{
  "history": [
    {
      "added": 0,
      "commit": "b3cfa4b0edc356dad07e0b6e7ab6da0a94af0246",
      "date": "2026-11-01",
      "dependencies": 5,
      "errors": [],
      "fixable": 0,
      "go_version": null,
      "in_binary": null,
      "new_vulnerabilities": 0,
      "osv_confirmed": 0,
      "osv_only": 3,
      "ref": "v0.33.1",
      "release_changed": false,
      "release_integrity": "none",
      "removed": 0,
      "resolved_vulnerabilities": 0,
      "scorecard": null,
      "upgraded": 0,
      "vulnerabilities": {
        "Critical": 0,
        "High": 0,
        "Low": 0,
        "Medium": 0,
        "Negligible": 0,
        "Unknown": 0
      },
      "workflow": {
        "High": 21,
        "Low": 0,
        "Medium": 11,
        "files": 2
      }
    },
    {
      "added": 0,
      "commit": "b3cfa4b0edc356dad07e0b6e7ab6da0a94af0246",
      "date": "2026-11-02",
      "dependencies": 5,
      "errors": [],
      "fixable": 0,
      "go_version": null,
      "in_binary": null,
      "kev": null,
      "kev_new": 0,
      "new_vulnerabilities": 0,
      "osv_confirmed": 0,
      "osv_only": 3,
      "ref": "v0.33.1",
      "release_changed": false,
      "release_integrity": "none",
      "removed": 0,
      "resolved_vulnerabilities": 0,
      "scorecard": null,
      "scorecard_date": null,
      "scorecard_note": "the project is not in the OpenSSF public dataset; the Scorecard CLI fallback was skipped because this shard's weekly budget was used",
      "scorecard_source": null,
      "upgraded": 0,
      "vulnerabilities": {
        "Critical": 0,
        "High": 0,
        "Low": 0,
        "Medium": 0,
        "Negligible": 0,
        "Unknown": 0
      },
      "vulnerable_packages": 0,
      "workflow": {
        "High": 21,
        "Low": 0,
        "Medium": 11,
        "files": 2
      }
    }
  ],
  "latest": {
    "archived": false,
    "category": "SBOM Generation",
    "changes": {
      "added": [],
      "any": false,
      "baseline": false,
      "integrity_drift": 0,
      "license_changes": [],
      "new_vulnerabilities": [],
      "previous_ref": "v0.33.1",
      "release_changed": false,
      "removed": [],
      "resolved_vulnerabilities": [],
      "upgraded": [],
      "workflow_new": 0,
      "workflow_resolved": 0
    },
    "commit": "b3cfa4b0edc356dad07e0b6e7ab6da0a94af0246",
    "compliance": {
      "overall_score": 55,
      "standards": {
        "bsi_tr03183": {
          "failed_checks": [
            "Component Creator",
            "Distribution Licences",
            "SHA-512 Hash",
            "Dependency Relationship",
            "SBOM Creator Contact"
          ],
          "passed": 4,
          "score": 44,
          "total": 9
        },
        "cisa": {
          "failed_checks": [
            "Software Producer",
            "Dependency Relationship",
            "License Information",
            "Component Hash",
            "SBOM Author"
          ],
          "passed": 5,
          "score": 50,
          "total": 10
        },
        "ntia": {
          "failed_checks": [
            "Supplier Name",
            "Dependency Relationship"
          ],
          "passed": 5,
          "score": 71,
          "total": 7
        }
      }
    },
    "components": [
      {
        "ecosystem": "github",
        "licenses": [],
        "location": ".github/workflows/dotnetcore.yml",
        "name": "actions/checkout",
        "purl": "pkg:github/actions/checkout@v7.0.1",
        "version": "v7.0.1"
      },
      {
        "ecosystem": "github",
        "licenses": [],
        "location": ".github/workflows/release.yml",
        "name": "actions/create-release",
        "purl": "pkg:github/actions/create-release@v1.1.4",
        "version": "v1.1.4"
      },
      {
        "ecosystem": "github",
        "licenses": [],
        "location": ".github/workflows/dotnetcore.yml",
        "name": "actions/setup-dotnet",
        "purl": "pkg:github/actions/setup-dotnet@v6.0.0",
        "version": "v6.0.0"
      },
      {
        "ecosystem": "github",
        "licenses": [],
        "location": ".github/workflows/release.yml",
        "name": "actions/upload-release-asset",
        "purl": "pkg:github/actions/upload-release-asset@v1.0.2",
        "version": "v1.0.2"
      },
      {
        "ecosystem": "github",
        "licenses": [],
        "location": ".github/workflows/release.yml",
        "name": "docker/setup-buildx-action",
        "purl": "pkg:github/docker/setup-buildx-action@v4.2.0",
        "version": "v4.2.0"
      }
    ],
    "description": "Inspect, convert, and merge CycloneDX SBOMs",
    "errors": [],
    "id": "CycloneDX__cyclonedx-cli",
    "manifests": [
      ".github/workflows/dotnetcore.yml",
      ".github/workflows/release.yml",
      "src/cyclonedx/cyclonedx.csproj"
    ],
    "name": "cyclonedx-cli",
    "osv": {
      "advisories": 3,
      "available": true,
      "confirmed": 0,
      "osv_only": [
        {
          "ecosystem": "NuGet",
          "ids": [
            "BIT-dotnet-2026-96960",
            "BIT-dotnet-sdk-2026-96960",
            "CVE-2026-96960",
            "GHSA-7hqp-7c5m-4vq6"
          ],
          "package": "System.Security.Cryptography.Xml",
          "score": "7.5",
          "severity": "High",
          "version": "10.0.10"
        },
        {
          "ecosystem": "NuGet",
          "ids": [
            "BIT-dotnet-2026-96959",
            "BIT-dotnet-sdk-2026-96959",
            "CVE-2026-96959",
            "GHSA-c399-9853-6jmj"
          ],
          "package": "System.Security.Cryptography.Xml",
          "score": "7.5",
          "severity": "High",
          "version": "10.0.10"
        },
        {
          "ecosystem": "NuGet",
          "ids": [
            "BIT-dotnet-2026-96958",
            "BIT-dotnet-sdk-2026-96958",
            "CVE-2026-96958",
            "GHSA-r955-8q5j-3h83"
          ],
          "package": "System.Security.Cryptography.Xml",
          "score": "7.5",
          "severity": "High",
          "version": "10.0.10"
        }
      ],
      "warning": null
    },
    "ref": "v0.33.1",
    "ref_kind": "release",
    "release_integrity": {
      "asset": "cyclonedx-linux-x64",
      "assets": 10,
      "build_provenance": null,
      "checksums_published": false,
      "digest_matches_github": true,
      "immutable_release": null,
      "methods": [],
      "provenance_published": false,
      "sbom_published": true,
      "signature": null,
      "signatures_published": false,
      "signer": null,
      "verdict": "none"
    },
    "released_at": "2026-07-23T19:48:51Z",
    "repository": "CycloneDX/cyclonedx-cli",
    "sbomlyze_diff": {
      "added": 0,
      "changed": 0,
      "drift": {},
      "findings": [
        "0 version changes among 9 shared packages \u2014 no actual upgrades"
      ],
      "removed": 0
    },
    "scanned_at": "2026-11-02T03:06:38+00:00",
    "scorecard": null,
    "scorecard_note": "the project is not in the OpenSSF public dataset; the Scorecard CLI fallback was skipped because this shard's weekly budget was used",
    "vulnerabilities": [],
    "workflow_audit": {
      "files": 2,
      "findings": [
        {
          "confidence": "High",
          "description": "unpinned action reference",
          "file": ".github/workflows/dotnetcore.yml",
          "line": 23,
          "note": "this step",
          "rule": "unpinned-uses",
          "severity": "High",
          "url": "https://docs.zizmor.sh/audits/#unpinned-uses"
        },
        {
          "confidence": "High",
          "description": "unpinned action reference",
          "file": ".github/workflows/dotnetcore.yml",
          "line": 24,
          "note": "this step",
          "rule": "unpinned-uses",
          "severity": "High",
          "url": "https://docs.zizmor.sh/audits/#unpinned-uses"
        },
        {
          "confidence": "High",
          "description": "unpinned action reference",
          "file": ".github/workflows/dotnetcore.yml",
          "line": 40,
          "note": "this step",
          "rule": "unpinned-uses",
          "severity": "High",
          "url": "https://docs.zizmor.sh/audits/#unpinned-uses"
        },
        {
          "confidence": "High",
          "description": "unpinned action reference",
          "file": ".github/workflows/dotnetcore.yml",
          "line": 41,
          "note": "this step",
          "rule": "unpinned-uses",
          "severity": "High",
          "url": "https://docs.zizmor.sh/audits/#unpinned-uses"
        },
        {
          "confidence": "High",
          "description": "unpinned action reference",
          "file": ".github/workflows/dotnetcore.yml",
          "line": 64,
          "note": "this step",
          "rule": "unpinned-uses",
          "severity": "High",
          "url": "https://docs.zizmor.sh/audits/#unpinned-uses"
        },
        {
          "confidence": "High",
          "description": "unpinned action reference",
          "file": ".github/workflows/dotnetcore.yml",
          "line": 65,
          "note": "this step",
          "rule": "unpinned-uses",
          "severity": "High",
          "url": "https://docs.zizmor.sh/audits/#unpinned-uses"
        },
        {
          "confidence": "High",
          "description": "unpinned action reference",
          "file": ".github/workflows/release.yml",
          "line": 42,
          "note": "this step",
          "rule": "unpinned-uses",
          "severity": "High",
          "url": "https://docs.zizmor.sh/audits/#unpinned-uses"
        },
        {
          "confidence": "High",
          "description": "unpinned action reference",
          "file": ".github/workflows/release.yml",
          "line": 44,
          "note": "this step",
          "rule": "unpinned-uses",
          "severity": "High",
          "url": "https://docs.zizmor.sh/audits/#unpinned-uses"
        },
        {
          "confidence": "High",
          "description": "unpinned action reference",
          "file": ".github/workflows/release.yml",
          "line": 88,
          "note": "this step",
          "rule": "unpinned-uses",
          "severity": "High",
          "url": "https://docs.zizmor.sh/audits/#unpinned-uses"
        },
        {
          "confidence": "High",
          "description": "unpinned action reference",
          "file": ".github/workflows/release.yml",
          "line": 99,
          "note": "this step",
          "rule": "unpinned-uses",
          "severity": "High",
          "url": "https://docs.zizmor.sh/audits/#unpinned-uses"
        },
        {
          "confidence": "High",
          "description": "unpinned action reference",
          "file": ".github/workflows/release.yml",
          "line": 109,
          "note": "this step",
          "rule": "unpinned-uses",
          "severity": "High",
          "url": "https://docs.zizmor.sh/audits/#unpinned-uses"
        },
        {
          "confidence": "High",
          "description": "unpinned action reference",
          "file": ".github/workflows/release.yml",
          "line": 119,
          "note": "this step",
          "rule": "unpinned-uses",
          "severity": "High",
          "url": "https://docs.zizmor.sh/audits/#unpinned-uses"
        },
        {
          "confidence": "High",
          "description": "unpinned action reference",
          "file": ".github/workflows/release.yml",
          "line": 129,
          "note": "this step",
          "rule": "unpinned-uses",
          "severity": "High",
          "url": "https://docs.zizmor.sh/audits/#unpinned-uses"
        },
        {
          "confidence": "High",
          "description": "unpinned action reference",
          "file": ".github/workflows/release.yml",
          "line": 139,
          "note": "this step",
          "rule": "unpinned-uses",
          "severity": "High",
          "url": "https://docs.zizmor.sh/audits/#unpinned-uses"
        },
        {
          "confidence": "High",
          "description": "unpinned action reference",
          "file": ".github/workflows/release.yml",
          "line": 149,
          "note": "this step",
          "rule": "unpinned-uses",
          "severity": "High",
          "url": "https://docs.zizmor.sh/audits/#unpinned-uses"
        },
        {
          "confidence": "High",
          "description": "unpinned action reference",
          "file": ".github/workflows/release.yml",
          "line": 159,
          "note": "this step",
          "rule": "unpinned-uses",
          "severity": "High",
          "url": "https://docs.zizmor.sh/audits/#unpinned-uses"
        },
        {
          "confidence": "High",
          "description": "unpinned action reference",
          "file": ".github/workflows/release.yml",
          "line": 169,
          "note": "this step",
          "rule": "unpinned-uses",
          "severity": "High",
          "url": "https://docs.zizmor.sh/audits/#unpinned-uses"
        },
        {
          "confidence": "High",
          "description": "unpinned action reference",
          "file": ".github/workflows/release.yml",
          "line": 179,
          "note": "this step",
          "rule": "unpinned-uses",
          "severity": "High",
          "url": "https://docs.zizmor.sh/audits/#unpinned-uses"
        },
        {
          "confidence": "High",
          "description": "unpinned action reference",
          "file": ".github/workflows/release.yml",
          "line": 199,
          "note": "this step",
          "rule": "unpinned-uses",
          "severity": "High",
          "url": "https://docs.zizmor.sh/audits/#unpinned-uses"
        },
        {
          "confidence": "High",
          "description": "unpinned action reference",
          "file": ".github/workflows/release.yml",
          "line": 200,
          "note": "this step",
          "rule": "unpinned-uses",
          "severity": "High",
          "url": "https://docs.zizmor.sh/audits/#unpinned-uses"
        },
        {
          "confidence": "High",
          "description": "unpinned action reference",
          "file": ".github/workflows/release.yml",
          "line": 217,
          "note": "this step",
          "rule": "unpinned-uses",
          "severity": "High",
          "url": "https://docs.zizmor.sh/audits/#unpinned-uses"
        },
        {
          "confidence": "High",
          "description": "action or reusable workflow from archived repository",
          "file": ".github/workflows/release.yml",
          "line": 88,
          "note": "this step",
          "rule": "archived-uses",
          "severity": "Medium",
          "url": "https://docs.zizmor.sh/audits/#archived-uses"
        },
        {
          "confidence": "High",
          "description": "action or reusable workflow from archived repository",
          "file": ".github/workflows/release.yml",
          "line": 99,
          "note": "this step",
          "rule": "archived-uses",
          "severity": "Medium",
          "url": "https://docs.zizmor.sh/audits/#archived-uses"
        },
        {
          "confidence": "High",
          "description": "action or reusable workflow from archived repository",
          "file": ".github/workflows/release.yml",
          "line": 109,
          "note": "this step",
          "rule": "archived-uses",
          "severity": "Medium",
          "url": "https://docs.zizmor.sh/audits/#archived-uses"
        },
        {
          "confidence": "High",
          "description": "action or reusable workflow from archived repository",
          "file": ".github/workflows/release.yml",
          "line": 119,
          "note": "this step",
          "rule": "archived-uses",
          "severity": "Medium",
          "url": "https://docs.zizmor.sh/audits/#archived-uses"
        },
        {
          "confidence": "High",
          "description": "action or reusable workflow from archived repository",
          "file": ".github/workflows/release.yml",
          "line": 129,
          "note": "this step",
          "rule": "archived-uses",
          "severity": "Medium",
          "url": "https://docs.zizmor.sh/audits/#archived-uses"
        },
        {
          "confidence": "High",
          "description": "action or reusable workflow from archived repository",
          "file": ".github/workflows/release.yml",
          "line": 139,
          "note": "this step",
          "rule": "archived-uses",
          "severity": "Medium",
          "url": "https://docs.zizmor.sh/audits/#archived-uses"
        },
        {
          "confidence": "High",
          "description": "action or reusable workflow from archived repository",
          "file": ".github/workflows/release.yml",
          "line": 149,
          "note": "this step",
          "rule": "archived-uses",
          "severity": "Medium",
          "url": "https://docs.zizmor.sh/audits/#archived-uses"
        },
        {
          "confidence": "High",
          "description": "action or reusable workflow from archived repository",
          "file": ".github/workflows/release.yml",
          "line": 159,
          "note": "this step",
          "rule": "archived-uses",
          "severity": "Medium",
          "url": "https://docs.zizmor.sh/audits/#archived-uses"
        },
        {
          "confidence": "High",
          "description": "action or reusable workflow from archived repository",
          "file": ".github/workflows/release.yml",
          "line": 169,
          "note": "this step",
          "rule": "archived-uses",
          "severity": "Medium",
          "url": "https://docs.zizmor.sh/audits/#archived-uses"
        },
        {
          "confidence": "High",
          "description": "action or reusable workflow from archived repository",
          "file": ".github/workflows/release.yml",
          "line": 179,
          "note": "this step",
          "rule": "archived-uses",
          "severity": "Medium",
          "url": "https://docs.zizmor.sh/audits/#archived-uses"
        },
        {
          "confidence": "High",
          "description": "action or reusable workflow from archived repository",
          "file": ".github/workflows/release.yml",
          "line": 217,
          "note": "this step",
          "rule": "archived-uses",
          "severity": "Medium",
          "url": "https://docs.zizmor.sh/audits/#archived-uses"
        }
      ]
    }
  },
  "updated": "2026-11-02"
}