.1.0", "version": "v7.1.0" }, { "ecosystem": "github", "licenses": [], "location": ".github/workflows/image-build.yml", "name": "actions/setup-python", "purl": "pkg:github/actions/setup-python@v7.1.0", "version": "v7.1.0" }, { "ecosystem": "github", "licenses": [], "location": ".github/workflows/binary-builds.yml", "name": "actions/upload-artifact", "purl": "pkg:github/actions/upload-artifact@v7.0.2", "version": "v7.0.2" }, { "ecosystem": "github", "licenses": [], "location": ".github/workflows/repotests.yml", "name": "android-actions/setup-android", "purl": "pkg:github/android-actions/setup-android@v4.0.4", "version": "v4.0.4" }, { "ecosystem": "github", "licenses": [], "location": ".github/workflows/project-sync.yml", "name": "cdxgen/.github/.github/workflows/project-sync.yml", "purl": "pkg:github/cdxgen/.github@b1465b8f2735aec854721269d1285f61a3895156#.github/workflows/project-sync.yml", "version": "b1465b8f2735aec854721269d1285f61a3895156" }, { "ecosystem": "github", "licenses": [], "location": ".github/workflows/npm-release.yml", "name": "cloudposse/github-action-matrix-outputs-write", "purl": "pkg:github/cloudposse/github-action-matrix-outputs-write@v1", "version": "v1" }, { "ecosystem": "github", "licenses": [], "location": ".github/workflows/python-atom-tests.yml", "name": "coursier/cache-action", "purl": "pkg:github/coursier/cache-action@v8.2.0", "version": "v8.2.0" }, { "ecosystem": "github", "licenses": [], "location": ".github/workflows/repotests.yml", "name": "coursier/setup-action", "purl": "pkg:github/coursier/setup-action@v3.0.4", "version": "v3.0.4" }, { "ecosystem": "github", "licenses": [], "location": ".github/workflows/deno.yml", "name": "denoland/setup-deno", "purl": "pkg:github/denoland/setup-deno@v2.0.5", "version": "v2.0.5" }, { "ecosystem": "github", "licenses": [], "location": ".github/actions/build-docker-image/action.yml", "name": "docker/build-push-action", "purl": "pkg:github/docker/build-push-action@v7.4.0", "version": "v7.4.0" }, { "ecosystem": "github", "licenses": [], "location": ".github/workflows/image-build.yml", "name": "docker/login-action", "purl": "pkg:github/docker/login-action@v4.6.0", "version": "v4.6.0" }, { "ecosystem": "github", "licenses": [], "location": ".github/workflows/image-build.yml", "name": "docker/metadata-action", "purl": "pkg:github/docker/metadata-action@v6.2.0", "version": "v6.2.0" }, { "ecosystem": "github", "licenses": [], "location": ".github/workflows/image-build.yml", "name": "docker/setup-buildx-action", "purl": "pkg:github/docker/setup-buildx-action@v4.4.1", "version": "v4.4.1" }, { "ecosystem": "github", "licenses": [], "location": ".github/workflows/npm-release.yml", "name": "docker/setup-qemu-action", "purl": "pkg:github/docker/setup-qemu-action@v4.4.0", "version": "v4.4.0" }, { "ecosystem": "github", "licenses": [], "location": ".github/workflows/codeql.yml", "name": "github/codeql-action/analyze", "purl": "pkg:github/github/codeql-action@v2.27.3#analyze", "version": "v2.27.3" }, { "ecosystem": "github", "licenses": [], "location": ".github/workflows/codeql.yml", "name": "github/codeql-action/init", "purl": "pkg:github/github/codeql-action@v2.27.3#init", "version": "v2.27.3" }, { "ecosystem": "github", "licenses": [], "location": ".github/workflows/image-build.yml", "name": "int128/docker-manifest-create-action", "purl": "pkg:github/int128/docker-manifest-create-action@v2.29.0", "version": "v2.29.0" }, { "ecosystem": "github", "licenses": [], "location": ".github/workflows/image-build.yml", "name": "jlumbroso/free-disk-space", "purl": "pkg:github/jlumbroso/free-disk-space@v2.0.0", "version": "v2.0.0" }, { "ecosystem": "github", "licenses": [], "location": ".github/workflows/bun.yml", "name": "oven-sh/setup-bun", "purl": "pkg:github/oven-sh/setup-bun@v2.2.0", "version": "v2.2.0" }, { "ecosystem": "github", "licenses": [], "location": ".github/workflows/binary-builds.yml", "name": "pnpm/action-setup", "purl": "pkg:github/pnpm/action-setup@v6.1.0", "version": "v6.1.0" }, { "ecosystem": "github", "licenses": [], "location": ".github/workflows/repotests.yml", "name": "ruby/setup-ruby", "purl": "pkg:github/ruby/setup-ruby@v1.333.0", "version": "v1.333.0" }, { "ecosystem": "github", "licenses": [], "location": ".github/workflows/repotests.yml", "name": "sbt/setup-sbt", "purl": "pkg:github/sbt/setup-sbt@v1.5.12", "version": "v1.5.12" }, { "ecosystem": "github", "licenses": [], "location": ".github/workflows/binary-builds.yml", "name": "softprops/action-gh-release", "purl": "pkg:github/softprops/action-gh-release@v3.0.3", "version": "v3.0.3" }, { "ecosystem": "npm", "licenses": [], "location": "pnpm-lock.yaml", "name": "@appthreat/atom", "purl": "pkg:npm/%40appthreat/atom@3.1.1", "version": "3.1.1" }, { "ecosystem": "npm", "licenses": [], "location": "pnpm-lock.yaml", "name": "@appthreat/atom-common", "purl": "pkg:npm/%40appthreat/atom-common@1.1.0", "version": "1.1.0" }, { "ecosystem": "npm", "licenses": [], "location": "pnpm-lock.yaml", "name": "@appthreat/atom-darwin-amd64", "purl": "pkg:npm/%40appthreat/atom-darwin-amd64@3.1.1", "version": "3.1.1" }, { "ecosystem": "npm", "licenses": [], "location": "pnpm-lock.yaml", "name": "@appthreat/atom-darwin-arm64", "purl": "pkg:npm/%40appthreat/atom-darwin-arm64@3.1.1", "version": "3.1.1" }, { "ecosystem": "npm", "licenses": [], "location": "pnpm-lock.yaml", "name": "@appthreat/atom-jar", "purl": "pkg:npm/%40appthreat/atom-jar@3.1.1", "version": "3.1.1" }, { "ecosystem": "npm", "licenses": [], "location": "pnpm-lock.yaml", "name": "@appthreat/atom-linux-amd64", "purl": "pkg:npm/%40appthreat/atom-linux-amd64@3.1.1", "version": "3.1.1" }, { "ecosystem": "npm", "licenses": [], "location": "pnpm-lock.yaml", "name": "@appthreat/atom-linux-amd64-musl", "purl": "pkg:npm/%40appthreat/atom-linux-amd64-musl@3.1.1", "version": "3.1.1" }, { "ecosystem": "npm", "licenses": [], "location": "pnpm-lock.yaml", "name": "@appthreat/atom-linux-arm64", "purl": "pkg:npm/%40appthreat/atom-linux-arm64@3.1.1", "version": "3.1.1" }, { "ecosystem": "npm", "licenses": [], "location": "pnpm-lock.yaml", "name": "@appthreat/atom-linux-arm64-musl", "purl": "pkg:npm/%40appthreat/atom-linux-arm64-musl@3.1.1", "version": "3.1.1" }, { "ecosystem": "npm", "licenses": [], "location": "pnpm-lock.yaml", "name": "@appthreat/atom-parsetools", "purl": "pkg:npm/%40appthreat/atom-parsetools@1.10.6", "version": "1.10.6" }, { "ecosystem": "npm", "licenses": [], "location": "pnpm-lock.yaml", "name": "@appthreat/atom-windows-amd64", "purl": "pkg:npm/%40appthreat/atom-windows-amd64@3.1.1", "version": "3.1.1" }, { "ecosystem": "npm", "licenses": [], "location": "pnpm-lock.yaml", "name": "@appthreat/atom-windows-arm64", "purl": "pkg:npm/%40appthreat/atom-windows-arm64@3.1.1", "version": "3.1.1" }, { "ecosystem": "npm", "licenses": [], "location": "pnpm-lock.yaml", "name": "@babel/code-frame", "purl": "pkg:npm/%40babel/code-frame@8.0.6", "version": "8.0.6" }, { "ecosystem": "npm", "licenses": [], "location": "pnpm-lock.yaml", "name": "@babel/generator", "purl": "pkg:npm/%40babel/generator@8.0.6", "version": "8.0.6" }, { "ecosystem": "npm", "licenses": [], "location": "pnpm-lock.yaml", "name": "@babel/helper-globals", "purl": "pkg:npm/%40babel/helper-globals@8.0.6", "version": "8.0.6" }, { "ecosystem": "npm", "licenses": [], "location": "pnpm-lock.yaml", "name": "@babel/helper-string-parser", "purl": "pkg:npm/%40babel/helper-string-parser@8.0.6", "version": "8.0.6" }, { "ecosystem": "npm", "licenses": [], "location": "pnpm-lock.yaml", "name": "@babel/helper-validator-identifier", "purl": "pkg:npm/%40babel/helper-validator-identifier@8.0.6", "version": "8.0.6" }, { "ecosystem": "npm", "licenses": [], "location": "pnpm-lock.yaml", "name": "@babel/parser", "purl": "pkg:npm/%40babel/parser@8.0.7", "version": "8.0.7" }, { "ecosystem": "npm", "licenses": [], "location": "pnpm-lock.yaml", "name": "@babel/template", "purl": "pkg:npm/%40babel/template@8.0.0", "version": "8.0.0" }, { "ecosystem": "npm", "licenses": [], "location": "pnpm-lock.yaml", "name": "@babel/traverse", "purl": "pkg:npm/%40babel/traverse@8.0.7", "version": "8.0.7" }, { "ecosystem": "npm", "licenses": [], "location": "pnpm-lock.yaml", "name": "@babel/types", "purl": "pkg:npm/%40babel/types@8.0.6", "version": "8.0.6" }, { "ecosystem": "npm", "licenses": [], "location": "pnpm-lock.yaml", "name": "@biomejs/biome", "purl": "pkg:npm/%40biomejs/biome@2.5.15", "version": "2.5.15" }, { "ecosystem": "npm", "licenses": [], "location": "pnpm-lock.yaml", "name": "@biomejs/cli-darwin-arm64", "purl": "pkg:npm/%40biomejs/cli-darwin-arm64@2.5.15", "version": "2.5.15" }, { "ecosystem": "npm", "licenses": [], "location": "pnpm-lock.yaml", "name": "@biomejs/cli-darwin-x64", "purl": "pkg:npm/%40biomejs/cli-darwin-x64@2.5.15", "version": "2.5.15" }, { "ecosystem": "npm", "licenses": [], "location": "pnpm-lock.yaml", "name": "@biomejs/cli-linux-arm64", "purl": "pkg:npm/%40biomejs/cli-linux-arm64@2.5.15", "version": "2.5.15" }, { "ecosystem": "npm", "licenses": [], "location": "pnpm-lock.yaml", "name": "@biomejs/cli-linux-arm64-musl", "purl": "pkg:npm/%40biomejs/cli-linux-arm64-musl@2.5.15", "version": "2.5.15" }, { "ecosystem": "npm", "licenses": [], "location": "pnpm-lock.yaml", "name": "@biomejs/cli-linux-x64", "purl": "pkg:npm/%40biomejs/cli-linux-x64@2.5.15", "version": "2.5.15" }, { "ecosystem": "npm", "licenses": [], "location": "pnpm-lock.yaml", "name": "@biomejs/cli-linux-x64-musl", "purl": "pkg:npm/%40biomejs/cli-linux-x64-musl@2.5.15", "version": "2.5.15" }, { "ecosystem": "npm", "licenses": [], "location": "pnpm-lock.yaml", "name": "@biomejs/cli-win32-arm64", "purl": "pkg:npm/%40biomejs/cli-win32-arm64@2.5.15", "version": "2.5.15" }, { "ecosystem": "npm", "licenses": [], "location": "pnpm-lock.yaml", "name": "@biomejs/cli-win32-x64", "purl": "pkg:npm/%40biomejs/cli-win32-x64@2.5.15", "version": "2.5.15" }, { "ecosystem": "npm", "licenses": [], "location": "pnpm-lock.yaml", "name": "@bufbuild/protobuf", "purl": "pkg:npm/%40bufbuild/protobuf@2.15.0", "version": "2.15.0" }, { "ecosystem": "npm", "licenses": [], "location": "pnpm-lock.yaml", "name": "@bufbuild/protobuf", "purl": "pkg:npm/%40bufbuild/protobuf@2.16.0", "version": "2.16.0" }, { "ecosystem": "npm", "licenses": [], "location": "pnpm-lock.yaml", "name": "@cdxgen/cdx-hbom", "purl": "pkg:npm/%40cdxgen/cdx-hbom@0.7.0", "version": "0.7.0" }, { "ecosystem": "npm", "licenses": [], "location": "pnpm-lock.yaml", "name": "@cdxgen/cdx-proto", "purl": "pkg:npm/%40cdxgen/cdx-proto@2.3.0", "version": "2.3.0" }, { "ecosystem": "npm", "licenses": [], "location": "pnpm-lock.yaml", "name": "@cdxgen/cdx-purl", "purl": "pkg:npm/%40cdxgen/cdx-purl@0.0.6", "version": "0.0.6" }, { "ecosystem": "npm", "licenses": [], "location": "pnpm-lock.yaml", "name": "@cdxgen/cdxgen-plugins-bin", "purl": "pkg:npm/%40cdxgen/cdxgen-plugins-bin@4.2.0", "version": "4.2.0" }, { "ecosystem": "npm", "licenses": [], "location": "pnpm-lock.yaml", "name": "@cdxgen/cdxgen-plugins-bin-darwin-amd64", "purl": "pkg:npm/%40cdxgen/cdxgen-plugins-bin-darwin-amd64@4.2.0", "version": "4.2.0" }, { "ecosystem": "npm", "licenses": [], "location": "pnpm-lock.yaml", "name": "@cdxgen/cdxgen-plugins-bin-darwin-arm64", "purl": "pkg:npm/%40cdxgen/cdxgen-plugins-bin-darwin-arm64@4.2.0", "version": "4.2.0" }, { "ecosystem": "npm", "licenses": [], "location": "pnpm-lock.yaml", "name": "@cdxgen/cdxgen-plugins-bin-linux-amd64", "purl": "pkg:npm/%40cdxgen/cdxgen-plugins-bin-linux-amd64@4.2.0", "version": "4.2.0" }, { "ecosystem": "npm", "licenses": [], "location": "pnpm-lock.yaml", "name": "@cdxgen/cdxgen-plugins-bin-linux-arm", "purl": "pkg:npm/%40cdxgen/cdxgen-plugins-bin-linux-arm@4.2.0", "version": "4.2.0" }, { "ecosystem": "npm", "licenses": [], "location": "pnpm-lock.yaml", "name": "@cdxgen/cdxgen-plugins-bin-linux-arm64", "purl": "pkg:npm/%40cdxgen/cdxgen-plugins-bin-linux-arm64@4.2.0", "version": "4.2.0" }, { "ecosystem": "npm", "licenses": [], "location": "pnpm-lock.yaml", "name": "@cdxgen/cdxgen-plugins-bin-linux-ppc64", "purl": "pkg:npm/%40cdxgen/cdxgen-plugins-bin-linux-ppc64@4.2.0", "version": "4.2.0" }, { "ecosystem": "npm", "licenses": [], "location": "pnpm-lock.yaml", "name": "@cdxgen/cdxgen-plugins-bin-linuxmusl-amd64", "purl": "pkg:npm/%40cdxgen/cdxgen-plugins-bin-linuxmusl-amd64@4.2.0", "version": "4.2.0" }, { "ecosystem": "npm", "licenses": [], "location": "pnpm-lock.yaml", "name": "@cdxgen/cdxgen-plugins-bin-linuxmusl-arm64", "purl": "pkg:npm/%40cdxgen/cdxgen-plugins-bin-linuxmusl-arm64@4.2.0", "version": "4.2.0" }, { "ecosystem": "npm", "licenses": [], "location": "pnpm-lock.yaml", "name": "@cdxgen/cdxgen-plugins-bin-windows-amd64", "purl": "pkg:npm/%40cdxgen/cdxgen-plugins-bin-windows-amd64@4.2.0", "version": "4.2.0" }, { "ecosystem": "npm", "licenses": [], "location": "pnpm-lock.yaml", "name": "@cdxgen/cdxgen-plugins-bin-windows-arm64", "purl": "pkg:npm/%40cdxgen/cdxgen-plugins-bin-windows-arm64@4.2.0", "version": "4.2.0" }, { "ecosystem": "npm", "licenses": [], "location": "pnpm-lock.yaml", "name": "@cdxgen/safer-exec", "purl": "pkg:npm/%40cdxgen/safer-exec@1.2.1", "version": "1.2.1" }, { "ecosystem": "npm", "licenses": [], "location": "pnpm-lock.yaml", "name": "@cdxgen/safer-exec-darwin-amd64", "purl": "pkg:npm/%40cdxgen/safer-exec-darwin-amd64@1.2.1", "version": "1.2.1" }, { "ecosystem": "npm", "licenses": [], "location": "pnpm-lock.yaml", "name": "@cdxgen/safer-exec-darwin-arm64", "purl": "pkg:npm/%40cdxgen/safer-exec-darwin-arm64@1.2.1", "version": "1.2.1" }, { "ecosystem": "npm", "licenses": [], "location": "pnpm-lock.yaml", "name": "@cdxgen/safer-exec-linux-amd64", "purl": "pkg:npm/%40cdxgen/safer-exec-linux-amd64@1.2.1", "version": "1.2.1" }, { "ecosystem": "npm", "licenses": [], "location": "pnpm-lock.yaml", "name": "@cdxgen/safer-exec-linux-arm64", "purl": "pkg:npm/%40cdxgen/safer-exec-linux-arm64@1.2.1", "version": "1.2.1" }, { "ecosystem": "npm", "licenses": [], "location": "pnpm-lock.yaml", "name": "@cdxgen/safer-exec-windows-amd64", "purl": "pkg:npm/%40cdxgen/safer-exec-windows-amd64@1.2.1", "version": "1.2.1" }, { "ecosystem": "npm", "licenses": [], "location": "pnpm-lock.yaml", "name": "@cdxgen/safer-exec-windows-arm64", "purl": "pkg:npm/%40cdxgen/safer-exec-windows-arm64@1.2.1", "version": "1.2.1" }, { "ecosystem": "npm", "licenses": [], "location": "pnpm-lock.yaml", "name": "@gar/promise-retry", "purl": "pkg:npm/%40gar/promise-retry@1.0.3", "version": "1.0.3" }, { "ecosystem": "npm", "licenses": [], "location": "pnpm-lock.yaml", "name": "@isaacs/fs-minipass", "purl": "pkg:npm/%40isaacs/fs-minipass@4.0.1", "version": "4.0.1" }, { "ecosystem": "npm", "licenses": [], "location": "pnpm-lock.yaml", "name": "@isaacs/string-locale-compare", "purl": "pkg:npm/%40isaacs/string-locale-compare@1.1.0", "version": "1.1.0" }, { "ecosystem": "npm", "licenses": [], "location": "pnpm-lock.yaml", "name": "@jridgewell/gen-mapping", "purl": "pkg:npm/%40jridgewell/gen-mapping@0.3.13", "version": "0.3.13" }, { "ecosystem": "npm", "licenses": [], "location": "pnpm-lock.yaml", "name": "@jridgewell/gen-mapping", "purl": "pkg:npm/%40jridgewell/gen-mapping@0.4.0-beta.0", "version": "0.4.0-beta.0" }, { "ecosystem": "npm", "licenses": [], "location": "pnpm-lock.yaml", "name": "@jridgewell/remapping", "purl": "pkg:npm/%40jridgewell/remapping@2.3.5", "version": "2.3.5" }, { "ecosystem": "npm", "licenses": [], "location": "pnpm-lock.yaml", "name": "@jridgewell/resolve-uri", "purl": "pkg:npm/%40jridgewell/resolve-uri@3.1.2", "version": "3.1.2" }, { "ecosystem": "npm", "licenses": [], "location": "pnpm-lock.yaml", "name": "@jridgewell/sourcemap-codec", "purl": "pkg:npm/%40jridgewell/sourcemap-codec@1.6.0", "version": "1.6.0" }, { "ecosystem": "npm", "licenses": [], "location": "pnpm-lock.yaml", "name": "@jridgewell/trace-mapping", "purl": "pkg:npm/%40jridgewell/trace-mapping@0.3.31", "version": "0.3.31" }, { "ecosystem": "npm", "licenses": [], "location": "pnpm-lock.yaml", "name": "@npmcli/fs", "purl": "pkg:npm/%40npmcli/fs@6.0.0", "version": "6.0.0" }, { "ecosystem": "npm", "licenses": [], "location": "pnpm-lock.yaml", "name": "@npmcli/git", "purl": "pkg:npm/%40npmcli/git@8.0.0", "version": "8.0.0" }, { "ecosystem": "npm", "licenses": [], "location": "pnpm-lock.yaml", "name": "@npmcli/map-workspaces", "purl": "pkg:npm/%40npmcli/map-workspaces@6.0.0", "version": "6.0.0" }, { "ecosystem": "npm", "licenses": [], "location": "pnpm-lock.yaml", "name": "@npmcli/name-from-folder", "purl": "pkg:npm/%40npmcli/name-from-folder@5.0.0", "version": "5.0.0" }, { "ecosystem": "npm", "licenses": [], "location": "pnpm-lock.yaml", "name": "@npmcli/package-json", "purl": "pkg:npm/%40npmcli/package-json@8.0.0", "version": "8.0.0" }, { "ecosystem": "npm", "licenses": [], "location": "pnpm-lock.yaml", "name": "@npmcli/promise-spawn", "purl": "pkg:npm/%40npmcli/promise-spawn@10.0.0", "version": "10.0.0" }, { "ecosystem": "npm", "licenses": [], "location": "pnpm-lock.yaml", "name": "@pnpm/exe.android-arm64", "purl": "pkg:npm/%40pnpm/exe.android-arm64@12.10.1", "version": "12.10.1" }, { "ecosystem": "npm", "licenses": [], "location": "pnpm-lock.yaml", "name": "@pnpm/exe.android-x64", "purl": "pkg:npm/%40pnpm/exe.android-x64@12.10.1", "version": "12.10.1" }, { "ecosystem": "npm", "licenses": [], "location": "pnpm-lock.yaml", "name": "@pnpm/exe.darwin-arm64", "purl": "pkg:npm/%40pnpm/exe.darwin-arm64@12.10.1", "version": "12.10.1" }, { "ecosystem": "npm", "licenses": [], "location": "pnpm-lock.yaml", "name": "@pnpm/exe.darwin-x64", "purl": "pkg:npm/%40pnpm/exe.darwin-x64@12.10.1", "version": "12.10.1" }, { "ecosystem": "npm", "licenses": [], "location": "pnpm-lock.yaml", "name": "@pnpm/exe.freebsd-x64", "purl": "pkg:npm/%40pnpm/exe.freebsd-x64@12.10.1", "version": "12.10.1" }, { "ecosystem": "npm", "licenses": [], "location": "pnpm-lock.yaml", "name": "@pnpm/exe.linux-arm64", "purl": "pkg:npm/%40pnpm/exe.linux-arm64@12.10.1", "version": "12.10.1" }, { "ecosystem": "npm", "licenses": [], "location": "pnpm-lock.yaml", "name": "@pnpm/exe.linux-arm64-musl", "purl": "pkg:npm/%40pnpm/exe.linux-arm64-musl@12.10.1", "version": "12.10.1" }, { "ecosystem": "npm", "licenses": [], "location": "pnpm-lock.yaml", "name": "@pnpm/exe.linux-ppc64", "purl": "pkg:npm/%40pnpm/exe.linux-ppc64@12.10.1", "version": "12.10.1" }, { "ecosystem": "npm", "licenses": [], "location": "pnpm-lock.yaml", "name": "@pnpm/exe.linux-riscv64", "purl": "pkg:npm/%40pnpm/exe.linux-riscv64@12.10.1", "version": "12.10.1" }, { "ecosystem": "npm", "licenses": [], "location": "pnpm-lock.yaml", "name": "@pnpm/exe.linux-s390x", "purl": "pkg:npm/%40pnpm/exe.linux-s390x@12.10.1", "version": "12.10.1" }, { "ecosystem": "npm", "licenses": [], "location": "pnpm-lock.yaml", "name": "@pnpm/exe.linux-x64", "purl": "pkg:npm/%40pnpm/exe.linux-x64@12.10.1", "version": "12.10.1" }, { "ecosystem": "npm", "licenses": [], "location": "pnpm-lock.yaml", "name": "@pnpm/exe.linux-x64-musl", "purl": "pkg:npm/%40pnpm/exe.linux-x64-musl@12.10.1", "version": "12.10.1" }, { "ecosystem": "npm", "licenses": [], "location": "pnpm-lock.yaml", "name": "@pnpm/exe.win32-arm64", "purl": "pkg:npm/%40pnpm/exe.win32-arm64@12.10.1", "version": "12.10.1" }, { "ecosystem": "npm", "licenses": [], "location": "pnpm-lock.yaml", "name": "@pnpm/exe.win32-x64", "purl": "pkg:npm/%40pnpm/exe.win32-x64@12.10.1", "version": "12.10.1" }, { "ecosystem": "npm", "licenses": [], "location": "pnpm-lock.yaml", "name": "@sinonjs/commons", "purl": "pkg:npm/%40sinonjs/commons@3.0.1", "version": "3.0.1" }, { "ecosystem": "npm", "licenses": [], "location": "pnpm-lock.yaml", "name": "@sinonjs/fake-timers", "purl": "pkg:npm/%40sinonjs/fake-timers@15.4.0", "version": "15.4.0" }, { "ecosystem": "npm", "licenses": [], "location": "pnpm-lock.yaml", "name": "@sinonjs/samsam", "purl": "pkg:npm/%40sinonjs/samsam@10.0.2", "version": "10.0.2" }, { "ecosystem": "npm", "licenses": [], "location": "pnpm-lock.yaml", "name": "@sveltejs/acorn-typescript", "purl": "pkg:npm/%40sveltejs/acorn-typescript@1.0.13", "version": "1.0.13" }, { "ecosystem": "npm", "licenses": [], "location": "pnpm-lock.yaml", "name": "@types/estree", "purl": "pkg:npm/%40types/estree@1.0.9", "version": "1.0.9" }, { "ecosystem": "npm", "licenses": [], "location": "pnpm-lock.yaml", "name": "@types/jsesc", "purl": "pkg:npm/%40types/jsesc@2.5.1", "version": "2.5.1" }, { "ecosystem": "npm", "licenses": [], "location": "pnpm-lock.yaml", "name": "@typescript/typescript-aix-ppc64", "purl": "pkg:npm/%40typescript/typescript-aix-ppc64@7.0.2", "version": "7.0.2" }, { "ecosystem": "npm", "licenses": [], "location": "pnpm-lock.yaml", "name": "@typescript/typescript-darwin-arm64", "purl": "pkg:npm/%40typescript/typescript-darwin-arm64@7.0.2", "version": "7.0.2" }, { "ecosystem": "npm", "licenses": [], "location": "pnpm-lock.yaml", "name": "@typescript/typescript-darwin-x64", "purl": "pkg:npm/%40typescript/typescript-darwin-x64@7.0.2", "version": "7.0.2" }, { "ecosystem": "npm", "licenses": [], "location": "pnpm-lock.yaml", "name": "@typescript/typescript-freebsd-arm64", "purl": "pkg:npm/%40typescript/typescript-freebsd-arm64@7.0.2", "version": "7.0.2" }, { "ecosystem": "npm", "licenses": [], "location": "pnpm-lock.yaml", "name": "@typescript/typescript-freebsd-x64", "purl": "pkg:npm/%40typescript/typescript-freebsd-x64@7.0.2", "version": "7.0.2" }, { "ecosystem": "npm", "licenses": [], "location": "pnpm-lock.yaml", "name": "@typescript/typescript-linux-arm", "purl": "pkg:npm/%40typescript/typescript-linux-arm@7.0.2", "version": "7.0.2" }, { "ecosystem": "npm", "licenses": [], "location": "pnpm-lock.yaml", "name": "@typescript/typescript-linux-arm64", "purl": "pkg:npm/%40typescript/typescript-linux-arm64@7.0.2", "version": "7.0.2" }, { "ecosystem": "npm", "licenses": [], "location": "pnpm-lock.yaml", "name": "@typescript/typescript-linux-loong64", "purl": "pkg:npm/%40typescript/typescript-linux-loong64@7.0.2", "version": "7.0.2" }, { "ecosystem": "npm", "licenses": [], "location": "pnpm-lock.yaml", "name": "@typescript/typescript-linux-mips64el", "purl": "pkg:npm/%40typescript/typescript-linux-mips64el@7.0.2", "version": "7.0.2" }, { "ecosystem": "npm", "licenses": [], "location": "pnpm-lock.yaml", "name": "@typescript/typescript-linux-ppc64", "purl": "pkg:npm/%40typescript/typescript-linux-ppc64@7.0.2", "version": "7.0.2" }, { "ecosystem": "npm", "licenses": [], "location": "pnpm-lock.yaml", "name": "@typescript/typescript-linux-riscv64", "purl": "pkg:npm/%40typescript/typescript-linux-riscv64@7.0.2", "version": "7.0.2" }, { "ecosystem": "npm", "licenses": [], "location": "pnpm-lock.yaml", "name": "@typescript/typescript-linux-s390x", "purl": "pkg:npm/%40typescript/typescript-linux-s390x@7.0.2", "version": "7.0.2" }, { "ecosystem": "npm", "licenses": [], "location": "pnpm-lock.yaml", "name": "@typescript/typescript-linux-x64", "purl": "pkg:npm/%40typescript/typescript-linux-x64@7.0.2", "version": "7.0.2" }, { "ecosystem": "npm", "licenses": [], "location": "pnpm-lock.yaml", "name": "@typescript/typescript-netbsd-arm64", "purl": "pkg:npm/%40typescript/typescript-netbsd-arm64@7.0.2", "version": "7.0.2" }, { "ecosystem": "npm", "licenses": [], "location": "pnpm-lock.yaml", "name": "@typescript/typescript-netbsd-x64", "purl": "pkg:npm/%40typescript/typescript-netbsd-x64@7.0.2", "version": "7.0.2" }, { "ecosystem": "npm", "licenses": [], "location": "pnpm-lock.yaml", "name": "@typescript/typescript-openbsd-arm64", "purl": "pkg:npm/%40typescript/typescript-openbsd-arm64@7.0.2", "version": "7.0.2" }, { "ecosystem": "npm", "licenses": [], "location": "pnpm-lock.yaml", "name": "@typescript/typescript-openbsd-x64", "purl": "pkg:npm/%40typescript/typescript-openbsd-x64@7.0.2", "version": "7.0.2" }, { "ecosystem": "npm", "licenses": [], "location": "pnpm-lock.yaml", "name": "@typescript/typescript-sunos-x64", "purl": "pkg:npm/%40typescript/typescript-sunos-x64@7.0.2", "version": "7.0.2" }, { "ecosystem": "npm", "licenses": [], "location": "pnpm-lock.yaml", "name": "@typescript/typescript-win32-arm64", "purl": "pkg:npm/%40typescript/typescript-win32-arm64@7.0.2", "version": "7.0.2" }, { "ecosystem": "npm", "licenses": [], "location": "pnpm-lock.yaml", "name": "@typescript/typescript-win32-x64", "purl": "pkg:npm/%40typescript/typescript-win32-x64@7.0.2", "version": "7.0.2" }, { "ecosystem": "npm", "licenses": [], "location": "pnpm-lock.yaml", "name": "@typescript/typescript6", "purl": "pkg:npm/%40typescript/typescript6@6.0.2", "version": "6.0.2" }, { "ecosystem": "npm", "licenses": [], "location": "pnpm-lock.yaml", "name": "acorn", "purl": "pkg:npm/acorn@8.18.0", "version": "8.18.0" }, { "ecosystem": "npm", "licenses": [], "location": "pnpm-lock.yaml", "name": "ajv", "purl": "pkg:npm/ajv@8.20.0", "version": "8.20.0" }, { "ecosystem": "npm", "licenses": [], "location": "pnpm-lock.yaml", "name": "ajv-formats", "purl": "pkg:npm/ajv-formats@3.0.1", "version": "3.0.1" }, { "ecosystem": "npm", "licenses": [], "location": "pnpm-lock.yaml", "name": "ansi-regex", "purl": "pkg:npm/ansi-regex@6.3.0", "version": "6.3.0" }, { "ecosystem": "npm", "licenses": [], "location": "pnpm-lock.yaml", "name": "ansi-styles", "purl": "pkg:npm/ansi-styles@6.2.3", "version": "6.2.3" }, { "ecosystem": "npm", "licenses": [], "location": "pnpm-lock.yaml", "name": "aria-query", "purl": "pkg:npm/aria-query@5.3.1", "version": "5.3.1" }, { "ecosystem": "npm", "licenses": [], "location": "pnpm-lock.yaml", "name": "axobject-query", "purl": "pkg:npm/axobject-query@4.1.0", "version": "4.1.0" }, { "ecosystem": "npm", "licenses": [], "location": "pnpm-lock.yaml", "name": "balanced-match", "purl": "pkg:npm/balanced-match@4.0.4", "version": "4.0.4" }, { "ecosystem": "npm", "licenses": [], "location": "pnpm-lock.yaml", "name": "body-parser", "purl": "pkg:npm/body-parser@2.3.0", "version": "2.3.0" }, { "ecosystem": "npm", "licenses": [], "location": "pnpm-lock.yaml", "name": "brace-expansion", "purl": "pkg:npm/brace-expansion@5.0.12", "version": "5.0.12" }, { "ecosystem": "npm", "licenses": [], "location": "pnpm-lock.yaml", "name": "bytes", "purl": "pkg:npm/bytes@3.1.2", "version": "3.1.2" }, { "ecosystem": "npm", "licenses": [], "location": "pnpm-lock.yaml", "name": "call-bind-apply-helpers", "purl": "pkg:npm/call-bind-apply-helpers@1.0.2", "version": "1.0.2" }, { "ecosystem": "npm", "licenses": [], "location": "pnpm-lock.yaml", "name": "call-bound", "purl": "pkg:npm/call-bound@1.0.4", "version": "1.0.4" }, { "ecosystem": "npm", "licenses": [], "location": "pnpm-lock.yaml", "name": "chownr", "purl": "pkg:npm/chownr@3.0.0", "version": "3.0.0" }, { "ecosystem": "npm", "licenses": [], "location": "pnpm-lock.yaml", "name": "cliui", "purl": "pkg:npm/cliui@9.0.1", "version": "9.0.1" }, { "ecosystem": "npm", "licenses": [], "location": "pnpm-lock.yaml", "name": "clsx", "purl": "pkg:npm/clsx@2.1.1", "version": "2.1.1" }, { "ecosystem": "npm", "licenses": [], "location": "pnpm-lock.yaml", "name": "common-ancestor-path", "purl": "pkg:npm/common-ancestor-path@2.0.0", "version": "2.0.0" }, { "ecosystem": "npm", "licenses": [], "location": "pnpm-lock.yaml", "name": "compressible", "purl": "pkg:npm/compressible@2.0.18", "version": "2.0.18" }, { "ecosystem": "npm", "licenses": [], "location": "pnpm-lock.yaml", "name": "compression", "purl": "pkg:npm/compression@1.8.2", "version": "1.8.2" }, { "ecosystem": "npm", "licenses": [], "location": "pnpm-lock.yaml", "name": "connect", "purl": "pkg:npm/connect@3.7.0", "version": "3.7.0" }, { "ecosystem": "npm", "licenses": [], "location": "pnpm-lock.yaml", "name": "content-type", "purl": "pkg:npm/content-type@2.1.0", "version": "2.1.0" }, { "ecosystem": "npm", "licenses": [], "location": "pnpm-lock.yaml", "name": "debug", "purl": "pkg:npm/debug@2.6.9", "version": "2.6.9" }, { "ecosystem": "npm", "licenses": [], "location": "pnpm-lock.yaml", "name": "debug", "purl": "pkg:npm/debug@4.4.3", "version": "4.4.3" }, { "ecosystem": "npm", "licenses": [], "location": "pnpm-lock.yaml", "name": "depd", "purl": "pkg:npm/depd@2.0.0", "version": "2.0.0" }, { "ecosystem": "npm", "licenses": [], "location": "pnpm-lock.yaml", "name": "destroy", "purl": "pkg:npm/destroy@1.2.0", "version": "1.2.0" }, { "ecosystem": "npm", "licenses": [], "location": "pnpm-lock.yaml", "name": "devalue", "purl": "pkg:npm/devalue@5.9.4", "version": "5.9.4" }, { "ecosystem": "npm", "licenses": [], "location": "pnpm-lock.yaml", "name": "diff", "purl": "pkg:npm/diff@9.0.0", "version": "9.0.0" }, { "ecosystem": "npm", "licenses": [], "location": "pnpm-lock.yaml", "name": "dunder-proto", "purl": "pkg:npm/dunder-proto@1.0.1", "version": "1.0.1" }, { "ecosystem": "npm", "licenses": [], "location": "pnpm-lock.yaml", "name": "edn-data", "purl": "pkg:npm/edn-data@1.2.2", "version": "1.2.2" }, { "ecosystem": "npm", "licenses": [], "location": "pnpm-lock.yaml", "name": "ee-first", "purl": "pkg:npm/ee-first@1.1.1", "version": "1.1.1" }, { "ecosystem": "npm", "licenses": [], "location": "pnpm-lock.yaml", "name": "emoji-regex", "purl": "pkg:npm/emoji-regex@10.6.0", "version": "10.6.0" }, { "ecosystem": "npm", "licenses": [], "location": "pnpm-lock.yaml", "name": "encodeurl", "purl": "pkg:npm/encodeurl@1.0.2", "version": "1.0.2" }, { "ecosystem": "npm", "licenses": [], "location": "pnpm-lock.yaml", "name": "es-define-property", "purl": "pkg:npm/es-define-property@1.0.1", "version": "1.0.1" }, { "ecosystem": "npm", "licenses": [], "location": "pnpm-lock.yaml", "name": "es-errors", "purl": "pkg:npm/es-errors@1.3.0", "version": "1.3.0" }, { "ecosystem": "npm", "licenses": [], "location": "pnpm-lock.yaml", "name": "es-object-atoms", "purl": "pkg:npm/es-object-atoms@1.1.2", "version": "1.1.2" }, { "ecosystem": "npm", "licenses": [], "location": "pnpm-lock.yaml", "name": "escalade", "purl": "pkg:npm/escalade@3.2.0", "version": "3.2.0" }, { "ecosystem": "npm", "licenses": [], "location": "pnpm-lock.yaml", "name": "escape-html", "purl": "pkg:npm/escape-html@1.0.3", "version": "1.0.3" }, { "ecosystem": "npm", "licenses": [], "location": "pnpm-lock.yaml", "name": "esm-env", "purl": "pkg:npm/esm-env@1.2.2", "version": "1.2.2" }, { "ecosystem": "npm", "licenses": [], "location": "pnpm-lock.yaml", "name": "esmock", "purl": "pkg:npm/esmock@2.8.0", "version": "2.8.0" }, { "ecosystem": "npm", "licenses": [], "location": "pnpm-lock.yaml", "name": "esrap", "purl": "pkg:npm/esrap@2.3.7", "version": "2.3.7" }, { "ecosystem": "npm", "licenses": [], "location": "pnpm-lock.yaml", "name": "fast-deep-equal", "purl": "pkg:npm/fast-deep-equal@3.1.3", "version": "3.1.3" }, { "ecosystem": "npm", "licenses": [], "location": "pnpm-lock.yaml", "name": "fast-uri", "purl": "pkg:npm/fast-uri@3.1.8", "version": "3.1.8" }, { "ecosystem": "npm", "licenses": [], "location": "pnpm-lock.yaml", "name": "finalhandler", "purl": "pkg:npm/finalhandler@1.1.2", "version": "1.1.2" }, { "ecosystem": "npm", "licenses": [], "location": "pnpm-lock.yaml", "name": "function-bind", "purl": "pkg:npm/function-bind@1.1.2", "version": "1.1.2" }, { "ecosystem": "npm", "licenses": [], "location": "pnpm-lock.yaml", "name": "get-caller-file", "purl": "pkg:npm/get-caller-file@2.0.5", "version": "2.0.5" }, { "ecosystem": "npm", "licenses": [], "location": "pnpm-lock.yaml", "name": "get-east-asian-width", "purl": "pkg:npm/get-east-asian-width@1.6.0", "version": "1.6.0" }, { "ecosystem": "npm", "licenses": [], "location": "pnpm-lock.yaml", "name": "get-intrinsic", "purl": "pkg:npm/get-intrinsic@1.3.0", "version": "1.3.0" }, { "ecosystem": "npm", "licenses": [], "location": "pnpm-lock.yaml", "name": "get-proto", "purl": "pkg:npm/get-proto@1.0.1", "version": "1.0.1" }, { "ecosystem": "npm", "licenses": [], "location": "pnpm-lock.yaml", "name": "glob", "purl": "pkg:npm/glob@13.0.6", "version": "13.0.6" }, { "ecosystem": "npm", "licenses": [], "location": "pnpm-lock.yaml", "name": "gopd", "purl": "pkg:npm/gopd@1.2.0", "version": "1.2.0" }, { "ecosystem": "npm", "licenses": [], "location": "pnpm-lock.yaml", "name": "has-symbols", "purl": "pkg:npm/has-symbols@1.1.0", "version": "1.1.0" }, { "ecosystem": "npm", "licenses": [], "location": "pnpm-lock.yaml", "name": "hasown", "purl": "pkg:npm/hasown@2.0.4", "version": "2.0.4" }, { "ecosystem": "npm", "licenses": [], "location": "pnpm-lock.yaml", "name": "hermes-estree", "purl": "pkg:npm/hermes-estree@0.37.0", "version": "0.37.0" }, { "ecosystem": "npm", "licenses": [], "location": "pnpm-lock.yaml", "name": "hermes-parser", "purl": "pkg:npm/hermes-parser@0.37.0", "version": "0.37.0" }, { "ecosystem": "npm", "licenses": [], "location": "pnpm-lock.yaml", "name": "hosted-git-info", "purl": "pkg:npm/hosted-git-info@10.1.1", "version": "10.1.1" }, { "ecosystem": "npm", "licenses": [], "location": "pnpm-lock.yaml", "name": "http-errors", "purl": "pkg:npm/http-errors@2.0.1", "version": "2.0.1" }, { "ecosystem": "npm", "licenses": [], "location": "pnpm-lock.yaml", "name": "iconv-lite", "purl": "pkg:npm/iconv-lite@0.7.2", "version": "0.7.2" }, { "ecosystem": "npm", "licenses": [], "location": "pnpm-lock.yaml", "name": "inherits", "purl": "pkg:npm/inherits@2.0.4", "version": "2.0.4" }, { "ecosystem": "npm", "licenses": [], "location": "pnpm-lock.yaml", "name": "ini", "purl": "pkg:npm/ini@7.0.0", "version": "7.0.0" }, { "ecosystem": "npm", "licenses": [], "location": "pnpm-lock.yaml", "name": "is-reference", "purl": "pkg:npm/is-reference@3.0.3", "version": "3.0.3" }, { "ecosystem": "npm", "licenses": [], "location": "pnpm-lock.yaml", "name": "isexe", "purl": "pkg:npm/isexe@4.0.0", "version": "4.0.0" }, { "ecosystem": "npm", "licenses": [], "location": "pnpm-lock.yaml", "name": "js-tokens", "purl": "pkg:npm/js-tokens@10.0.0", "version": "10.0.0" }, { "ecosystem": "npm", "licenses": [], "location": "pnpm-lock.yaml", "name": "jsesc", "purl": "pkg:npm/jsesc@3.1.0", "version": "3.1.0" }, { "ecosystem": "npm", "licenses": [], "location": "pnpm-lock.yaml", "name": "json-parse-even-better-errors", "purl": "pkg:npm/json-parse-even-better-errors@6.0.0", "version": "6.0.0" }, { "ecosystem": "npm", "licenses": [], "location": "pnpm-lock.yaml", "name": "json-schema-traverse", "purl": "pkg:npm/json-schema-traverse@1.0.0", "version": "1.0.0" }, { "ecosystem": "npm", "licenses": [], "location": "pnpm-lock.yaml", "name": "jsonata", "purl": "pkg:npm/jsonata@2.2.2", "version": "2.2.2" }, { "ecosystem": "npm", "licenses": [], "location": "pnpm-lock.yaml", "name": "just-diff", "purl": "pkg:npm/just-diff@6.0.2", "version": "6.0.2" }, { "ecosystem": "npm", "licenses": [], "location": "pnpm-lock.yaml", "name": "just-diff-apply", "purl": "pkg:npm/just-diff-apply@5.5.0", "version": "5.5.0" }, { "ecosystem": "npm", "licenses": [], "location": "pnpm-lock.yaml", "name": "locate-character", "purl": "pkg:npm/locate-character@3.0.0", "version": "3.0.0" }, { "ecosystem": "npm", "licenses": [], "location": "pnpm-lock.yaml", "name": "lru-cache", "purl": "pkg:npm/lru-cache@11.5.2", "version": "11.5.2" }, { "ecosystem": "npm", "licenses": [], "location": "pnpm-lock.yaml", "name": "magic-string", "purl": "pkg:npm/magic-string@0.30.21", "version": "0.30.21" }, { "ecosystem": "npm", "licenses": [], "location": "pnpm-lock.yaml", "name": "math-intrinsics", "purl": "pkg:npm/math-intrinsics@1.1.0", "version": "1.1.0" }, { "ecosystem": "npm", "licenses": [], "location": "pnpm-lock.yaml", "name": "media-typer", "purl": "pkg:npm/media-typer@1.1.1", "version": "1.1.1" }, { "ecosystem": "npm", "licenses": [], "location": "pnpm-lock.yaml", "name": "mime-db", "purl": "pkg:npm/mime-db@1.54.0", "version": "1.54.0" }, { "ecosystem": "npm", "licenses": [], "location": "pnpm-lock.yaml", "name": "mime-types", "purl": "pkg:npm/mime-types@3.0.2", "version": "3.0.2" }, { "ecosystem": "npm", "licenses": [], "location": "pnpm-lock.yaml", "name": "minimatch", "purl": "pkg:npm/minimatch@10.2.6", "version": "10.2.6" }, { "ecosystem": "npm", "licenses": [], "location": "pnpm-lock.yaml", "name": "minipass", "purl": "pkg:npm/minipass@7.1.3", "version": "7.1.3" }, { "ecosystem": "npm", "licenses": [], "location": "pnpm-lock.yaml", "name": "minizlib", "purl": "pkg:npm/minizlib@3.1.0", "version": "3.1.0" }, { "ecosystem": "npm", "licenses": [], "location": "pnpm-lock.yaml", "name": "ms", "purl": "pkg:npm/ms@2.0.0", "version": "2.0.0" }, { "ecosystem": "npm", "licenses": [], "location": "pnpm-lock.yaml", "name": "ms", "purl": "pkg:npm/ms@2.1.3", "version": "2.1.3" }, { "ecosystem": "npm", "licenses": [], "location": "pnpm-lock.yaml", "name": "negotiator", "purl": "pkg:npm/negotiator@0.6.4", "version": "0.6.4" }, { "ecosystem": "npm", "licenses": [], "location": "pnpm-lock.yaml", "name": "node-stream-zip", "purl": "pkg:npm/node-stream-zip@1.16.0", "version": "1.16.0" }, { "ecosystem": "npm", "licenses": [], "location": "pnpm-lock.yaml", "name": "npm-install-checks", "purl": "pkg:npm/npm-install-checks@9.0.0", "version": "9.0.0" }, { "ecosystem": "npm", "licenses": [], "location": "pnpm-lock.yaml", "name": "npm-normalize-package-bin", "purl": "pkg:npm/npm-normalize-package-bin@6.0.0", "version": "6.0.0" }, { "ecosystem": "npm", "licenses": [], "location": "pnpm-lock.yaml", "name": "npm-package-arg", "purl": "pkg:npm/npm-package-arg@14.0.0", "version": "14.0.0" }, { "ecosystem": "npm", "licenses": [], "location": "pnpm-lock.yaml", "name": "npm-pick-manifest", "purl": "pkg:npm/npm-pick-manifest@12.0.0", "version": "12.0.0" }, { "ecosystem": "npm", "licenses": [], "location": "pnpm-lock.yaml", "name": "object-inspect", "purl": "pkg:npm/object-inspect@1.13.4", "version": "1.13.4" }, { "ecosystem": "npm", "licenses": [], "location": "pnpm-lock.yaml", "name": "obug", "purl": "pkg:npm/obug@3.0.0", "version": "3.0.0" }, { "ecosystem": "npm", "licenses": [], "location": "pnpm-lock.yaml", "name": "on-finished", "purl": "pkg:npm/on-finished@2.4.1", "version": "2.4.1" }, { "ecosystem": "npm", "licenses": [], "location": "pnpm-lock.yaml", "name": "on-headers", "purl": "pkg:npm/on-headers@1.1.0", "version": "1.1.0" }, { "ecosystem": "npm", "licenses": [], "location": "pnpm-lock.yaml", "name": "parse-conflict-json", "purl": "pkg:npm/parse-conflict-json@6.0.0", "version": "6.0.0" }, { "ecosystem": "npm", "licenses": [], "location": "pnpm-lock.yaml", "name": "parseurl", "purl": "pkg:npm/parseurl@1.3.3", "version": "1.3.3" }, { "ecosystem": "npm", "licenses": [], "location": "pnpm-lock.yaml", "name": "path-scurry", "purl": "pkg:npm/path-scurry@2.0.2", "version": "2.0.2" }, { "ecosystem": "npm", "licenses": [], "location": "pnpm-lock.yaml", "name": "pnpm", "purl": "pkg:npm/pnpm@12.10.1", "version": "12.10.1" }, { "ecosystem": "npm", "licenses": [], "location": "pnpm-lock.yaml", "name": "poku", "purl": "pkg:npm/poku@4.5.0", "version": "4.5.0" }, { "ecosystem": "npm", "licenses": [], "location": "pnpm-lock.yaml", "name": "proc-log", "purl": "pkg:npm/proc-log@7.0.0", "version": "7.0.0" }, { "ecosystem": "npm", "licenses": [], "location": "pnpm-lock.yaml", "name": "qs", "purl": "pkg:npm/qs@6.16.0", "version": "6.16.0" }, { "ecosystem": "npm", "licenses": [], "location": "pnpm-lock.yaml", "name": "raw-body", "purl": "pkg:npm/raw-body@3.0.2", "version": "3.0.2" }, { "ecosystem": "npm", "licenses": [], "location": "pnpm-lock.yaml", "name": "require-from-string", "purl": "pkg:npm/require-from-string@2.0.2", "version": "2.0.2" }, { "ecosystem": "npm", "licenses": [], "location": "pnpm-lock.yaml", "name": "safe-buffer", "purl": "pkg:npm/safe-buffer@5.2.1", "version": "5.2.1" }, { "ecosystem": "npm", "licenses": [], "location": "pnpm-lock.yaml", "name": "safer-buffer", "purl": "pkg:npm/safer-buffer@2.1.2", "version": "2.1.2" }, { "ecosystem": "npm", "licenses": [], "location": "pnpm-lock.yaml", "name": "semver", "purl": "pkg:npm/semver@7.8.5", "version": "7.8.5" }, { "ecosystem": "npm", "licenses": [], "location": "pnpm-lock.yaml", "name": "setprototypeof", "purl": "pkg:npm/setprototypeof@1.2.0", "version": "1.2.0" }, { "ecosystem": "npm", "licenses": [], "location": "pnpm-lock.yaml", "name": "side-channel", "purl": "pkg:npm/side-channel@1.1.1", "version": "1.1.1" }, { "ecosystem": "npm", "licenses": [], "location": "pnpm-lock.yaml", "name": "side-channel-list", "purl": "pkg:npm/side-channel-list@1.0.1", "version": "1.0.1" }, { "ecosystem": "npm", "licenses": [], "location": "pnpm-lock.yaml", "name": "side-channel-map", "purl": "pkg:npm/side-channel-map@1.0.1", "version": "1.0.1" }, { "ecosystem": "npm", "licenses": [], "location": "pnpm-lock.yaml", "name": "side-channel-weakmap", "purl": "pkg:npm/side-channel-weakmap@1.0.2", "version": "1.0.2" }, { "ecosystem": "npm", "licenses": [], "location": "pnpm-lock.yaml", "name": "sinon", "purl": "pkg:npm/sinon@22.1.0", "version": "22.1.0" }, { "ecosystem": "npm", "licenses": [], "location": "pnpm-lock.yaml", "name": "smol-toml", "purl": "pkg:npm/smol-toml@1.9.1", "version": "1.9.1" }, { "ecosystem": "npm", "licenses": [], "location": "pnpm-lock.yaml", "name": "spdx-exceptions", "purl": "pkg:npm/spdx-exceptions@2.5.0", "version": "2.5.0" }, { "ecosystem": "npm", "licenses": [], "location": "pnpm-lock.yaml", "name": "spdx-expression-parse", "purl": "pkg:npm/spdx-expression-parse@4.0.0", "version": "4.0.0" }, { "ecosystem": "npm", "licenses": [], "location": "pnpm-lock.yaml", "name": "spdx-license-ids", "purl": "pkg:npm/spdx-license-ids@3.0.23", "version": "3.0.23" }, { "ecosystem": "npm", "licenses": [], "location": "pnpm-lock.yaml", "name": "ssri", "purl": "pkg:npm/ssri@14.0.0", "version": "14.0.0" }, { "ecosystem": "npm", "licenses": [], "location": "pnpm-lock.yaml", "name": "statuses", "purl": "pkg:npm/statuses@1.5.0", "version": "1.5.0" }, { "ecosystem": "npm", "licenses": [], "location": "pnpm-lock.yaml", "name": "statuses", "purl": "pkg:npm/statuses@2.0.2", "version": "2.0.2" }, { "ecosystem": "npm", "licenses": [], "location": "pnpm-lock.yaml", "name": "string-width", "purl": "pkg:npm/string-width@7.2.0", "version": "7.2.0" }, { "ecosystem": "npm", "licenses": [], "location": "pnpm-lock.yaml", "name": "string-width", "purl": "pkg:npm/string-width@8.2.2", "version": "8.2.2" }, { "ecosystem": "npm", "licenses": [], "location": "pnpm-lock.yaml", "name": "strip-ansi", "purl": "pkg:npm/strip-ansi@7.2.0", "version": "7.2.0" }, { "ecosystem": "npm", "licenses": [], "location": "pnpm-lock.yaml", "name": "svelte", "purl": "pkg:npm/svelte@5.57.0", "version": "5.57.0" }, { "ecosystem": "npm", "licenses": [], "location": "pnpm-lock.yaml", "name": "tar", "purl": "pkg:npm/tar@7.5.22", "version": "7.5.22" }, { "ecosystem": "npm", "licenses": [], "location": "pnpm-lock.yaml", "name": "toidentifier", "purl": "pkg:npm/toidentifier@1.0.1", "version": "1.0.1" }, { "ecosystem": "npm", "licenses": [], "location": "pnpm-lock.yaml", "name": "treeverse", "purl": "pkg:npm/treeverse@3.0.0", "version": "3.0.0" }, { "ecosystem": "npm", "licenses": [], "location": "pnpm-lock.yaml", "name": "type-detect", "purl": "pkg:npm/type-detect@4.1.0", "version": "4.1.0" }, { "ecosystem": "npm", "licenses": [], "location": "pnpm-lock.yaml", "name": "type-is", "purl": "pkg:npm/type-is@2.1.0", "version": "2.1.0" }, { "ecosystem": "npm", "licenses": [], "location": "pnpm-lock.yaml", "name": "typescript", "purl": "pkg:npm/typescript@6.0.3", "version": "6.0.3" }, { "ecosystem": "npm", "licenses": [], "location": "pnpm-lock.yaml", "name": "typescript", "purl": "pkg:npm/typescript@7.0.2", "version": "7.0.2" }, { "ecosystem": "npm", "licenses": [], "location": "pnpm-lock.yaml", "name": "undici", "purl": "pkg:npm/undici@8.12.3", "version": "8.12.3" }, { "ecosystem": "npm", "licenses": [], "location": "pnpm-lock.yaml", "name": "unpipe", "purl": "pkg:npm/unpipe@1.0.0", "version": "1.0.0" }, { "ecosystem": "npm", "licenses": [], "location": "pnpm-lock.yaml", "name": "utils-merge", "purl": "pkg:npm/utils-merge@1.0.1", "version": "1.0.1" }, { "ecosystem": "npm", "licenses": [], "location": "pnpm-lock.yaml", "name": "validate-npm-package-name", "purl": "pkg:npm/validate-npm-package-name@8.0.0", "version": "8.0.0" }, { "ecosystem": "npm", "licenses": [], "location": "pnpm-lock.yaml", "name": "vary", "purl": "pkg:npm/vary@1.1.2", "version": "1.1.2" }, { "ecosystem": "npm", "licenses": [], "location": "pnpm-lock.yaml", "name": "walk-up-path", "purl": "pkg:npm/walk-up-path@4.0.0", "version": "4.0.0" }, { "ecosystem": "npm", "licenses": [], "location": "pnpm-lock.yaml", "name": "which", "purl": "pkg:npm/which@7.0.0", "version": "7.0.0" }, { "ecosystem": "npm", "licenses": [], "location": "pnpm-lock.yaml", "name": "wrap-ansi", "purl": "pkg:npm/wrap-ansi@9.0.2", "version": "9.0.2" }, { "ecosystem": "npm", "licenses": [], "location": "pnpm-lock.yaml", "name": "y18n", "purl": "pkg:npm/y18n@5.0.8", "version": "5.0.8" }, { "ecosystem": "npm", "licenses": [], "location": "pnpm-lock.yaml", "name": "yallist", "purl": "pkg:npm/yallist@5.0.0", "version": "5.0.0" }, { "ecosystem": "npm", "licenses": [], "location": "pnpm-lock.yaml", "name": "yaml", "purl": "pkg:npm/yaml@2.9.1", "version": "2.9.1" }, { "ecosystem": "npm", "licenses": [], "location": "pnpm-lock.yaml", "name": "yargs", "purl": "pkg:npm/yargs@18.2.0", "version": "18.2.0" }, { "ecosystem": "npm", "licenses": [], "location": "pnpm-lock.yaml", "name": "yargs-parser", "purl": "pkg:npm/yargs-parser@22.0.0", "version": "22.0.0" }, { "ecosystem": "npm", "licenses": [], "location": "pnpm-lock.yaml", "name": "zimmerframe", "purl": "pkg:npm/zimmerframe@1.1.5", "version": "1.1.5" }, { "ecosystem": "pypi", "licenses": [], "location": "uv.lock", "name": "annotated-types", "purl": "pkg:pypi/annotated-types@0.8.0", "version": "0.8.0" }, { "ecosystem": "pypi", "licenses": [], "location": "uv.lock", "name": "apkinspector", "purl": "pkg:pypi/apkinspector@1.3.6", "version": "1.3.6" }, { "ecosystem": "pypi", "licenses": [], "location": "uv.lock", "name": "appdirs", "purl": "pkg:pypi/appdirs@1.4.4", "version": "1.4.4" }, { "ecosystem": "pypi", "licenses": [], "location": "uv.lock", "name": "apsw", "purl": "pkg:pypi/apsw@3.53.4.0", "version": "3.53.4.0" }, { "ecosystem": "pypi", "licenses": [], "location": "uv.lock", "name": "ar", "purl": "pkg:pypi/ar@1.0.1", "version": "1.0.1" }, { "ecosystem": "pypi", "licenses": [], "location": "uv.lock", "name": "atom-tools", "purl": "pkg:pypi/atom-tools@0.9.1", "version": "0.9.1" }, { "ecosystem": "pypi", "licenses": [], "location": "uv.lock", "name": "attrs", "purl": "pkg:pypi/attrs@26.1.0", "version": "26.1.0" }, { "ecosystem": "pypi", "licenses": [], "location": "uv.lock", "name": "blint", "purl": "pkg:pypi/blint@3.2.4", "version": "3.2.4" }, { "ecosystem": "pypi", "licenses": [], "location": "uv.lock", "name": "cdxgen", "purl": "pkg:pypi/cdxgen@13.0.1", "version": "13.0.1" }, { "ecosystem": "pypi", "licenses": [], "location": "uv.lock", "name": "certifi", "purl": "pkg:pypi/certifi@2026.7.22", "version": "2026.7.22" }, { "ecosystem": "pypi", "licenses": [], "location": "uv.lock", "name": "charset-normalizer", "purl": "pkg:pypi/charset-normalizer@3.5.0", "version": "3.5.0" }, { "ecosystem": "pypi", "licenses": [], "location": "uv.lock", "name": "cleo", "purl": "pkg:pypi/cleo@2.1.0", "version": "2.1.0" }, { "ecosystem": "pypi", "licenses": [], "location": "uv.lock", "name": "crashtest", "purl": "pkg:pypi/crashtest@0.4.1", "version": "0.4.1" }, { "ecosystem": "pypi", "licenses": [], "location": "uv.lock", "name": "custom-json-diff", "purl": "pkg:pypi/custom-json-diff@2.1.6", "version": "2.1.6" }, { "ecosystem": "pypi", "licenses": [], "location": "uv.lock", "name": "defusedxml", "purl": "pkg:pypi/defusedxml@0.7.1", "version": "0.7.1" }, { "ecosystem": "pypi", "licenses": [], "location": "uv.lock", "name": "dnspython", "purl": "pkg:pypi/dnspython@2.8.0", "version": "2.8.0" }, { "ecosystem": "pypi", "licenses": [], "location": "uv.lock", "name": "email-validator", "purl": "pkg:pypi/email-validator@2.3.0", "version": "2.3.0" }, { "ecosystem": "pypi", "licenses": [], "location": "uv.lock", "name": "idna", "purl": "pkg:pypi/idna@3.18", "version": "3.18" }, { "ecosystem": "pypi", "licenses": [], "location": "uv.lock", "name": "jinja2", "purl": "pkg:pypi/jinja2@3.1.6", "version": "3.1.6" }, { "ecosystem": "pypi", "licenses": [], "location": "uv.lock", "name": "jmespath", "purl": "pkg:pypi/jmespath@1.1.0", "version": "1.1.0" }, { "ecosystem": "pypi", "licenses": [], "location": "uv.lock", "name": "json-flatten", "purl": "pkg:pypi/json-flatten@0.3.1", "version": "0.3.1" }, { "ecosystem": "pypi", "licenses": [], "location": "uv.lock", "name": "jsonschema", "purl": "pkg:pypi/jsonschema@4.26.0", "version": "4.26.0" }, { "ecosystem": "pypi", "licenses": [], "location": "uv.lock", "name": "jsonschema-specifications", "purl": "pkg:pypi/jsonschema-specifications@2025.9.1", "version": "2025.9.1" }, { "ecosystem": "pypi", "licenses": [], "location": "uv.lock", "name": "lief", "purl": "pkg:pypi/lief@1.0.0", "version": "1.0.0" }, { "ecosystem": "pypi", "licenses": [], "location": "uv.lock", "name": "markdown-it-py", "purl": "pkg:pypi/markdown-it-py@4.2.0", "version": "4.2.0" }, { "ecosystem": "pypi", "licenses": [], "location": "uv.lock", "name": "markupsafe", "purl": "pkg:pypi/markupsafe@3.0.3", "version": "3.0.3" }, { "ecosystem": "pypi", "licenses": [], "location": "uv.lock", "name": "mdurl", "purl": "pkg:pypi/mdurl@0.1.2", "version": "0.1.2" }, { "ecosystem": "pypi", "licenses": [], "location": "uv.lock", "name": "multi-demangle", "purl": "pkg:pypi/multi-demangle@1.0.4", "version": "1.0.4" }, { "ecosystem": "pypi", "licenses": [], "location": "uv.lock", "name": "oras", "purl": "pkg:pypi/oras@0.2.43", "version": "0.2.43" }, { "ecosystem": "pypi", "licenses": [], "location": "uv.lock", "name": "orjson", "purl": "pkg:pypi/orjson@3.11.9", "version": "3.11.9" }, { "ecosystem": "pypi", "licenses": [], "location": "uv.lock", "name": "packageurl-python", "purl": "pkg:pypi/packageurl-python@0.17.6", "version": "0.17.6" }, { "ecosystem": "pypi", "licenses": [], "location": "uv.lock", "name": "pydantic", "purl": "pkg:pypi/pydantic@2.13.4", "version": "2.13.4" }, { "ecosystem": "pypi", "licenses": [], "location": "uv.lock", "name": "pydantic-core", "purl": "pkg:pypi/pydantic-core@2.46.4", "version": "2.46.4" }, { "ecosystem": "pypi", "licenses": [], "location": "uv.lock", "name": "pygments", "purl": "pkg:pypi/pygments@2.20.0", "version": "2.20.0" }, { "ecosystem": "pypi", "licenses": [], "location": "uv.lock", "name": "pyyaml", "purl": "pkg:pypi/pyyaml@6.0.3", "version": "6.0.3" }, { "ecosystem": "pypi", "licenses": [], "location": "uv.lock", "name": "rapidfuzz", "purl": "pkg:pypi/rapidfuzz@3.14.5", "version": "3.14.5" }, { "ecosystem": "pypi", "licenses": [], "location": "uv.lock", "name": "referencing", "purl": "pkg:pypi/referencing@0.37.0", "version": "0.37.0" }, { "ecosystem": "pypi", "licenses": [], "location": "uv.lock", "name": "requests", "purl": "pkg:pypi/requests@2.34.2", "version": "2.34.2" }, { "ecosystem": "pypi", "licenses": [], "location": "uv.lock", "name": "rich", "purl": "pkg:pypi/rich@15.0.0", "version": "15.0.0" }, { "ecosystem": "pypi", "licenses": [], "location": "uv.lock", "name": "rpds-py", "purl": "pkg:pypi/rpds-py@0.30.0", "version": "0.30.0" }, { "ecosystem": "pypi", "licenses": [], "location": "uv.lock", "name": "rpds-py", "purl": "pkg:pypi/rpds-py@2026.6.3", "version": "2026.6.3" }, { "ecosystem": "pypi", "licenses": [], "location": "uv.lock", "name": "semver", "purl": "pkg:pypi/semver@3.0.4", "version": "3.0.4" }, { "ecosystem": "pypi", "licenses": [], "location": "uv.lock", "name": "thefuzz", "purl": "pkg:pypi/thefuzz@0.22.1", "version": "0.22.1" }, { "ecosystem": "pypi", "licenses": [], "location": "uv.lock", "name": "toml", "purl": "pkg:pypi/toml@0.10.2", "version": "0.10.2" }, { "ecosystem": "pypi", "licenses": [], "location": "uv.lock", "name": "typing-extensions", "purl": "pkg:pypi/typing-extensions@4.16.0", "version": "4.16.0" }, { "ecosystem": "pypi", "licenses": [], "location": "uv.lock", "name": "typing-inspection", "purl": "pkg:pypi/typing-inspection@0.4.4", "version": "0.4.4" }, { "ecosystem": "pypi", "licenses": [], "location": "uv.lock", "name": "urllib3", "purl": "pkg:pypi/urllib3@2.7.0", "version": "2.7.0" }, { "ecosystem": "pypi", "licenses": [], "location": "uv.lock", "name": "wasm-tools", "purl": "pkg:pypi/wasm-tools@1.0.3", "version": "1.0.3" }, { "ecosystem": "unknown", "licenses": [], "location": ".github/actions/generate-attach-sbom/action.yml", "name": "./.github/actions/build-docker-image", "purl": "", "version": "UNKNOWN" }, { "ecosystem": "unknown", "licenses": [], "location": ".github/workflows/image-build.yml", "name": "./.github/actions/generate-attach-sbom", "purl": "", "version": "UNKNOWN" }, { "ecosystem": "unknown", "licenses": [], "location": ".github/workflows/build-images.yml", "name": "./.github/workflows/image-build.yml", "purl": "", "version": "UNKNOWN" } ], "description": "Create CycloneDX SBOMs for various languages", "errors": [], "id": "CycloneDX__cdxgen", "manifests": [ ".github/actions/build-docker-image/action.yml", ".github/actions/generate-attach-sbom/action.yml", ".github/workflows/agent-plugin.yml", ".github/workflows/binary-builds.yml", ".github/workflows/build-image.yml", ".github/workflows/build-images.yml", ".github/workflows/build-rolling-image.yml", ".github/workflows/bun.yml", ".github/workflows/codeql.yml", ".github/workflows/copilot-setup-steps.yml", ".github/workflows/deno.yml", ".github/workflows/dockertests.yml", ".github/workflows/hbom-artifacts.yml", ".github/workflows/image-build.yml", ".github/workflows/java-reachables-test.yml", ".github/workflows/license-policy.yml", ".github/workflows/lint.yml", ".github/workflows/nodejs.yml", ".github/workflows/npm-release.yml", ".github/workflows/project-sync.yml", ".github/workflows/python-atom-tests.yml", ".github/workflows/rebuild-release-images.yml", ".github/workflows/repotests-quick.yml", ".github/workflows/repotests.yml", ".github/workflows/rerun-workflow.yml", ".github/workflows/test-nodejs-nightly.yml", ".github/workflows/wslc-test.yml", "contrib/requirements.txt", "package.json", "pnpm-lock.yaml", "pyproject.toml", "uv.lock" ], "name": "cdxgen", "osv": { "advisories": 13, "available": true, "confirmed": 13, "osv_only": [], "warning": null }, "ref": "v13.6.0", "ref_kind": "release", "release_integrity": { "asset": "cdxgen-linux-amd64", "assets": 342, "build_provenance": null, "checksums_published": true, "digest_matches_github": true, "immutable_release": null, "methods": [], "provenance_published": false, "sbom_published": true, "signature": null, "signatures_published": false, "signer": null, "verdict": "checksums-only" }, "released_at": "2026-10-31T09:35:36Z", "repository": "CycloneDX/cdxgen", "sbomlyze_diff": { "added": 0, "changed": 0, "drift": {}, "findings": [ "0 version changes among 437 shared packages \u2014 no actual upgrades", "Core system packages stable: npm (249), github (106), pypi (48), file (28) unchanged" ], "removed": 0 }, "scanned_at": "2026-11-02T03:07:37+00:00", "scorecard": null, "scorecard_note": "the project is not in the OpenSSF public dataset; the Scorecard CLI fallback was skipped because this shard's weekly budget was used", "vulnerabilities": [ { "aliases": [], "ecosystem": "pypi", "epss": null, "fix_state": "fixed", "fixed_in": [ "2026.10.18" ], "id": "GHSA-6q48-6c7w-9gw2", "kev": null, "location": "uv.lock", "osv_confirmed": true, "package": "certifi", "severity": "Critical", "summary": "certifi bundles emSign root CAs with compromised intermediate CA keys", "url": "https://github.com/advisories/GHSA-6q48-6c7w-9gw2", "version": "2026.7.22" }, { "aliases": [ "CVE-2026-111181" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-111181", "percentile": 0.32919, "score": 0.00388 }, "fix_state": "fixed", "fixed_in": [ "2.4.0" ], "id": "GHSA-27r3-jxmh-p828", "kev": null, "location": "pnpm-lock.yaml", "osv_confirmed": true, "package": "body-parser", "severity": "High", "summary": "body-parser vulnerable to Denial of Service via trailing bytes after a compressed request body", "url": "https://github.com/advisories/GHSA-27r3-jxmh-p828", "version": "2.3.0" }, { "aliases": [ "CVE-2026-114605" ], "ecosystem": "pypi", "epss": { "cve": "CVE-2026-114605", "percentile": 0.40313, "score": 0.00466 }, "fix_state": "fixed", "fixed_in": [ "2.9.0" ], "id": "GHSA-45c3-73f7-pv4m", "kev": null, "location": "uv.lock", "osv_confirmed": true, "package": "dnspython", "severity": "High", "summary": "dnspython dns.name.from_wire_parser() excessive CPU use", "url": "https://github.com/advisories/GHSA-45c3-73f7-pv4m", "version": "2.8.0" }, { "aliases": [ "CVE-2026-97687" ], "ecosystem": "pypi", "epss": { "cve": "CVE-2026-97687", "percentile": 0.10658, "score": 0.00206 }, "fix_state": "fixed", "fixed_in": [ "2.8.0" ], "id": "GHSA-8988-9cw3-xx77", "kev": null, "location": "uv.lock", "osv_confirmed": true, "package": "urllib3", "severity": "High", "summary": "urllib3: HTTPS proxy TLS configuration may be ignored or overridden", "url": "https://github.com/advisories/GHSA-8988-9cw3-xx77", "version": "2.7.0" }, { "aliases": [ "CVE-2026-97689" ], "ecosystem": "pypi", "epss": { "cve": "CVE-2026-97689", "percentile": 0.26853, "score": 0.00335 }, "fix_state": "fixed", "fixed_in": [ "2.8.0" ], "id": "GHSA-vxq7-64xx-v4gw", "kev": null, "location": "uv.lock", "osv_confirmed": true, "package": "urllib3", "severity": "High", "summary": "urllib3: HTTPResponse.stream()/read_chunked() buffers an unbounded chunk-size line into memory", "url": "https://github.com/advisories/GHSA-vxq7-64xx-v4gw", "version": "2.7.0" }, { "aliases": [ "CVE-2026-110306" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-110306", "percentile": 0.1635, "score": 0.0025 }, "fix_state": "fixed", "fixed_in": [ "3.1.9" ], "id": "GHSA-w74x-v6f9-j3xg", "kev": null, "location": "pnpm-lock.yaml", "osv_confirmed": true, "package": "fast-uri", "severity": "Medium", "summary": "fast-uri vulnerable to URI scheme spoofing via percent-encoded scheme decoding", "url": "https://github.com/advisories/GHSA-w74x-v6f9-j3xg", "version": "3.1.8" }, { "aliases": [ "CVE-2026-110180" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-110180", "percentile": 0.17118, "score": 0.00255 }, "fix_state": "fixed", "fixed_in": [ "3.1.9" ], "id": "GHSA-wjr9-j795-jxcr", "kev": null, "location": "pnpm-lock.yaml", "osv_confirmed": true, "package": "fast-uri", "severity": "Medium", "summary": "fast-uri vulnerable to host confusion via unchecked WHATWG host canonicalization", "url": "https://github.com/advisories/GHSA-wjr9-j795-jxcr", "version": "3.1.8" }, { "aliases": [ "CVE-2026-118773" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-118773", "percentile": 0.28707, "score": 0.0035 }, "fix_state": "fixed", "fixed_in": [ "14.0.2" ], "id": "GHSA-3g3m-2fjr-6pw4", "kev": null, "location": "pnpm-lock.yaml", "osv_confirmed": true, "package": "glob", "severity": "Medium", "summary": "Glob: AbortSignal cancellation bypass allows post-timeout filesystem traversal", "url": "https://github.com/advisories/GHSA-3g3m-2fjr-6pw4", "version": "13.0.6" }, { "aliases": [ "CVE-2026-118764" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-118764", "percentile": 0.21751, "score": 0.00291 }, "fix_state": "fixed", "fixed_in": [ "11.0.1" ], "id": "GHSA-g3hv-75wg-m249", "kev": null, "location": "pnpm-lock.yaml", "osv_confirmed": true, "package": "minimatch", "severity": "Medium", "summary": "minimatch has potential denial of service via globparts amplification", "url": "https://github.com/advisories/GHSA-g3hv-75wg-m249", "version": "10.2.6" }, { "aliases": [ "CVE-2026-110816" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-110816", "percentile": 0.30708, "score": 0.00368 }, "fix_state": "fixed", "fixed_in": [ "6.16.1" ], "id": "GHSA-6pq8-jhm2-2vcw", "kev": null, "location": "pnpm-lock.yaml", "osv_confirmed": true, "package": "qs", "severity": "Medium", "summary": "qs : qs.stringify with arrayFormat 'comma' throws an uncaught TypeError on array elements carrying a non-callable own toString (DoS)", "url": "https://github.com/advisories/GHSA-6pq8-jhm2-2vcw", "version": "6.16.0" }, { "aliases": [ "CVE-2026-97688" ], "ecosystem": "pypi", "epss": { "cve": "CVE-2026-97688", "percentile": 0.21778, "score": 0.00292 }, "fix_state": "fixed", "fixed_in": [ "2.8.0" ], "id": "GHSA-gh4c-6fx4-qh6g", "kev": null, "location": "uv.lock", "osv_confirmed": true, "package": "urllib3", "severity": "Medium", "summary": "urllib3: Chunked Deflate streaming can enter an infinite loop", "url": "https://github.com/advisories/GHSA-gh4c-6fx4-qh6g", "version": "2.7.0" }, { "aliases": [ "CVE-2026-110725" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-110725", "percentile": 0.22997, "score": 0.00302 }, "fix_state": "fixed", "fixed_in": [ "3.1.9" ], "id": "GHSA-333x-w4r6-6crp", "kev": null, "location": "pnpm-lock.yaml", "osv_confirmed": true, "package": "fast-uri", "severity": "Low", "summary": "fast-uri vulnerable to scheme injection via an unescaped first-segment colon in suffix references", "url": "https://github.com/advisories/GHSA-333x-w4r6-6crp", "version": "3.1.8" }, { "aliases": [ "CVE-2026-110095" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-110095", "percentile": 0.21547, "score": 0.00289 }, "fix_state": "fixed", "fixed_in": [ "3.1.9" ], "id": "GHSA-xhq7-xmqj-769h", "kev": null, "location": "pnpm-lock.yaml", "osv_confirmed": true, "package": "fast-uri", "severity": "Low", "summary": "fast-uri vulnerable to improper path equivalence in relative reference normalization", "url": "https://github.com/advisories/GHSA-xhq7-xmqj-769h", "version": "3.1.8" } ], "workflow_audit": { "files": 27, "findings": [ { "confidence": "Medium", "description": "use of fundamentally insecure workflow trigger", "file": ".github/workflows/project-sync.yml", "line": 6, "note": "this workflow", "rule": "dangerous-triggers", "severity": "High", "url": "https://docs.zizmor.sh/audits/#dangerous-triggers" }, { "confidence": "High", "description": "use GitHub's dedicated self-repository syntax", "file": ".github/actions/generate-attach-sbom/action.yml", "line": 28, "note": "this step", "rule": "self-repository", "severity": "Low", "url": "https://docs.zizmor.sh/audits/#self-repository" }, { "confidence": "High", "description": "ad-hoc installation of packages", "file": ".github/workflows/agent-plugin.yml", "line": 35, "note": "this step", "rule": "adhoc-packages", "severity": "Low", "url": "https://docs.zizmor.sh/audits/#adhoc-packages" }, { "confidence": "High", "description": "use GitHub's dedicated self-repository syntax", "file": ".github/workflows/build-image.yml", "line": 89, "note": "this step", "rule": "self-repository", "severity": "Low", "url": "https://docs.zizmor.sh/audits/#self-repository" }, { "confidence": "High", "description": "use GitHub's dedicated self-repository syntax", "file": ".github/workflows/build-images.yml", "line": 59, "note": "this job", "rule": "self-repository", "severity": "Low", "url": "https://docs.zizmor.sh/audits/#self-repository" }, { "confidence": "High", "description": "use GitHub's dedicated self-repository syntax", "file": ".github/workflows/build-rolling-image.yml", "line": 24, "note": "this job", "rule": "self-repository", "severity": "Low", "url": "https://docs.zizmor.sh/audits/#self-repository" }, { "confidence": "High", "description": "use GitHub's dedicated self-repository syntax", "file": ".github/workflows/image-build.yml", "line": 197, "note": "this step", "rule": "self-repository", "severity": "Low", "url": "https://docs.zizmor.sh/audits/#self-repository" }, { "confidence": "High", "description": "use GitHub's dedicated self-repository syntax", "file": ".github/workflows/image-build.yml", "line": 220, "note": "this step", "rule": "self-repository", "severity": "Low", "url": "https://docs.zizmor.sh/audits/#self-repository" }, { "confidence": "High", "description": "use GitHub's dedicated self-repository syntax", "file": ".github/workflows/image-build.yml", "line": 250, "note": "this step", "rule": "self-repository", "severity": "Low", "url": "https://docs.zizmor.sh/audits/#self-repository" }, { "confidence": "High", "description": "use GitHub's dedicated self-repository syntax", "file": ".github/workflows/image-build.yml", "line": 280, "note": "this step", "rule": "self-repository", "severity": "Low", "url": "https://docs.zizmor.sh/audits/#self-repository" }, { "confidence": "High", "description": "use GitHub's dedicated self-repository syntax", "file": ".github/workflows/image-build.yml", "line": 308, "note": "this step", "rule": "self-repository", "severity": "Low", "url": "https://docs.zizmor.sh/audits/#self-repository" }, { "confidence": "High", "description": "use GitHub's dedicated self-repository syntax", "file": ".github/workflows/image-build.yml", "line": 340, "note": "this step", "rule": "self-repository", "severity": "Low", "url": "https://docs.zizmor.sh/audits/#self-repository" }, { "confidence": "High", "description": "use GitHub's dedicated self-repository syntax", "file": ".github/workflows/image-build.yml", "line": 434, "note": "this step", "rule": "self-repository", "severity": "Low", "url": "https://docs.zizmor.sh/audits/#self-repository" }, { "confidence": "High", "description": "use GitHub's dedicated self-repository syntax", "file": ".github/workflows/image-build.yml", "line": 457, "note": "this step", "rule": "self-repository", "severity": "Low", "url": "https://docs.zizmor.sh/audits/#self-repository" }, { "confidence": "High", "description": "use GitHub's dedicated self-repository syntax", "file": ".github/workflows/image-build.yml", "line": 487, "note": "this step", "rule": "self-repository", "severity": "Low", "url": "https://docs.zizmor.sh/audits/#self-repository" }, { "confidence": "High", "description": "use GitHub's dedicated self-repository syntax", "file": ".github/workflows/image-build.yml", "line": 517, "note": "this step", "rule": "self-repository", "severity": "Low", "url": "https://docs.zizmor.sh/audits/#self-repository" }, { "confidence": "High", "description": "use GitHub's dedicated self-repository syntax", "file": ".github/workflows/image-build.yml", "line": 545, "note": "this step", "rule": "self-repository", "severity": "Low", "url": "https://docs.zizmor.sh/audits/#self-repository" }, { "confidence": "High", "description": "use GitHub's dedicated self-repository syntax", "file": ".github/workflows/image-build.yml", "line": 577, "note": "this step", "rule": "self-repository", "severity": "Low", "url": "https://docs.zizmor.sh/audits/#self-repository" }, { "confidence": "High", "description": "use GitHub's dedicated self-repository syntax", "file": ".github/workflows/image-build.yml", "line": 995, "note": "this step", "rule": "self-repository", "severity": "Low", "url": "https://docs.zizmor.sh/audits/#self-repository" }, { "confidence": "High", "description": "use GitHub's dedicated self-repository syntax", "file": ".github/workflows/image-build.yml", "line": 1004, "note": "this step", "rule": "self-repository", "severity": "Low", "url": "https://docs.zizmor.sh/audits/#self-repository" }, { "confidence": "High", "description": "use GitHub's dedicated self-repository syntax", "file": ".github/workflows/image-build.yml", "line": 1016, "note": "this step", "rule": "self-repository", "severity": "Low", "url": "https://docs.zizmor.sh/audits/#self-repository" }, { "confidence": "High", "description": "use GitHub's dedicated self-repository syntax", "file": ".github/workflows/image-build.yml", "line": 1026, "note": "this step", "rule": "self-repository", "severity": "Low", "url": "https://docs.zizmor.sh/audits/#self-repository" }, { "confidence": "High", "description": "use GitHub's dedicated self-repository syntax", "file": ".github/workflows/image-build.yml", "line": 1036, "note": "this step", "rule": "self-repository", "severity": "Low", "url": "https://docs.zizmor.sh/audits/#self-repository" }, { "confidence": "High", "description": "use GitHub's dedicated self-repository syntax", "file": ".github/workflows/image-build.yml", "line": 1048, "note": "this step", "rule": "self-repository", "severity": "Low", "url": "https://docs.zizmor.sh/audits/#self-repository" }, { "confidence": "High", "description": "use GitHub's dedicated self-repository syntax", "file": ".github/workflows/image-build.yml", "line": 1105, "note": "this step", "rule": "self-repository", "severity": "Low", "url": "https://docs.zizmor.sh/audits/#self-repository" }, { "confidence": "High", "description": "use GitHub's dedicated self-repository syntax", "file": ".github/workflows/image-build.yml", "line": 1114, "note": "this step", "rule": "self-repository", "severity": "Low", "url": "https://docs.zizmor.sh/audits/#self-repository" }, { "confidence": "High", "description": "use GitHub's dedicated self-repository syntax", "file": ".github/workflows/image-build.yml", "line": 1126, "note": "this step", "rule": "self-repository", "severity": "Low", "url": "https://docs.zizmor.sh/audits/#self-repository" }, { "confidence": "High", "description": "use GitHub's dedicated self-repository syntax", "file": ".github/workflows/image-build.yml", "line": 1136, "note": "this step", "rule": "self-repository", "severity": "Low", "url": "https://docs.zizmor.sh/audits/#self-repository" }, { "confidence": "High", "description": "use GitHub's dedicated self-repository syntax", "file": ".github/workflows/image-build.yml", "line": 1146, "note": "this step", "rule": "self-repository", "severity": "Low", "url": "https://docs.zizmor.sh/audits/#self-repository" }, { "confidence": "High", "description": "use GitHub's dedicated self-repository syntax", "file": ".github/workflows/image-build.yml", "line": 1158, "note": "this step", "rule": "self-repository", "severity": "Low", "url": "https://docs.zizmor.sh/audits/#self-repository" }, { "confidence": "High", "description": "ad-hoc installation of packages", "file": ".github/workflows/repotests.yml", "line": 188, "note": "this step", "rule": "adhoc-packages", "severity": "Low", "url": "https://docs.zizmor.sh/audits/#adhoc-packages" }, { "confidence": "High", "description": "action functionality is already included by the runner", "file": ".github/workflows/binary-builds.yml", "line": 396, "note": "this step", "rule": "superfluous-actions", "severity": "Informational", "url": "https://docs.zizmor.sh/audits/#superfluous-actions" }, { "confidence": "High", "description": "action functionality is already included by the runner", "file": ".github/workflows/nodejs.yml", "line": 260, "note": "this step", "rule": "superfluous-actions", "severity": "Informational", "url": "https://docs.zizmor.sh/audits/#superfluous-actions" }, { "confidence": "High", "description": "action functionality is already included by the runner", "file": ".github/workflows/npm-release.yml", "line": 410, "note": "this step", "rule": "superfluous-actions", "severity": "Informational", "url": "https://docs.zizmor.sh/audits/#superfluous-actions" }, { "confidence": "High", "description": "action functionality is already included by the runner", "file": ".github/workflows/npm-release.yml", "line": 616, "note": "this step", "rule": "superfluous-actions", "severity": "Informational", "url": "https://docs.zizmor.sh/audits/#superfluous-actions" }, { "confidence": "High", "description": "action functionality is already included by the runner", "file": ".github/workflows/npm-release.yml", "line": 818, "note": "this step", "rule": "superfluous-actions", "severity": "Informational", "url": "https://docs.zizmor.sh/audits/#superfluous-actions" }, { "confidence": "High", "description": "action functionality is already included by the runner", "file": ".github/workflows/npm-release.yml", "line": 1081, "note": "this step", "rule": "superfluous-actions", "severity": "Informational", "url": "https://docs.zizmor.sh/audits/#superfluous-actions" } ] } }, "updated": "2026-11-02" }