{
  "history": [
    {
      "added": 0,
      "commit": "7a43eb90ffd1d951adc1e445efd5abc0e188bfea",
      "date": "2026-11-01",
      "dependencies": 42,
      "errors": [],
      "fixable": 1,
      "go_version": "go1.26.10",
      "in_binary": {
        "dependencies": 0,
        "stdlib": 0,
        "total": 0
      },
      "new_vulnerabilities": 0,
      "osv_confirmed": 1,
      "osv_only": 0,
      "ref": "v0.6.0",
      "release_changed": false,
      "release_integrity": "verified",
      "removed": 0,
      "resolved_vulnerabilities": 0,
      "scorecard": 7.9,
      "upgraded": 0,
      "vulnerabilities": {
        "Critical": 0,
        "High": 1,
        "Low": 0,
        "Medium": 0,
        "Negligible": 0,
        "Unknown": 0
      },
      "workflow": {
        "High": 4,
        "Low": 2,
        "Medium": 0,
        "files": 11
      }
    },
    {
      "added": 0,
      "commit": "7a43eb90ffd1d951adc1e445efd5abc0e188bfea",
      "date": "2026-11-02",
      "dependencies": 42,
      "errors": [],
      "fixable": 1,
      "go_version": "go1.26.10",
      "in_binary": {
        "dependencies": 0,
        "stdlib": 0,
        "total": 0
      },
      "kev": 0,
      "kev_new": 0,
      "new_vulnerabilities": 0,
      "osv_confirmed": 1,
      "osv_only": 0,
      "ref": "v0.6.0",
      "release_changed": false,
      "release_integrity": "verified",
      "removed": 0,
      "resolved_vulnerabilities": 0,
      "scorecard": 7.9,
      "scorecard_date": "2026-11-01",
      "scorecard_note": null,
      "scorecard_source": "openssf-api",
      "upgraded": 0,
      "vulnerabilities": {
        "Critical": 0,
        "High": 1,
        "Low": 0,
        "Medium": 0,
        "Negligible": 0,
        "Unknown": 0
      },
      "vulnerable_packages": 1,
      "workflow": {
        "High": 4,
        "Low": 2,
        "Medium": 0,
        "files": 11
      }
    }
  ],
  "latest": {
    "archived": false,
    "category": "SBOM Generation",
    "changes": {
      "added": [],
      "any": false,
      "baseline": false,
      "in_binary_new": [],
      "in_binary_resolved": [],
      "integrity_drift": 0,
      "license_changes": [],
      "new_vulnerabilities": [],
      "previous_ref": "v0.6.0",
      "release_changed": false,
      "removed": [],
      "resolved_vulnerabilities": [],
      "upgraded": [],
      "workflow_new": 0,
      "workflow_resolved": 0
    },
    "commit": "7a43eb90ffd1d951adc1e445efd5abc0e188bfea",
    "compliance": {
      "overall_score": 55,
      "standards": {
        "bsi_tr03183": {
          "failed_checks": [
            "Component Creator",
            "Distribution Licences",
            "SHA-512 Hash",
            "Dependency Relationship",
            "SBOM Creator Contact"
          ],
          "passed": 4,
          "score": 44,
          "total": 9
        },
        "cisa": {
          "failed_checks": [
            "Software Producer",
            "Dependency Relationship",
            "License Information",
            "Component Hash",
            "SBOM Author"
          ],
          "passed": 5,
          "score": 50,
          "total": 10
        },
        "ntia": {
          "failed_checks": [
            "Supplier Name",
            "Dependency Relationship"
          ],
          "passed": 5,
          "score": 71,
          "total": 7
        }
      }
    },
    "components": [
      {
        "ecosystem": "github",
        "licenses": [],
        "location": ".github/workflows/release.yml",
        "name": "actions/attest",
        "purl": "pkg:github/actions/attest@v4.2.2",
        "version": "v4.2.2"
      },
      {
        "ecosystem": "github",
        "licenses": [],
        "location": ".github/workflows/ci.yml",
        "name": "actions/checkout",
        "purl": "pkg:github/actions/checkout@v7.0.1",
        "version": "v7.0.1"
      },
      {
        "ecosystem": "github",
        "licenses": [],
        "location": ".github/workflows/ci.yml",
        "name": "actions/setup-go",
        "purl": "pkg:github/actions/setup-go@v7.0.0",
        "version": "v7.0.0"
      },
      {
        "ecosystem": "github",
        "licenses": [],
        "location": ".github/workflows/release.yml",
        "name": "anchore/sbom-action/download-syft",
        "purl": "pkg:github/anchore/sbom-action@v0.24.2#download-syft",
        "version": "v0.24.2"
      },
      {
        "ecosystem": "github",
        "licenses": [],
        "location": ".github/workflows/scorecard.yml",
        "name": "github/codeql-action/upload-sarif",
        "purl": "pkg:github/github/codeql-action@v4.38.2#upload-sarif",
        "version": "v4.38.2"
      },
      {
        "ecosystem": "github",
        "licenses": [],
        "location": ".github/workflows/ci.yml",
        "name": "golang/govulncheck-action",
        "purl": "pkg:github/golang/govulncheck-action@v1.1.0",
        "version": "v1.1.0"
      },
      {
        "ecosystem": "github",
        "licenses": [],
        "location": ".github/workflows/ci.yml",
        "name": "golangci/golangci-lint-action",
        "purl": "pkg:github/golangci/golangci-lint-action@v9.3.0",
        "version": "v9.3.0"
      },
      {
        "ecosystem": "github",
        "licenses": [],
        "location": ".github/workflows/release-please.yml",
        "name": "googleapis/release-please-action",
        "purl": "pkg:github/googleapis/release-please-action@v5.0.0",
        "version": "v5.0.0"
      },
      {
        "ecosystem": "github",
        "licenses": [],
        "location": ".github/workflows/release.yml",
        "name": "goreleaser/goreleaser-action",
        "purl": "pkg:github/goreleaser/goreleaser-action@v7.2.3",
        "version": "v7.2.3"
      },
      {
        "ecosystem": "github",
        "licenses": [],
        "location": ".github/workflows/scorecard.yml",
        "name": "ossf/scorecard-action",
        "purl": "pkg:github/ossf/scorecard-action@v2.4.4",
        "version": "v2.4.4"
      },
      {
        "ecosystem": "github",
        "licenses": [],
        "location": ".github/workflows/deploy-site.yml",
        "name": "peaceiris/actions-hugo",
        "purl": "pkg:github/peaceiris/actions-hugo@v3.2.1",
        "version": "v3.2.1"
      },
      {
        "ecosystem": "github",
        "licenses": [],
        "location": ".github/workflows/monthly-maintenance.yml",
        "name": "peter-evans/create-pull-request",
        "purl": "pkg:github/peter-evans/create-pull-request@v8.1.1",
        "version": "v8.1.1"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/anchore/go-struct-converter",
        "purl": "pkg:golang/github.com/anchore/go-struct-converter@v0.1.0",
        "version": "v0.1.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/atotto/clipboard",
        "purl": "pkg:golang/github.com/atotto/clipboard@v0.1.4",
        "version": "v0.1.4"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/aymanbagabas/go-osc52/v2",
        "purl": "pkg:golang/github.com/aymanbagabas/go-osc52/v2@v2.0.1",
        "version": "v2.0.1"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/charmbracelet/bubbles",
        "purl": "pkg:golang/github.com/charmbracelet/bubbles@v1.0.0",
        "version": "v1.0.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/charmbracelet/bubbletea",
        "purl": "pkg:golang/github.com/charmbracelet/bubbletea@v1.3.10",
        "version": "v1.3.10"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/charmbracelet/colorprofile",
        "purl": "pkg:golang/github.com/charmbracelet/colorprofile@v0.4.1",
        "version": "v0.4.1"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/charmbracelet/lipgloss",
        "purl": "pkg:golang/github.com/charmbracelet/lipgloss@v1.1.0",
        "version": "v1.1.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/charmbracelet/x/ansi",
        "purl": "pkg:golang/github.com/charmbracelet/x/ansi@v0.11.6",
        "version": "v0.11.6"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/charmbracelet/x/cellbuf",
        "purl": "pkg:golang/github.com/charmbracelet/x/cellbuf@v0.0.15",
        "version": "v0.0.15"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/charmbracelet/x/term",
        "purl": "pkg:golang/github.com/charmbracelet/x/term@v0.2.2",
        "version": "v0.2.2"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/clipperhouse/displaywidth",
        "purl": "pkg:golang/github.com/clipperhouse/displaywidth@v0.9.0",
        "version": "v0.9.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/clipperhouse/stringish",
        "purl": "pkg:golang/github.com/clipperhouse/stringish@v0.1.1",
        "version": "v0.1.1"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/clipperhouse/uax29/v2",
        "purl": "pkg:golang/github.com/clipperhouse/uax29/v2@v2.5.0",
        "version": "v2.5.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/CycloneDX/cyclonedx-go",
        "purl": "pkg:golang/github.com/CycloneDX/cyclonedx-go@v0.12.0",
        "version": "v0.12.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/erikgeiser/coninput",
        "purl": "pkg:golang/github.com/erikgeiser/coninput@v0.0.0-20211004153227-1c3628e74d0f",
        "version": "v0.0.0-20211004153227-1c3628e74d0f"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/github/go-spdx/v2",
        "purl": "pkg:golang/github.com/github/go-spdx/v2@v2.8.0",
        "version": "v2.8.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/lucasb-eyer/go-colorful",
        "purl": "pkg:golang/github.com/lucasb-eyer/go-colorful@v1.3.0",
        "version": "v1.3.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/mattn/go-isatty",
        "purl": "pkg:golang/github.com/mattn/go-isatty@v0.0.24",
        "version": "v0.0.24"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/mattn/go-localereader",
        "purl": "pkg:golang/github.com/mattn/go-localereader@v0.0.1",
        "version": "v0.0.1"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/mattn/go-runewidth",
        "purl": "pkg:golang/github.com/mattn/go-runewidth@v0.0.19",
        "version": "v0.0.19"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/muesli/ansi",
        "purl": "pkg:golang/github.com/muesli/ansi@v0.0.0-20230316100256-276c6243b2f6",
        "version": "v0.0.0-20230316100256-276c6243b2f6"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/muesli/cancelreader",
        "purl": "pkg:golang/github.com/muesli/cancelreader@v0.2.2",
        "version": "v0.2.2"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/muesli/termenv",
        "purl": "pkg:golang/github.com/muesli/termenv@v0.16.0",
        "version": "v0.16.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/rivo/uniseg",
        "purl": "pkg:golang/github.com/rivo/uniseg@v0.4.7",
        "version": "v0.4.7"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/sahilm/fuzzy",
        "purl": "pkg:golang/github.com/sahilm/fuzzy@v0.1.1",
        "version": "v0.1.1"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/spdx/tools-golang",
        "purl": "pkg:golang/github.com/spdx/tools-golang@v0.5.7",
        "version": "v0.5.7"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/xo/terminfo",
        "purl": "pkg:golang/github.com/xo/terminfo@v0.0.0-20220910002029-abceb7e1c41e",
        "version": "v0.0.0-20220910002029-abceb7e1c41e"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "golang.org/x/sys",
        "purl": "pkg:golang/golang.org/x/sys@v0.46.0",
        "version": "v0.46.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "golang.org/x/text",
        "purl": "pkg:golang/golang.org/x/text@v0.39.0",
        "version": "v0.39.0"
      },
      {
        "ecosystem": "unknown",
        "licenses": [],
        "location": ".github/workflows/marketplace-smoke.yml",
        "name": "./",
        "purl": "",
        "version": "UNKNOWN"
      }
    ],
    "description": "Compare SBOMs to detect supply-chain drift",
    "errors": [],
    "go_binary": {
      "asset": "sbomlyze_0.6.0_Linux_x86_64.tar.gz",
      "binary": "sbomlyze",
      "db": "https://vuln.go.dev",
      "db_last_modified": "2026-10-27T21:16:18Z",
      "findings": [],
      "go_version": "go1.26.10",
      "main_module": "github.com/rezmoss/sbomlyze"
    },
    "id": "rezmoss__sbomlyze",
    "manifests": [
      ".github/workflows/ci.yml",
      ".github/workflows/deploy-site.yml",
      ".github/workflows/marketplace-smoke.yml",
      ".github/workflows/monthly-maintenance.yml",
      ".github/workflows/release-please.yml",
      ".github/workflows/release.yml",
      ".github/workflows/scorecard.yml",
      ".github/workflows/sync-site-version.yml",
      ".github/workflows/update-pkg-repo.yml",
      "action.yml",
      "go.mod",
      "go.sum",
      "site/data/action.yaml"
    ],
    "name": "sbomlyze",
    "osv": {
      "advisories": 1,
      "available": true,
      "confirmed": 1,
      "osv_only": [],
      "warning": null
    },
    "ref": "v0.6.0",
    "ref_kind": "release",
    "release_integrity": {
      "asset": "sbomlyze_0.6.0_Linux_x86_64.tar.gz",
      "assets": 33,
      "build_provenance": "verified",
      "checksums_published": true,
      "digest_matches_github": true,
      "immutable_release": null,
      "methods": [
        {
          "method": "github-attestation",
          "predicates": [
            "https://slsa.dev/provenance/v1"
          ],
          "status": "verified"
        }
      ],
      "provenance_published": false,
      "sbom_published": true,
      "signature": null,
      "signatures_published": true,
      "signer": null,
      "verdict": "verified"
    },
    "released_at": "2026-11-01T14:40:09Z",
    "repository": "rezmoss/sbomlyze",
    "sbomlyze_diff": {
      "added": 0,
      "changed": 0,
      "drift": {},
      "findings": [
        "0 version changes among 63 shared packages \u2014 no actual upgrades",
        "Core system packages stable: golang (29), github (23) unchanged"
      ],
      "removed": 0
    },
    "scanned_at": "2026-11-02T03:07:59+00:00",
    "scorecard": {
      "checks": [
        {
          "name": "Code-Review",
          "reason": "Found 0/25 approved changesets -- score normalized to 0",
          "score": 0
        },
        {
          "name": "Signed-Releases",
          "reason": "1 out of the last 5 releases have a total of 1 signed artifacts.",
          "score": 1
        },
        {
          "name": "Branch-Protection",
          "reason": "branch protection is not maximal on development and all release branches",
          "score": 4
        },
        {
          "name": "CII-Best-Practices",
          "reason": "badge detected: Passing",
          "score": 5
        },
        {
          "name": "Pinned-Dependencies",
          "reason": "dependency not pinned by hash detected -- score normalized to 8",
          "score": 8
        },
        {
          "name": "Vulnerabilities",
          "reason": "1 existing vulnerabilities detected",
          "score": 9
        },
        {
          "name": "Binary-Artifacts",
          "reason": "no binaries found in the repo",
          "score": 10
        },
        {
          "name": "CI-Tests",
          "reason": "28 out of 28 merged PRs checked by a CI test -- score normalized to 10",
          "score": 10
        },
        {
          "name": "Contributors",
          "reason": "project has 3 contributing companies or organizations -- score normalized to 10",
          "score": 10
        },
        {
          "name": "Dangerous-Workflow",
          "reason": "no dangerous workflow patterns detected",
          "score": 10
        },
        {
          "name": "Dependency-Update-Tool",
          "reason": "update tool detected",
          "score": 10
        },
        {
          "name": "Fuzzing",
          "reason": "project is fuzzed",
          "score": 10
        },
        {
          "name": "License",
          "reason": "license file detected",
          "score": 10
        },
        {
          "name": "Maintained",
          "reason": "30 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10",
          "score": 10
        },
        {
          "name": "Packaging",
          "reason": "packaging workflow detected",
          "score": 10
        },
        {
          "name": "SAST",
          "reason": "SAST tool is run on all commits",
          "score": 10
        },
        {
          "name": "Security-Policy",
          "reason": "security policy file detected",
          "score": 10
        },
        {
          "name": "Token-Permissions",
          "reason": "GitHub workflow tokens follow principle of least privilege",
          "score": 10
        }
      ],
      "date": "2026-11-01",
      "score": 7.9,
      "source": "openssf-api",
      "version": "v5.5.0"
    },
    "vulnerabilities": [
      {
        "aliases": [
          "CVE-2026-56851"
        ],
        "ecosystem": "golang",
        "epss": {
          "cve": "CVE-2026-56851",
          "percentile": 0.40313,
          "score": 0.00466
        },
        "fix_state": "fixed",
        "fixed_in": [
          "0.41.0"
        ],
        "id": "GO-2026-6629",
        "in_binary": "not in released binary",
        "kev": null,
        "location": "go.mod",
        "osv_confirmed": true,
        "package": "golang.org/x/text",
        "severity": "High",
        "summary": "The Nickname profile can panic with an out-of-bounds slice error when transforming crafted input into a short destination buffer.",
        "url": "https://go.dev/cl/793360",
        "version": "v0.39.0"
      }
    ],
    "workflow_audit": {
      "files": 11,
      "findings": [
        {
          "confidence": "High",
          "description": "code injection via template expansion",
          "file": ".github/workflows/sync-site-version.yml",
          "line": 29,
          "note": "this step",
          "rule": "template-injection",
          "severity": "High",
          "url": "https://docs.zizmor.sh/audits/#template-injection"
        },
        {
          "confidence": "High",
          "description": "code injection via template expansion",
          "file": ".github/workflows/sync-site-version.yml",
          "line": 29,
          "note": "this step",
          "rule": "template-injection",
          "severity": "High",
          "url": "https://docs.zizmor.sh/audits/#template-injection"
        },
        {
          "confidence": "High",
          "description": "code injection via template expansion",
          "file": ".github/workflows/update-pkg-repo.yml",
          "line": 28,
          "note": "this step",
          "rule": "template-injection",
          "severity": "High",
          "url": "https://docs.zizmor.sh/audits/#template-injection"
        },
        {
          "confidence": "High",
          "description": "code injection via template expansion",
          "file": ".github/workflows/update-pkg-repo.yml",
          "line": 28,
          "note": "this step",
          "rule": "template-injection",
          "severity": "High",
          "url": "https://docs.zizmor.sh/audits/#template-injection"
        },
        {
          "confidence": "High",
          "description": "use GitHub's dedicated self-repository syntax",
          "file": ".github/workflows/marketplace-smoke.yml",
          "line": 21,
          "note": "this step",
          "rule": "self-repository",
          "severity": "Low",
          "url": "https://docs.zizmor.sh/audits/#self-repository"
        },
        {
          "confidence": "High",
          "description": "use GitHub's dedicated self-repository syntax",
          "file": ".github/workflows/marketplace-smoke.yml",
          "line": 54,
          "note": "this step",
          "rule": "self-repository",
          "severity": "Low",
          "url": "https://docs.zizmor.sh/audits/#self-repository"
        }
      ]
    }
  },
  "updated": "2026-11-02"
}