{
  "history": [
    {
      "added": 0,
      "commit": "568cb0e1c90685dd89f07f91c64e97a49228a47f",
      "date": "2026-11-01",
      "dependencies": 712,
      "errors": [],
      "fixable": 71,
      "go_version": "go1.26.2",
      "in_binary": {
        "dependencies": 24,
        "stdlib": 34,
        "total": 58
      },
      "new_vulnerabilities": 0,
      "osv_confirmed": 84,
      "osv_only": 0,
      "ref": "v1.20.0",
      "release_changed": false,
      "release_integrity": "verified",
      "removed": 0,
      "resolved_vulnerabilities": 0,
      "scorecard": 7.4,
      "upgraded": 0,
      "vulnerabilities": {
        "Critical": 4,
        "High": 41,
        "Low": 1,
        "Medium": 35,
        "Negligible": 0,
        "Unknown": 3
      },
      "workflow": {
        "High": 5,
        "Low": 1,
        "Medium": 0,
        "files": 12
      }
    },
    {
      "added": 0,
      "commit": "568cb0e1c90685dd89f07f91c64e97a49228a47f",
      "date": "2026-11-02",
      "dependencies": 712,
      "errors": [],
      "fixable": 71,
      "go_version": "go1.26.2",
      "in_binary": {
        "dependencies": 25,
        "stdlib": 33,
        "total": 58
      },
      "kev": 0,
      "kev_new": 0,
      "new_vulnerabilities": 0,
      "osv_confirmed": 84,
      "osv_only": 0,
      "ref": "v1.20.0",
      "release_changed": false,
      "release_integrity": "verified",
      "removed": 0,
      "resolved_vulnerabilities": 0,
      "scorecard": 7.4,
      "scorecard_date": "2026-11-01",
      "scorecard_note": null,
      "scorecard_source": "openssf-api",
      "upgraded": 0,
      "vulnerabilities": {
        "Critical": 4,
        "High": 41,
        "Low": 1,
        "Medium": 35,
        "Negligible": 0,
        "Unknown": 3
      },
      "vulnerable_packages": 24,
      "workflow": {
        "High": 5,
        "Low": 1,
        "Medium": 0,
        "files": 12
      }
    }
  ],
  "latest": {
    "archived": false,
    "category": "Software Composition Analysis (SCA)",
    "changes": {
      "added": [],
      "any": false,
      "baseline": false,
      "in_binary_new": [],
      "in_binary_resolved": [],
      "integrity_drift": 0,
      "license_changes": [],
      "new_vulnerabilities": [],
      "previous_ref": "v1.20.0",
      "release_changed": false,
      "removed": [],
      "resolved_vulnerabilities": [],
      "upgraded": [],
      "workflow_new": 0,
      "workflow_resolved": 0
    },
    "commit": "568cb0e1c90685dd89f07f91c64e97a49228a47f",
    "compliance": {
      "overall_score": 55,
      "standards": {
        "bsi_tr03183": {
          "failed_checks": [
            "Component Creator",
            "Distribution Licences",
            "SHA-512 Hash",
            "Dependency Relationship",
            "SBOM Creator Contact"
          ],
          "passed": 4,
          "score": 44,
          "total": 9
        },
        "cisa": {
          "failed_checks": [
            "Software Producer",
            "Dependency Relationship",
            "License Information",
            "Component Hash",
            "SBOM Author"
          ],
          "passed": 5,
          "score": 50,
          "total": 10
        },
        "ntia": {
          "failed_checks": [
            "Supplier Name",
            "Dependency Relationship"
          ],
          "passed": 5,
          "score": 71,
          "total": 7
        }
      }
    },
    "components": [
      {
        "ecosystem": "github",
        "licenses": [],
        "location": ".github/workflows/goreleaser.yml",
        "name": "actions/attest-build-provenance",
        "purl": "pkg:github/actions/attest-build-provenance@v4.1.0",
        "version": "v4.1.0"
      },
      {
        "ecosystem": "github",
        "licenses": [],
        "location": ".github/workflows/ci.yml",
        "name": "actions/cache",
        "purl": "pkg:github/actions/cache@v5.0.5",
        "version": "v5.0.5"
      },
      {
        "ecosystem": "github",
        "licenses": [],
        "location": ".github/workflows/ci.yml",
        "name": "actions/checkout",
        "purl": "pkg:github/actions/checkout@v6.0.2",
        "version": "v6.0.2"
      },
      {
        "ecosystem": "github",
        "licenses": [],
        "location": ".github/workflows/gh-pages-deploy.yml",
        "name": "actions/configure-pages",
        "purl": "pkg:github/actions/configure-pages@v5",
        "version": "v5"
      },
      {
        "ecosystem": "github",
        "licenses": [],
        "location": ".github/workflows/dependency-review.yml",
        "name": "actions/dependency-review-action",
        "purl": "pkg:github/actions/dependency-review-action@v3",
        "version": "v3"
      },
      {
        "ecosystem": "github",
        "licenses": [],
        "location": ".github/workflows/gh-pages-deploy.yml",
        "name": "actions/deploy-pages",
        "purl": "pkg:github/actions/deploy-pages@v4",
        "version": "v4"
      },
      {
        "ecosystem": "github",
        "licenses": [],
        "location": ".github/workflows/goreleaser.yml",
        "name": "actions/download-artifact",
        "purl": "pkg:github/actions/download-artifact@v5.0.0",
        "version": "v5.0.0"
      },
      {
        "ecosystem": "github",
        "licenses": [],
        "location": ".github/workflows/gh-pages-deploy.yml",
        "name": "actions/jekyll-build-pages",
        "purl": "pkg:github/actions/jekyll-build-pages@v1",
        "version": "v1"
      },
      {
        "ecosystem": "github",
        "licenses": [],
        "location": ".github/workflows/ci.yml",
        "name": "actions/setup-go",
        "purl": "pkg:github/actions/setup-go@v6.4.0",
        "version": "v6.4.0"
      },
      {
        "ecosystem": "github",
        "licenses": [],
        "location": ".github/workflows/ci.yml",
        "name": "actions/setup-node",
        "purl": "pkg:github/actions/setup-node@v6.4.0",
        "version": "v6.4.0"
      },
      {
        "ecosystem": "github",
        "licenses": [],
        "location": ".github/workflows/scorecard.yml",
        "name": "actions/upload-artifact",
        "purl": "pkg:github/actions/upload-artifact@v4.6.0",
        "version": "v4.6.0"
      },
      {
        "ecosystem": "github",
        "licenses": [],
        "location": ".github/workflows/goreleaser.yml",
        "name": "actions/upload-artifact",
        "purl": "pkg:github/actions/upload-artifact@v4.6.2",
        "version": "v4.6.2"
      },
      {
        "ecosystem": "github",
        "licenses": [],
        "location": ".github/workflows/gh-pages-deploy.yml",
        "name": "actions/upload-pages-artifact",
        "purl": "pkg:github/actions/upload-pages-artifact@v3",
        "version": "v3"
      },
      {
        "ecosystem": "github",
        "licenses": [],
        "location": ".github/workflows/ci.yml",
        "name": "codecov/codecov-action",
        "purl": "pkg:github/codecov/codecov-action@v5",
        "version": "v5"
      },
      {
        "ecosystem": "github",
        "licenses": [],
        "location": ".github/workflows/container.yml",
        "name": "docker/login-action",
        "purl": "pkg:github/docker/login-action@v4.2.0",
        "version": "v4.2.0"
      },
      {
        "ecosystem": "github",
        "licenses": [],
        "location": ".github/workflows/ci.yml",
        "name": "docker/setup-buildx-action",
        "purl": "pkg:github/docker/setup-buildx-action@v4.1.0",
        "version": "v4.1.0"
      },
      {
        "ecosystem": "github",
        "licenses": [],
        "location": ".github/workflows/ci.yml",
        "name": "docker/setup-qemu-action",
        "purl": "pkg:github/docker/setup-qemu-action@v4.1.0",
        "version": "v4.1.0"
      },
      {
        "ecosystem": "github",
        "licenses": [],
        "location": ".github/workflows/codeql.yml",
        "name": "github/codeql-action/analyze",
        "purl": "pkg:github/github/codeql-action@v4#analyze",
        "version": "v4"
      },
      {
        "ecosystem": "github",
        "licenses": [],
        "location": ".github/workflows/codeql.yml",
        "name": "github/codeql-action/init",
        "purl": "pkg:github/github/codeql-action@v4#init",
        "version": "v4"
      },
      {
        "ecosystem": "github",
        "licenses": [],
        "location": ".github/workflows/scorecard.yml",
        "name": "github/codeql-action/upload-sarif",
        "purl": "pkg:github/github/codeql-action@v4#upload-sarif",
        "version": "v4"
      },
      {
        "ecosystem": "github",
        "licenses": [],
        "location": ".github/workflows/golangci-lint.yml",
        "name": "golangci/golangci-lint-action",
        "purl": "pkg:github/golangci/golangci-lint-action@v8",
        "version": "v8"
      },
      {
        "ecosystem": "github",
        "licenses": [],
        "location": ".github/workflows/ci.yml",
        "name": "goreleaser/goreleaser-action",
        "purl": "pkg:github/goreleaser/goreleaser-action@v7.2.3",
        "version": "v7.2.3"
      },
      {
        "ecosystem": "github",
        "licenses": [],
        "location": ".github/workflows/scorecard.yml",
        "name": "ossf/scorecard-action",
        "purl": "pkg:github/ossf/scorecard-action@v2.3.1",
        "version": "v2.3.1"
      },
      {
        "ecosystem": "github",
        "licenses": [],
        "location": ".github/workflows/vet-ci.yml",
        "name": "safedep/vet-action",
        "purl": "pkg:github/safedep/vet-action@01f547ee95dfd4f8f11fa64b399e5e00f22b0801",
        "version": "01f547ee95dfd4f8f11fa64b399e5e00f22b0801"
      },
      {
        "ecosystem": "github",
        "licenses": [],
        "location": ".github/workflows/secret_scan.yml",
        "name": "trufflesecurity/trufflehog",
        "purl": "pkg:github/trufflesecurity/trufflehog@8b6f55b592e46ac44a42dc3e3dee0ebcc0f56df5",
        "version": "8b6f55b592e46ac44a42dc3e3dee0ebcc0f56df5"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "al.essio.dev/pkg/shellescape",
        "purl": "pkg:golang/al.essio.dev/pkg/shellescape@v1.5.1",
        "version": "v1.5.1"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "ariga.io/atlas",
        "purl": "pkg:golang/ariga.io/atlas@v1.1.0",
        "version": "v1.1.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "bitbucket.org/creachadair/stringset",
        "purl": "pkg:golang/bitbucket.org/creachadair/stringset@v0.0.14",
        "version": "v0.0.14"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "buf.build/gen/go/bufbuild/protovalidate/protocolbuffers/go",
        "purl": "pkg:golang/buf.build/gen/go/bufbuild/protovalidate/protocolbuffers/go@v1.36.12-20260415201107-50325440f8f2.1",
        "version": "v1.36.12-20260415201107-50325440f8f2.1"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "buf.build/gen/go/safedep/api/grpc/go",
        "purl": "pkg:golang/buf.build/gen/go/safedep/api/grpc/go@v1.6.2-20261001145028-14c0defb961c.1",
        "version": "v1.6.2-20261001145028-14c0defb961c.1"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "buf.build/gen/go/safedep/api/protocolbuffers/go",
        "purl": "pkg:golang/buf.build/gen/go/safedep/api/protocolbuffers/go@v1.36.12-20261001145028-14c0defb961c.2",
        "version": "v1.36.12-20261001145028-14c0defb961c.2"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "buf.build/go/protovalidate",
        "purl": "pkg:golang/buf.build/go/protovalidate@v1.1.3",
        "version": "v1.1.3"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "cel.dev/expr",
        "purl": "pkg:golang/cel.dev/expr@v0.25.2",
        "version": "v0.25.2"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "cloud.google.com/go",
        "purl": "pkg:golang/cloud.google.com/go@v0.123.0",
        "version": "v0.123.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "cloud.google.com/go/auth",
        "purl": "pkg:golang/cloud.google.com/go/auth@v0.18.2",
        "version": "v0.18.2"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "cloud.google.com/go/auth/oauth2adapt",
        "purl": "pkg:golang/cloud.google.com/go/auth/oauth2adapt@v0.2.8",
        "version": "v0.2.8"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "cloud.google.com/go/compute/metadata",
        "purl": "pkg:golang/cloud.google.com/go/compute/metadata@v0.9.0",
        "version": "v0.9.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "cloud.google.com/go/iam",
        "purl": "pkg:golang/cloud.google.com/go/iam@v1.5.3",
        "version": "v1.5.3"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "cloud.google.com/go/monitoring",
        "purl": "pkg:golang/cloud.google.com/go/monitoring@v1.24.3",
        "version": "v1.24.3"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "cloud.google.com/go/storage",
        "purl": "pkg:golang/cloud.google.com/go/storage@v1.60.0",
        "version": "v1.60.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "cyphar.com/go-pathrs",
        "purl": "pkg:golang/cyphar.com/go-pathrs@v0.2.4",
        "version": "v0.2.4"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "dario.cat/mergo",
        "purl": "pkg:golang/dario.cat/mergo@v1.0.2",
        "version": "v1.0.2"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "deps.dev/api/v3",
        "purl": "pkg:golang/deps.dev/api/v3@v3.0.0-20260225225317-765e10b45d5b",
        "version": "v3.0.0-20260225225317-765e10b45d5b"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "deps.dev/api/v3alpha",
        "purl": "pkg:golang/deps.dev/api/v3alpha@v0.0.0-20260225225317-765e10b45d5b",
        "version": "v0.0.0-20260225225317-765e10b45d5b"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "deps.dev/util/maven",
        "purl": "pkg:golang/deps.dev/util/maven@v0.0.0-20260225225317-765e10b45d5b",
        "version": "v0.0.0-20260225225317-765e10b45d5b"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "deps.dev/util/pypi",
        "purl": "pkg:golang/deps.dev/util/pypi@v0.0.0-20260225225317-765e10b45d5b",
        "version": "v0.0.0-20260225225317-765e10b45d5b"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "deps.dev/util/resolve",
        "purl": "pkg:golang/deps.dev/util/resolve@v0.0.0-20260225225317-765e10b45d5b",
        "version": "v0.0.0-20260225225317-765e10b45d5b"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "deps.dev/util/semver",
        "purl": "pkg:golang/deps.dev/util/semver@v0.0.0-20260225225317-765e10b45d5b",
        "version": "v0.0.0-20260225225317-765e10b45d5b"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "entgo.io/ent",
        "purl": "pkg:golang/entgo.io/ent@v0.14.6-0.20260218064135-ab0540611e15",
        "version": "v0.14.6-0.20260218064135-ab0540611e15"
      },
      {
        "ecosystem": "golang",
        "licenses": [
          "MIT"
        ],
        "location": "go.mod",
        "name": "github.com/a-h/parse",
        "purl": "pkg:golang/github.com/a-h/parse@v0.0.0-20250122154542-74294addb73e",
        "version": "v0.0.0-20250122154542-74294addb73e"
      },
      {
        "ecosystem": "golang",
        "licenses": [
          "BSD-3-Clause",
          "MIT"
        ],
        "location": "go.mod",
        "name": "github.com/a-h/templ",
        "purl": "pkg:golang/github.com/a-h/templ@v0.3.1001",
        "version": "v0.3.1001"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/acobaugh/osrelease",
        "purl": "pkg:golang/github.com/acobaugh/osrelease@v0.1.0",
        "version": "v0.1.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/AdaLogics/go-fuzz-headers",
        "purl": "pkg:golang/github.com/AdaLogics/go-fuzz-headers@v0.0.0-20240806141605-e8a1dd7889d6",
        "version": "v0.0.0-20240806141605-e8a1dd7889d6"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/AdamKorcz/go-118-fuzz-build",
        "purl": "pkg:golang/github.com/AdamKorcz/go-118-fuzz-build@v0.0.0-20250520111509-a70c2aa677fa",
        "version": "v0.0.0-20250520111509-a70c2aa677fa"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/adrg/xdg",
        "purl": "pkg:golang/github.com/adrg/xdg@v0.5.3",
        "version": "v0.5.3"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/aead/serpent",
        "purl": "pkg:golang/github.com/aead/serpent@v0.0.0-20160714141033-fba169763ea6",
        "version": "v0.0.0-20160714141033-fba169763ea6"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/afex/hystrix-go",
        "purl": "pkg:golang/github.com/afex/hystrix-go@v0.0.0-20180502004556-fa1af6a1f4f5",
        "version": "v0.0.0-20180502004556-fa1af6a1f4f5"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/agext/levenshtein",
        "purl": "pkg:golang/github.com/agext/levenshtein@v1.2.3",
        "version": "v1.2.3"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/AlecAivazis/survey/v2",
        "purl": "pkg:golang/github.com/AlecAivazis/survey/v2@v2.3.7",
        "version": "v2.3.7"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/alecthomas/chroma/v2",
        "purl": "pkg:golang/github.com/alecthomas/chroma/v2@v2.23.1",
        "version": "v2.23.1"
      },
      {
        "ecosystem": "golang",
        "licenses": [
          "MIT"
        ],
        "location": "go.mod",
        "name": "github.com/alessio/shellescape",
        "purl": "pkg:golang/github.com/alessio/shellescape@v1.4.1",
        "version": "v1.4.1"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/anchore/clio",
        "purl": "pkg:golang/github.com/anchore/clio@v0.0.0-20260302164412-3ffbbe8c23a9",
        "version": "v0.0.0-20260302164412-3ffbbe8c23a9"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/anchore/fangs",
        "purl": "pkg:golang/github.com/anchore/fangs@v0.0.0-20260302165001-7b3d34e1cfff",
        "version": "v0.0.0-20260302165001-7b3d34e1cfff"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/anchore/go-homedir",
        "purl": "pkg:golang/github.com/anchore/go-homedir@v0.0.0-20250319154043-c29668562e4d",
        "version": "v0.0.0-20250319154043-c29668562e4d"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/anchore/go-logger",
        "purl": "pkg:golang/github.com/anchore/go-logger@v0.0.0-20260217144723-3bb369b8046c",
        "version": "v0.0.0-20260217144723-3bb369b8046c"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/anchore/go-lzo",
        "purl": "pkg:golang/github.com/anchore/go-lzo@v0.1.0",
        "version": "v0.1.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/anchore/go-macholibre",
        "purl": "pkg:golang/github.com/anchore/go-macholibre@v0.0.0-20260303191308-266b511890b2",
        "version": "v0.0.0-20260303191308-266b511890b2"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/anchore/go-struct-converter",
        "purl": "pkg:golang/github.com/anchore/go-struct-converter@v0.1.0",
        "version": "v0.1.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/anchore/go-sync",
        "purl": "pkg:golang/github.com/anchore/go-sync@v0.0.0-20260122203928-582959aeb913",
        "version": "v0.0.0-20260122203928-582959aeb913"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/anchore/packageurl-go",
        "purl": "pkg:golang/github.com/anchore/packageurl-go@v0.1.1-0.20250220190351-d62adb6e1115",
        "version": "v0.1.1-0.20250220190351-d62adb6e1115"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/anchore/stereoscope",
        "purl": "pkg:golang/github.com/anchore/stereoscope@v0.1.17",
        "version": "v0.1.17"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/anchore/syft",
        "purl": "pkg:golang/github.com/anchore/syft@v1.40.0",
        "version": "v1.40.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [
          "MIT"
        ],
        "location": "go.mod",
        "name": "github.com/andybalholm/brotli",
        "purl": "pkg:golang/github.com/andybalholm/brotli@v1.2.0",
        "version": "v1.2.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/anthropics/anthropic-sdk-go",
        "purl": "pkg:golang/github.com/anthropics/anthropic-sdk-go@v1.26.0",
        "version": "v1.26.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/antlr4-go/antlr/v4",
        "purl": "pkg:golang/github.com/antlr4-go/antlr/v4@v4.13.1",
        "version": "v4.13.1"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/apapsch/go-jsonmerge/v2",
        "purl": "pkg:golang/github.com/apapsch/go-jsonmerge/v2@v2.0.0",
        "version": "v2.0.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/apparentlymart/go-textseg/v15",
        "purl": "pkg:golang/github.com/apparentlymart/go-textseg/v15@v15.0.0",
        "version": "v15.0.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/atotto/clipboard",
        "purl": "pkg:golang/github.com/atotto/clipboard@v0.1.4",
        "version": "v0.1.4"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/aws/aws-sdk-go-v2",
        "purl": "pkg:golang/github.com/aws/aws-sdk-go-v2@v1.41.5",
        "version": "v1.41.5"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream",
        "purl": "pkg:golang/github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.7.8",
        "version": "v1.7.8"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/aws/aws-sdk-go-v2/config",
        "purl": "pkg:golang/github.com/aws/aws-sdk-go-v2/config@v1.32.15",
        "version": "v1.32.15"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/aws/aws-sdk-go-v2/credentials",
        "purl": "pkg:golang/github.com/aws/aws-sdk-go-v2/credentials@v1.19.14",
        "version": "v1.19.14"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/aws/aws-sdk-go-v2/feature/ec2/imds",
        "purl": "pkg:golang/github.com/aws/aws-sdk-go-v2/feature/ec2/imds@v1.18.21",
        "version": "v1.18.21"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/aws/aws-sdk-go-v2/internal/configsources",
        "purl": "pkg:golang/github.com/aws/aws-sdk-go-v2/internal/configsources@v1.4.21",
        "version": "v1.4.21"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/aws/aws-sdk-go-v2/internal/endpoints/v2",
        "purl": "pkg:golang/github.com/aws/aws-sdk-go-v2/internal/endpoints/v2@v2.7.21",
        "version": "v2.7.21"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/aws/aws-sdk-go-v2/internal/v4a",
        "purl": "pkg:golang/github.com/aws/aws-sdk-go-v2/internal/v4a@v1.4.22",
        "version": "v1.4.22"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding",
        "purl": "pkg:golang/github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding@v1.13.7",
        "version": "v1.13.7"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/aws/aws-sdk-go-v2/service/internal/checksum",
        "purl": "pkg:golang/github.com/aws/aws-sdk-go-v2/service/internal/checksum@v1.9.13",
        "version": "v1.9.13"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/aws/aws-sdk-go-v2/service/internal/presigned-url",
        "purl": "pkg:golang/github.com/aws/aws-sdk-go-v2/service/internal/presigned-url@v1.13.21",
        "version": "v1.13.21"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/aws/aws-sdk-go-v2/service/internal/s3shared",
        "purl": "pkg:golang/github.com/aws/aws-sdk-go-v2/service/internal/s3shared@v1.19.21",
        "version": "v1.19.21"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/aws/aws-sdk-go-v2/service/s3",
        "purl": "pkg:golang/github.com/aws/aws-sdk-go-v2/service/s3@v1.99.0",
        "version": "v1.99.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/aws/aws-sdk-go-v2/service/signin",
        "purl": "pkg:golang/github.com/aws/aws-sdk-go-v2/service/signin@v1.0.9",
        "version": "v1.0.9"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/aws/aws-sdk-go-v2/service/sso",
        "purl": "pkg:golang/github.com/aws/aws-sdk-go-v2/service/sso@v1.30.15",
        "version": "v1.30.15"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/aws/aws-sdk-go-v2/service/ssooidc",
        "purl": "pkg:golang/github.com/aws/aws-sdk-go-v2/service/ssooidc@v1.35.19",
        "version": "v1.35.19"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/aws/aws-sdk-go-v2/service/sts",
        "purl": "pkg:golang/github.com/aws/aws-sdk-go-v2/service/sts@v1.41.10",
        "version": "v1.41.10"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/aws/smithy-go",
        "purl": "pkg:golang/github.com/aws/smithy-go@v1.24.2",
        "version": "v1.24.2"
      },
      {
        "ecosystem": "golang",
        "licenses": [
          "MIT"
        ],
        "location": "go.mod",
        "name": "github.com/aymanbagabas/go-osc52/v2",
        "purl": "pkg:golang/github.com/aymanbagabas/go-osc52/v2@v2.0.1",
        "version": "v2.0.1"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/aymerick/douceur",
        "purl": "pkg:golang/github.com/aymerick/douceur@v0.2.0",
        "version": "v0.2.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/ayoubfaouzi/pkcs7",
        "purl": "pkg:golang/github.com/ayoubfaouzi/pkcs7@v0.2.2",
        "version": "v0.2.2"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/bahlo/generic-list-go",
        "purl": "pkg:golang/github.com/bahlo/generic-list-go@v0.2.0",
        "version": "v0.2.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/bazelbuild/buildtools",
        "purl": "pkg:golang/github.com/bazelbuild/buildtools@v0.0.0-20260211083412-859bfffeef82",
        "version": "v0.0.0-20260211083412-859bfffeef82"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/becheran/wildmatch-go",
        "purl": "pkg:golang/github.com/becheran/wildmatch-go@v1.0.0",
        "version": "v1.0.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/beorn7/perks",
        "purl": "pkg:golang/github.com/beorn7/perks@v1.0.1",
        "version": "v1.0.1"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/bgentry/go-netrc",
        "purl": "pkg:golang/github.com/bgentry/go-netrc@v0.0.0-20140422174119-9fd32a8b3d3d",
        "version": "v0.0.0-20140422174119-9fd32a8b3d3d"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/bmatcuk/doublestar",
        "purl": "pkg:golang/github.com/bmatcuk/doublestar@v1.3.4",
        "version": "v1.3.4"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/bmatcuk/doublestar/v4",
        "purl": "pkg:golang/github.com/bmatcuk/doublestar/v4@v4.10.0",
        "version": "v4.10.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/bodgit/plumbing",
        "purl": "pkg:golang/github.com/bodgit/plumbing@v1.3.0",
        "version": "v1.3.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/bodgit/sevenzip",
        "purl": "pkg:golang/github.com/bodgit/sevenzip@v1.6.1",
        "version": "v1.6.1"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/bodgit/windows",
        "purl": "pkg:golang/github.com/bodgit/windows@v1.0.1",
        "version": "v1.0.1"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/boltdb/bolt",
        "purl": "pkg:golang/github.com/boltdb/bolt@v1.3.1",
        "version": "v1.3.1"
      },
      {
        "ecosystem": "golang",
        "licenses": [
          "Apache-2.0",
          "sha256:b53dce8cb12bce0b96fc3e6cc59f9fb65f104dd0675c6a7102e19da89030b57c"
        ],
        "location": "go.mod",
        "name": "github.com/briandowns/spinner",
        "purl": "pkg:golang/github.com/briandowns/spinner@v1.23.2",
        "version": "v1.23.2"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/buger/jsonparser",
        "purl": "pkg:golang/github.com/buger/jsonparser@v1.1.1",
        "version": "v1.1.1"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/BurntSushi/toml",
        "purl": "pkg:golang/github.com/BurntSushi/toml@v1.6.0",
        "version": "v1.6.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/bytedance/gopkg",
        "purl": "pkg:golang/github.com/bytedance/gopkg@v0.1.3",
        "version": "v0.1.3"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/bytedance/sonic",
        "purl": "pkg:golang/github.com/bytedance/sonic@v1.15.0",
        "version": "v1.15.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/bytedance/sonic/loader",
        "purl": "pkg:golang/github.com/bytedance/sonic/loader@v0.5.0",
        "version": "v0.5.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/caarlos0/env/v11",
        "purl": "pkg:golang/github.com/caarlos0/env/v11@v11.4.0",
        "version": "v11.4.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/cactus/go-statsd-client/statsd",
        "purl": "pkg:golang/github.com/cactus/go-statsd-client/statsd@v0.0.0-20200423205355-cb0885a1018c",
        "version": "v0.0.0-20200423205355-cb0885a1018c"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/cayleygraph/cayley",
        "purl": "pkg:golang/github.com/cayleygraph/cayley@v0.7.7-0.20240706181042-81dcd7d73e45",
        "version": "v0.7.7-0.20240706181042-81dcd7d73e45"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/cayleygraph/quad",
        "purl": "pkg:golang/github.com/cayleygraph/quad@v1.3.0",
        "version": "v1.3.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [
          "MIT"
        ],
        "location": "go.mod",
        "name": "github.com/cenkalti/backoff/v4",
        "purl": "pkg:golang/github.com/cenkalti/backoff/v4@v4.3.0",
        "version": "v4.3.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/cespare/xxhash/v2",
        "purl": "pkg:golang/github.com/cespare/xxhash/v2@v2.3.0",
        "version": "v2.3.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/chainguard-dev/git-urls",
        "purl": "pkg:golang/github.com/chainguard-dev/git-urls@v1.0.2",
        "version": "v1.0.2"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/charmbracelet/bubbles",
        "purl": "pkg:golang/github.com/charmbracelet/bubbles@v1.0.0",
        "version": "v1.0.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/charmbracelet/bubbletea",
        "purl": "pkg:golang/github.com/charmbracelet/bubbletea@v1.3.10",
        "version": "v1.3.10"
      },
      {
        "ecosystem": "golang",
        "licenses": [
          "MIT"
        ],
        "location": "go.mod",
        "name": "github.com/charmbracelet/colorprofile",
        "purl": "pkg:golang/github.com/charmbracelet/colorprofile@v0.4.2",
        "version": "v0.4.2"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/charmbracelet/glamour",
        "purl": "pkg:golang/github.com/charmbracelet/glamour@v0.10.0",
        "version": "v0.10.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [
          "MIT"
        ],
        "location": "go.mod",
        "name": "github.com/charmbracelet/lipgloss",
        "purl": "pkg:golang/github.com/charmbracelet/lipgloss@v1.1.1-0.20250404203927-76690c660834",
        "version": "v1.1.1-0.20250404203927-76690c660834"
      },
      {
        "ecosystem": "golang",
        "licenses": [
          "MIT"
        ],
        "location": "go.mod",
        "name": "github.com/charmbracelet/x/ansi",
        "purl": "pkg:golang/github.com/charmbracelet/x/ansi@v0.11.6",
        "version": "v0.11.6"
      },
      {
        "ecosystem": "golang",
        "licenses": [
          "MIT"
        ],
        "location": "go.mod",
        "name": "github.com/charmbracelet/x/cellbuf",
        "purl": "pkg:golang/github.com/charmbracelet/x/cellbuf@v0.0.15",
        "version": "v0.0.15"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/charmbracelet/x/exp/slice",
        "purl": "pkg:golang/github.com/charmbracelet/x/exp/slice@v0.0.0-20260304084025-7dd5c0ab408e",
        "version": "v0.0.0-20260304084025-7dd5c0ab408e"
      },
      {
        "ecosystem": "golang",
        "licenses": [
          "MIT"
        ],
        "location": "go.mod",
        "name": "github.com/charmbracelet/x/term",
        "purl": "pkg:golang/github.com/charmbracelet/x/term@v0.2.2",
        "version": "v0.2.2"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/chengxilo/virtualterm",
        "purl": "pkg:golang/github.com/chengxilo/virtualterm@v1.0.4",
        "version": "v1.0.4"
      },
      {
        "ecosystem": "golang",
        "licenses": [
          "BSD-2-Clause"
        ],
        "location": "go.mod",
        "name": "github.com/cli/browser",
        "purl": "pkg:golang/github.com/cli/browser@v1.3.0",
        "version": "v1.3.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/cli/oauth",
        "purl": "pkg:golang/github.com/cli/oauth@v1.2.2",
        "version": "v1.2.2"
      },
      {
        "ecosystem": "golang",
        "licenses": [
          "MIT"
        ],
        "location": "go.mod",
        "name": "github.com/clipperhouse/displaywidth",
        "purl": "pkg:golang/github.com/clipperhouse/displaywidth@v0.11.0",
        "version": "v0.11.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [
          "MIT"
        ],
        "location": "go.mod",
        "name": "github.com/clipperhouse/uax29/v2",
        "purl": "pkg:golang/github.com/clipperhouse/uax29/v2@v2.7.0",
        "version": "v2.7.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/cloudwego/base64x",
        "purl": "pkg:golang/github.com/cloudwego/base64x@v0.1.6",
        "version": "v0.1.6"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/cloudwego/eino",
        "purl": "pkg:golang/github.com/cloudwego/eino@v0.7.37",
        "version": "v0.7.37"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/cloudwego/eino-ext/components/model/claude",
        "purl": "pkg:golang/github.com/cloudwego/eino-ext/components/model/claude@v0.1.17",
        "version": "v0.1.17"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/cloudwego/eino-ext/components/model/gemini",
        "purl": "pkg:golang/github.com/cloudwego/eino-ext/components/model/gemini@v0.1.28",
        "version": "v0.1.28"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/cloudwego/eino-ext/components/model/openai",
        "purl": "pkg:golang/github.com/cloudwego/eino-ext/components/model/openai@v0.1.8",
        "version": "v0.1.8"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/cloudwego/eino-ext/components/tool/mcp",
        "purl": "pkg:golang/github.com/cloudwego/eino-ext/components/tool/mcp@v0.0.8",
        "version": "v0.0.8"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/cloudwego/eino-ext/libs/acl/openai",
        "purl": "pkg:golang/github.com/cloudwego/eino-ext/libs/acl/openai@v0.1.13",
        "version": "v0.1.13"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/CloudyKit/fastprinter",
        "purl": "pkg:golang/github.com/CloudyKit/fastprinter@v0.0.0-20251202014920-1725d2651bd4",
        "version": "v0.0.0-20251202014920-1725d2651bd4"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/CloudyKit/jet/v6",
        "purl": "pkg:golang/github.com/CloudyKit/jet/v6@v6.3.1",
        "version": "v6.3.1"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/cncf/xds/go",
        "purl": "pkg:golang/github.com/cncf/xds/go@v0.0.0-20260202195803-dba9d589def2",
        "version": "v0.0.0-20260202195803-dba9d589def2"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/compose-spec/compose-go/v2",
        "purl": "pkg:golang/github.com/compose-spec/compose-go/v2@v2.10.1",
        "version": "v2.10.1"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/containerd/cgroups/v3",
        "purl": "pkg:golang/github.com/containerd/cgroups/v3@v3.1.0",
        "version": "v3.1.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/containerd/containerd",
        "purl": "pkg:golang/github.com/containerd/containerd@v1.7.30",
        "version": "v1.7.30"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/containerd/containerd/api",
        "purl": "pkg:golang/github.com/containerd/containerd/api@v1.10.0",
        "version": "v1.10.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/containerd/continuity",
        "purl": "pkg:golang/github.com/containerd/continuity@v0.4.5",
        "version": "v0.4.5"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/containerd/errdefs",
        "purl": "pkg:golang/github.com/containerd/errdefs@v1.0.0",
        "version": "v1.0.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/containerd/errdefs/pkg",
        "purl": "pkg:golang/github.com/containerd/errdefs/pkg@v0.3.0",
        "version": "v0.3.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/containerd/fifo",
        "purl": "pkg:golang/github.com/containerd/fifo@v1.1.0",
        "version": "v1.1.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/containerd/log",
        "purl": "pkg:golang/github.com/containerd/log@v0.1.0",
        "version": "v0.1.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/containerd/platforms",
        "purl": "pkg:golang/github.com/containerd/platforms@v1.0.0-rc.2",
        "version": "v1.0.0-rc.2"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/containerd/stargz-snapshotter/estargz",
        "purl": "pkg:golang/github.com/containerd/stargz-snapshotter/estargz@v0.18.2",
        "version": "v0.18.2"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/containerd/ttrpc",
        "purl": "pkg:golang/github.com/containerd/ttrpc@v1.2.7",
        "version": "v1.2.7"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/containerd/typeurl/v2",
        "purl": "pkg:golang/github.com/containerd/typeurl/v2@v2.2.3",
        "version": "v2.2.3"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/cpuguy83/go-md2man/v2",
        "purl": "pkg:golang/github.com/cpuguy83/go-md2man/v2@v2.0.7",
        "version": "v2.0.7"
      },
      {
        "ecosystem": "golang",
        "licenses": [
          "MIT"
        ],
        "location": "go.mod",
        "name": "github.com/creack/pty",
        "purl": "pkg:golang/github.com/creack/pty@v1.1.24",
        "version": "v1.1.24"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/CycloneDX/cyclonedx-go",
        "purl": "pkg:golang/github.com/CycloneDX/cyclonedx-go@v0.10.0",
        "version": "v0.10.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/cyphar/filepath-securejoin",
        "purl": "pkg:golang/github.com/cyphar/filepath-securejoin@v0.6.1",
        "version": "v0.6.1"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/danieljoos/wincred",
        "purl": "pkg:golang/github.com/danieljoos/wincred@v1.2.3",
        "version": "v1.2.3"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/DataDog/datadog-go",
        "purl": "pkg:golang/github.com/DataDog/datadog-go@v4.8.3%2Bincompatible",
        "version": "v4.8.3+incompatible"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "scripts/go.mod",
        "name": "github.com/davecgh/go-spew",
        "purl": "pkg:golang/github.com/davecgh/go-spew@v1.1.1",
        "version": "v1.1.1"
      },
      {
        "ecosystem": "golang",
        "licenses": [
          "ISC"
        ],
        "location": "go.mod",
        "name": "github.com/davecgh/go-spew",
        "purl": "pkg:golang/github.com/davecgh/go-spew@v1.1.2-0.20180830191138-d8f796af33cc",
        "version": "v1.1.2-0.20180830191138-d8f796af33cc"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/deepmap/oapi-codegen",
        "purl": "pkg:golang/github.com/deepmap/oapi-codegen@v1.16.3",
        "version": "v1.16.3"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/deitch/magic",
        "purl": "pkg:golang/github.com/deitch/magic@v0.0.0-20240306090643-c67ab88f10cb",
        "version": "v0.0.0-20240306090643-c67ab88f10cb"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/denisbrodbeck/machineid",
        "purl": "pkg:golang/github.com/denisbrodbeck/machineid@v1.0.1",
        "version": "v1.0.1"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/diskfs/go-diskfs",
        "purl": "pkg:golang/github.com/diskfs/go-diskfs@v1.7.0",
        "version": "v1.7.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/distribution/reference",
        "purl": "pkg:golang/github.com/distribution/reference@v0.6.0",
        "version": "v0.6.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/djherbis/times",
        "purl": "pkg:golang/github.com/djherbis/times@v1.6.0",
        "version": "v1.6.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/dlclark/regexp2",
        "purl": "pkg:golang/github.com/dlclark/regexp2@v1.11.5",
        "version": "v1.11.5"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/docker/cli",
        "purl": "pkg:golang/github.com/docker/cli@v29.2.1%2Bincompatible",
        "version": "v29.2.1+incompatible"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/docker/distribution",
        "purl": "pkg:golang/github.com/docker/distribution@v2.8.3%2Bincompatible",
        "version": "v2.8.3+incompatible"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/docker/docker",
        "purl": "pkg:golang/github.com/docker/docker@v28.5.2%2Bincompatible",
        "version": "v28.5.2+incompatible"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/docker/docker-credential-helpers",
        "purl": "pkg:golang/github.com/docker/docker-credential-helpers@v0.9.5",
        "version": "v0.9.5"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/docker/go-connections",
        "purl": "pkg:golang/github.com/docker/go-connections@v0.6.0",
        "version": "v0.6.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/docker/go-events",
        "purl": "pkg:golang/github.com/docker/go-events@v0.0.0-20250808211157-605354379745",
        "version": "v0.0.0-20250808211157-605354379745"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/docker/go-units",
        "purl": "pkg:golang/github.com/docker/go-units@v0.5.0",
        "version": "v0.5.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/dop251/goja",
        "purl": "pkg:golang/github.com/dop251/goja@v0.0.0-20250114131315-46d383d606d3",
        "version": "v0.0.0-20250114131315-46d383d606d3"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/dsnet/compress",
        "purl": "pkg:golang/github.com/dsnet/compress@v0.0.2-0.20230904184137-39efe44ab707",
        "version": "v0.0.2-0.20230904184137-39efe44ab707"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/dsoprea/go-exfat",
        "purl": "pkg:golang/github.com/dsoprea/go-exfat@v0.0.0-20190906070738-5e932fbdb589",
        "version": "v0.0.0-20190906070738-5e932fbdb589"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/dsoprea/go-logging",
        "purl": "pkg:golang/github.com/dsoprea/go-logging@v0.0.0-20200710184922-b02d349568dd",
        "version": "v0.0.0-20200710184922-b02d349568dd"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/dustin/go-humanize",
        "purl": "pkg:golang/github.com/dustin/go-humanize@v1.0.1",
        "version": "v1.0.1"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/edsrzf/mmap-go",
        "purl": "pkg:golang/github.com/edsrzf/mmap-go@v1.2.0",
        "version": "v1.2.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/eino-contrib/jsonschema",
        "purl": "pkg:golang/github.com/eino-contrib/jsonschema@v1.0.3",
        "version": "v1.0.3"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/elliotwutingfeng/asciiset",
        "purl": "pkg:golang/github.com/elliotwutingfeng/asciiset@v0.0.0-20260129054604-cfde2086bc57",
        "version": "v0.0.0-20260129054604-cfde2086bc57"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/envoyproxy/go-control-plane/envoy",
        "purl": "pkg:golang/github.com/envoyproxy/go-control-plane/envoy@v1.37.0",
        "version": "v1.37.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/envoyproxy/protoc-gen-validate",
        "purl": "pkg:golang/github.com/envoyproxy/protoc-gen-validate@v1.3.3",
        "version": "v1.3.3"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/erikgeiser/coninput",
        "purl": "pkg:golang/github.com/erikgeiser/coninput@v0.0.0-20211004153227-1c3628e74d0f",
        "version": "v0.0.0-20211004153227-1c3628e74d0f"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/erikvarga/go-rpmdb",
        "purl": "pkg:golang/github.com/erikvarga/go-rpmdb@v0.0.0-20250523120114-a15a62cd4593",
        "version": "v0.0.0-20250523120114-a15a62cd4593"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/evanphx/json-patch",
        "purl": "pkg:golang/github.com/evanphx/json-patch@v0.5.2",
        "version": "v0.5.2"
      },
      {
        "ecosystem": "golang",
        "licenses": [
          "MIT"
        ],
        "location": "go.mod",
        "name": "github.com/evilmartians/lefthook",
        "purl": "pkg:golang/github.com/evilmartians/lefthook@v1.13.6",
        "version": "v1.13.6"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/facebookincubator/nvdtools",
        "purl": "pkg:golang/github.com/facebookincubator/nvdtools@v0.1.5",
        "version": "v0.1.5"
      },
      {
        "ecosystem": "golang",
        "licenses": [
          "MIT"
        ],
        "location": "go.mod",
        "name": "github.com/fatih/color",
        "purl": "pkg:golang/github.com/fatih/color@v1.18.0",
        "version": "v1.18.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/fatih/structs",
        "purl": "pkg:golang/github.com/fatih/structs@v1.1.0",
        "version": "v1.1.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/felixge/fgprof",
        "purl": "pkg:golang/github.com/felixge/fgprof@v0.9.5",
        "version": "v0.9.5"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/felixge/httpsnoop",
        "purl": "pkg:golang/github.com/felixge/httpsnoop@v1.0.4",
        "version": "v1.0.4"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/flosch/pongo2/v4",
        "purl": "pkg:golang/github.com/flosch/pongo2/v4@v4.0.2",
        "version": "v4.0.2"
      },
      {
        "ecosystem": "golang",
        "licenses": [
          "BSD-3-Clause"
        ],
        "location": "go.mod",
        "name": "github.com/fsnotify/fsnotify",
        "purl": "pkg:golang/github.com/fsnotify/fsnotify@v1.9.0",
        "version": "v1.9.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [
          "MIT"
        ],
        "location": "go.mod",
        "name": "github.com/gabriel-vasile/mimetype",
        "purl": "pkg:golang/github.com/gabriel-vasile/mimetype@v1.4.13",
        "version": "v1.4.13"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/GehirnInc/crypt",
        "purl": "pkg:golang/github.com/GehirnInc/crypt@v0.0.0-20230320061759-8cc1b52080c5",
        "version": "v0.0.0-20230320061759-8cc1b52080c5"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/gin-contrib/sse",
        "purl": "pkg:golang/github.com/gin-contrib/sse@v1.1.0",
        "version": "v1.1.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/gin-gonic/gin",
        "purl": "pkg:golang/github.com/gin-gonic/gin@v1.12.0",
        "version": "v1.12.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/github/go-spdx/v2",
        "purl": "pkg:golang/github.com/github/go-spdx/v2@v2.4.0",
        "version": "v2.4.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/go-errors/errors",
        "purl": "pkg:golang/github.com/go-errors/errors@v1.5.1",
        "version": "v1.5.1"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/go-git/gcfg",
        "purl": "pkg:golang/github.com/go-git/gcfg@v1.5.1-0.20230307220236-3a3c6141e376",
        "version": "v1.5.1-0.20230307220236-3a3c6141e376"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/go-git/go-billy/v5",
        "purl": "pkg:golang/github.com/go-git/go-billy/v5@v5.9.0",
        "version": "v5.9.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/go-git/go-git/v5",
        "purl": "pkg:golang/github.com/go-git/go-git/v5@v5.19.2",
        "version": "v5.19.2"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/go-jose/go-jose/v4",
        "purl": "pkg:golang/github.com/go-jose/go-jose/v4@v4.1.4",
        "version": "v4.1.4"
      },
      {
        "ecosystem": "golang",
        "licenses": [
          "BSD-3-Clause"
        ],
        "location": "go.mod",
        "name": "github.com/go-json-experiment/json",
        "purl": "pkg:golang/github.com/go-json-experiment/json@v0.0.0-20250910080747-cc2cfa0554c3",
        "version": "v0.0.0-20250910080747-cc2cfa0554c3"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/go-logr/logr",
        "purl": "pkg:golang/github.com/go-logr/logr@v1.4.4",
        "version": "v1.4.4"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/go-logr/stdr",
        "purl": "pkg:golang/github.com/go-logr/stdr@v1.2.2",
        "version": "v1.2.2"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/go-ole/go-ole",
        "purl": "pkg:golang/github.com/go-ole/go-ole@v1.3.0",
        "version": "v1.3.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/go-openapi/inflect",
        "purl": "pkg:golang/github.com/go-openapi/inflect@v0.21.5",
        "version": "v0.21.5"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/go-playground/locales",
        "purl": "pkg:golang/github.com/go-playground/locales@v0.14.1",
        "version": "v0.14.1"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/go-playground/universal-translator",
        "purl": "pkg:golang/github.com/go-playground/universal-translator@v0.18.1",
        "version": "v0.18.1"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/go-playground/validator/v10",
        "purl": "pkg:golang/github.com/go-playground/validator/v10@v10.30.1",
        "version": "v10.30.1"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/go-restruct/restruct",
        "purl": "pkg:golang/github.com/go-restruct/restruct@v1.2.0-alpha",
        "version": "v1.2.0-alpha"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/go-resty/resty/v2",
        "purl": "pkg:golang/github.com/go-resty/resty/v2@v2.17.2",
        "version": "v2.17.2"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/go-sourcemap/sourcemap",
        "purl": "pkg:golang/github.com/go-sourcemap/sourcemap@v2.1.4%2Bincompatible",
        "version": "v2.1.4+incompatible"
      },
      {
        "ecosystem": "golang",
        "licenses": [
          "MIT"
        ],
        "location": "go.mod",
        "name": "github.com/go-viper/mapstructure/v2",
        "purl": "pkg:golang/github.com/go-viper/mapstructure/v2@v2.5.0",
        "version": "v2.5.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [
          "MIT"
        ],
        "location": "go.mod",
        "name": "github.com/gobwas/glob",
        "purl": "pkg:golang/github.com/gobwas/glob@v0.2.3",
        "version": "v0.2.3"
      },
      {
        "ecosystem": "golang",
        "licenses": [
          "MIT"
        ],
        "location": "go.mod",
        "name": "github.com/goccy/go-json",
        "purl": "pkg:golang/github.com/goccy/go-json@v0.10.5",
        "version": "v0.10.5"
      },
      {
        "ecosystem": "golang",
        "licenses": [
          "MIT"
        ],
        "location": "go.mod",
        "name": "github.com/goccy/go-yaml",
        "purl": "pkg:golang/github.com/goccy/go-yaml@v1.19.2",
        "version": "v1.19.2"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/godbus/dbus/v5",
        "purl": "pkg:golang/github.com/godbus/dbus/v5@v5.1.0",
        "version": "v5.1.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/gofri/go-github-ratelimit",
        "purl": "pkg:golang/github.com/gofri/go-github-ratelimit@v1.1.1",
        "version": "v1.1.1"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/gogo/protobuf",
        "purl": "pkg:golang/github.com/gogo/protobuf@v1.3.2",
        "version": "v1.3.2"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/gohugoio/hashstructure",
        "purl": "pkg:golang/github.com/gohugoio/hashstructure@v0.6.0",
        "version": "v0.6.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/gojek/heimdall",
        "purl": "pkg:golang/github.com/gojek/heimdall@v5.0.2%2Bincompatible",
        "version": "v5.0.2+incompatible"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/gojek/heimdall/v7",
        "purl": "pkg:golang/github.com/gojek/heimdall/v7@v7.1.0",
        "version": "v7.1.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/gojek/valkyrie",
        "purl": "pkg:golang/github.com/gojek/valkyrie@v0.0.0-20190210220504-8f62c1e7ba45",
        "version": "v0.0.0-20190210220504-8f62c1e7ba45"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/golang-jwt/jwt/v5",
        "purl": "pkg:golang/github.com/golang-jwt/jwt/v5@v5.3.1",
        "version": "v5.3.1"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/golang/groupcache",
        "purl": "pkg:golang/github.com/golang/groupcache@v0.0.0-20241129210726-2c02b8208cf8",
        "version": "v0.0.0-20241129210726-2c02b8208cf8"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/golang/protobuf",
        "purl": "pkg:golang/github.com/golang/protobuf@v1.5.4",
        "version": "v1.5.4"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/golang/snappy",
        "purl": "pkg:golang/github.com/golang/snappy@v1.0.0",
        "version": "v1.0.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/gomarkdown/markdown",
        "purl": "pkg:golang/github.com/gomarkdown/markdown@v0.0.0-20260217112301-37c66b85d6ab",
        "version": "v0.0.0-20260217112301-37c66b85d6ab"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/google/cel-go",
        "purl": "pkg:golang/github.com/google/cel-go@v0.27.0",
        "version": "v0.27.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [
          "BSD-3-Clause"
        ],
        "location": "go.mod",
        "name": "github.com/google/go-cmp",
        "purl": "pkg:golang/github.com/google/go-cmp@v0.7.0",
        "version": "v0.7.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/google/go-containerregistry",
        "purl": "pkg:golang/github.com/google/go-containerregistry@v0.21.2",
        "version": "v0.21.2"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/google/go-github/v70",
        "purl": "pkg:golang/github.com/google/go-github/v70@v70.0.0",
        "version": "v70.0.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/google/go-github/v74",
        "purl": "pkg:golang/github.com/google/go-github/v74@v74.0.0",
        "version": "v74.0.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/google/go-querystring",
        "purl": "pkg:golang/github.com/google/go-querystring@v1.2.0",
        "version": "v1.2.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/google/licensecheck",
        "purl": "pkg:golang/github.com/google/licensecheck@v0.3.1",
        "version": "v0.3.1"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/google/osv-scalibr",
        "purl": "pkg:golang/github.com/google/osv-scalibr@v0.4.4",
        "version": "v0.4.4"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/google/osv-scanner",
        "purl": "pkg:golang/github.com/google/osv-scanner@v1.9.2",
        "version": "v1.9.2"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/google/pprof",
        "purl": "pkg:golang/github.com/google/pprof@v0.0.0-20260302011040-a15ffb7f9dcc",
        "version": "v0.0.0-20260302011040-a15ffb7f9dcc"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/google/s2a-go",
        "purl": "pkg:golang/github.com/google/s2a-go@v0.1.9",
        "version": "v0.1.9"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/google/uuid",
        "purl": "pkg:golang/github.com/google/uuid@v1.6.0",
        "version": "v1.6.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/googleapis/enterprise-certificate-proxy",
        "purl": "pkg:golang/github.com/googleapis/enterprise-certificate-proxy@v0.3.13",
        "version": "v0.3.13"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/googleapis/gax-go/v2",
        "purl": "pkg:golang/github.com/googleapis/gax-go/v2@v2.17.0",
        "version": "v2.17.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp",
        "purl": "pkg:golang/github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp@v1.33.0",
        "version": "v1.33.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/GoogleCloudPlatform/opentelemetry-operations-go/exporter/metric",
        "purl": "pkg:golang/github.com/GoogleCloudPlatform/opentelemetry-operations-go/exporter/metric@v0.55.0",
        "version": "v0.55.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/resourcemapping",
        "purl": "pkg:golang/github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/resourcemapping@v0.55.0",
        "version": "v0.55.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/gookit/color",
        "purl": "pkg:golang/github.com/gookit/color@v1.6.0",
        "version": "v1.6.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/goph/emperror",
        "purl": "pkg:golang/github.com/goph/emperror@v0.17.2",
        "version": "v0.17.2"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/gorilla/css",
        "purl": "pkg:golang/github.com/gorilla/css@v1.0.1",
        "version": "v1.0.1"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/gorilla/websocket",
        "purl": "pkg:golang/github.com/gorilla/websocket@v1.5.3",
        "version": "v1.5.3"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/grpc-ecosystem/go-grpc-middleware",
        "purl": "pkg:golang/github.com/grpc-ecosystem/go-grpc-middleware@v1.4.0",
        "version": "v1.4.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/hashicorp/aws-sdk-go-base/v2",
        "purl": "pkg:golang/github.com/hashicorp/aws-sdk-go-base/v2@v2.0.0-beta.71",
        "version": "v2.0.0-beta.71"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/hashicorp/errwrap",
        "purl": "pkg:golang/github.com/hashicorp/errwrap@v1.1.0",
        "version": "v1.1.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/hashicorp/go-cleanhttp",
        "purl": "pkg:golang/github.com/hashicorp/go-cleanhttp@v0.5.2",
        "version": "v0.5.2"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/hashicorp/go-getter",
        "purl": "pkg:golang/github.com/hashicorp/go-getter@v1.8.4",
        "version": "v1.8.4"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/hashicorp/go-multierror",
        "purl": "pkg:golang/github.com/hashicorp/go-multierror@v1.1.1",
        "version": "v1.1.1"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/hashicorp/go-version",
        "purl": "pkg:golang/github.com/hashicorp/go-version@v1.8.0",
        "version": "v1.8.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/hashicorp/golang-lru/v2",
        "purl": "pkg:golang/github.com/hashicorp/golang-lru/v2@v2.0.7",
        "version": "v2.0.7"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/hashicorp/hcl/v2",
        "purl": "pkg:golang/github.com/hashicorp/hcl/v2@v2.24.0",
        "version": "v2.24.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/hidal-go/hidalgo",
        "purl": "pkg:golang/github.com/hidal-go/hidalgo@v0.3.0",
        "version": "v0.3.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/iancoleman/strcase",
        "purl": "pkg:golang/github.com/iancoleman/strcase@v0.3.0",
        "version": "v0.3.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/ianlancetaylor/demangle",
        "purl": "pkg:golang/github.com/ianlancetaylor/demangle@v0.0.0-20251118225945-96ee0021ea0f",
        "version": "v0.0.0-20251118225945-96ee0021ea0f"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/icholy/digest",
        "purl": "pkg:golang/github.com/icholy/digest@v1.1.0",
        "version": "v1.1.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/inconshreveable/mousetrap",
        "purl": "pkg:golang/github.com/inconshreveable/mousetrap@v1.1.0",
        "version": "v1.1.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/invopop/jsonschema",
        "purl": "pkg:golang/github.com/invopop/jsonschema@v0.13.0",
        "version": "v0.13.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/iris-contrib/schema",
        "purl": "pkg:golang/github.com/iris-contrib/schema@v0.0.6",
        "version": "v0.0.6"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/jbenet/go-context",
        "purl": "pkg:golang/github.com/jbenet/go-context@v0.0.0-20150711004518-d14ea06fba99",
        "version": "v0.0.0-20150711004518-d14ea06fba99"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/jedib0t/go-pretty/v6",
        "purl": "pkg:golang/github.com/jedib0t/go-pretty/v6@v6.7.9",
        "version": "v6.7.9"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/jinzhu/copier",
        "purl": "pkg:golang/github.com/jinzhu/copier@v0.4.0",
        "version": "v0.4.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/Joker/jade",
        "purl": "pkg:golang/github.com/Joker/jade@v1.1.3",
        "version": "v1.1.3"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/josharian/intern",
        "purl": "pkg:golang/github.com/josharian/intern@v1.0.0",
        "version": "v1.0.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/json-iterator/go",
        "purl": "pkg:golang/github.com/json-iterator/go@v1.1.12",
        "version": "v1.1.12"
      },
      {
        "ecosystem": "golang",
        "licenses": [
          "MIT"
        ],
        "location": "go.mod",
        "name": "github.com/kaptinlin/go-i18n",
        "purl": "pkg:golang/github.com/kaptinlin/go-i18n@v0.1.7",
        "version": "v0.1.7"
      },
      {
        "ecosystem": "golang",
        "licenses": [
          "MIT"
        ],
        "location": "go.mod",
        "name": "github.com/kaptinlin/jsonschema",
        "purl": "pkg:golang/github.com/kaptinlin/jsonschema@v0.4.14",
        "version": "v0.4.14"
      },
      {
        "ecosystem": "golang",
        "licenses": [
          "MIT"
        ],
        "location": "go.mod",
        "name": "github.com/kaptinlin/messageformat-go",
        "purl": "pkg:golang/github.com/kaptinlin/messageformat-go@v0.4.0",
        "version": "v0.4.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/kataras/blocks",
        "purl": "pkg:golang/github.com/kataras/blocks@v0.0.12",
        "version": "v0.0.12"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/kataras/golog",
        "purl": "pkg:golang/github.com/kataras/golog@v0.1.12",
        "version": "v0.1.12"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/kataras/iris/v12",
        "purl": "pkg:golang/github.com/kataras/iris/v12@v12.2.11",
        "version": "v12.2.11"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/kataras/pio",
        "purl": "pkg:golang/github.com/kataras/pio@v0.0.13",
        "version": "v0.0.13"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/kataras/sitemap",
        "purl": "pkg:golang/github.com/kataras/sitemap@v0.0.6",
        "version": "v0.0.6"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/kataras/tunnel",
        "purl": "pkg:golang/github.com/kataras/tunnel@v0.0.4",
        "version": "v0.0.4"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/kballard/go-shellquote",
        "purl": "pkg:golang/github.com/kballard/go-shellquote@v0.0.0-20180428030007-95032a82bc51",
        "version": "v0.0.0-20180428030007-95032a82bc51"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/klauspost/compress",
        "purl": "pkg:golang/github.com/klauspost/compress@v1.18.4",
        "version": "v1.18.4"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/klauspost/cpuid/v2",
        "purl": "pkg:golang/github.com/klauspost/cpuid/v2@v2.3.0",
        "version": "v2.3.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/klauspost/pgzip",
        "purl": "pkg:golang/github.com/klauspost/pgzip@v1.2.6",
        "version": "v1.2.6"
      },
      {
        "ecosystem": "golang",
        "licenses": [
          "MIT"
        ],
        "location": "go.mod",
        "name": "github.com/knadh/koanf/maps",
        "purl": "pkg:golang/github.com/knadh/koanf/maps@v0.1.2",
        "version": "v0.1.2"
      },
      {
        "ecosystem": "golang",
        "licenses": [
          "MIT"
        ],
        "location": "go.mod",
        "name": "github.com/knadh/koanf/parsers/json",
        "purl": "pkg:golang/github.com/knadh/koanf/parsers/json@v1.0.0",
        "version": "v1.0.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [
          "MIT"
        ],
        "location": "go.mod",
        "name": "github.com/knadh/koanf/parsers/toml/v2",
        "purl": "pkg:golang/github.com/knadh/koanf/parsers/toml/v2@v2.2.0",
        "version": "v2.2.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [
          "MIT"
        ],
        "location": "go.mod",
        "name": "github.com/knadh/koanf/parsers/yaml",
        "purl": "pkg:golang/github.com/knadh/koanf/parsers/yaml@v1.1.0",
        "version": "v1.1.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [
          "MIT"
        ],
        "location": "go.mod",
        "name": "github.com/knadh/koanf/providers/fs",
        "purl": "pkg:golang/github.com/knadh/koanf/providers/fs@v1.0.0",
        "version": "v1.0.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [
          "MIT"
        ],
        "location": "go.mod",
        "name": "github.com/knadh/koanf/v2",
        "purl": "pkg:golang/github.com/knadh/koanf/v2@v2.3.0",
        "version": "v2.3.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [
          "MIT"
        ],
        "location": "go.mod",
        "name": "github.com/kr/pretty",
        "purl": "pkg:golang/github.com/kr/pretty@v0.3.1",
        "version": "v0.3.1"
      },
      {
        "ecosystem": "golang",
        "licenses": [
          "MIT"
        ],
        "location": "go.mod",
        "name": "github.com/kr/text",
        "purl": "pkg:golang/github.com/kr/text@v0.2.0",
        "version": "v0.2.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/kubescape/go-git-url",
        "purl": "pkg:golang/github.com/kubescape/go-git-url@v0.0.31",
        "version": "v0.0.31"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/labstack/echo/v4",
        "purl": "pkg:golang/github.com/labstack/echo/v4@v4.15.1",
        "version": "v4.15.1"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/labstack/gommon",
        "purl": "pkg:golang/github.com/labstack/gommon@v0.4.2",
        "version": "v0.4.2"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/leodido/go-urn",
        "purl": "pkg:golang/github.com/leodido/go-urn@v1.4.0",
        "version": "v1.4.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [
          "MIT"
        ],
        "location": "go.mod",
        "name": "github.com/lucasb-eyer/go-colorful",
        "purl": "pkg:golang/github.com/lucasb-eyer/go-colorful@v1.3.0",
        "version": "v1.3.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/lunixbochs/struc",
        "purl": "pkg:golang/github.com/lunixbochs/struc@v0.0.0-20241101090106-8d528fa2c543",
        "version": "v0.0.0-20241101090106-8d528fa2c543"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/mailgun/raymond/v2",
        "purl": "pkg:golang/github.com/mailgun/raymond/v2@v2.0.48",
        "version": "v2.0.48"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/mailru/easyjson",
        "purl": "pkg:golang/github.com/mailru/easyjson@v0.9.1",
        "version": "v0.9.1"
      },
      {
        "ecosystem": "golang",
        "licenses": [
          "MIT"
        ],
        "location": "go.mod",
        "name": "github.com/MakeNowJust/heredoc",
        "purl": "pkg:golang/github.com/MakeNowJust/heredoc@v1.0.0",
        "version": "v1.0.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/mark3labs/mcp-go",
        "purl": "pkg:golang/github.com/mark3labs/mcp-go@v0.44.1",
        "version": "v0.44.1"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/masahiro331/go-ext4-filesystem",
        "purl": "pkg:golang/github.com/masahiro331/go-ext4-filesystem@v0.0.0-20240620024024-ca14e6327bbd",
        "version": "v0.0.0-20240620024024-ca14e6327bbd"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/Masterminds/semver/v3",
        "purl": "pkg:golang/github.com/Masterminds/semver/v3@v3.4.0",
        "version": "v3.4.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [
          "MIT"
        ],
        "location": "go.mod",
        "name": "github.com/mattn/go-colorable",
        "purl": "pkg:golang/github.com/mattn/go-colorable@v0.1.14",
        "version": "v0.1.14"
      },
      {
        "ecosystem": "golang",
        "licenses": [
          "MIT"
        ],
        "location": "go.mod",
        "name": "github.com/mattn/go-isatty",
        "purl": "pkg:golang/github.com/mattn/go-isatty@v0.0.20",
        "version": "v0.0.20"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/mattn/go-localereader",
        "purl": "pkg:golang/github.com/mattn/go-localereader@v0.0.2-0.20220822084749-2491eb6c1c75",
        "version": "v0.0.2-0.20220822084749-2491eb6c1c75"
      },
      {
        "ecosystem": "golang",
        "licenses": [
          "MIT"
        ],
        "location": "go.mod",
        "name": "github.com/mattn/go-runewidth",
        "purl": "pkg:golang/github.com/mattn/go-runewidth@v0.0.20",
        "version": "v0.0.20"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/mattn/go-shellwords",
        "purl": "pkg:golang/github.com/mattn/go-shellwords@v1.0.12",
        "version": "v1.0.12"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/mattn/go-sqlite3",
        "purl": "pkg:golang/github.com/mattn/go-sqlite3@v1.14.34",
        "version": "v1.14.34"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/mattn/go-tty",
        "purl": "pkg:golang/github.com/mattn/go-tty@v0.0.7",
        "version": "v0.0.7"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/meguminnnnnnnnn/go-openai",
        "purl": "pkg:golang/github.com/meguminnnnnnnnn/go-openai@v0.1.1",
        "version": "v0.1.1"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/mgutz/ansi",
        "purl": "pkg:golang/github.com/mgutz/ansi@v0.0.0-20200706080929-d51e80ef957d",
        "version": "v0.0.0-20200706080929-d51e80ef957d"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/mholt/archives",
        "purl": "pkg:golang/github.com/mholt/archives@v0.1.5",
        "version": "v0.1.5"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/microcosm-cc/bluemonday",
        "purl": "pkg:golang/github.com/microcosm-cc/bluemonday@v1.0.27",
        "version": "v1.0.27"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/micromdm/plist",
        "purl": "pkg:golang/github.com/micromdm/plist@v0.2.2",
        "version": "v0.2.2"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/Microsoft/go-winio",
        "purl": "pkg:golang/github.com/Microsoft/go-winio@v0.6.2",
        "version": "v0.6.2"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/Microsoft/hcsshim",
        "purl": "pkg:golang/github.com/Microsoft/hcsshim@v0.14.0-rc.1",
        "version": "v0.14.0-rc.1"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/mikelolasagasti/xz",
        "purl": "pkg:golang/github.com/mikelolasagasti/xz@v1.0.1",
        "version": "v1.0.1"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/minio/minlz",
        "purl": "pkg:golang/github.com/minio/minlz@v1.0.1",
        "version": "v1.0.1"
      },
      {
        "ecosystem": "golang",
        "licenses": [
          "MIT"
        ],
        "location": "go.mod",
        "name": "github.com/mitchellh/colorstring",
        "purl": "pkg:golang/github.com/mitchellh/colorstring@v0.0.0-20190213212951-d06e56a500db",
        "version": "v0.0.0-20190213212951-d06e56a500db"
      },
      {
        "ecosystem": "golang",
        "licenses": [
          "MIT"
        ],
        "location": "go.mod",
        "name": "github.com/mitchellh/copystructure",
        "purl": "pkg:golang/github.com/mitchellh/copystructure@v1.2.0",
        "version": "v1.2.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/mitchellh/go-homedir",
        "purl": "pkg:golang/github.com/mitchellh/go-homedir@v1.1.0",
        "version": "v1.1.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/mitchellh/go-wordwrap",
        "purl": "pkg:golang/github.com/mitchellh/go-wordwrap@v1.0.1",
        "version": "v1.0.1"
      },
      {
        "ecosystem": "golang",
        "licenses": [
          "MIT"
        ],
        "location": "go.mod",
        "name": "github.com/mitchellh/mapstructure",
        "purl": "pkg:golang/github.com/mitchellh/mapstructure@v1.5.0",
        "version": "v1.5.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [
          "MIT"
        ],
        "location": "go.mod",
        "name": "github.com/mitchellh/reflectwalk",
        "purl": "pkg:golang/github.com/mitchellh/reflectwalk@v1.0.2",
        "version": "v1.0.2"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/moby/buildkit",
        "purl": "pkg:golang/github.com/moby/buildkit@v0.26.3",
        "version": "v0.26.3"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/moby/docker-image-spec",
        "purl": "pkg:golang/github.com/moby/docker-image-spec@v1.3.1",
        "version": "v1.3.1"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/moby/locker",
        "purl": "pkg:golang/github.com/moby/locker@v1.0.1",
        "version": "v1.0.1"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/moby/sys/mountinfo",
        "purl": "pkg:golang/github.com/moby/sys/mountinfo@v0.7.2",
        "version": "v0.7.2"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/moby/sys/sequential",
        "purl": "pkg:golang/github.com/moby/sys/sequential@v0.6.0",
        "version": "v0.6.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/moby/sys/signal",
        "purl": "pkg:golang/github.com/moby/sys/signal@v0.7.1",
        "version": "v0.7.1"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/moby/sys/user",
        "purl": "pkg:golang/github.com/moby/sys/user@v0.4.0",
        "version": "v0.4.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/moby/sys/userns",
        "purl": "pkg:golang/github.com/moby/sys/userns@v0.1.0",
        "version": "v0.1.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/modern-go/concurrent",
        "purl": "pkg:golang/github.com/modern-go/concurrent@v0.0.0-20180306012644-bacd9c7ef1dd",
        "version": "v0.0.0-20180306012644-bacd9c7ef1dd"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/modern-go/reflect2",
        "purl": "pkg:golang/github.com/modern-go/reflect2@v1.0.3-0.20250322232337-35a7c28c31ee",
        "version": "v1.0.3-0.20250322232337-35a7c28c31ee"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/muesli/ansi",
        "purl": "pkg:golang/github.com/muesli/ansi@v0.0.0-20230316100256-276c6243b2f6",
        "version": "v0.0.0-20230316100256-276c6243b2f6"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/muesli/cancelreader",
        "purl": "pkg:golang/github.com/muesli/cancelreader@v0.2.2",
        "version": "v0.2.2"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/muesli/reflow",
        "purl": "pkg:golang/github.com/muesli/reflow@v0.3.0",
        "version": "v0.3.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [
          "MIT"
        ],
        "location": "go.mod",
        "name": "github.com/muesli/termenv",
        "purl": "pkg:golang/github.com/muesli/termenv@v0.16.0",
        "version": "v0.16.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/munnerz/goautoneg",
        "purl": "pkg:golang/github.com/munnerz/goautoneg@v0.0.0-20191010083416-a7dc8b61c822",
        "version": "v0.0.0-20191010083416-a7dc8b61c822"
      },
      {
        "ecosystem": "golang",
        "licenses": [
          "MIT"
        ],
        "location": "go.mod",
        "name": "github.com/natefinch/atomic",
        "purl": "pkg:golang/github.com/natefinch/atomic@v1.0.1",
        "version": "v1.0.1"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/ncruces/go-strftime",
        "purl": "pkg:golang/github.com/ncruces/go-strftime@v1.0.0",
        "version": "v1.0.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/nikolalohinski/gonja",
        "purl": "pkg:golang/github.com/nikolalohinski/gonja@v1.5.3",
        "version": "v1.5.3"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/nwaples/rardecode/v2",
        "purl": "pkg:golang/github.com/nwaples/rardecode/v2@v2.2.2",
        "version": "v2.2.2"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/oklog/ulid/v2",
        "purl": "pkg:golang/github.com/oklog/ulid/v2@v2.1.1",
        "version": "v2.1.1"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/opencontainers/go-digest",
        "purl": "pkg:golang/github.com/opencontainers/go-digest@v1.0.0",
        "version": "v1.0.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/opencontainers/image-spec",
        "purl": "pkg:golang/github.com/opencontainers/image-spec@v1.1.1",
        "version": "v1.1.1"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/opencontainers/runtime-spec",
        "purl": "pkg:golang/github.com/opencontainers/runtime-spec@v1.2.1",
        "version": "v1.2.1"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/opencontainers/selinux",
        "purl": "pkg:golang/github.com/opencontainers/selinux@v1.13.1",
        "version": "v1.13.1"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/ossf/osv-schema/bindings/go",
        "purl": "pkg:golang/github.com/ossf/osv-schema/bindings/go@v0.0.0-20260304051245-ec3272c283e4",
        "version": "v0.0.0-20260304051245-ec3272c283e4"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/owenrumney/go-sarif/v2",
        "purl": "pkg:golang/github.com/owenrumney/go-sarif/v2@v2.3.3",
        "version": "v2.3.3"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/package-url/packageurl-go",
        "purl": "pkg:golang/github.com/package-url/packageurl-go@v0.1.4",
        "version": "v0.1.4"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/pandatix/go-cvss",
        "purl": "pkg:golang/github.com/pandatix/go-cvss@v0.6.2",
        "version": "v0.6.2"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/pborman/indent",
        "purl": "pkg:golang/github.com/pborman/indent@v1.2.1",
        "version": "v1.2.1"
      },
      {
        "ecosystem": "golang",
        "licenses": [
          "MIT"
        ],
        "location": "go.mod",
        "name": "github.com/pelletier/go-toml/v2",
        "purl": "pkg:golang/github.com/pelletier/go-toml/v2@v2.2.4",
        "version": "v2.2.4"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/pierrec/lz4/v4",
        "purl": "pkg:golang/github.com/pierrec/lz4/v4@v4.1.25",
        "version": "v4.1.25"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/piprate/json-gold",
        "purl": "pkg:golang/github.com/piprate/json-gold@v0.5.0",
        "version": "v0.5.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/pkg/errors",
        "purl": "pkg:golang/github.com/pkg/errors@v0.9.1",
        "version": "v0.9.1"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/pkg/profile",
        "purl": "pkg:golang/github.com/pkg/profile@v1.7.0",
        "version": "v1.7.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/pkg/xattr",
        "purl": "pkg:golang/github.com/pkg/xattr@v0.4.12",
        "version": "v0.4.12"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/planetscale/vtprotobuf",
        "purl": "pkg:golang/github.com/planetscale/vtprotobuf@v0.6.1-0.20240319094008-0393e58bdf10",
        "version": "v0.6.1-0.20240319094008-0393e58bdf10"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "scripts/go.mod",
        "name": "github.com/pmezard/go-difflib",
        "purl": "pkg:golang/github.com/pmezard/go-difflib@v1.0.0",
        "version": "v1.0.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [
          "BSD-3-Clause"
        ],
        "location": "go.mod",
        "name": "github.com/pmezard/go-difflib",
        "purl": "pkg:golang/github.com/pmezard/go-difflib@v1.0.1-0.20181226105442-5d4384ee4fb2",
        "version": "v1.0.1-0.20181226105442-5d4384ee4fb2"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/posthog/posthog-go",
        "purl": "pkg:golang/github.com/posthog/posthog-go@v1.10.0",
        "version": "v1.10.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/pquerna/cachecontrol",
        "purl": "pkg:golang/github.com/pquerna/cachecontrol@v0.2.0",
        "version": "v0.2.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/prometheus/client_golang",
        "purl": "pkg:golang/github.com/prometheus/client_golang@v1.23.2",
        "version": "v1.23.2"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/prometheus/client_model",
        "purl": "pkg:golang/github.com/prometheus/client_model@v0.6.2",
        "version": "v0.6.2"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/prometheus/common",
        "purl": "pkg:golang/github.com/prometheus/common@v0.66.1",
        "version": "v0.66.1"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/prometheus/procfs",
        "purl": "pkg:golang/github.com/prometheus/procfs@v0.17.0",
        "version": "v0.17.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/quic-go/qpack",
        "purl": "pkg:golang/github.com/quic-go/qpack@v0.6.0",
        "version": "v0.6.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/quic-go/quic-go",
        "purl": "pkg:golang/github.com/quic-go/quic-go@v0.59.0",
        "version": "v0.59.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/rcrowley/go-metrics",
        "purl": "pkg:golang/github.com/rcrowley/go-metrics@v0.0.0-20250401214520-65e299d6c5c9",
        "version": "v0.0.0-20250401214520-65e299d6c5c9"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/remyoudompheng/bigfft",
        "purl": "pkg:golang/github.com/remyoudompheng/bigfft@v0.0.0-20230129092748-24d4a6f8daec",
        "version": "v0.0.0-20230129092748-24d4a6f8daec"
      },
      {
        "ecosystem": "golang",
        "licenses": [
          "MIT"
        ],
        "location": "go.mod",
        "name": "github.com/rivo/uniseg",
        "purl": "pkg:golang/github.com/rivo/uniseg@v0.4.7",
        "version": "v0.4.7"
      },
      {
        "ecosystem": "golang",
        "licenses": [
          "BSD-3-Clause"
        ],
        "location": "go.mod",
        "name": "github.com/rogpeppe/go-internal",
        "purl": "pkg:golang/github.com/rogpeppe/go-internal@v1.14.1",
        "version": "v1.14.1"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/russross/blackfriday/v2",
        "purl": "pkg:golang/github.com/russross/blackfriday/v2@v2.1.0",
        "version": "v2.1.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/rust-secure-code/go-rustaudit",
        "purl": "pkg:golang/github.com/rust-secure-code/go-rustaudit@v0.0.0-20250226111315-e20ec32e963c",
        "version": "v0.0.0-20250226111315-e20ec32e963c"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/safedep/code",
        "purl": "pkg:golang/github.com/safedep/code@v0.0.0-20260224174612-abe896956bc1",
        "version": "v0.0.0-20260224174612-abe896956bc1"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/safedep/dry",
        "purl": "pkg:golang/github.com/safedep/dry@v0.0.0-20260430094716-037c59666d04",
        "version": "v0.0.0-20260430094716-037c59666d04"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/saferwall/pe",
        "purl": "pkg:golang/github.com/saferwall/pe@v1.5.9",
        "version": "v1.5.9"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/sagikazarmark/locafero",
        "purl": "pkg:golang/github.com/sagikazarmark/locafero@v0.12.0",
        "version": "v0.12.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/saintfish/chardet",
        "purl": "pkg:golang/github.com/saintfish/chardet@v0.0.0-20230101081208-5e3ef4b5456d",
        "version": "v0.0.0-20230101081208-5e3ef4b5456d"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/santhosh-tekuri/jsonschema/v6",
        "purl": "pkg:golang/github.com/santhosh-tekuri/jsonschema/v6@v6.0.2",
        "version": "v6.0.2"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/schollz/closestmatch",
        "purl": "pkg:golang/github.com/schollz/closestmatch@v2.1.0%2Bincompatible",
        "version": "v2.1.0+incompatible"
      },
      {
        "ecosystem": "golang",
        "licenses": [
          "MIT"
        ],
        "location": "go.mod",
        "name": "github.com/schollz/progressbar/v3",
        "purl": "pkg:golang/github.com/schollz/progressbar/v3@v3.18.0",
        "version": "v3.18.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/scylladb/go-set",
        "purl": "pkg:golang/github.com/scylladb/go-set@v1.0.3-0.20200225121959-cc7b2070d91e",
        "version": "v1.0.3-0.20200225121959-cc7b2070d91e"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/shirou/gopsutil",
        "purl": "pkg:golang/github.com/shirou/gopsutil@v3.21.11%2Bincompatible",
        "version": "v3.21.11+incompatible"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/Shopify/goreferrer",
        "purl": "pkg:golang/github.com/Shopify/goreferrer@v0.0.0-20250617153402-88c1d9a79b05",
        "version": "v0.0.0-20250617153402-88c1d9a79b05"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/sirupsen/logrus",
        "purl": "pkg:golang/github.com/sirupsen/logrus@v1.9.4",
        "version": "v1.9.4"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/slongfield/pyfmt",
        "purl": "pkg:golang/github.com/slongfield/pyfmt@v0.0.0-20220222012616-ea85ff4c361f",
        "version": "v0.0.0-20220222012616-ea85ff4c361f"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/smacker/go-tree-sitter",
        "purl": "pkg:golang/github.com/smacker/go-tree-sitter@v0.0.0-20240827094217-dd81d9e9be82",
        "version": "v0.0.0-20240827094217-dd81d9e9be82"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/sony/gobreaker/v2",
        "purl": "pkg:golang/github.com/sony/gobreaker/v2@v2.4.0",
        "version": "v2.4.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/sorairolake/lzip-go",
        "purl": "pkg:golang/github.com/sorairolake/lzip-go@v0.3.8",
        "version": "v0.3.8"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/spdx/gordf",
        "purl": "pkg:golang/github.com/spdx/gordf@v0.0.0-20250128162952-000978ccd6fb",
        "version": "v0.0.0-20250128162952-000978ccd6fb"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/spdx/tools-golang",
        "purl": "pkg:golang/github.com/spdx/tools-golang@v0.5.7",
        "version": "v0.5.7"
      },
      {
        "ecosystem": "golang",
        "licenses": [
          "Apache-2.0"
        ],
        "location": "go.mod",
        "name": "github.com/spf13/afero",
        "purl": "pkg:golang/github.com/spf13/afero@v1.15.0",
        "version": "v1.15.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/spf13/cast",
        "purl": "pkg:golang/github.com/spf13/cast@v1.10.0",
        "version": "v1.10.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [
          "Apache-2.0"
        ],
        "location": "go.mod",
        "name": "github.com/spf13/cobra",
        "purl": "pkg:golang/github.com/spf13/cobra@v1.10.2",
        "version": "v1.10.2"
      },
      {
        "ecosystem": "golang",
        "licenses": [
          "BSD-3-Clause"
        ],
        "location": "go.mod",
        "name": "github.com/spf13/pflag",
        "purl": "pkg:golang/github.com/spf13/pflag@v1.0.10",
        "version": "v1.0.10"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/spf13/viper",
        "purl": "pkg:golang/github.com/spf13/viper@v1.21.0",
        "version": "v1.21.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/spiffe/go-spiffe/v2",
        "purl": "pkg:golang/github.com/spiffe/go-spiffe/v2@v2.7.0",
        "version": "v2.7.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/STARRY-S/zip",
        "purl": "pkg:golang/github.com/STARRY-S/zip@v0.2.3",
        "version": "v0.2.3"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/stretchr/objx",
        "purl": "pkg:golang/github.com/stretchr/objx@v0.5.3",
        "version": "v0.5.3"
      },
      {
        "ecosystem": "golang",
        "licenses": [
          "MIT"
        ],
        "location": "go.mod",
        "name": "github.com/stretchr/testify",
        "purl": "pkg:golang/github.com/stretchr/testify@v1.11.1",
        "version": "v1.11.1"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/subosito/gotenv",
        "purl": "pkg:golang/github.com/subosito/gotenv@v1.6.0",
        "version": "v1.6.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/sylabs/squashfs",
        "purl": "pkg:golang/github.com/sylabs/squashfs@v1.0.6",
        "version": "v1.0.6"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/tdewolff/minify/v2",
        "purl": "pkg:golang/github.com/tdewolff/minify/v2@v2.24.10",
        "version": "v2.24.10"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/tdewolff/parse/v2",
        "purl": "pkg:golang/github.com/tdewolff/parse/v2@v2.8.10",
        "version": "v2.8.10"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/therootcompany/xz",
        "purl": "pkg:golang/github.com/therootcompany/xz@v1.0.1",
        "version": "v1.0.1"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/thoas/go-funk",
        "purl": "pkg:golang/github.com/thoas/go-funk@v0.9.3",
        "version": "v0.9.3"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/tidwall/gjson",
        "purl": "pkg:golang/github.com/tidwall/gjson@v1.18.0",
        "version": "v1.18.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/tidwall/jsonc",
        "purl": "pkg:golang/github.com/tidwall/jsonc@v0.3.2",
        "version": "v0.3.2"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/tidwall/match",
        "purl": "pkg:golang/github.com/tidwall/match@v1.2.0",
        "version": "v1.2.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/tidwall/pretty",
        "purl": "pkg:golang/github.com/tidwall/pretty@v1.2.1",
        "version": "v1.2.1"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/tidwall/sjson",
        "purl": "pkg:golang/github.com/tidwall/sjson@v1.2.5",
        "version": "v1.2.5"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/tink-crypto/tink-go/v2",
        "purl": "pkg:golang/github.com/tink-crypto/tink-go/v2@v2.6.0",
        "version": "v2.6.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/tklauser/go-sysconf",
        "purl": "pkg:golang/github.com/tklauser/go-sysconf@v0.3.16",
        "version": "v0.3.16"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/tklauser/numcpus",
        "purl": "pkg:golang/github.com/tklauser/numcpus@v0.11.0",
        "version": "v0.11.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/tonistiigi/go-csvvalue",
        "purl": "pkg:golang/github.com/tonistiigi/go-csvvalue@v0.0.0-20240814133006-030d3b2625d0",
        "version": "v0.0.0-20240814133006-030d3b2625d0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/twitchyliquid64/golang-asm",
        "purl": "pkg:golang/github.com/twitchyliquid64/golang-asm@v0.15.1",
        "version": "v0.15.1"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/tylertreat/BoomFilters",
        "purl": "pkg:golang/github.com/tylertreat/BoomFilters@v0.0.0-20210315201527-1a82519a3e43",
        "version": "v0.0.0-20210315201527-1a82519a3e43"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/ugorji/go/codec",
        "purl": "pkg:golang/github.com/ugorji/go/codec@v1.3.1",
        "version": "v1.3.1"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/ulikunitz/xz",
        "purl": "pkg:golang/github.com/ulikunitz/xz@v0.5.15",
        "version": "v0.5.15"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/valyala/bytebufferpool",
        "purl": "pkg:golang/github.com/valyala/bytebufferpool@v1.0.0",
        "version": "v1.0.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/valyala/fasttemplate",
        "purl": "pkg:golang/github.com/valyala/fasttemplate@v1.2.2",
        "version": "v1.2.2"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/vbatts/tar-split",
        "purl": "pkg:golang/github.com/vbatts/tar-split@v0.12.2",
        "version": "v0.12.2"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/vifraa/gopom",
        "purl": "pkg:golang/github.com/vifraa/gopom@v1.0.0",
        "version": "v1.0.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/vmihailenco/msgpack/v5",
        "purl": "pkg:golang/github.com/vmihailenco/msgpack/v5@v5.4.1",
        "version": "v5.4.1"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/vmihailenco/tagparser/v2",
        "purl": "pkg:golang/github.com/vmihailenco/tagparser/v2@v2.0.0",
        "version": "v2.0.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/wagoodman/go-partybus",
        "purl": "pkg:golang/github.com/wagoodman/go-partybus@v0.0.0-20230516145632-8ccac152c651",
        "version": "v0.0.0-20230516145632-8ccac152c651"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/wagoodman/go-progress",
        "purl": "pkg:golang/github.com/wagoodman/go-progress@v0.0.0-20260303201901-10176f79b2c0",
        "version": "v0.0.0-20260303201901-10176f79b2c0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/wk8/go-ordered-map/v2",
        "purl": "pkg:golang/github.com/wk8/go-ordered-map/v2@v2.1.8",
        "version": "v2.1.8"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/xhit/go-str2duration/v2",
        "purl": "pkg:golang/github.com/xhit/go-str2duration/v2@v2.1.0",
        "version": "v2.1.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [
          "MIT"
        ],
        "location": "go.mod",
        "name": "github.com/xo/terminfo",
        "purl": "pkg:golang/github.com/xo/terminfo@v0.0.0-20220910002029-abceb7e1c41e",
        "version": "v0.0.0-20220910002029-abceb7e1c41e"
      },
      {
        "ecosystem": "golang",
        "licenses": [
          "BSD-3-Clause"
        ],
        "location": "go.mod",
        "name": "github.com/xyproto/randomstring",
        "purl": "pkg:golang/github.com/xyproto/randomstring@v1.0.5",
        "version": "v1.0.5"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/yargevad/filepathx",
        "purl": "pkg:golang/github.com/yargevad/filepathx@v1.0.0",
        "version": "v1.0.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/yosida95/uritemplate/v3",
        "purl": "pkg:golang/github.com/yosida95/uritemplate/v3@v3.0.2",
        "version": "v3.0.2"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/yosssi/ace",
        "purl": "pkg:golang/github.com/yosssi/ace@v0.0.5",
        "version": "v0.0.5"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/yuin/goldmark",
        "purl": "pkg:golang/github.com/yuin/goldmark@v1.7.16",
        "version": "v1.7.16"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/yuin/goldmark-emoji",
        "purl": "pkg:golang/github.com/yuin/goldmark-emoji@v1.0.6",
        "version": "v1.0.6"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/yusufpapurcu/wmi",
        "purl": "pkg:golang/github.com/yusufpapurcu/wmi@v1.2.4",
        "version": "v1.2.4"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/zalando/go-keyring",
        "purl": "pkg:golang/github.com/zalando/go-keyring@v0.2.6",
        "version": "v0.2.6"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/zclconf/go-cty",
        "purl": "pkg:golang/github.com/zclconf/go-cty@v1.18.0",
        "version": "v1.18.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/zclconf/go-cty-yaml",
        "purl": "pkg:golang/github.com/zclconf/go-cty-yaml@v1.2.0",
        "version": "v1.2.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "go.etcd.io/bbolt",
        "purl": "pkg:golang/go.etcd.io/bbolt@v1.4.3",
        "version": "v1.4.3"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "go.mongodb.org/mongo-driver/v2",
        "purl": "pkg:golang/go.mongodb.org/mongo-driver/v2@v2.5.0",
        "version": "v2.5.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "go.opencensus.io",
        "purl": "pkg:golang/go.opencensus.io@v0.24.0",
        "version": "v0.24.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "go.opentelemetry.io/auto/sdk",
        "purl": "pkg:golang/go.opentelemetry.io/auto/sdk@v1.2.1",
        "version": "v1.2.1"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "go.opentelemetry.io/contrib/detectors/gcp",
        "purl": "pkg:golang/go.opentelemetry.io/contrib/detectors/gcp@v1.44.0",
        "version": "v1.44.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc",
        "purl": "pkg:golang/go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc@v0.66.0",
        "version": "v0.66.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp",
        "purl": "pkg:golang/go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp@v0.66.0",
        "version": "v0.66.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "go.opentelemetry.io/otel",
        "purl": "pkg:golang/go.opentelemetry.io/otel@v1.45.0",
        "version": "v1.45.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "go.opentelemetry.io/otel/metric",
        "purl": "pkg:golang/go.opentelemetry.io/otel/metric@v1.45.0",
        "version": "v1.45.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "go.opentelemetry.io/otel/sdk",
        "purl": "pkg:golang/go.opentelemetry.io/otel/sdk@v1.45.0",
        "version": "v1.45.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "go.opentelemetry.io/otel/sdk/metric",
        "purl": "pkg:golang/go.opentelemetry.io/otel/sdk/metric@v1.45.0",
        "version": "v1.45.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "go.opentelemetry.io/otel/trace",
        "purl": "pkg:golang/go.opentelemetry.io/otel/trace@v1.45.0",
        "version": "v1.45.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "go.uber.org/multierr",
        "purl": "pkg:golang/go.uber.org/multierr@v1.11.0",
        "version": "v1.11.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "go.uber.org/zap",
        "purl": "pkg:golang/go.uber.org/zap@v1.27.1",
        "version": "v1.27.1"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "go.yaml.in/yaml/v2",
        "purl": "pkg:golang/go.yaml.in/yaml/v2@v2.4.3",
        "version": "v2.4.3"
      },
      {
        "ecosystem": "golang",
        "licenses": [
          "Apache-2.0",
          "MIT"
        ],
        "location": "go.mod",
        "name": "go.yaml.in/yaml/v3",
        "purl": "pkg:golang/go.yaml.in/yaml/v3@v3.0.4",
        "version": "v3.0.4"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "go.yaml.in/yaml/v4",
        "purl": "pkg:golang/go.yaml.in/yaml/v4@v4.0.0-rc.4",
        "version": "v4.0.0-rc.4"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "go4.org",
        "purl": "pkg:golang/go4.org@v0.0.0-20260112195520-a5071408f32f",
        "version": "v0.0.0-20260112195520-a5071408f32f"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "golang.org/x/arch",
        "purl": "pkg:golang/golang.org/x/arch@v0.24.0",
        "version": "v0.24.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "golang.org/x/crypto",
        "purl": "pkg:golang/golang.org/x/crypto@v0.55.0",
        "version": "v0.55.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [
          "BSD-3-Clause"
        ],
        "location": "go.mod",
        "name": "golang.org/x/exp",
        "purl": "pkg:golang/golang.org/x/exp@v0.0.0-20260410095643-746e56fc9e2f",
        "version": "v0.0.0-20260410095643-746e56fc9e2f"
      },
      {
        "ecosystem": "golang",
        "licenses": [
          "BSD-3-Clause"
        ],
        "location": "go.mod",
        "name": "golang.org/x/mod",
        "purl": "pkg:golang/golang.org/x/mod@v0.38.0",
        "version": "v0.38.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [
          "BSD-3-Clause"
        ],
        "location": "go.mod",
        "name": "golang.org/x/net",
        "purl": "pkg:golang/golang.org/x/net@v0.58.0",
        "version": "v0.58.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "golang.org/x/oauth2",
        "purl": "pkg:golang/golang.org/x/oauth2@v0.36.0",
        "version": "v0.36.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [
          "BSD-3-Clause"
        ],
        "location": "go.mod",
        "name": "golang.org/x/sync",
        "purl": "pkg:golang/golang.org/x/sync@v0.22.0",
        "version": "v0.22.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [
          "BSD-3-Clause"
        ],
        "location": "go.mod",
        "name": "golang.org/x/sys",
        "purl": "pkg:golang/golang.org/x/sys@v0.47.0",
        "version": "v0.47.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "golang.org/x/telemetry",
        "purl": "pkg:golang/golang.org/x/telemetry@v0.0.0-20260708182218-49f421fb7959",
        "version": "v0.0.0-20260708182218-49f421fb7959"
      },
      {
        "ecosystem": "golang",
        "licenses": [
          "BSD-3-Clause"
        ],
        "location": "go.mod",
        "name": "golang.org/x/term",
        "purl": "pkg:golang/golang.org/x/term@v0.45.0",
        "version": "v0.45.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [
          "BSD-3-Clause"
        ],
        "location": "go.mod",
        "name": "golang.org/x/text",
        "purl": "pkg:golang/golang.org/x/text@v0.41.0",
        "version": "v0.41.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "golang.org/x/time",
        "purl": "pkg:golang/golang.org/x/time@v0.14.0",
        "version": "v0.14.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [
          "BSD-3-Clause"
        ],
        "location": "go.mod",
        "name": "golang.org/x/tools",
        "purl": "pkg:golang/golang.org/x/tools@v0.48.0",
        "version": "v0.48.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "golang.org/x/vuln",
        "purl": "pkg:golang/golang.org/x/vuln@v1.1.4",
        "version": "v1.1.4"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "golang.org/x/xerrors",
        "purl": "pkg:golang/golang.org/x/xerrors@v0.0.0-20240903120638-7835f813f4da",
        "version": "v0.0.0-20240903120638-7835f813f4da"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "google.golang.org/api",
        "purl": "pkg:golang/google.golang.org/api@v0.269.0",
        "version": "v0.269.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "google.golang.org/genai",
        "purl": "pkg:golang/google.golang.org/genai@v1.48.0",
        "version": "v1.48.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "google.golang.org/genproto",
        "purl": "pkg:golang/google.golang.org/genproto@v0.0.0-20260226221140-a57be14db171",
        "version": "v0.0.0-20260226221140-a57be14db171"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "google.golang.org/genproto/googleapis/api",
        "purl": "pkg:golang/google.golang.org/genproto/googleapis/api@v0.0.0-20260526163538-3dc84a4a5aaa",
        "version": "v0.0.0-20260526163538-3dc84a4a5aaa"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "google.golang.org/genproto/googleapis/rpc",
        "purl": "pkg:golang/google.golang.org/genproto/googleapis/rpc@v0.0.0-20260526163538-3dc84a4a5aaa",
        "version": "v0.0.0-20260526163538-3dc84a4a5aaa"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "google.golang.org/grpc",
        "purl": "pkg:golang/google.golang.org/grpc@v1.83.2",
        "version": "v1.83.2"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "google.golang.org/protobuf",
        "purl": "pkg:golang/google.golang.org/protobuf@v1.36.12",
        "version": "v1.36.12"
      },
      {
        "ecosystem": "golang",
        "licenses": [
          "BSD-2-Clause"
        ],
        "location": "go.mod",
        "name": "gopkg.in/check.v1",
        "purl": "pkg:golang/gopkg.in/check.v1@v1.0.0-20201130134442-10cb98267c6c",
        "version": "v1.0.0-20201130134442-10cb98267c6c"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "gopkg.in/ini.v1",
        "purl": "pkg:golang/gopkg.in/ini.v1@v1.67.1",
        "version": "v1.67.1"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "gopkg.in/natefinch/lumberjack.v2",
        "purl": "pkg:golang/gopkg.in/natefinch/lumberjack.v2@v2.2.1",
        "version": "v2.2.1"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "gopkg.in/warnings.v0",
        "purl": "pkg:golang/gopkg.in/warnings.v0@v0.1.2",
        "version": "v0.1.2"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "gopkg.in/yaml.v2",
        "purl": "pkg:golang/gopkg.in/yaml.v2@v2.4.0",
        "version": "v2.4.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [
          "Apache-2.0",
          "MIT"
        ],
        "location": "go.mod",
        "name": "gopkg.in/yaml.v3",
        "purl": "pkg:golang/gopkg.in/yaml.v3@v3.0.1",
        "version": "v3.0.1"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "k8s.io/utils",
        "purl": "pkg:golang/k8s.io/utils@v0.0.0-20260210185600-b8788abfbbc2",
        "version": "v0.0.0-20260210185600-b8788abfbbc2"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "modernc.org/libc",
        "purl": "pkg:golang/modernc.org/libc@v1.70.0",
        "version": "v1.70.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "modernc.org/mathutil",
        "purl": "pkg:golang/modernc.org/mathutil@v1.7.1",
        "version": "v1.7.1"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "modernc.org/memory",
        "purl": "pkg:golang/modernc.org/memory@v1.11.0",
        "version": "v1.11.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "modernc.org/sqlite",
        "purl": "pkg:golang/modernc.org/sqlite@v1.48.1",
        "version": "v1.48.1"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "osv.dev/bindings/go",
        "purl": "pkg:golang/osv.dev/bindings/go@v0.0.0-20260304060910-4fcedbd3c18b",
        "version": "v0.0.0-20260304060910-4fcedbd3c18b"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "sigs.k8s.io/yaml",
        "purl": "pkg:golang/sigs.k8s.io/yaml@v1.6.0",
        "version": "v1.6.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "www.velocidex.com/golang/go-ntfs",
        "purl": "pkg:golang/www.velocidex.com/golang/go-ntfs@v0.2.0",
        "version": "v0.2.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "www.velocidex.com/golang/regparser",
        "purl": "pkg:golang/www.velocidex.com/golang/regparser@v0.0.0-20250203141505-31e704a67ef7",
        "version": "v0.0.0-20250203141505-31e704a67ef7"
      },
      {
        "ecosystem": "npm",
        "licenses": [],
        "location": "pnpm-lock.yaml",
        "name": "@babel/generator",
        "purl": "pkg:npm/%40babel/generator@8.0.0-rc.5",
        "version": "8.0.0-rc.5"
      },
      {
        "ecosystem": "npm",
        "licenses": [],
        "location": "pnpm-lock.yaml",
        "name": "@babel/helper-string-parser",
        "purl": "pkg:npm/%40babel/helper-string-parser@8.0.0-rc.6",
        "version": "8.0.0-rc.6"
      },
      {
        "ecosystem": "npm",
        "licenses": [],
        "location": "pnpm-lock.yaml",
        "name": "@babel/helper-validator-identifier",
        "purl": "pkg:npm/%40babel/helper-validator-identifier@8.0.0-rc.5",
        "version": "8.0.0-rc.5"
      },
      {
        "ecosystem": "npm",
        "licenses": [],
        "location": "pnpm-lock.yaml",
        "name": "@babel/helper-validator-identifier",
        "purl": "pkg:npm/%40babel/helper-validator-identifier@8.0.0-rc.6",
        "version": "8.0.0-rc.6"
      },
      {
        "ecosystem": "npm",
        "licenses": [],
        "location": "pnpm-lock.yaml",
        "name": "@babel/parser",
        "purl": "pkg:npm/%40babel/parser@8.0.0-rc.4",
        "version": "8.0.0-rc.4"
      },
      {
        "ecosystem": "npm",
        "licenses": [],
        "location": "pnpm-lock.yaml",
        "name": "@babel/parser",
        "purl": "pkg:npm/%40babel/parser@8.0.0-rc.6",
        "version": "8.0.0-rc.6"
      },
      {
        "ecosystem": "npm",
        "licenses": [],
        "location": "pnpm-lock.yaml",
        "name": "@babel/types",
        "purl": "pkg:npm/%40babel/types@8.0.0-rc.6",
        "version": "8.0.0-rc.6"
      },
      {
        "ecosystem": "npm",
        "licenses": [],
        "location": "pnpm-lock.yaml",
        "name": "@emnapi/core",
        "purl": "pkg:npm/%40emnapi/core@1.10.0",
        "version": "1.10.0"
      },
      {
        "ecosystem": "npm",
        "licenses": [],
        "location": "pnpm-lock.yaml",
        "name": "@emnapi/core",
        "purl": "pkg:npm/%40emnapi/core@1.4.5",
        "version": "1.4.5"
      },
      {
        "ecosystem": "npm",
        "licenses": [],
        "location": "pnpm-lock.yaml",
        "name": "@emnapi/runtime",
        "purl": "pkg:npm/%40emnapi/runtime@1.10.0",
        "version": "1.10.0"
      },
      {
        "ecosystem": "npm",
        "licenses": [],
        "location": "pnpm-lock.yaml",
        "name": "@emnapi/runtime",
        "purl": "pkg:npm/%40emnapi/runtime@1.4.5",
        "version": "1.4.5"
      },
      {
        "ecosystem": "npm",
        "licenses": [],
        "location": "pnpm-lock.yaml",
        "name": "@emnapi/wasi-threads",
        "purl": "pkg:npm/%40emnapi/wasi-threads@1.0.4",
        "version": "1.0.4"
      },
      {
        "ecosystem": "npm",
        "licenses": [],
        "location": "pnpm-lock.yaml",
        "name": "@emnapi/wasi-threads",
        "purl": "pkg:npm/%40emnapi/wasi-threads@1.2.1",
        "version": "1.2.1"
      },
      {
        "ecosystem": "npm",
        "licenses": [],
        "location": "pnpm-lock.yaml",
        "name": "@jest/diff-sequences",
        "purl": "pkg:npm/%40jest/diff-sequences@30.0.1",
        "version": "30.0.1"
      },
      {
        "ecosystem": "npm",
        "licenses": [],
        "location": "pnpm-lock.yaml",
        "name": "@jridgewell/gen-mapping",
        "purl": "pkg:npm/%40jridgewell/gen-mapping@0.3.13",
        "version": "0.3.13"
      },
      {
        "ecosystem": "npm",
        "licenses": [],
        "location": "pnpm-lock.yaml",
        "name": "@jridgewell/resolve-uri",
        "purl": "pkg:npm/%40jridgewell/resolve-uri@3.1.2",
        "version": "3.1.2"
      },
      {
        "ecosystem": "npm",
        "licenses": [],
        "location": "pnpm-lock.yaml",
        "name": "@jridgewell/sourcemap-codec",
        "purl": "pkg:npm/%40jridgewell/sourcemap-codec@1.5.5",
        "version": "1.5.5"
      },
      {
        "ecosystem": "npm",
        "licenses": [],
        "location": "pnpm-lock.yaml",
        "name": "@jridgewell/trace-mapping",
        "purl": "pkg:npm/%40jridgewell/trace-mapping@0.3.31",
        "version": "0.3.31"
      },
      {
        "ecosystem": "npm",
        "licenses": [],
        "location": "pnpm-lock.yaml",
        "name": "@napi-rs/wasm-runtime",
        "purl": "pkg:npm/%40napi-rs/wasm-runtime@0.2.4",
        "version": "0.2.4"
      },
      {
        "ecosystem": "npm",
        "licenses": [],
        "location": "pnpm-lock.yaml",
        "name": "@napi-rs/wasm-runtime",
        "purl": "pkg:npm/%40napi-rs/wasm-runtime@1.1.4",
        "version": "1.1.4"
      },
      {
        "ecosystem": "npm",
        "licenses": [],
        "location": "pnpm-lock.yaml",
        "name": "@nx/nx-darwin-arm64",
        "purl": "pkg:npm/%40nx/nx-darwin-arm64@23.1.1",
        "version": "23.1.1"
      },
      {
        "ecosystem": "npm",
        "licenses": [],
        "location": "pnpm-lock.yaml",
        "name": "@nx/nx-darwin-x64",
        "purl": "pkg:npm/%40nx/nx-darwin-x64@23.1.1",
        "version": "23.1.1"
      },
      {
        "ecosystem": "npm",
        "licenses": [],
        "location": "pnpm-lock.yaml",
        "name": "@nx/nx-freebsd-x64",
        "purl": "pkg:npm/%40nx/nx-freebsd-x64@23.1.1",
        "version": "23.1.1"
      },
      {
        "ecosystem": "npm",
        "licenses": [],
        "location": "pnpm-lock.yaml",
        "name": "@nx/nx-linux-arm-gnueabihf",
        "purl": "pkg:npm/%40nx/nx-linux-arm-gnueabihf@23.1.1",
        "version": "23.1.1"
      },
      {
        "ecosystem": "npm",
        "licenses": [],
        "location": "pnpm-lock.yaml",
        "name": "@nx/nx-linux-arm64-gnu",
        "purl": "pkg:npm/%40nx/nx-linux-arm64-gnu@23.1.1",
        "version": "23.1.1"
      },
      {
        "ecosystem": "npm",
        "licenses": [],
        "location": "pnpm-lock.yaml",
        "name": "@nx/nx-linux-arm64-musl",
        "purl": "pkg:npm/%40nx/nx-linux-arm64-musl@23.1.1",
        "version": "23.1.1"
      },
      {
        "ecosystem": "npm",
        "licenses": [],
        "location": "pnpm-lock.yaml",
        "name": "@nx/nx-linux-x64-gnu",
        "purl": "pkg:npm/%40nx/nx-linux-x64-gnu@23.1.1",
        "version": "23.1.1"
      },
      {
        "ecosystem": "npm",
        "licenses": [],
        "location": "pnpm-lock.yaml",
        "name": "@nx/nx-linux-x64-musl",
        "purl": "pkg:npm/%40nx/nx-linux-x64-musl@23.1.1",
        "version": "23.1.1"
      },
      {
        "ecosystem": "npm",
        "licenses": [],
        "location": "pnpm-lock.yaml",
        "name": "@nx/nx-win32-arm64-msvc",
        "purl": "pkg:npm/%40nx/nx-win32-arm64-msvc@23.1.1",
        "version": "23.1.1"
      },
      {
        "ecosystem": "npm",
        "licenses": [],
        "location": "pnpm-lock.yaml",
        "name": "@nx/nx-win32-x64-msvc",
        "purl": "pkg:npm/%40nx/nx-win32-x64-msvc@23.1.1",
        "version": "23.1.1"
      },
      {
        "ecosystem": "npm",
        "licenses": [],
        "location": "pnpm-lock.yaml",
        "name": "@oxc-project/types",
        "purl": "pkg:npm/%40oxc-project/types@0.133.0",
        "version": "0.133.0"
      },
      {
        "ecosystem": "npm",
        "licenses": [],
        "location": "pnpm-lock.yaml",
        "name": "@quansync/fs",
        "purl": "pkg:npm/%40quansync/fs@1.0.0",
        "version": "1.0.0"
      },
      {
        "ecosystem": "npm",
        "licenses": [],
        "location": "pnpm-lock.yaml",
        "name": "@rolldown/binding-android-arm64",
        "purl": "pkg:npm/%40rolldown/binding-android-arm64@1.0.3",
        "version": "1.0.3"
      },
      {
        "ecosystem": "npm",
        "licenses": [],
        "location": "pnpm-lock.yaml",
        "name": "@rolldown/binding-darwin-arm64",
        "purl": "pkg:npm/%40rolldown/binding-darwin-arm64@1.0.3",
        "version": "1.0.3"
      },
      {
        "ecosystem": "npm",
        "licenses": [],
        "location": "pnpm-lock.yaml",
        "name": "@rolldown/binding-darwin-x64",
        "purl": "pkg:npm/%40rolldown/binding-darwin-x64@1.0.3",
        "version": "1.0.3"
      },
      {
        "ecosystem": "npm",
        "licenses": [],
        "location": "pnpm-lock.yaml",
        "name": "@rolldown/binding-freebsd-x64",
        "purl": "pkg:npm/%40rolldown/binding-freebsd-x64@1.0.3",
        "version": "1.0.3"
      },
      {
        "ecosystem": "npm",
        "licenses": [],
        "location": "pnpm-lock.yaml",
        "name": "@rolldown/binding-linux-arm-gnueabihf",
        "purl": "pkg:npm/%40rolldown/binding-linux-arm-gnueabihf@1.0.3",
        "version": "1.0.3"
      },
      {
        "ecosystem": "npm",
        "licenses": [],
        "location": "pnpm-lock.yaml",
        "name": "@rolldown/binding-linux-arm64-gnu",
        "purl": "pkg:npm/%40rolldown/binding-linux-arm64-gnu@1.0.3",
        "version": "1.0.3"
      },
      {
        "ecosystem": "npm",
        "licenses": [],
        "location": "pnpm-lock.yaml",
        "name": "@rolldown/binding-linux-arm64-musl",
        "purl": "pkg:npm/%40rolldown/binding-linux-arm64-musl@1.0.3",
        "version": "1.0.3"
      },
      {
        "ecosystem": "npm",
        "licenses": [],
        "location": "pnpm-lock.yaml",
        "name": "@rolldown/binding-linux-ppc64-gnu",
        "purl": "pkg:npm/%40rolldown/binding-linux-ppc64-gnu@1.0.3",
        "version": "1.0.3"
      },
      {
        "ecosystem": "npm",
        "licenses": [],
        "location": "pnpm-lock.yaml",
        "name": "@rolldown/binding-linux-s390x-gnu",
        "purl": "pkg:npm/%40rolldown/binding-linux-s390x-gnu@1.0.3",
        "version": "1.0.3"
      },
      {
        "ecosystem": "npm",
        "licenses": [],
        "location": "pnpm-lock.yaml",
        "name": "@rolldown/binding-linux-x64-gnu",
        "purl": "pkg:npm/%40rolldown/binding-linux-x64-gnu@1.0.3",
        "version": "1.0.3"
      },
      {
        "ecosystem": "npm",
        "licenses": [],
        "location": "pnpm-lock.yaml",
        "name": "@rolldown/binding-linux-x64-musl",
        "purl": "pkg:npm/%40rolldown/binding-linux-x64-musl@1.0.3",
        "version": "1.0.3"
      },
      {
        "ecosystem": "npm",
        "licenses": [],
        "location": "pnpm-lock.yaml",
        "name": "@rolldown/binding-openharmony-arm64",
        "purl": "pkg:npm/%40rolldown/binding-openharmony-arm64@1.0.3",
        "version": "1.0.3"
      },
      {
        "ecosystem": "npm",
        "licenses": [],
        "location": "pnpm-lock.yaml",
        "name": "@rolldown/binding-wasm32-wasi",
        "purl": "pkg:npm/%40rolldown/binding-wasm32-wasi@1.0.3",
        "version": "1.0.3"
      },
      {
        "ecosystem": "npm",
        "licenses": [],
        "location": "pnpm-lock.yaml",
        "name": "@rolldown/binding-win32-arm64-msvc",
        "purl": "pkg:npm/%40rolldown/binding-win32-arm64-msvc@1.0.3",
        "version": "1.0.3"
      },
      {
        "ecosystem": "npm",
        "licenses": [],
        "location": "pnpm-lock.yaml",
        "name": "@rolldown/binding-win32-x64-msvc",
        "purl": "pkg:npm/%40rolldown/binding-win32-x64-msvc@1.0.3",
        "version": "1.0.3"
      },
      {
        "ecosystem": "npm",
        "licenses": [],
        "location": "pnpm-lock.yaml",
        "name": "@rolldown/pluginutils",
        "purl": "pkg:npm/%40rolldown/pluginutils@1.0.1",
        "version": "1.0.1"
      },
      {
        "ecosystem": "npm",
        "licenses": [],
        "location": "pnpm-lock.yaml",
        "name": "@tybys/wasm-util",
        "purl": "pkg:npm/%40tybys/wasm-util@0.10.2",
        "version": "0.10.2"
      },
      {
        "ecosystem": "npm",
        "licenses": [],
        "location": "pnpm-lock.yaml",
        "name": "@tybys/wasm-util",
        "purl": "pkg:npm/%40tybys/wasm-util@0.9.0",
        "version": "0.9.0"
      },
      {
        "ecosystem": "npm",
        "licenses": [],
        "location": "pnpm-lock.yaml",
        "name": "@types/estree",
        "purl": "pkg:npm/%40types/estree@1.0.9",
        "version": "1.0.9"
      },
      {
        "ecosystem": "npm",
        "licenses": [],
        "location": "pnpm-lock.yaml",
        "name": "@types/jsesc",
        "purl": "pkg:npm/%40types/jsesc@2.5.1",
        "version": "2.5.1"
      },
      {
        "ecosystem": "npm",
        "licenses": [],
        "location": "pnpm-lock.yaml",
        "name": "@types/node",
        "purl": "pkg:npm/%40types/node@20.19.41",
        "version": "20.19.41"
      },
      {
        "ecosystem": "npm",
        "licenses": [],
        "location": "pnpm-lock.yaml",
        "name": "@types/node",
        "purl": "pkg:npm/%40types/node@25.9.1",
        "version": "25.9.1"
      },
      {
        "ecosystem": "npm",
        "licenses": [],
        "location": "pnpm-lock.yaml",
        "name": "@yarnpkg/lockfile",
        "purl": "pkg:npm/%40yarnpkg/lockfile@1.1.0",
        "version": "1.1.0"
      },
      {
        "ecosystem": "npm",
        "licenses": [],
        "location": "pnpm-lock.yaml",
        "name": "@zkochan/js-yaml",
        "purl": "pkg:npm/%40zkochan/js-yaml@0.0.7",
        "version": "0.0.7"
      },
      {
        "ecosystem": "npm",
        "licenses": [],
        "location": "pnpm-lock.yaml",
        "name": "agent-base",
        "purl": "pkg:npm/agent-base@6.0.2",
        "version": "6.0.2"
      },
      {
        "ecosystem": "npm",
        "licenses": [],
        "location": "pnpm-lock.yaml",
        "name": "ansi-colors",
        "purl": "pkg:npm/ansi-colors@4.1.3",
        "version": "4.1.3"
      },
      {
        "ecosystem": "npm",
        "licenses": [],
        "location": "pnpm-lock.yaml",
        "name": "ansi-regex",
        "purl": "pkg:npm/ansi-regex@5.0.1",
        "version": "5.0.1"
      },
      {
        "ecosystem": "npm",
        "licenses": [],
        "location": "pnpm-lock.yaml",
        "name": "ansi-styles",
        "purl": "pkg:npm/ansi-styles@4.3.0",
        "version": "4.3.0"
      },
      {
        "ecosystem": "npm",
        "licenses": [],
        "location": "pnpm-lock.yaml",
        "name": "ansis",
        "purl": "pkg:npm/ansis@4.3.0",
        "version": "4.3.0"
      },
      {
        "ecosystem": "npm",
        "licenses": [],
        "location": "pnpm-lock.yaml",
        "name": "argparse",
        "purl": "pkg:npm/argparse@2.0.1",
        "version": "2.0.1"
      },
      {
        "ecosystem": "npm",
        "licenses": [],
        "location": "pnpm-lock.yaml",
        "name": "ast-kit",
        "purl": "pkg:npm/ast-kit@3.0.0-beta.1",
        "version": "3.0.0-beta.1"
      },
      {
        "ecosystem": "npm",
        "licenses": [],
        "location": "pnpm-lock.yaml",
        "name": "asynckit",
        "purl": "pkg:npm/asynckit@0.4.0",
        "version": "0.4.0"
      },
      {
        "ecosystem": "npm",
        "licenses": [],
        "location": "pnpm-lock.yaml",
        "name": "axios",
        "purl": "pkg:npm/axios@1.18.1",
        "version": "1.18.1"
      },
      {
        "ecosystem": "npm",
        "licenses": [],
        "location": "pnpm-lock.yaml",
        "name": "balanced-match",
        "purl": "pkg:npm/balanced-match@4.0.3",
        "version": "4.0.3"
      },
      {
        "ecosystem": "npm",
        "licenses": [],
        "location": "pnpm-lock.yaml",
        "name": "base64-js",
        "purl": "pkg:npm/base64-js@1.5.1",
        "version": "1.5.1"
      },
      {
        "ecosystem": "npm",
        "licenses": [],
        "location": "pnpm-lock.yaml",
        "name": "birpc",
        "purl": "pkg:npm/birpc@4.0.0",
        "version": "4.0.0"
      },
      {
        "ecosystem": "npm",
        "licenses": [],
        "location": "pnpm-lock.yaml",
        "name": "bl",
        "purl": "pkg:npm/bl@4.1.0",
        "version": "4.1.0"
      },
      {
        "ecosystem": "npm",
        "licenses": [],
        "location": "pnpm-lock.yaml",
        "name": "brace-expansion",
        "purl": "pkg:npm/brace-expansion@5.0.9",
        "version": "5.0.9"
      },
      {
        "ecosystem": "npm",
        "licenses": [],
        "location": "pnpm-lock.yaml",
        "name": "buffer",
        "purl": "pkg:npm/buffer@5.7.1",
        "version": "5.7.1"
      },
      {
        "ecosystem": "npm",
        "licenses": [],
        "location": "pnpm-lock.yaml",
        "name": "bundle-name",
        "purl": "pkg:npm/bundle-name@4.1.0",
        "version": "4.1.0"
      },
      {
        "ecosystem": "npm",
        "licenses": [],
        "location": "pnpm-lock.yaml",
        "name": "cac",
        "purl": "pkg:npm/cac@7.0.0",
        "version": "7.0.0"
      },
      {
        "ecosystem": "npm",
        "licenses": [],
        "location": "pnpm-lock.yaml",
        "name": "call-bind-apply-helpers",
        "purl": "pkg:npm/call-bind-apply-helpers@1.0.2",
        "version": "1.0.2"
      },
      {
        "ecosystem": "npm",
        "licenses": [],
        "location": "pnpm-lock.yaml",
        "name": "chalk",
        "purl": "pkg:npm/chalk@4.1.2",
        "version": "4.1.2"
      },
      {
        "ecosystem": "npm",
        "licenses": [],
        "location": "pnpm-lock.yaml",
        "name": "cli-cursor",
        "purl": "pkg:npm/cli-cursor@3.1.0",
        "version": "3.1.0"
      },
      {
        "ecosystem": "npm",
        "licenses": [],
        "location": "pnpm-lock.yaml",
        "name": "cli-spinners",
        "purl": "pkg:npm/cli-spinners@2.6.1",
        "version": "2.6.1"
      },
      {
        "ecosystem": "npm",
        "licenses": [],
        "location": "pnpm-lock.yaml",
        "name": "cliui",
        "purl": "pkg:npm/cliui@8.0.1",
        "version": "8.0.1"
      },
      {
        "ecosystem": "npm",
        "licenses": [],
        "location": "pnpm-lock.yaml",
        "name": "clone",
        "purl": "pkg:npm/clone@1.0.4",
        "version": "1.0.4"
      },
      {
        "ecosystem": "npm",
        "licenses": [],
        "location": "pnpm-lock.yaml",
        "name": "color-convert",
        "purl": "pkg:npm/color-convert@2.0.1",
        "version": "2.0.1"
      },
      {
        "ecosystem": "npm",
        "licenses": [],
        "location": "pnpm-lock.yaml",
        "name": "color-name",
        "purl": "pkg:npm/color-name@1.1.4",
        "version": "1.1.4"
      },
      {
        "ecosystem": "npm",
        "licenses": [],
        "location": "pnpm-lock.yaml",
        "name": "combined-stream",
        "purl": "pkg:npm/combined-stream@1.0.8",
        "version": "1.0.8"
      },
      {
        "ecosystem": "npm",
        "licenses": [],
        "location": "pnpm-lock.yaml",
        "name": "debug",
        "purl": "pkg:npm/debug@4.4.3",
        "version": "4.4.3"
      },
      {
        "ecosystem": "npm",
        "licenses": [],
        "location": "pnpm-lock.yaml",
        "name": "default-browser",
        "purl": "pkg:npm/default-browser@5.2.1",
        "version": "5.2.1"
      },
      {
        "ecosystem": "npm",
        "licenses": [],
        "location": "pnpm-lock.yaml",
        "name": "default-browser-id",
        "purl": "pkg:npm/default-browser-id@5.0.0",
        "version": "5.0.0"
      },
      {
        "ecosystem": "npm",
        "licenses": [],
        "location": "pnpm-lock.yaml",
        "name": "defaults",
        "purl": "pkg:npm/defaults@1.0.4",
        "version": "1.0.4"
      },
      {
        "ecosystem": "npm",
        "licenses": [],
        "location": "pnpm-lock.yaml",
        "name": "define-lazy-prop",
        "purl": "pkg:npm/define-lazy-prop@3.0.0",
        "version": "3.0.0"
      },
      {
        "ecosystem": "npm",
        "licenses": [],
        "location": "pnpm-lock.yaml",
        "name": "defu",
        "purl": "pkg:npm/defu@6.1.7",
        "version": "6.1.7"
      },
      {
        "ecosystem": "npm",
        "licenses": [],
        "location": "pnpm-lock.yaml",
        "name": "delayed-stream",
        "purl": "pkg:npm/delayed-stream@1.0.0",
        "version": "1.0.0"
      },
      {
        "ecosystem": "npm",
        "licenses": [],
        "location": "pnpm-lock.yaml",
        "name": "dotenv",
        "purl": "pkg:npm/dotenv@16.4.7",
        "version": "16.4.7"
      },
      {
        "ecosystem": "npm",
        "licenses": [],
        "location": "pnpm-lock.yaml",
        "name": "dotenv-expand",
        "purl": "pkg:npm/dotenv-expand@12.0.3",
        "version": "12.0.3"
      },
      {
        "ecosystem": "npm",
        "licenses": [],
        "location": "pnpm-lock.yaml",
        "name": "dts-resolver",
        "purl": "pkg:npm/dts-resolver@3.0.0",
        "version": "3.0.0"
      },
      {
        "ecosystem": "npm",
        "licenses": [],
        "location": "pnpm-lock.yaml",
        "name": "dunder-proto",
        "purl": "pkg:npm/dunder-proto@1.0.1",
        "version": "1.0.1"
      },
      {
        "ecosystem": "npm",
        "licenses": [],
        "location": "pnpm-lock.yaml",
        "name": "ejs",
        "purl": "pkg:npm/ejs@5.0.1",
        "version": "5.0.1"
      },
      {
        "ecosystem": "npm",
        "licenses": [],
        "location": "pnpm-lock.yaml",
        "name": "emoji-regex",
        "purl": "pkg:npm/emoji-regex@8.0.0",
        "version": "8.0.0"
      },
      {
        "ecosystem": "npm",
        "licenses": [],
        "location": "pnpm-lock.yaml",
        "name": "empathic",
        "purl": "pkg:npm/empathic@2.0.1",
        "version": "2.0.1"
      },
      {
        "ecosystem": "npm",
        "licenses": [],
        "location": "pnpm-lock.yaml",
        "name": "end-of-stream",
        "purl": "pkg:npm/end-of-stream@1.4.5",
        "version": "1.4.5"
      },
      {
        "ecosystem": "npm",
        "licenses": [],
        "location": "pnpm-lock.yaml",
        "name": "enquirer",
        "purl": "pkg:npm/enquirer@2.3.6",
        "version": "2.3.6"
      },
      {
        "ecosystem": "npm",
        "licenses": [],
        "location": "pnpm-lock.yaml",
        "name": "es-define-property",
        "purl": "pkg:npm/es-define-property@1.0.1",
        "version": "1.0.1"
      },
      {
        "ecosystem": "npm",
        "licenses": [],
        "location": "pnpm-lock.yaml",
        "name": "es-errors",
        "purl": "pkg:npm/es-errors@1.3.0",
        "version": "1.3.0"
      },
      {
        "ecosystem": "npm",
        "licenses": [],
        "location": "pnpm-lock.yaml",
        "name": "es-object-atoms",
        "purl": "pkg:npm/es-object-atoms@1.1.1",
        "version": "1.1.1"
      },
      {
        "ecosystem": "npm",
        "licenses": [],
        "location": "pnpm-lock.yaml",
        "name": "es-set-tostringtag",
        "purl": "pkg:npm/es-set-tostringtag@2.1.0",
        "version": "2.1.0"
      },
      {
        "ecosystem": "npm",
        "licenses": [],
        "location": "pnpm-lock.yaml",
        "name": "escalade",
        "purl": "pkg:npm/escalade@3.2.0",
        "version": "3.2.0"
      },
      {
        "ecosystem": "npm",
        "licenses": [],
        "location": "pnpm-lock.yaml",
        "name": "escape-string-regexp",
        "purl": "pkg:npm/escape-string-regexp@1.0.5",
        "version": "1.0.5"
      },
      {
        "ecosystem": "npm",
        "licenses": [],
        "location": "pnpm-lock.yaml",
        "name": "estree-walker",
        "purl": "pkg:npm/estree-walker@3.0.3",
        "version": "3.0.3"
      },
      {
        "ecosystem": "npm",
        "licenses": [],
        "location": "pnpm-lock.yaml",
        "name": "fdir",
        "purl": "pkg:npm/fdir@6.5.0",
        "version": "6.5.0"
      },
      {
        "ecosystem": "npm",
        "licenses": [],
        "location": "pnpm-lock.yaml",
        "name": "figures",
        "purl": "pkg:npm/figures@3.2.0",
        "version": "3.2.0"
      },
      {
        "ecosystem": "npm",
        "licenses": [],
        "location": "pnpm-lock.yaml",
        "name": "flat",
        "purl": "pkg:npm/flat@5.0.2",
        "version": "5.0.2"
      },
      {
        "ecosystem": "npm",
        "licenses": [],
        "location": "pnpm-lock.yaml",
        "name": "follow-redirects",
        "purl": "pkg:npm/follow-redirects@1.16.0",
        "version": "1.16.0"
      },
      {
        "ecosystem": "npm",
        "licenses": [],
        "location": "pnpm-lock.yaml",
        "name": "form-data",
        "purl": "pkg:npm/form-data@4.0.6",
        "version": "4.0.6"
      },
      {
        "ecosystem": "npm",
        "licenses": [],
        "location": "pnpm-lock.yaml",
        "name": "fs-constants",
        "purl": "pkg:npm/fs-constants@1.0.0",
        "version": "1.0.0"
      },
      {
        "ecosystem": "npm",
        "licenses": [],
        "location": "pnpm-lock.yaml",
        "name": "function-bind",
        "purl": "pkg:npm/function-bind@1.1.2",
        "version": "1.1.2"
      },
      {
        "ecosystem": "npm",
        "licenses": [],
        "location": "pnpm-lock.yaml",
        "name": "get-caller-file",
        "purl": "pkg:npm/get-caller-file@2.0.5",
        "version": "2.0.5"
      },
      {
        "ecosystem": "npm",
        "licenses": [],
        "location": "pnpm-lock.yaml",
        "name": "get-intrinsic",
        "purl": "pkg:npm/get-intrinsic@1.3.0",
        "version": "1.3.0"
      },
      {
        "ecosystem": "npm",
        "licenses": [],
        "location": "pnpm-lock.yaml",
        "name": "get-proto",
        "purl": "pkg:npm/get-proto@1.0.1",
        "version": "1.0.1"
      },
      {
        "ecosystem": "npm",
        "licenses": [],
        "location": "pnpm-lock.yaml",
        "name": "get-tsconfig",
        "purl": "pkg:npm/get-tsconfig@5.0.0-beta.5",
        "version": "5.0.0-beta.5"
      },
      {
        "ecosystem": "npm",
        "licenses": [],
        "location": "pnpm-lock.yaml",
        "name": "gopd",
        "purl": "pkg:npm/gopd@1.2.0",
        "version": "1.2.0"
      },
      {
        "ecosystem": "npm",
        "licenses": [],
        "location": "pnpm-lock.yaml",
        "name": "has-flag",
        "purl": "pkg:npm/has-flag@4.0.0",
        "version": "4.0.0"
      },
      {
        "ecosystem": "npm",
        "licenses": [],
        "location": "pnpm-lock.yaml",
        "name": "has-symbols",
        "purl": "pkg:npm/has-symbols@1.1.0",
        "version": "1.1.0"
      },
      {
        "ecosystem": "npm",
        "licenses": [],
        "location": "pnpm-lock.yaml",
        "name": "has-tostringtag",
        "purl": "pkg:npm/has-tostringtag@1.0.2",
        "version": "1.0.2"
      },
      {
        "ecosystem": "npm",
        "licenses": [],
        "location": "pnpm-lock.yaml",
        "name": "hasown",
        "purl": "pkg:npm/hasown@2.0.2",
        "version": "2.0.2"
      },
      {
        "ecosystem": "npm",
        "licenses": [],
        "location": "pnpm-lock.yaml",
        "name": "hasown",
        "purl": "pkg:npm/hasown@2.0.4",
        "version": "2.0.4"
      },
      {
        "ecosystem": "npm",
        "licenses": [],
        "location": "pnpm-lock.yaml",
        "name": "hookable",
        "purl": "pkg:npm/hookable@6.1.1",
        "version": "6.1.1"
      },
      {
        "ecosystem": "npm",
        "licenses": [],
        "location": "pnpm-lock.yaml",
        "name": "https-proxy-agent",
        "purl": "pkg:npm/https-proxy-agent@5.0.1",
        "version": "5.0.1"
      },
      {
        "ecosystem": "npm",
        "licenses": [],
        "location": "pnpm-lock.yaml",
        "name": "ieee754",
        "purl": "pkg:npm/ieee754@1.2.1",
        "version": "1.2.1"
      },
      {
        "ecosystem": "npm",
        "licenses": [],
        "location": "pnpm-lock.yaml",
        "name": "ignore",
        "purl": "pkg:npm/ignore@7.0.5",
        "version": "7.0.5"
      },
      {
        "ecosystem": "npm",
        "licenses": [],
        "location": "pnpm-lock.yaml",
        "name": "import-without-cache",
        "purl": "pkg:npm/import-without-cache@0.4.0",
        "version": "0.4.0"
      },
      {
        "ecosystem": "npm",
        "licenses": [],
        "location": "pnpm-lock.yaml",
        "name": "inherits",
        "purl": "pkg:npm/inherits@2.0.4",
        "version": "2.0.4"
      },
      {
        "ecosystem": "npm",
        "licenses": [],
        "location": "pnpm-lock.yaml",
        "name": "is-docker",
        "purl": "pkg:npm/is-docker@3.0.0",
        "version": "3.0.0"
      },
      {
        "ecosystem": "npm",
        "licenses": [],
        "location": "pnpm-lock.yaml",
        "name": "is-fullwidth-code-point",
        "purl": "pkg:npm/is-fullwidth-code-point@3.0.0",
        "version": "3.0.0"
      },
      {
        "ecosystem": "npm",
        "licenses": [],
        "location": "pnpm-lock.yaml",
        "name": "is-inside-container",
        "purl": "pkg:npm/is-inside-container@1.0.0",
        "version": "1.0.0"
      },
      {
        "ecosystem": "npm",
        "licenses": [],
        "location": "pnpm-lock.yaml",
        "name": "is-interactive",
        "purl": "pkg:npm/is-interactive@1.0.0",
        "version": "1.0.0"
      },
      {
        "ecosystem": "npm",
        "licenses": [],
        "location": "pnpm-lock.yaml",
        "name": "is-unicode-supported",
        "purl": "pkg:npm/is-unicode-supported@0.1.0",
        "version": "0.1.0"
      },
      {
        "ecosystem": "npm",
        "licenses": [],
        "location": "pnpm-lock.yaml",
        "name": "is-wsl",
        "purl": "pkg:npm/is-wsl@3.1.0",
        "version": "3.1.0"
      },
      {
        "ecosystem": "npm",
        "licenses": [],
        "location": "pnpm-lock.yaml",
        "name": "isexe",
        "purl": "pkg:npm/isexe@2.0.0",
        "version": "2.0.0"
      },
      {
        "ecosystem": "npm",
        "licenses": [],
        "location": "pnpm-lock.yaml",
        "name": "jsesc",
        "purl": "pkg:npm/jsesc@3.1.0",
        "version": "3.1.0"
      },
      {
        "ecosystem": "npm",
        "licenses": [],
        "location": "pnpm-lock.yaml",
        "name": "json5",
        "purl": "pkg:npm/json5@2.2.3",
        "version": "2.2.3"
      },
      {
        "ecosystem": "npm",
        "licenses": [],
        "location": "pnpm-lock.yaml",
        "name": "jsonc-parser",
        "purl": "pkg:npm/jsonc-parser@3.3.1",
        "version": "3.3.1"
      },
      {
        "ecosystem": "npm",
        "licenses": [],
        "location": "pnpm-lock.yaml",
        "name": "lines-and-columns",
        "purl": "pkg:npm/lines-and-columns@2.0.3",
        "version": "2.0.3"
      },
      {
        "ecosystem": "npm",
        "licenses": [],
        "location": "pnpm-lock.yaml",
        "name": "log-symbols",
        "purl": "pkg:npm/log-symbols@4.1.0",
        "version": "4.1.0"
      },
      {
        "ecosystem": "npm",
        "licenses": [],
        "location": "pnpm-lock.yaml",
        "name": "math-intrinsics",
        "purl": "pkg:npm/math-intrinsics@1.1.0",
        "version": "1.1.0"
      },
      {
        "ecosystem": "npm",
        "licenses": [],
        "location": "pnpm-lock.yaml",
        "name": "mime-db",
        "purl": "pkg:npm/mime-db@1.52.0",
        "version": "1.52.0"
      },
      {
        "ecosystem": "npm",
        "licenses": [],
        "location": "pnpm-lock.yaml",
        "name": "mime-types",
        "purl": "pkg:npm/mime-types@2.1.35",
        "version": "2.1.35"
      },
      {
        "ecosystem": "npm",
        "licenses": [],
        "location": "pnpm-lock.yaml",
        "name": "mimic-fn",
        "purl": "pkg:npm/mimic-fn@2.1.0",
        "version": "2.1.0"
      },
      {
        "ecosystem": "npm",
        "licenses": [],
        "location": "pnpm-lock.yaml",
        "name": "minimatch",
        "purl": "pkg:npm/minimatch@10.2.5",
        "version": "10.2.5"
      },
      {
        "ecosystem": "npm",
        "licenses": [],
        "location": "pnpm-lock.yaml",
        "name": "minimist",
        "purl": "pkg:npm/minimist@1.2.8",
        "version": "1.2.8"
      },
      {
        "ecosystem": "npm",
        "licenses": [],
        "location": "pnpm-lock.yaml",
        "name": "ms",
        "purl": "pkg:npm/ms@2.1.3",
        "version": "2.1.3"
      },
      {
        "ecosystem": "npm",
        "licenses": [],
        "location": "pnpm-lock.yaml",
        "name": "npm-run-path",
        "purl": "pkg:npm/npm-run-path@4.0.1",
        "version": "4.0.1"
      },
      {
        "ecosystem": "npm",
        "licenses": [],
        "location": "pnpm-lock.yaml",
        "name": "nx",
        "purl": "pkg:npm/nx@23.1.1",
        "version": "23.1.1"
      },
      {
        "ecosystem": "npm",
        "licenses": [],
        "location": "pnpm-lock.yaml",
        "name": "obug",
        "purl": "pkg:npm/obug@2.1.1",
        "version": "2.1.1"
      },
      {
        "ecosystem": "npm",
        "licenses": [],
        "location": "pnpm-lock.yaml",
        "name": "once",
        "purl": "pkg:npm/once@1.4.0",
        "version": "1.4.0"
      },
      {
        "ecosystem": "npm",
        "licenses": [],
        "location": "pnpm-lock.yaml",
        "name": "onetime",
        "purl": "pkg:npm/onetime@5.1.2",
        "version": "5.1.2"
      },
      {
        "ecosystem": "npm",
        "licenses": [],
        "location": "pnpm-lock.yaml",
        "name": "open",
        "purl": "pkg:npm/open@10.1.0",
        "version": "10.1.0"
      },
      {
        "ecosystem": "npm",
        "licenses": [],
        "location": "pnpm-lock.yaml",
        "name": "ora",
        "purl": "pkg:npm/ora@5.4.1",
        "version": "5.4.1"
      },
      {
        "ecosystem": "npm",
        "licenses": [],
        "location": "pnpm-lock.yaml",
        "name": "path-key",
        "purl": "pkg:npm/path-key@3.1.1",
        "version": "3.1.1"
      },
      {
        "ecosystem": "npm",
        "licenses": [],
        "location": "pnpm-lock.yaml",
        "name": "pathe",
        "purl": "pkg:npm/pathe@2.0.3",
        "version": "2.0.3"
      },
      {
        "ecosystem": "npm",
        "licenses": [],
        "location": "pnpm-lock.yaml",
        "name": "picocolors",
        "purl": "pkg:npm/picocolors@1.1.1",
        "version": "1.1.1"
      },
      {
        "ecosystem": "npm",
        "licenses": [],
        "location": "pnpm-lock.yaml",
        "name": "picomatch",
        "purl": "pkg:npm/picomatch@4.0.4",
        "version": "4.0.4"
      },
      {
        "ecosystem": "npm",
        "licenses": [],
        "location": "pnpm-lock.yaml",
        "name": "proxy-from-env",
        "purl": "pkg:npm/proxy-from-env@2.1.0",
        "version": "2.1.0"
      },
      {
        "ecosystem": "npm",
        "licenses": [],
        "location": "pnpm-lock.yaml",
        "name": "quansync",
        "purl": "pkg:npm/quansync@1.0.0",
        "version": "1.0.0"
      },
      {
        "ecosystem": "npm",
        "licenses": [],
        "location": "pnpm-lock.yaml",
        "name": "readable-stream",
        "purl": "pkg:npm/readable-stream@3.6.2",
        "version": "3.6.2"
      },
      {
        "ecosystem": "npm",
        "licenses": [],
        "location": "pnpm-lock.yaml",
        "name": "require-directory",
        "purl": "pkg:npm/require-directory@2.1.1",
        "version": "2.1.1"
      },
      {
        "ecosystem": "npm",
        "licenses": [],
        "location": "pnpm-lock.yaml",
        "name": "resolve-pkg-maps",
        "purl": "pkg:npm/resolve-pkg-maps@1.0.0",
        "version": "1.0.0"
      },
      {
        "ecosystem": "npm",
        "licenses": [],
        "location": "pnpm-lock.yaml",
        "name": "resolve.exports",
        "purl": "pkg:npm/resolve.exports@2.0.3",
        "version": "2.0.3"
      },
      {
        "ecosystem": "npm",
        "licenses": [],
        "location": "pnpm-lock.yaml",
        "name": "restore-cursor",
        "purl": "pkg:npm/restore-cursor@3.1.0",
        "version": "3.1.0"
      },
      {
        "ecosystem": "npm",
        "licenses": [],
        "location": "pnpm-lock.yaml",
        "name": "rolldown",
        "purl": "pkg:npm/rolldown@1.0.3",
        "version": "1.0.3"
      },
      {
        "ecosystem": "npm",
        "licenses": [],
        "location": "pnpm-lock.yaml",
        "name": "rolldown-plugin-dts",
        "purl": "pkg:npm/rolldown-plugin-dts@0.25.1",
        "version": "0.25.1"
      },
      {
        "ecosystem": "npm",
        "licenses": [],
        "location": "pnpm-lock.yaml",
        "name": "run-applescript",
        "purl": "pkg:npm/run-applescript@7.0.0",
        "version": "7.0.0"
      },
      {
        "ecosystem": "npm",
        "licenses": [],
        "location": "pnpm-lock.yaml",
        "name": "safe-buffer",
        "purl": "pkg:npm/safe-buffer@5.2.1",
        "version": "5.2.1"
      },
      {
        "ecosystem": "npm",
        "licenses": [],
        "location": "pnpm-lock.yaml",
        "name": "semver",
        "purl": "pkg:npm/semver@7.8.1",
        "version": "7.8.1"
      },
      {
        "ecosystem": "npm",
        "licenses": [],
        "location": "pnpm-lock.yaml",
        "name": "semver",
        "purl": "pkg:npm/semver@7.8.4",
        "version": "7.8.4"
      },
      {
        "ecosystem": "npm",
        "licenses": [],
        "location": "pnpm-lock.yaml",
        "name": "signal-exit",
        "purl": "pkg:npm/signal-exit@3.0.7",
        "version": "3.0.7"
      },
      {
        "ecosystem": "npm",
        "licenses": [],
        "location": "pnpm-lock.yaml",
        "name": "smol-toml",
        "purl": "pkg:npm/smol-toml@1.6.1",
        "version": "1.6.1"
      },
      {
        "ecosystem": "npm",
        "licenses": [],
        "location": "pnpm-lock.yaml",
        "name": "string-width",
        "purl": "pkg:npm/string-width@4.2.3",
        "version": "4.2.3"
      },
      {
        "ecosystem": "npm",
        "licenses": [],
        "location": "pnpm-lock.yaml",
        "name": "string_decoder",
        "purl": "pkg:npm/string_decoder@1.3.0",
        "version": "1.3.0"
      },
      {
        "ecosystem": "npm",
        "licenses": [],
        "location": "pnpm-lock.yaml",
        "name": "strip-ansi",
        "purl": "pkg:npm/strip-ansi@6.0.1",
        "version": "6.0.1"
      },
      {
        "ecosystem": "npm",
        "licenses": [],
        "location": "pnpm-lock.yaml",
        "name": "strip-bom",
        "purl": "pkg:npm/strip-bom@3.0.0",
        "version": "3.0.0"
      },
      {
        "ecosystem": "npm",
        "licenses": [],
        "location": "pnpm-lock.yaml",
        "name": "supports-color",
        "purl": "pkg:npm/supports-color@7.2.0",
        "version": "7.2.0"
      },
      {
        "ecosystem": "npm",
        "licenses": [],
        "location": "pnpm-lock.yaml",
        "name": "tar-stream",
        "purl": "pkg:npm/tar-stream@2.2.0",
        "version": "2.2.0"
      },
      {
        "ecosystem": "npm",
        "licenses": [],
        "location": "pnpm-lock.yaml",
        "name": "tinyexec",
        "purl": "pkg:npm/tinyexec@1.2.3",
        "version": "1.2.3"
      },
      {
        "ecosystem": "npm",
        "licenses": [],
        "location": "pnpm-lock.yaml",
        "name": "tinyglobby",
        "purl": "pkg:npm/tinyglobby@0.2.16",
        "version": "0.2.16"
      },
      {
        "ecosystem": "npm",
        "licenses": [],
        "location": "pnpm-lock.yaml",
        "name": "tmp",
        "purl": "pkg:npm/tmp@0.2.7",
        "version": "0.2.7"
      },
      {
        "ecosystem": "npm",
        "licenses": [],
        "location": "pnpm-lock.yaml",
        "name": "tree-kill",
        "purl": "pkg:npm/tree-kill@1.2.2",
        "version": "1.2.2"
      },
      {
        "ecosystem": "npm",
        "licenses": [],
        "location": "pnpm-lock.yaml",
        "name": "tsconfig-paths",
        "purl": "pkg:npm/tsconfig-paths@4.2.0",
        "version": "4.2.0"
      },
      {
        "ecosystem": "npm",
        "licenses": [],
        "location": "pnpm-lock.yaml",
        "name": "tsdown",
        "purl": "pkg:npm/tsdown@0.22.0",
        "version": "0.22.0"
      },
      {
        "ecosystem": "npm",
        "licenses": [],
        "location": "pnpm-lock.yaml",
        "name": "tslib",
        "purl": "pkg:npm/tslib@2.8.1",
        "version": "2.8.1"
      },
      {
        "ecosystem": "npm",
        "licenses": [],
        "location": "pnpm-lock.yaml",
        "name": "typescript",
        "purl": "pkg:npm/typescript@6.0.3",
        "version": "6.0.3"
      },
      {
        "ecosystem": "npm",
        "licenses": [],
        "location": "pnpm-lock.yaml",
        "name": "unconfig-core",
        "purl": "pkg:npm/unconfig-core@7.5.0",
        "version": "7.5.0"
      },
      {
        "ecosystem": "npm",
        "licenses": [],
        "location": "pnpm-lock.yaml",
        "name": "undici-types",
        "purl": "pkg:npm/undici-types@6.21.0",
        "version": "6.21.0"
      },
      {
        "ecosystem": "npm",
        "licenses": [],
        "location": "pnpm-lock.yaml",
        "name": "undici-types",
        "purl": "pkg:npm/undici-types@7.24.6",
        "version": "7.24.6"
      },
      {
        "ecosystem": "npm",
        "licenses": [],
        "location": "pnpm-lock.yaml",
        "name": "unrun",
        "purl": "pkg:npm/unrun@0.3.1",
        "version": "0.3.1"
      },
      {
        "ecosystem": "npm",
        "licenses": [],
        "location": "pnpm-lock.yaml",
        "name": "util-deprecate",
        "purl": "pkg:npm/util-deprecate@1.0.2",
        "version": "1.0.2"
      },
      {
        "ecosystem": "npm",
        "licenses": [],
        "location": "pnpm-lock.yaml",
        "name": "wcwidth",
        "purl": "pkg:npm/wcwidth@1.0.1",
        "version": "1.0.1"
      },
      {
        "ecosystem": "npm",
        "licenses": [],
        "location": "pnpm-lock.yaml",
        "name": "which",
        "purl": "pkg:npm/which@3.0.1",
        "version": "3.0.1"
      },
      {
        "ecosystem": "npm",
        "licenses": [],
        "location": "pnpm-lock.yaml",
        "name": "wrap-ansi",
        "purl": "pkg:npm/wrap-ansi@7.0.0",
        "version": "7.0.0"
      },
      {
        "ecosystem": "npm",
        "licenses": [],
        "location": "pnpm-lock.yaml",
        "name": "wrappy",
        "purl": "pkg:npm/wrappy@1.0.2",
        "version": "1.0.2"
      },
      {
        "ecosystem": "npm",
        "licenses": [],
        "location": "pnpm-lock.yaml",
        "name": "y18n",
        "purl": "pkg:npm/y18n@5.0.8",
        "version": "5.0.8"
      },
      {
        "ecosystem": "npm",
        "licenses": [],
        "location": "pnpm-lock.yaml",
        "name": "yaml",
        "purl": "pkg:npm/yaml@2.9.0",
        "version": "2.9.0"
      },
      {
        "ecosystem": "npm",
        "licenses": [],
        "location": "pnpm-lock.yaml",
        "name": "yargs",
        "purl": "pkg:npm/yargs@17.7.2",
        "version": "17.7.2"
      },
      {
        "ecosystem": "npm",
        "licenses": [],
        "location": "pnpm-lock.yaml",
        "name": "yargs-parser",
        "purl": "pkg:npm/yargs-parser@21.1.1",
        "version": "21.1.1"
      }
    ],
    "description": "Enforce dependency policies and report supply-chain risks",
    "errors": [],
    "go_binary": {
      "asset": "vet_Linux_x86_64.tar.gz",
      "binary": "vet",
      "db": "https://vuln.go.dev",
      "db_last_modified": "2026-10-27T21:16:18Z",
      "findings": [
        {
          "aliases": [
            "CVE-2026-33814"
          ],
          "epss": {
            "cve": "CVE-2026-33814",
            "percentile": 0.57885,
            "score": 0.0084
          },
          "fixed_version": "v1.26.3",
          "id": "GO-2026-4918",
          "kev": null,
          "level": "symbol",
          "module": "stdlib",
          "summary": "Infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in net/http/internal/http2 in golang.org/x/net",
          "version": "v1.26.2"
        },
        {
          "aliases": [
            "CVE-2026-39822"
          ],
          "epss": {
            "cve": "CVE-2026-39822",
            "percentile": 0.14177,
            "score": 0.00232
          },
          "fixed_version": "v1.26.5",
          "id": "GO-2026-4970",
          "kev": null,
          "level": "symbol",
          "module": "stdlib",
          "summary": "Root escape via symlink plus trailing slash in os",
          "version": "v1.26.2"
        },
        {
          "aliases": [
            "CVE-2026-39836"
          ],
          "epss": {
            "cve": "CVE-2026-39836",
            "percentile": 0.50332,
            "score": 0.00633
          },
          "fixed_version": "v1.26.3",
          "id": "GO-2026-4971",
          "kev": null,
          "level": "symbol",
          "module": "stdlib",
          "summary": "Panic in Dial and LookupPort when handling NUL byte on Windows in net",
          "version": "v1.26.2"
        },
        {
          "aliases": [
            "CVE-2026-39825"
          ],
          "epss": {
            "cve": "CVE-2026-39825",
            "percentile": 0.33182,
            "score": 0.0039
          },
          "fixed_version": "v1.26.3",
          "id": "GO-2026-4976",
          "kev": null,
          "level": "symbol",
          "module": "stdlib",
          "summary": "ReverseProxy forwards queries with more than urlmaxqueryparams parameters in net/http/httputil",
          "version": "v1.26.2"
        },
        {
          "aliases": [
            "CVE-2026-42499"
          ],
          "epss": {
            "cve": "CVE-2026-42499",
            "percentile": 0.56521,
            "score": 0.00798
          },
          "fixed_version": "v1.26.3",
          "id": "GO-2026-4977",
          "kev": null,
          "level": "symbol",
          "module": "stdlib",
          "summary": "Quadratic string concatenation in consumePhrase in net/mail",
          "version": "v1.26.2"
        },
        {
          "aliases": [
            "CVE-2026-39826"
          ],
          "epss": {
            "cve": "CVE-2026-39826",
            "percentile": 0.31066,
            "score": 0.00371
          },
          "fixed_version": "v1.26.3",
          "id": "GO-2026-4980",
          "kev": null,
          "level": "symbol",
          "module": "stdlib",
          "summary": "Escaper bypass leads to XSS in html/template",
          "version": "v1.26.2"
        },
        {
          "aliases": [
            "CVE-2026-33811"
          ],
          "epss": {
            "cve": "CVE-2026-33811",
            "percentile": 0.58975,
            "score": 0.00875
          },
          "fixed_version": "v1.26.3",
          "id": "GO-2026-4981",
          "kev": null,
          "level": "symbol",
          "module": "stdlib",
          "summary": "Crash when handling long CNAME response in net",
          "version": "v1.26.2"
        },
        {
          "aliases": [
            "CVE-2026-39823"
          ],
          "epss": {
            "cve": "CVE-2026-39823",
            "percentile": 0.24388,
            "score": 0.00314
          },
          "fixed_version": "v1.26.3",
          "id": "GO-2026-4982",
          "kev": null,
          "level": "symbol",
          "module": "stdlib",
          "summary": "Bypass of meta content URL escaping causes XSS in html/template",
          "version": "v1.26.2"
        },
        {
          "aliases": [
            "CVE-2026-39820"
          ],
          "epss": {
            "cve": "CVE-2026-39820",
            "percentile": 0.56059,
            "score": 0.00784
          },
          "fixed_version": "v1.26.3",
          "id": "GO-2026-4986",
          "kev": null,
          "level": "symbol",
          "module": "stdlib",
          "summary": "Quadratic string concatentation in consumeComment in net/mail",
          "version": "v1.26.2"
        },
        {
          "aliases": [
            "CVE-2026-39821"
          ],
          "epss": {
            "cve": "CVE-2026-39821",
            "percentile": 0.78915,
            "score": 0.01834
          },
          "fixed_version": "v1.26.6",
          "id": "GO-2026-5026",
          "kev": null,
          "level": "symbol",
          "module": "stdlib",
          "summary": "Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna",
          "version": "v1.26.2"
        },
        {
          "aliases": [
            "CVE-2026-27145"
          ],
          "epss": {
            "cve": "CVE-2026-27145",
            "percentile": 0.48256,
            "score": 0.00591
          },
          "fixed_version": "v1.26.4",
          "id": "GO-2026-5037",
          "kev": null,
          "level": "symbol",
          "module": "stdlib",
          "summary": "Inefficient candidate hostname parsing in crypto/x509",
          "version": "v1.26.2"
        },
        {
          "aliases": [
            "CVE-2026-42504"
          ],
          "epss": {
            "cve": "CVE-2026-42504",
            "percentile": 0.46636,
            "score": 0.0056
          },
          "fixed_version": "v1.26.4",
          "id": "GO-2026-5038",
          "kev": null,
          "level": "symbol",
          "module": "stdlib",
          "summary": "Quadratic complexity in WordDecoder.DecodeHeader in mime",
          "version": "v1.26.2"
        },
        {
          "aliases": [
            "CVE-2026-42507"
          ],
          "epss": {
            "cve": "CVE-2026-42507",
            "percentile": 0.30985,
            "score": 0.0037
          },
          "fixed_version": "v1.26.4",
          "id": "GO-2026-5039",
          "kev": null,
          "level": "symbol",
          "module": "stdlib",
          "summary": "Arbitrary inputs are included in errors without any escaping in net/textproto",
          "version": "v1.26.2"
        },
        {
          "aliases": [
            "CVE-2026-42505"
          ],
          "epss": {
            "cve": "CVE-2026-42505",
            "percentile": 0.32254,
            "score": 0.00382
          },
          "fixed_version": "v1.26.5",
          "id": "GO-2026-5856",
          "kev": null,
          "level": "symbol",
          "module": "stdlib",
          "summary": "Invoking Encrypted Client Hello privacy leak in crypto/tls",
          "version": "v1.26.2"
        },
        {
          "aliases": [
            "CVE-2026-46600"
          ],
          "epss": {
            "cve": "CVE-2026-46600",
            "percentile": 0.45991,
            "score": 0.00549
          },
          "fixed_version": "v1.26.6",
          "id": "GO-2026-5942",
          "kev": null,
          "level": "symbol",
          "module": "stdlib",
          "summary": "Parsing an invalid SVCB or HTTPS RR can panic in golang.org/x/net/dns/dnsmessage",
          "version": "v1.26.2"
        },
        {
          "aliases": [
            "CVE-2026-33818"
          ],
          "epss": {
            "cve": "CVE-2026-33818",
            "percentile": 0.47077,
            "score": 0.00568
          },
          "fixed_version": "v1.26.6",
          "id": "GO-2026-5972",
          "kev": null,
          "level": "symbol",
          "module": "stdlib",
          "summary": "Enforce maximum recursion depth in encoding/asn1",
          "version": "v1.26.2"
        },
        {
          "aliases": [
            "CVE-2026-56859"
          ],
          "epss": {
            "cve": "CVE-2026-56859",
            "percentile": 0.47076,
            "score": 0.00568
          },
          "fixed_version": "v1.26.6",
          "id": "GO-2026-6088",
          "kev": null,
          "level": "symbol",
          "module": "stdlib",
          "summary": "Add recursion depth guard during decode in encoding/xml",
          "version": "v1.26.2"
        },
        {
          "aliases": [
            "CVE-2026-56853"
          ],
          "epss": {
            "cve": "CVE-2026-56853",
            "percentile": 0.47076,
            "score": 0.00568
          },
          "fixed_version": "v1.26.6",
          "id": "GO-2026-6089",
          "kev": null,
          "level": "symbol",
          "module": "stdlib",
          "summary": "Apply ReadHeaderTimeout when doing unencrypted HTTP/2 check in net/http",
          "version": "v1.26.2"
        },
        {
          "aliases": [
            "CVE-2026-56862"
          ],
          "epss": {
            "cve": "CVE-2026-56862",
            "percentile": 0.47076,
            "score": 0.00568
          },
          "fixed_version": "v1.26.6",
          "id": "GO-2026-6090",
          "kev": null,
          "level": "symbol",
          "module": "stdlib",
          "summary": "Limit handshake messages we are willing to accept post-handshake in crypto/tls",
          "version": "v1.26.2"
        },
        {
          "aliases": [
            "CVE-2026-56858"
          ],
          "epss": {
            "cve": "CVE-2026-56858",
            "percentile": 0.23831,
            "score": 0.0031
          },
          "fixed_version": "v1.26.6",
          "id": "GO-2026-6091",
          "kev": null,
          "level": "symbol",
          "module": "stdlib",
          "summary": "Fix Javascript regexp context tracking in html/template",
          "version": "v1.26.2"
        },
        {
          "aliases": [
            "CVE-2026-56860"
          ],
          "epss": {
            "cve": "CVE-2026-56860",
            "percentile": 0.46041,
            "score": 0.0055
          },
          "fixed_version": "v1.26.6",
          "id": "GO-2026-6218",
          "kev": null,
          "level": "symbol",
          "module": "stdlib",
          "summary": "Avoid quadratic complexity in resolvePath in net/url",
          "version": "v1.26.2"
        },
        {
          "aliases": [
            "CVE-2026-94448"
          ],
          "epss": {
            "cve": "CVE-2026-94448",
            "percentile": 0.21475,
            "score": 0.00289
          },
          "fixed_version": "v1.26.9",
          "id": "GO-2026-6599",
          "kev": null,
          "level": "symbol",
          "module": "stdlib",
          "summary": "Reset context tracking on consecutive template expressions in html/template",
          "version": "v1.26.2"
        },
        {
          "aliases": [
            "CVE-2026-97030"
          ],
          "epss": {
            "cve": "CVE-2026-97030",
            "percentile": 0.21475,
            "score": 0.00289
          },
          "fixed_version": "v1.26.9",
          "id": "GO-2026-6600",
          "kev": null,
          "level": "symbol",
          "module": "stdlib",
          "summary": "Recognize yield as regexp preceder keyword in html/template",
          "version": "v1.26.2"
        },
        {
          "aliases": [
            "CVE-2026-78659"
          ],
          "epss": {
            "cve": "CVE-2026-78659",
            "percentile": 0.50082,
            "score": 0.00627
          },
          "fixed_version": "v1.26.9",
          "id": "GO-2026-6603",
          "kev": null,
          "level": "symbol",
          "module": "stdlib",
          "summary": "HTTP/2 server memory exhaustion due to Trailer headers in net/http",
          "version": "v1.26.2"
        },
        {
          "aliases": [
            "CVE-2026-56866"
          ],
          "epss": {
            "cve": "CVE-2026-56866",
            "percentile": 0.40968,
            "score": 0.00473
          },
          "fixed_version": "v1.26.9",
          "id": "GO-2026-6605",
          "kev": null,
          "level": "symbol",
          "module": "stdlib",
          "summary": "HTTP/1 client connection desynchronization after CONNECT rejection in net/http",
          "version": "v1.26.2"
        },
        {
          "aliases": [
            "CVE-2026-97031"
          ],
          "epss": {
            "cve": "CVE-2026-97031",
            "percentile": 0.44095,
            "score": 0.00519
          },
          "fixed_version": "v1.26.9",
          "id": "GO-2026-6607",
          "kev": null,
          "level": "symbol",
          "module": "stdlib",
          "summary": "Reject malformed ECH outer extension references in crypto/tls",
          "version": "v1.26.2"
        },
        {
          "aliases": [
            "CVE-2026-94440"
          ],
          "epss": {
            "cve": "CVE-2026-94440",
            "percentile": 0.4362,
            "score": 0.00511
          },
          "fixed_version": "v1.26.9",
          "id": "GO-2026-6608",
          "kev": null,
          "level": "symbol",
          "module": "stdlib",
          "summary": "Memory limit bypass when parsing MIME headers in net/textproto, mime/multipart",
          "version": "v1.26.2"
        },
        {
          "aliases": [
            "CVE-2026-78667"
          ],
          "epss": {
            "cve": "CVE-2026-78667",
            "percentile": 0.41455,
            "score": 0.0048
          },
          "fixed_version": "v1.26.9",
          "id": "GO-2026-6609",
          "kev": null,
          "level": "symbol",
          "module": "stdlib",
          "summary": "Lack of limit on size of parsed Range headers in net/http",
          "version": "v1.26.2"
        },
        {
          "aliases": [
            "CVE-2026-78660"
          ],
          "epss": {
            "cve": "CVE-2026-78660",
            "percentile": 0.36838,
            "score": 0.00425
          },
          "fixed_version": "v1.26.9",
          "id": "GO-2026-6610",
          "kev": null,
          "level": "symbol",
          "module": "stdlib",
          "summary": "HTTP/2 transport accepts malformed framing-related headers in net/http",
          "version": "v1.26.2"
        },
        {
          "aliases": [
            "CVE-2026-78663"
          ],
          "epss": {
            "cve": "CVE-2026-78663",
            "percentile": 0.49813,
            "score": 0.00622
          },
          "fixed_version": "v1.26.9",
          "id": "GO-2026-6612",
          "kev": null,
          "level": "symbol",
          "module": "stdlib",
          "summary": "Double flow control refund on HTTP/2 server streams in net/http",
          "version": "v1.26.2"
        },
        {
          "aliases": [
            "CVE-2026-94439"
          ],
          "epss": {
            "cve": "CVE-2026-94439",
            "percentile": 0.35772,
            "score": 0.00414
          },
          "fixed_version": "v1.26.9",
          "id": "GO-2026-6613",
          "kev": null,
          "level": "symbol",
          "module": "stdlib",
          "summary": "HTTP/1 server connection desynchronization after 2xx CONNECT response in net/http",
          "version": "v1.26.2"
        },
        {
          "aliases": [
            "CVE-2026-97032"
          ],
          "epss": {
            "cve": "CVE-2026-97032",
            "percentile": 0.42154,
            "score": 0.0049
          },
          "fixed_version": "v1.26.9",
          "id": "GO-2026-6617",
          "kev": null,
          "level": "symbol",
          "module": "stdlib",
          "summary": "HTTP/2 server crash due to HPACK encoder race in net/http",
          "version": "v1.26.2"
        },
        {
          "aliases": [
            "CVE-2026-111943"
          ],
          "epss": {
            "cve": "CVE-2026-111943",
            "percentile": 0.33793,
            "score": 0.00396
          },
          "fixed_version": "v1.26.10",
          "id": "GO-2026-6809",
          "kev": null,
          "level": "symbol",
          "module": "stdlib",
          "summary": "Distrust compromised intermediate certificates in crypto/x509",
          "version": "v1.26.2"
        },
        {
          "aliases": [
            "CVE-2026-32285",
            "GHSA-6g7g-w4f8-9c9x"
          ],
          "epss": {
            "cve": "CVE-2026-32285",
            "percentile": 0.55918,
            "score": 0.00779
          },
          "fixed_version": "v1.1.2",
          "id": "GO-2026-4514",
          "kev": null,
          "level": "symbol",
          "module": "github.com/buger/jsonparser",
          "summary": "Denial of service in github.com/buger/jsonparser",
          "version": "v1.1.1"
        },
        {
          "aliases": [
            "CVE-2026-33997",
            "GHSA-pxq6-2prw-chj9"
          ],
          "epss": {
            "cve": "CVE-2026-33997",
            "percentile": 0.34433,
            "score": 0.00402
          },
          "fixed_version": "",
          "id": "GO-2026-4883",
          "kev": null,
          "level": "symbol",
          "module": "github.com/docker/docker",
          "summary": "Moby has an Off-by-one error in its plugin privilege validation in github.com/docker/docker",
          "version": "v28.5.2+incompatible"
        },
        {
          "aliases": [
            "CVE-2026-34040",
            "GHSA-x744-4wpc-v9h2"
          ],
          "epss": {
            "cve": "CVE-2026-34040",
            "percentile": 0.95361,
            "score": 0.0927
          },
          "fixed_version": "",
          "id": "GO-2026-4887",
          "kev": null,
          "level": "symbol",
          "module": "github.com/docker/docker",
          "summary": "Moby has AuthZ plugin bypass when provided oversized request bodies in github.com/docker/docker",
          "version": "v28.5.2+incompatible"
        },
        {
          "aliases": [
            "CVE-2026-42306",
            "GHSA-rg2x-37c3-w2rh"
          ],
          "epss": {
            "cve": "CVE-2026-42306",
            "percentile": 0.01018,
            "score": 0.00104
          },
          "fixed_version": "",
          "id": "GO-2026-5617",
          "kev": null,
          "level": "symbol",
          "module": "github.com/docker/docker",
          "summary": "Race condition in 'docker cp' in github.com/docker/docker allows bind mount redirection",
          "version": "v28.5.2+incompatible"
        },
        {
          "aliases": [
            "CVE-2026-41568",
            "GHSA-vp62-88p7-qqf5"
          ],
          "epss": {
            "cve": "CVE-2026-41568",
            "percentile": 0.01188,
            "score": 0.00108
          },
          "fixed_version": "",
          "id": "GO-2026-5668",
          "kev": null,
          "level": "symbol",
          "module": "github.com/docker/docker",
          "summary": "Race condition in 'docker cp' in github.com/docker/docker allows creation of arbitrary files",
          "version": "v28.5.2+incompatible"
        },
        {
          "aliases": [
            "CVE-2026-41567",
            "GHSA-x86f-5xw2-fm2r"
          ],
          "epss": {
            "cve": "CVE-2026-41567",
            "percentile": 0.04603,
            "score": 0.00155
          },
          "fixed_version": "",
          "id": "GO-2026-5746",
          "kev": null,
          "level": "symbol",
          "module": "github.com/docker/docker",
          "summary": "Docker: 'PUT /containers/{id}/archive' executes container binary on the host in github.com/docker/docker",
          "version": "v28.5.2+incompatible"
        },
        {
          "aliases": [
            "CVE-2026-40890",
            "GHSA-77fj-vx54-gvh7"
          ],
          "epss": {
            "cve": "CVE-2026-40890",
            "percentile": 0.2815,
            "score": 0.00346
          },
          "fixed_version": "v0.0.0-20260411013819-759bbc3e3207",
          "id": "GO-2026-5208",
          "kev": null,
          "level": "symbol",
          "module": "github.com/gomarkdown/markdown",
          "summary": "Go Markdown has an out-of-bounds read in SmartypantsRenderer in github.com/gomarkdown/markdown",
          "version": "v0.0.0-20260217112301-37c66b85d6ab"
        },
        {
          "aliases": [
            "GHSA-gcjh-h69q-9w9g"
          ],
          "epss": null,
          "fixed_version": "v0.30.0",
          "id": "GO-2026-6094",
          "kev": null,
          "level": "symbol",
          "module": "github.com/google/cel-go",
          "summary": "JSON private fields exposed via NativeTypes and ParseStructTag in github.com/google/cel-go",
          "version": "v0.27.0"
        },
        {
          "aliases": [
            "GHSA-259r-337f-4rfw"
          ],
          "epss": null,
          "fixed_version": "v1.18.7",
          "id": "GO-2026-5841",
          "kev": null,
          "level": "symbol",
          "module": "github.com/klauspost/compress",
          "summary": "OOB read in github.com/klauspost/compress/s2",
          "version": "v1.18.4"
        },
        {
          "aliases": [
            "CVE-2026-55677",
            "GHSA-vfp3-v2gw-7wfq"
          ],
          "epss": {
            "cve": "CVE-2026-55677",
            "percentile": 0.44161,
            "score": 0.00519
          },
          "fixed_version": "v4.15.3",
          "id": "GO-2026-6293",
          "kev": null,
          "level": "symbol",
          "module": "github.com/labstack/echo/v4",
          "summary": "Encoded slash (%2F) bypasses route-level protection and exposes static files in github.com/labstack/echo/v4 and github.com/labstack/echo/v5",
          "version": "v4.15.1"
        },
        {
          "aliases": [
            "CVE-2026-33747",
            "GHSA-4c29-8rgm-jvjj"
          ],
          "epss": {
            "cve": "CVE-2026-33747",
            "percentile": 0.43298,
            "score": 0.00507
          },
          "fixed_version": "v0.28.1",
          "id": "GO-2026-4858",
          "kev": null,
          "level": "symbol",
          "module": "github.com/moby/buildkit",
          "summary": "BuildKit's Malicious frontend can cause file escape outside of storage root in github.com/moby/buildkit",
          "version": "v0.26.3"
        },
        {
          "aliases": [
            "CVE-2026-33748",
            "GHSA-4vrq-3vrq-g6gg"
          ],
          "epss": {
            "cve": "CVE-2026-33748",
            "percentile": 0.41536,
            "score": 0.00481
          },
          "fixed_version": "v0.28.1",
          "id": "GO-2026-4859",
          "kev": null,
          "level": "symbol",
          "module": "github.com/moby/buildkit",
          "summary": "BuildKit Git URL subdir component can cause access to restricted files in github.com/moby/buildkit",
          "version": "v0.26.3"
        },
        {
          "aliases": [
            "CVE-2026-61711",
            "GHSA-7236-3392-c5c6"
          ],
          "epss": {
            "cve": "CVE-2026-61711",
            "percentile": 0.29451,
            "score": 0.00357
          },
          "fixed_version": "v0.31.1",
          "id": "GO-2026-6255",
          "kev": null,
          "level": "symbol",
          "module": "github.com/moby/buildkit",
          "summary": "BuildKit: Custom frontend could bypass Seccomp/AppArmor in github.com/moby/buildkit",
          "version": "v0.26.3"
        },
        {
          "aliases": [
            "CVE-2026-61712",
            "GHSA-72x6-4j93-7w86"
          ],
          "epss": {
            "cve": "CVE-2026-61712",
            "percentile": 0.34089,
            "score": 0.00399
          },
          "fixed_version": "v0.31.1",
          "id": "GO-2026-6256",
          "kev": null,
          "level": "symbol",
          "module": "github.com/moby/buildkit",
          "summary": "BuildKit has a possible runtime DoS via unbounded group parsing in github.com/moby/buildkit",
          "version": "v0.26.3"
        },
        {
          "aliases": [
            "CVE-2026-61801",
            "GHSA-mjcv-p78q-w5fw"
          ],
          "epss": {
            "cve": "CVE-2026-61801",
            "percentile": 0.01634,
            "score": 0.00117
          },
          "fixed_version": "v0.4.1",
          "id": "GO-2026-6686",
          "kev": null,
          "level": "symbol",
          "module": "github.com/moby/sys/user",
          "summary": "Possible DoS via unbounded parsing of user and group database files in github.com/moby/sys/user",
          "version": "v0.4.0"
        },
        {
          "aliases": [
            "CVE-2026-40898",
            "GHSA-vvgj-x9jq-8cj9"
          ],
          "epss": {
            "cve": "CVE-2026-40898",
            "percentile": 0.33786,
            "score": 0.00396
          },
          "fixed_version": "v0.59.1",
          "id": "GO-2026-5676",
          "kev": null,
          "level": "symbol",
          "module": "github.com/quic-go/quic-go",
          "summary": "HTTP/3 QPACK Trailer Expansion Memory Exhaustion in github.com/quic-go/quic-go",
          "version": "v0.59.0"
        },
        {
          "aliases": [
            "CVE-2026-5160",
            "GHSA-c97m-vxhj-p7j6"
          ],
          "epss": {
            "cve": "CVE-2026-5160",
            "percentile": 0.21228,
            "score": 0.00287
          },
          "fixed_version": "v1.7.17",
          "id": "GO-2026-5320",
          "kev": null,
          "level": "symbol",
          "module": "github.com/yuin/goldmark",
          "summary": "Cross-site Scripting (XSS) in github.com/yuin/goldmark",
          "version": "v1.7.16"
        },
        {
          "aliases": [],
          "epss": null,
          "fixed_version": "",
          "id": "GO-2026-5932",
          "kev": null,
          "level": "symbol",
          "module": "golang.org/x/crypto",
          "summary": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues",
          "version": "v0.55.0"
        },
        {
          "aliases": [
            "CVE-2026-78662"
          ],
          "epss": {
            "cve": "CVE-2026-78662",
            "percentile": 0.37388,
            "score": 0.00431
          },
          "fixed_version": "v0.56.0",
          "id": "GO-2026-6354",
          "kev": null,
          "level": "symbol",
          "module": "golang.org/x/crypto",
          "summary": "Prevent DoS on deadlocked undecided channel in golang.org/x/crypto/ssh",
          "version": "v0.55.0"
        },
        {
          "aliases": [
            "CVE-2026-56855"
          ],
          "epss": {
            "cve": "CVE-2026-56855",
            "percentile": 0.42867,
            "score": 0.005
          },
          "fixed_version": "v0.56.0",
          "id": "GO-2026-6355",
          "kev": null,
          "level": "symbol",
          "module": "golang.org/x/crypto",
          "summary": "Prevent DoS on deadlocked established channel in golang.org/x/crypto/ssh",
          "version": "v0.55.0"
        },
        {
          "aliases": [
            "CVE-2026-56865"
          ],
          "epss": {
            "cve": "CVE-2026-56865",
            "percentile": 0.02533,
            "score": 0.00129
          },
          "fixed_version": "v0.40.0",
          "id": "GO-2026-6179",
          "kev": null,
          "level": "symbol",
          "module": "golang.org/x/mod",
          "summary": "Fix transparency log tile verification bypass in golang.org/x/mod/sumdb/tlog",
          "version": "v0.38.0"
        },
        {
          "aliases": [
            "CVE-2026-56864"
          ],
          "epss": {
            "cve": "CVE-2026-56864",
            "percentile": 0.22506,
            "score": 0.00298
          },
          "fixed_version": "v0.40.0",
          "id": "GO-2026-6180",
          "kev": null,
          "level": "symbol",
          "module": "golang.org/x/mod",
          "summary": "Ignore unrelated, unauthenticated hashes in Lookup in golang.org/x/mod/sumdb",
          "version": "v0.38.0"
        },
        {
          "aliases": [
            "CVE-2026-78669"
          ],
          "epss": {
            "cve": "CVE-2026-78669",
            "percentile": 0.49426,
            "score": 0.00614
          },
          "fixed_version": "v0.60.0",
          "id": "GO-2026-6611",
          "kev": null,
          "level": "symbol",
          "module": "golang.org/x/net",
          "summary": "Excessive CPU consumption from repeated initial window changes in net/http",
          "version": "v0.58.0"
        },
        {
          "aliases": [
            "CVE-2026-78661"
          ],
          "epss": {
            "cve": "CVE-2026-78661",
            "percentile": 0.08063,
            "score": 0.00185
          },
          "fixed_version": "v0.62.0",
          "id": "GO-2026-6860",
          "kev": null,
          "level": "symbol",
          "module": "golang.org/x/net",
          "summary": "Avoid quadratic complexity when coalescing text nodes in html in golang.org/x/net",
          "version": "v0.58.0"
        },
        {
          "aliases": [
            "CVE-2026-97045"
          ],
          "epss": {
            "cve": "CVE-2026-97045",
            "percentile": 0.10117,
            "score": 0.00202
          },
          "fixed_version": "v0.62.0",
          "id": "GO-2026-6866",
          "kev": null,
          "level": "symbol",
          "module": "golang.org/x/net",
          "summary": "Check all ancestor namespace transitions when rendering raw text in html in golang.org/x/net",
          "version": "v0.58.0"
        },
        {
          "aliases": [
            "CVE-2026-33481",
            "GHSA-rjcw-vg7j-m9rc"
          ],
          "epss": {
            "cve": "CVE-2026-33481",
            "percentile": 0.36677,
            "score": 0.00423
          },
          "fixed_version": "v1.42.3",
          "id": "GO-2026-4809",
          "kev": null,
          "level": "module",
          "module": "github.com/anchore/syft",
          "summary": "Syft improper temporary file cleanup in github.com/anchore/syft",
          "version": "v1.40.0"
        },
        {
          "aliases": [
            "CVE-2026-53492",
            "GHSA-33vj-92qq-66hc"
          ],
          "epss": {
            "cve": "CVE-2026-53492",
            "percentile": 0.28922,
            "score": 0.00353
          },
          "fixed_version": "",
          "id": "GO-2026-5064",
          "kev": null,
          "level": "module",
          "module": "github.com/containerd/containerd",
          "summary": "containerd CRI checkpoint restore CDI annotation smuggling in github.com/containerd/containerd",
          "version": "v1.7.30"
        },
        {
          "aliases": [
            "CVE-2026-50195",
            "GHSA-cvxm-645q-p574"
          ],
          "epss": {
            "cve": "CVE-2026-50195",
            "percentile": 0.23133,
            "score": 0.00303
          },
          "fixed_version": "",
          "id": "GO-2026-5338",
          "kev": null,
          "level": "module",
          "module": "github.com/containerd/containerd",
          "summary": "containerd: CRI checkpoint import allows local image tag poisoning in github.com/containerd/containerd",
          "version": "v1.7.30"
        },
        {
          "aliases": [
            "CVE-2026-46680",
            "GHSA-fqw6-gf59-qr4w"
          ],
          "epss": {
            "cve": "CVE-2026-46680",
            "percentile": 0.05463,
            "score": 0.00163
          },
          "fixed_version": "v1.7.32",
          "id": "GO-2026-5378",
          "kev": null,
          "level": "module",
          "module": "github.com/containerd/containerd",
          "summary": "containerd user ID handling bypass allows runAsNonRoot evasion in github.com/containerd/containerd",
          "version": "v1.7.30"
        },
        {
          "aliases": [
            "CVE-2026-47262",
            "GHSA-jpcc-p29g-p8mq"
          ],
          "epss": {
            "cve": "CVE-2026-47262",
            "percentile": 0.18457,
            "score": 0.00265
          },
          "fixed_version": "v1.7.33",
          "id": "GO-2026-5475",
          "kev": null,
          "level": "module",
          "module": "github.com/containerd/containerd",
          "summary": "containerd image-triggered runtime DoS via unbounded group parsing in github.com/containerd/containerd",
          "version": "v1.7.30"
        },
        {
          "aliases": [
            "CVE-2026-53489",
            "GHSA-rgh6-rfwx-v388"
          ],
          "epss": {
            "cve": "CVE-2026-53489",
            "percentile": 0.06876,
            "score": 0.00174
          },
          "fixed_version": "",
          "id": "GO-2026-5622",
          "kev": null,
          "level": "module",
          "module": "github.com/containerd/containerd",
          "summary": "Arbitrary host CRI log file read via symlink following in CRI checkpoint restore in github.com/containerd/containerd",
          "version": "v1.7.30"
        },
        {
          "aliases": [
            "CVE-2026-53488",
            "GHSA-xhf5-7wjv-pqxp"
          ],
          "epss": {
            "cve": "CVE-2026-53488",
            "percentile": 0.07132,
            "score": 0.00176
          },
          "fixed_version": "v1.7.33",
          "id": "GO-2026-5758",
          "kev": null,
          "level": "module",
          "module": "github.com/containerd/containerd",
          "summary": "containerd CRI \u2014 image-config `LABEL` flows to restart-monitor `binary://` logger: host-root command execution from an image pull in github.com/containerd/containerd",
          "version": "v1.7.30"
        },
        {
          "aliases": [
            "CVE-2026-53495",
            "GHSA-7jxh-36q5-gcqv"
          ],
          "epss": {
            "cve": "CVE-2026-53495",
            "percentile": 0.05332,
            "score": 0.00162
          },
          "fixed_version": "v1.7.35",
          "id": "GO-2026-6444",
          "kev": null,
          "level": "module",
          "module": "github.com/containerd/containerd",
          "summary": "containerd: CRI ExecSync Goroutine Leak Leads to Node-Level Denial of Service in github.com/containerd/containerd",
          "version": "v1.7.30"
        },
        {
          "aliases": [
            "CVE-2026-53493",
            "GHSA-pg57-6jwg-q645"
          ],
          "epss": {
            "cve": "CVE-2026-53493",
            "percentile": 0.29375,
            "score": 0.00356
          },
          "fixed_version": "v1.7.36",
          "id": "GO-2026-6597",
          "kev": null,
          "level": "module",
          "module": "github.com/containerd/containerd",
          "summary": "Containerd has image-pull DoS via crafted OCI index graph amplification in github.com/containerd/containerd",
          "version": "v1.7.30"
        },
        {
          "aliases": [
            "CVE-2026-95837",
            "GHSA-p7v4-vr35-mj6f"
          ],
          "epss": {
            "cve": "CVE-2026-95837",
            "percentile": 0.011,
            "score": 0.00106
          },
          "fixed_version": "",
          "id": "GO-2026-6791",
          "kev": null,
          "level": "module",
          "module": "github.com/containerd/containerd",
          "summary": "containerd CRI plugin: Checkpoint restore bypasses destination security context in github.com/containerd/containerd",
          "version": "v1.7.30"
        },
        {
          "aliases": [
            "CVE-2026-95838",
            "GHSA-rp3h-jf77-q9p4"
          ],
          "epss": {
            "cve": "CVE-2026-95838",
            "percentile": 0.1296,
            "score": 0.00223
          },
          "fixed_version": "v1.7.35",
          "id": "GO-2026-6796",
          "kev": null,
          "level": "module",
          "module": "github.com/containerd/containerd",
          "summary": "containerd: Unpack DoS via repeated opaque whiteouts in github.com/containerd/containerd",
          "version": "v1.7.30"
        },
        {
          "aliases": [
            "CVE-2026-4660",
            "GHSA-92mm-2pjq-r785"
          ],
          "epss": {
            "cve": "CVE-2026-4660",
            "percentile": 0.47885,
            "score": 0.00583
          },
          "fixed_version": "v1.8.6",
          "id": "GO-2026-5058",
          "kev": null,
          "level": "module",
          "module": "github.com/hashicorp/go-getter",
          "summary": "HashiCorp's go-getter library may allow arbitrary file reads in github.com/hashicorp/go-getter",
          "version": "v1.8.4"
        }
      ],
      "go_version": "go1.26.2",
      "main_module": "github.com/safedep/vet"
    },
    "id": "safedep__vet",
    "manifests": [
      ".github/workflows/ci.yml",
      ".github/workflows/codeql.yml",
      ".github/workflows/container.yml",
      ".github/workflows/dependency-review.yml",
      ".github/workflows/gh-pages-deploy.yml",
      ".github/workflows/golangci-lint.yml",
      ".github/workflows/goreleaser.yml",
      ".github/workflows/mdm.yml",
      ".github/workflows/scorecard.yml",
      ".github/workflows/secret_scan.yml",
      ".github/workflows/vet-ci.yml",
      ".github/workflows/vet-container-scanning-e2e.yml",
      "go.mod",
      "go.sum",
      "package.json",
      "packages/smoke/package.json",
      "packages/vet-darwin-arm64/package.json",
      "packages/vet-darwin-x64/package.json",
      "packages/vet-linux-arm64/package.json",
      "packages/vet-linux-x64/package.json",
      "packages/vet-win32-x64/package.json",
      "packages/vet/package.json",
      "pnpm-lock.yaml",
      "scripts/go.mod",
      "scripts/go.sum"
    ],
    "name": "vet",
    "osv": {
      "advisories": 83,
      "available": true,
      "confirmed": 84,
      "osv_only": [],
      "warning": null
    },
    "ref": "v1.20.0",
    "ref_kind": "release",
    "release_integrity": {
      "asset": "vet_Linux_x86_64.tar.gz",
      "assets": 6,
      "build_provenance": "verified",
      "checksums_published": true,
      "digest_matches_github": true,
      "immutable_release": true,
      "methods": [
        {
          "method": "github-attestation",
          "predicates": [
            "https://slsa.dev/provenance/v1"
          ],
          "status": "verified"
        },
        {
          "detail": "GitHub attests the file is unchanged since the release was published",
          "method": "github-immutable-release",
          "status": "verified"
        }
      ],
      "provenance_published": false,
      "sbom_published": false,
      "signature": null,
      "signatures_published": false,
      "signer": null,
      "verdict": "verified"
    },
    "released_at": "2026-10-07T05:09:23Z",
    "repository": "safedep/vet",
    "sbomlyze_diff": {
      "added": 0,
      "changed": 0,
      "drift": {},
      "findings": [
        "0 version changes among 753 shared packages \u2014 no actual upgrades",
        "Core system packages stable: golang (489), npm (200), github (49), file (15) unchanged"
      ],
      "removed": 0
    },
    "scanned_at": "2026-11-02T03:08:13+00:00",
    "scorecard": {
      "checks": [
        {
          "name": "Code-Review",
          "reason": "Found 2/26 approved changesets -- score normalized to 0",
          "score": 0
        },
        {
          "name": "Signed-Releases",
          "reason": "Project has not signed or included provenance with any releases.",
          "score": 0
        },
        {
          "name": "Vulnerabilities",
          "reason": "155 existing vulnerabilities detected",
          "score": 0
        },
        {
          "name": "CII-Best-Practices",
          "reason": "badge detected: InProgress",
          "score": 2
        },
        {
          "name": "Branch-Protection",
          "reason": "branch protection is not maximal on development and all release branches",
          "score": 7
        },
        {
          "name": "Pinned-Dependencies",
          "reason": "dependency not pinned by hash detected -- score normalized to 9",
          "score": 9
        },
        {
          "name": "Security-Policy",
          "reason": "security policy file detected",
          "score": 9
        },
        {
          "name": "Binary-Artifacts",
          "reason": "no binaries found in the repo",
          "score": 10
        },
        {
          "name": "CI-Tests",
          "reason": "26 out of 26 merged PRs checked by a CI test -- score normalized to 10",
          "score": 10
        },
        {
          "name": "Contributors",
          "reason": "project has 17 contributing companies or organizations",
          "score": 10
        },
        {
          "name": "Dangerous-Workflow",
          "reason": "no dangerous workflow patterns detected",
          "score": 10
        },
        {
          "name": "Dependency-Update-Tool",
          "reason": "update tool detected",
          "score": 10
        },
        {
          "name": "Fuzzing",
          "reason": "project is fuzzed",
          "score": 10
        },
        {
          "name": "License",
          "reason": "license file detected",
          "score": 10
        },
        {
          "name": "Maintained",
          "reason": "30 commit(s) and 5 issue activity found in the last 90 days -- score normalized to 10",
          "score": 10
        },
        {
          "name": "Packaging",
          "reason": "packaging workflow detected",
          "score": 10
        },
        {
          "name": "SAST",
          "reason": "SAST tool is run on all commits",
          "score": 10
        },
        {
          "name": "Token-Permissions",
          "reason": "GitHub workflow tokens follow principle of least privilege",
          "score": 10
        }
      ],
      "date": "2026-11-01",
      "score": 7.4,
      "source": "openssf-api",
      "version": "v5.6.0"
    },
    "vulnerabilities": [
      {
        "aliases": [
          "CVE-2026-53492",
          "GHSA-33vj-92qq-66hc"
        ],
        "ecosystem": "golang",
        "epss": {
          "cve": "CVE-2026-53492",
          "percentile": 0.28922,
          "score": 0.00353
        },
        "fix_state": "unknown",
        "fixed_in": [],
        "id": "GO-2026-5064",
        "in_binary": "module in binary",
        "kev": null,
        "location": "go.mod",
        "osv_confirmed": true,
        "package": "github.com/containerd/containerd",
        "severity": "Critical",
        "summary": "containerd CRI checkpoint restore CDI annotation smuggling in github.com/containerd/containerd",
        "url": "https://github.com/containerd/containerd/security/advisories/GHSA-33vj-92qq-66hc",
        "version": "v1.7.30"
      },
      {
        "aliases": [
          "CVE-2026-50195",
          "GHSA-cvxm-645q-p574"
        ],
        "ecosystem": "golang",
        "epss": {
          "cve": "CVE-2026-50195",
          "percentile": 0.23133,
          "score": 0.00303
        },
        "fix_state": "unknown",
        "fixed_in": [],
        "id": "GO-2026-5338",
        "in_binary": "module in binary",
        "kev": null,
        "location": "go.mod",
        "osv_confirmed": true,
        "package": "github.com/containerd/containerd",
        "severity": "Critical",
        "summary": "containerd: CRI checkpoint import allows local image tag poisoning in github.com/containerd/containerd",
        "url": "https://github.com/containerd/containerd/security/advisories/GHSA-cvxm-645q-p574",
        "version": "v1.7.30"
      },
      {
        "aliases": [
          "CVE-2026-118264"
        ],
        "ecosystem": "golang",
        "epss": {
          "cve": "CVE-2026-118264",
          "percentile": 0.37206,
          "score": 0.0043
        },
        "fix_state": "fixed",
        "fixed_in": [
          "4.16.1"
        ],
        "id": "GHSA-cxf3-9h37-7rr8",
        "in_binary": "vulnerable code not in binary",
        "kev": null,
        "location": "go.mod",
        "osv_confirmed": true,
        "package": "github.com/labstack/echo/v4",
        "severity": "Critical",
        "summary": "Echo: Rejected WebSocket upgrades can bypass Echo route-level access controls",
        "url": "https://github.com/advisories/GHSA-cxf3-9h37-7rr8",
        "version": "v4.15.1"
      },
      {
        "aliases": [
          "CVE-2026-78663"
        ],
        "ecosystem": "golang",
        "epss": {
          "cve": "CVE-2026-78663",
          "percentile": 0.49813,
          "score": 0.00622
        },
        "fix_state": "fixed",
        "fixed_in": [
          "0.60.0"
        ],
        "id": "GO-2026-6612",
        "in_binary": "vulnerable code in binary",
        "kev": null,
        "location": "go.mod",
        "osv_confirmed": true,
        "package": "golang.org/x/net",
        "severity": "Critical",
        "summary": "The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a request handler reads the buffered data. A malicious client can exploit this to bypass the configure",
        "url": "https://go.dev/cl/847187",
        "version": "v0.58.0"
      },
      {
        "aliases": [
          "CVE-2026-101898"
        ],
        "ecosystem": "npm",
        "epss": {
          "cve": "CVE-2026-101898",
          "percentile": 0.45765,
          "score": 0.00545
        },
        "fix_state": "fixed",
        "fixed_in": [
          "1.20.0"
        ],
        "id": "GHSA-3pq3-5fj3-cg6v",
        "kev": null,
        "location": "pnpm-lock.yaml",
        "osv_confirmed": true,
        "package": "axios",
        "severity": "High",
        "summary": "Axios: HTTP/2 adapter bypasses configured DNS lookup and proxy controls",
        "url": "https://github.com/advisories/GHSA-3pq3-5fj3-cg6v",
        "version": "1.18.1"
      },
      {
        "aliases": [
          "CVE-2026-101901"
        ],
        "ecosystem": "npm",
        "epss": {
          "cve": "CVE-2026-101901",
          "percentile": 0.45207,
          "score": 0.00536
        },
        "fix_state": "fixed",
        "fixed_in": [
          "1.20.0"
        ],
        "id": "GHSA-542g-h47m-68v8",
        "kev": null,
        "location": "pnpm-lock.yaml",
        "osv_confirmed": true,
        "package": "axios",
        "severity": "High",
        "summary": "Axios: Denial of Service via Unhandled 'error' Event in HTTP/2 ClientHttp2Session Initialization",
        "url": "https://github.com/advisories/GHSA-542g-h47m-68v8",
        "version": "1.18.1"
      },
      {
        "aliases": [
          "CVE-2026-101903"
        ],
        "ecosystem": "npm",
        "epss": {
          "cve": "CVE-2026-101903",
          "percentile": 0.37877,
          "score": 0.00436
        },
        "fix_state": "fixed",
        "fixed_in": [
          "1.20.0"
        ],
        "id": "GHSA-c29m-xwm3-cm6r",
        "kev": null,
        "location": "pnpm-lock.yaml",
        "osv_confirmed": true,
        "package": "axios",
        "severity": "High",
        "summary": "Axios: ReDoS in fromDataURI data: URL parser freezes the Node event loop (DoS)",
        "url": "https://github.com/advisories/GHSA-c29m-xwm3-cm6r",
        "version": "1.18.1"
      },
      {
        "aliases": [
          "CVE-2026-101905"
        ],
        "ecosystem": "npm",
        "epss": {
          "cve": "CVE-2026-101905",
          "percentile": 0.36122,
          "score": 0.00418
        },
        "fix_state": "fixed",
        "fixed_in": [
          "1.20.0"
        ],
        "id": "GHSA-m8m8-qj5v-23w3",
        "kev": null,
        "location": "pnpm-lock.yaml",
        "osv_confirmed": true,
        "package": "axios",
        "severity": "High",
        "summary": "Axios: Node HTTP adapter prototype-pollution gadget allows request socket hijack via inherited createConnection",
        "url": "https://github.com/advisories/GHSA-m8m8-qj5v-23w3",
        "version": "1.18.1"
      },
      {
        "aliases": [
          "CVE-2026-101906"
        ],
        "ecosystem": "npm",
        "epss": {
          "cve": "CVE-2026-101906",
          "percentile": 0.39677,
          "score": 0.00457
        },
        "fix_state": "fixed",
        "fixed_in": [
          "1.20.0"
        ],
        "id": "GHSA-mghh-pgcx-3jjj",
        "kev": null,
        "location": "pnpm-lock.yaml",
        "osv_confirmed": true,
        "package": "axios",
        "severity": "High",
        "summary": "Axios: ReDoS (O(N\u00b2)) in shouldBypassProxy host normalization, reachable via untrusted redirect Location",
        "url": "https://github.com/advisories/GHSA-mghh-pgcx-3jjj",
        "version": "1.18.1"
      },
      {
        "aliases": [
          "CVE-2026-101907"
        ],
        "ecosystem": "npm",
        "epss": {
          "cve": "CVE-2026-101907",
          "percentile": 0.40789,
          "score": 0.00471
        },
        "fix_state": "fixed",
        "fixed_in": [
          "1.20.0"
        ],
        "id": "GHSA-r4gj-5m52-g5wh",
        "kev": null,
        "location": "pnpm-lock.yaml",
        "osv_confirmed": true,
        "package": "axios",
        "severity": "High",
        "summary": "Axios: maxRedirects: 0 is not enforced by the fetch adapter, allowing redirect-based SSRF",
        "url": "https://github.com/advisories/GHSA-r4gj-5m52-g5wh",
        "version": "1.18.1"
      },
      {
        "aliases": [
          "CVE-2026-101909"
        ],
        "ecosystem": "npm",
        "epss": {
          "cve": "CVE-2026-101909",
          "percentile": 0.42646,
          "score": 0.00497
        },
        "fix_state": "fixed",
        "fixed_in": [
          "1.20.0"
        ],
        "id": "GHSA-x97p-jq2g-jp4f",
        "kev": null,
        "location": "pnpm-lock.yaml",
        "osv_confirmed": true,
        "package": "axios",
        "severity": "High",
        "summary": "Axios: Prototype Pollution Gadget in axios toFormData Options",
        "url": "https://github.com/advisories/GHSA-x97p-jq2g-jp4f",
        "version": "1.18.1"
      },
      {
        "aliases": [
          "CVE-2026-102276"
        ],
        "ecosystem": "npm",
        "epss": {
          "cve": "CVE-2026-102276",
          "percentile": 0.39514,
          "score": 0.00455
        },
        "fix_state": "fixed",
        "fixed_in": [
          "5.0.10"
        ],
        "id": "GHSA-6j4f-fj2g-mc7p",
        "kev": null,
        "location": "pnpm-lock.yaml",
        "osv_confirmed": true,
        "package": "brace-expansion",
        "severity": "High",
        "summary": "brace-expansion: DoS via uncontrolled recursion in parseCommaParts causing stack exhaustion",
        "url": "https://github.com/advisories/GHSA-6j4f-fj2g-mc7p",
        "version": "5.0.9"
      },
      {
        "aliases": [
          "CVE-2026-102278"
        ],
        "ecosystem": "npm",
        "epss": {
          "cve": "CVE-2026-102278",
          "percentile": 0.42209,
          "score": 0.00491
        },
        "fix_state": "fixed",
        "fixed_in": [
          "5.0.11"
        ],
        "id": "GHSA-qhr7-859c-m2p7",
        "kev": null,
        "location": "pnpm-lock.yaml",
        "osv_confirmed": true,
        "package": "brace-expansion",
        "severity": "High",
        "summary": "brace-expansion: DoS via uncontrolled recursion on nested brace groups causing stack exhaustion",
        "url": "https://github.com/advisories/GHSA-qhr7-859c-m2p7",
        "version": "5.0.9"
      },
      {
        "aliases": [
          "CVE-2026-111755"
        ],
        "ecosystem": "npm",
        "epss": {
          "cve": "CVE-2026-111755",
          "percentile": 0.40761,
          "score": 0.00471
        },
        "fix_state": "fixed",
        "fixed_in": [
          "1.16.1"
        ],
        "id": "GHSA-8r9p-f939-6h3c",
        "kev": null,
        "location": "pnpm-lock.yaml",
        "osv_confirmed": true,
        "package": "follow-redirects",
        "severity": "High",
        "summary": "follow-redirects sensitiveHeaders regex escaping can expose credential headers",
        "url": "https://github.com/advisories/GHSA-8r9p-f939-6h3c",
        "version": "1.16.0"
      },
      {
        "aliases": [
          "CVE-2026-116689"
        ],
        "ecosystem": "npm",
        "epss": {
          "cve": "CVE-2026-116689",
          "percentile": 0.18802,
          "score": 0.00266
        },
        "fix_state": "fixed",
        "fixed_in": [
          "1.16.2"
        ],
        "id": "GHSA-mrwp-f3q8-3g9p",
        "kev": null,
        "location": "pnpm-lock.yaml",
        "osv_confirmed": true,
        "package": "follow-redirects",
        "severity": "High",
        "summary": "follow-redirects: Cross-realm sensitiveHeaders arrays are discarded and custom credentials can follow redirects",
        "url": "https://github.com/advisories/GHSA-mrwp-f3q8-3g9p",
        "version": "1.16.0"
      },
      {
        "aliases": [
          "CVE-2026-111756"
        ],
        "ecosystem": "npm",
        "epss": {
          "cve": "CVE-2026-111756",
          "percentile": 0.40762,
          "score": 0.00471
        },
        "fix_state": "fixed",
        "fixed_in": [
          "1.16.1"
        ],
        "id": "GHSA-q3jh-wrc6-jgq8",
        "kev": null,
        "location": "pnpm-lock.yaml",
        "osv_confirmed": true,
        "package": "follow-redirects",
        "severity": "High",
        "summary": "follow-redirects array-form headers bypass cross-origin credential stripping",
        "url": "https://github.com/advisories/GHSA-q3jh-wrc6-jgq8",
        "version": "1.16.0"
      },
      {
        "aliases": [
          "CVE-2026-32285"
        ],
        "ecosystem": "golang",
        "epss": {
          "cve": "CVE-2026-32285",
          "percentile": 0.55918,
          "score": 0.00779
        },
        "fix_state": "fixed",
        "fixed_in": [
          "1.1.2"
        ],
        "id": "GHSA-6g7g-w4f8-9c9x",
        "in_binary": "vulnerable code in binary",
        "kev": null,
        "location": "go.mod",
        "osv_confirmed": true,
        "package": "github.com/buger/jsonparser",
        "severity": "High",
        "summary": "github.com/buger/jsonparser has a denial of service vulnerability",
        "url": "https://github.com/advisories/GHSA-6g7g-w4f8-9c9x",
        "version": "v1.1.1"
      },
      {
        "aliases": [
          "CVE-2026-46680"
        ],
        "ecosystem": "golang",
        "epss": {
          "cve": "CVE-2026-46680",
          "percentile": 0.05463,
          "score": 0.00163
        },
        "fix_state": "fixed",
        "fixed_in": [
          "1.7.32"
        ],
        "id": "GHSA-fqw6-gf59-qr4w",
        "in_binary": "module in binary",
        "kev": null,
        "location": "go.mod",
        "osv_confirmed": true,
        "package": "github.com/containerd/containerd",
        "severity": "High",
        "summary": "containerd user ID handling bypass allows runAsNonRoot evasion",
        "url": "https://github.com/advisories/GHSA-fqw6-gf59-qr4w",
        "version": "v1.7.30"
      },
      {
        "aliases": [
          "CVE-2026-53488"
        ],
        "ecosystem": "golang",
        "epss": {
          "cve": "CVE-2026-53488",
          "percentile": 0.07132,
          "score": 0.00176
        },
        "fix_state": "fixed",
        "fixed_in": [
          "1.7.33"
        ],
        "id": "GHSA-xhf5-7wjv-pqxp",
        "in_binary": "module in binary",
        "kev": null,
        "location": "go.mod",
        "osv_confirmed": true,
        "package": "github.com/containerd/containerd",
        "severity": "High",
        "summary": "containerd CRI \u2014 image-config `LABEL` flows to restart-monitor `binary://` logger: host-root command execution from an image pull",
        "url": "https://github.com/advisories/GHSA-xhf5-7wjv-pqxp",
        "version": "v1.7.30"
      },
      {
        "aliases": [
          "CVE-2026-95837",
          "GHSA-p7v4-vr35-mj6f"
        ],
        "ecosystem": "golang",
        "epss": {
          "cve": "CVE-2026-95837",
          "percentile": 0.011,
          "score": 0.00106
        },
        "fix_state": "unknown",
        "fixed_in": [],
        "id": "GO-2026-6791",
        "in_binary": "module in binary",
        "kev": null,
        "location": "go.mod",
        "osv_confirmed": true,
        "package": "github.com/containerd/containerd",
        "severity": "High",
        "summary": "containerd CRI plugin: Checkpoint restore bypasses destination security context in github.com/containerd/containerd",
        "url": "https://github.com/containerd/containerd/security/advisories/GHSA-p7v4-vr35-mj6f",
        "version": "v1.7.30"
      },
      {
        "aliases": [
          "CVE-2026-42306"
        ],
        "ecosystem": "golang",
        "epss": {
          "cve": "CVE-2026-42306",
          "percentile": 0.01018,
          "score": 0.00104
        },
        "fix_state": "not-fixed",
        "fixed_in": [],
        "id": "GHSA-rg2x-37c3-w2rh",
        "in_binary": "vulnerable code in binary",
        "kev": null,
        "location": "go.mod",
        "osv_confirmed": true,
        "package": "github.com/docker/docker",
        "severity": "High",
        "summary": "Docker: Race condition in docker cp allows bind mount redirection to host path",
        "url": "https://github.com/advisories/GHSA-rg2x-37c3-w2rh",
        "version": "v28.5.2+incompatible"
      },
      {
        "aliases": [
          "CVE-2026-41567"
        ],
        "ecosystem": "golang",
        "epss": {
          "cve": "CVE-2026-41567",
          "percentile": 0.04603,
          "score": 0.00155
        },
        "fix_state": "not-fixed",
        "fixed_in": [],
        "id": "GHSA-x86f-5xw2-fm2r",
        "in_binary": "vulnerable code in binary",
        "kev": null,
        "location": "go.mod",
        "osv_confirmed": true,
        "package": "github.com/docker/docker",
        "severity": "High",
        "summary": "Docker: `PUT /containers/{id}/archive` executes container binary on the host",
        "url": "https://github.com/advisories/GHSA-x86f-5xw2-fm2r",
        "version": "v28.5.2+incompatible"
      },
      {
        "aliases": [
          "CVE-2026-34040",
          "GHSA-x744-4wpc-v9h2"
        ],
        "ecosystem": "golang",
        "epss": {
          "cve": "CVE-2026-34040",
          "percentile": 0.95361,
          "score": 0.0927
        },
        "fix_state": "unknown",
        "fixed_in": [],
        "id": "GO-2026-4887",
        "in_binary": "vulnerable code in binary",
        "kev": null,
        "location": "go.mod",
        "osv_confirmed": true,
        "package": "github.com/docker/docker",
        "severity": "High",
        "summary": "Moby has AuthZ plugin bypass when provided oversized request bodies in github.com/docker/docker",
        "url": "https://github.com/moby/moby/security/advisories/GHSA-x744-4wpc-v9h2",
        "version": "v28.5.2+incompatible"
      },
      {
        "aliases": [
          "CVE-2026-116587"
        ],
        "ecosystem": "golang",
        "epss": {
          "cve": "CVE-2026-116587",
          "percentile": 0.3048,
          "score": 0.00366
        },
        "fix_state": "fixed",
        "fixed_in": [
          "4.1.6"
        ],
        "id": "GHSA-mgcc-cww5-fp2q",
        "in_binary": "vulnerable code not in binary",
        "kev": null,
        "location": "go.mod",
        "osv_confirmed": true,
        "package": "github.com/go-jose/go-jose/v4",
        "severity": "High",
        "summary": "Go JOSE: DoS when parsing JWKs that contain RSA keys",
        "url": "https://github.com/advisories/GHSA-mgcc-cww5-fp2q",
        "version": "v4.1.4"
      },
      {
        "aliases": [
          "CVE-2026-40890"
        ],
        "ecosystem": "golang",
        "epss": {
          "cve": "CVE-2026-40890",
          "percentile": 0.2815,
          "score": 0.00346
        },
        "fix_state": "fixed",
        "fixed_in": [
          "0.0.0-20260411013819-759bbc3e3207"
        ],
        "id": "GHSA-77fj-vx54-gvh7",
        "in_binary": "vulnerable code in binary",
        "kev": null,
        "location": "go.mod",
        "osv_confirmed": true,
        "package": "github.com/gomarkdown/markdown",
        "severity": "High",
        "summary": "Go Markdown has an Out-of-bounds Read in SmartypantsRenderer",
        "url": "https://github.com/advisories/GHSA-77fj-vx54-gvh7",
        "version": "v0.0.0-20260217112301-37c66b85d6ab"
      },
      {
        "aliases": [
          "CVE-2026-102941"
        ],
        "ecosystem": "golang",
        "epss": {
          "cve": "CVE-2026-102941",
          "percentile": 0.20376,
          "score": 0.00279
        },
        "fix_state": "fixed",
        "fixed_in": [
          "0.0.0-20260724235538-61af6e1e6971"
        ],
        "id": "GHSA-cv23-7vc5-jfh7",
        "in_binary": "vulnerable code not in binary",
        "kev": null,
        "location": "go.mod",
        "osv_confirmed": true,
        "package": "github.com/gomarkdown/markdown",
        "severity": "High",
        "summary": "gomarkdown/markdown IsSafeURL panics on short URLs",
        "url": "https://github.com/advisories/GHSA-cv23-7vc5-jfh7",
        "version": "v0.0.0-20260217112301-37c66b85d6ab"
      },
      {
        "aliases": [
          "CVE-2026-4660"
        ],
        "ecosystem": "golang",
        "epss": {
          "cve": "CVE-2026-4660",
          "percentile": 0.47885,
          "score": 0.00583
        },
        "fix_state": "fixed",
        "fixed_in": [
          "1.8.6"
        ],
        "id": "GHSA-92mm-2pjq-r785",
        "in_binary": "module in binary",
        "kev": null,
        "location": "go.mod",
        "osv_confirmed": true,
        "package": "github.com/hashicorp/go-getter",
        "severity": "High",
        "summary": "HashiCorp's go-getter library may allow arbitrary file reads",
        "url": "https://github.com/advisories/GHSA-92mm-2pjq-r785",
        "version": "v1.8.4"
      },
      {
        "aliases": [
          "CVE-2026-63209"
        ],
        "ecosystem": "golang",
        "epss": {
          "cve": "CVE-2026-63209",
          "percentile": 0.47329,
          "score": 0.00572
        },
        "fix_state": "fixed",
        "fixed_in": [
          "1.18.7"
        ],
        "id": "GHSA-259r-337f-4rfw",
        "in_binary": "vulnerable code in binary",
        "kev": null,
        "location": "go.mod",
        "osv_confirmed": true,
        "package": "github.com/klauspost/compress",
        "severity": "High",
        "summary": "Compress/s2: Integer Overflow or Wraparound and Out-of-bounds Write in compress",
        "url": "https://github.com/advisories/GHSA-259r-337f-4rfw",
        "version": "v1.18.4"
      },
      {
        "aliases": [
          "CVE-2026-118650"
        ],
        "ecosystem": "golang",
        "epss": {
          "cve": "CVE-2026-118650",
          "percentile": 0.3387,
          "score": 0.00396
        },
        "fix_state": "fixed",
        "fixed_in": [
          "4.16.0"
        ],
        "id": "GHSA-375p-5qhx-8wq4",
        "in_binary": "vulnerable code not in binary",
        "kev": null,
        "location": "go.mod",
        "osv_confirmed": true,
        "package": "github.com/labstack/echo/v4",
        "severity": "High",
        "summary": "Echo's middleware.Static: `%2F`-encoded path bypasses route/group middleware guarding a statically-served path",
        "url": "https://github.com/advisories/GHSA-375p-5qhx-8wq4",
        "version": "v4.15.1"
      },
      {
        "aliases": [
          "CVE-2026-118262"
        ],
        "ecosystem": "golang",
        "epss": {
          "cve": "CVE-2026-118262",
          "percentile": 0.22933,
          "score": 0.00302
        },
        "fix_state": "fixed",
        "fixed_in": [
          "4.16.1"
        ],
        "id": "GHSA-9969-6676-49h5",
        "in_binary": "vulnerable code not in binary",
        "kev": null,
        "location": "go.mod",
        "osv_confirmed": true,
        "package": "github.com/labstack/echo/v4",
        "severity": "High",
        "summary": "Echo: WebSocket proxy can retain connections and handlers after client disconnect",
        "url": "https://github.com/advisories/GHSA-9969-6676-49h5",
        "version": "v4.15.1"
      },
      {
        "aliases": [
          "CVE-2026-118260"
        ],
        "ecosystem": "golang",
        "epss": {
          "cve": "CVE-2026-118260",
          "percentile": 0.31116,
          "score": 0.00372
        },
        "fix_state": "fixed",
        "fixed_in": [
          "4.16.1"
        ],
        "id": "GHSA-f48p-c9v4-h7xv",
        "in_binary": "vulnerable code not in binary",
        "kev": null,
        "location": "go.mod",
        "osv_confirmed": true,
        "package": "github.com/labstack/echo/v4",
        "severity": "High",
        "summary": "Echo: BodyDump captures request and response bodies without size limits in v4",
        "url": "https://github.com/advisories/GHSA-f48p-c9v4-h7xv",
        "version": "v4.15.1"
      },
      {
        "aliases": [
          "CVE-2026-118261"
        ],
        "ecosystem": "golang",
        "epss": {
          "cve": "CVE-2026-118261",
          "percentile": 0.31117,
          "score": 0.00372
        },
        "fix_state": "fixed",
        "fixed_in": [
          "4.16.1"
        ],
        "id": "GHSA-h7wr-284f-5qvc",
        "in_binary": "vulnerable code not in binary",
        "kev": null,
        "location": "go.mod",
        "osv_confirmed": true,
        "package": "github.com/labstack/echo/v4",
        "severity": "High",
        "summary": "Echo: Decompress permits unbounded gzip expansion in v4",
        "url": "https://github.com/advisories/GHSA-h7wr-284f-5qvc",
        "version": "v4.15.1"
      },
      {
        "aliases": [
          "CVE-2026-55677"
        ],
        "ecosystem": "golang",
        "epss": {
          "cve": "CVE-2026-55677",
          "percentile": 0.44161,
          "score": 0.00519
        },
        "fix_state": "fixed",
        "fixed_in": [
          "4.15.3"
        ],
        "id": "GHSA-vfp3-v2gw-7wfq",
        "in_binary": "vulnerable code in binary",
        "kev": null,
        "location": "go.mod",
        "osv_confirmed": true,
        "package": "github.com/labstack/echo/v4",
        "severity": "High",
        "summary": "Echo: Encoded slash (%2F) bypasses route-level protection and exposes static files",
        "url": "https://github.com/advisories/GHSA-vfp3-v2gw-7wfq",
        "version": "v4.15.1"
      },
      {
        "aliases": [
          "CVE-2026-33747"
        ],
        "ecosystem": "golang",
        "epss": {
          "cve": "CVE-2026-33747",
          "percentile": 0.43298,
          "score": 0.00507
        },
        "fix_state": "fixed",
        "fixed_in": [
          "0.28.1"
        ],
        "id": "GHSA-4c29-8rgm-jvjj",
        "in_binary": "vulnerable code in binary",
        "kev": null,
        "location": "go.mod",
        "osv_confirmed": true,
        "package": "github.com/moby/buildkit",
        "severity": "High",
        "summary": "BuildKit's Malicious frontend can cause file escape outside of storage root",
        "url": "https://github.com/advisories/GHSA-4c29-8rgm-jvjj",
        "version": "v0.26.3"
      },
      {
        "aliases": [
          "CVE-2026-33748"
        ],
        "ecosystem": "golang",
        "epss": {
          "cve": "CVE-2026-33748",
          "percentile": 0.41536,
          "score": 0.00481
        },
        "fix_state": "fixed",
        "fixed_in": [
          "0.28.1"
        ],
        "id": "GHSA-4vrq-3vrq-g6gg",
        "in_binary": "vulnerable code in binary",
        "kev": null,
        "location": "go.mod",
        "osv_confirmed": true,
        "package": "github.com/moby/buildkit",
        "severity": "High",
        "summary": "BuildKit Git URL subdir component can cause access to restricted files",
        "url": "https://github.com/advisories/GHSA-4vrq-3vrq-g6gg",
        "version": "v0.26.3"
      },
      {
        "aliases": [
          "CVE-2026-78662"
        ],
        "ecosystem": "golang",
        "epss": {
          "cve": "CVE-2026-78662",
          "percentile": 0.37388,
          "score": 0.00431
        },
        "fix_state": "fixed",
        "fixed_in": [
          "0.56.0"
        ],
        "id": "GO-2026-6354",
        "in_binary": "vulnerable code in binary",
        "kev": null,
        "location": "go.mod",
        "osv_confirmed": true,
        "package": "golang.org/x/crypto",
        "severity": "High",
        "summary": "Previously, a channel registered in the mux's chanList is not usable until it is established. A malicious peer was able flood the channel's incomingRequests, deadlocking the entire connection. Now, we add an atomic established state, set when a channel becomes usable. Until such a time, handlePacket",
        "url": "https://go.dev/issue/81316",
        "version": "v0.55.0"
      },
      {
        "aliases": [
          "CVE-2026-56855"
        ],
        "ecosystem": "golang",
        "epss": {
          "cve": "CVE-2026-56855",
          "percentile": 0.42867,
          "score": 0.005
        },
        "fix_state": "fixed",
        "fixed_in": [
          "0.56.0"
        ],
        "id": "GO-2026-6355",
        "in_binary": "vulnerable code in binary",
        "kev": null,
        "location": "go.mod",
        "osv_confirmed": true,
        "package": "golang.org/x/crypto",
        "severity": "High",
        "summary": "Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection. Now, we handle all RFC 4254 channel messages; global requests are handled explicitly. Then, treat all other messages as a protocol error and tear the connection d",
        "url": "https://go.dev/issue/81317",
        "version": "v0.55.0"
      },
      {
        "aliases": [
          "CVE-2026-56865"
        ],
        "ecosystem": "golang",
        "epss": {
          "cve": "CVE-2026-56865",
          "percentile": 0.02533,
          "score": 0.00129
        },
        "fix_state": "fixed",
        "fixed_in": [
          "0.40.0"
        ],
        "id": "GO-2026-6179",
        "in_binary": "vulnerable code in binary",
        "kev": null,
        "location": "go.mod",
        "osv_confirmed": true,
        "package": "golang.org/x/mod",
        "severity": "High",
        "summary": "A malicious GOPROXY was previously capable of forging up to two sumdb tiles that allow for a requested module to bypass the GOSUMDB check and persist attacker-controlled module content to a local Go module cache. This attack allows for a malicious GOPROXY to serve malicious module content that canno",
        "url": "https://go.dev/issue/80744",
        "version": "v0.38.0"
      },
      {
        "aliases": [
          "CVE-2026-56864"
        ],
        "ecosystem": "golang",
        "epss": {
          "cve": "CVE-2026-56864",
          "percentile": 0.22506,
          "score": 0.00298
        },
        "fix_state": "fixed",
        "fixed_in": [
          "0.40.0"
        ],
        "id": "GO-2026-6180",
        "in_binary": "vulnerable code in binary",
        "kev": null,
        "location": "go.mod",
        "osv_confirmed": true,
        "package": "golang.org/x/mod",
        "severity": "High",
        "summary": "A malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log. This attack allows for a coordinating GOPROXY and GOSUMDB to serve a client malicious module content that cannot be detected by evaluating the transparency log. In order to determine if you",
        "url": "https://go.dev/issue/80745",
        "version": "v0.38.0"
      },
      {
        "aliases": [
          "CVE-2026-78659"
        ],
        "ecosystem": "golang",
        "epss": {
          "cve": "CVE-2026-78659",
          "percentile": 0.50082,
          "score": 0.00627
        },
        "fix_state": "fixed",
        "fixed_in": [
          "0.60.0"
        ],
        "id": "GO-2026-6603",
        "in_binary": "vulnerable code in binary",
        "kev": null,
        "location": "go.mod",
        "osv_confirmed": true,
        "package": "golang.org/x/net",
        "severity": "High",
        "summary": "When \"Trailer\" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs memory overhead. For HTTP/2 servers, a malicious client can exploit this by sending a \"",
        "url": "https://go.dev/cl/847185",
        "version": "v0.58.0"
      },
      {
        "aliases": [
          "CVE-2026-78660"
        ],
        "ecosystem": "golang",
        "epss": {
          "cve": "CVE-2026-78660",
          "percentile": 0.36838,
          "score": 0.00425
        },
        "fix_state": "fixed",
        "fixed_in": [
          "0.60.0"
        ],
        "id": "GO-2026-6610",
        "in_binary": "vulnerable code in binary",
        "kev": null,
        "location": "go.mod",
        "osv_confirmed": true,
        "package": "golang.org/x/net",
        "severity": "High",
        "summary": "Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing. However, this makes it possible for our HTTP/2 implementation to forward responses containing such headers to an HTTP/1 client when acting as a re",
        "url": "https://go.dev/cl/835145",
        "version": "v0.58.0"
      },
      {
        "aliases": [
          "CVE-2026-78669"
        ],
        "ecosystem": "golang",
        "epss": {
          "cve": "CVE-2026-78669",
          "percentile": 0.49426,
          "score": 0.00614
        },
        "fix_state": "fixed",
        "fixed_in": [
          "0.60.0"
        ],
        "id": "GO-2026-6611",
        "in_binary": "vulnerable code in binary",
        "kev": null,
        "location": "go.mod",
        "osv_confirmed": true,
        "package": "golang.org/x/net",
        "severity": "High",
        "summary": "A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGS_INITIAL_WINDOW_SIZE values.",
        "url": "https://go.dev/cl/847186",
        "version": "v0.58.0"
      },
      {
        "aliases": [
          "CVE-2026-97032"
        ],
        "ecosystem": "golang",
        "epss": {
          "cve": "CVE-2026-97032",
          "percentile": 0.42154,
          "score": 0.0049
        },
        "fix_state": "fixed",
        "fixed_in": [
          "0.60.0"
        ],
        "id": "GO-2026-6617",
        "in_binary": "vulnerable code in binary",
        "kev": null,
        "location": "go.mod",
        "osv_confirmed": true,
        "package": "golang.org/x/net",
        "severity": "High",
        "summary": "HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently. This happens because the server modifies the HPACK encoder from two goroutines without synchronization: one uses the encoder to encode a HEADERS frame as part of a response sent to a client and the ot",
        "url": "https://go.dev/cl/847188",
        "version": "v0.58.0"
      },
      {
        "aliases": [
          "CVE-2026-104854"
        ],
        "ecosystem": "npm",
        "epss": {
          "cve": "CVE-2026-104854",
          "percentile": 0.03449,
          "score": 0.00142
        },
        "fix_state": "fixed",
        "fixed_in": [
          "23.1.2"
        ],
        "id": "GHSA-w3vv-58gj-gw77",
        "kev": null,
        "location": "pnpm-lock.yaml",
        "osv_confirmed": true,
        "package": "nx",
        "severity": "High",
        "summary": "Nx daemon and plugin worker sockets are accessible to other local users",
        "url": "https://github.com/advisories/GHSA-w3vv-58gj-gw77",
        "version": "23.1.1"
      },
      {
        "aliases": [
          "CVE-2026-85730"
        ],
        "ecosystem": "npm",
        "epss": {
          "cve": "CVE-2026-85730",
          "percentile": 0.4444,
          "score": 0.00524
        },
        "fix_state": "fixed",
        "fixed_in": [
          "1.7.1"
        ],
        "id": "GHSA-7w5x-hrqm-74c2",
        "kev": null,
        "location": "pnpm-lock.yaml",
        "osv_confirmed": true,
        "package": "smol-toml",
        "severity": "High",
        "summary": "smol-toml: Denial of Service via malformed TOML documents",
        "url": "https://github.com/advisories/GHSA-7w5x-hrqm-74c2",
        "version": "1.6.1"
      },
      {
        "aliases": [
          "CVE-2026-101899"
        ],
        "ecosystem": "npm",
        "epss": {
          "cve": "CVE-2026-101899",
          "percentile": 0.4369,
          "score": 0.00512
        },
        "fix_state": "fixed",
        "fixed_in": [
          "1.20.0"
        ],
        "id": "GHSA-44g4-m2mj-wpvx",
        "kev": null,
        "location": "pnpm-lock.yaml",
        "osv_confirmed": true,
        "package": "axios",
        "severity": "Medium",
        "summary": "Axios: CIDR-form NO_PROXY entries are ignored, causing proxy exclusion bypass for internal IP ranges",
        "url": "https://github.com/advisories/GHSA-44g4-m2mj-wpvx",
        "version": "1.18.1"
      },
      {
        "aliases": [
          "CVE-2026-101900"
        ],
        "ecosystem": "npm",
        "epss": {
          "cve": "CVE-2026-101900",
          "percentile": 0.45807,
          "score": 0.00546
        },
        "fix_state": "fixed",
        "fixed_in": [
          "1.20.0"
        ],
        "id": "GHSA-4hqw-qxg8-jxx2",
        "kev": null,
        "location": "pnpm-lock.yaml",
        "osv_confirmed": true,
        "package": "axios",
        "severity": "Medium",
        "summary": "Axios: Fetch Adapter Header Injection via Inherited FormData getHeaders",
        "url": "https://github.com/advisories/GHSA-4hqw-qxg8-jxx2",
        "version": "1.18.1"
      },
      {
        "aliases": [
          "CVE-2026-101902"
        ],
        "ecosystem": "npm",
        "epss": {
          "cve": "CVE-2026-101902",
          "percentile": 0.35667,
          "score": 0.00414
        },
        "fix_state": "fixed",
        "fixed_in": [
          "1.20.0"
        ],
        "id": "GHSA-9fr6-4gfg-395g",
        "kev": null,
        "location": "pnpm-lock.yaml",
        "osv_confirmed": true,
        "package": "axios",
        "severity": "Medium",
        "summary": "Axios: Prototype-Pollution Gadget in the Default Instance Allows Inherited Object.prototype.method to Override HTTP Method",
        "url": "https://github.com/advisories/GHSA-9fr6-4gfg-395g",
        "version": "1.18.1"
      },
      {
        "aliases": [
          "CVE-2026-101904"
        ],
        "ecosystem": "npm",
        "epss": {
          "cve": "CVE-2026-101904",
          "percentile": 0.42037,
          "score": 0.00488
        },
        "fix_state": "fixed",
        "fixed_in": [
          "1.20.0"
        ],
        "id": "GHSA-j8rh-479h-cp32",
        "kev": null,
        "location": "pnpm-lock.yaml",
        "osv_confirmed": true,
        "package": "axios",
        "severity": "Medium",
        "summary": "Axios: Header Injection via Inherited headers After Minimal Interceptor",
        "url": "https://github.com/advisories/GHSA-j8rh-479h-cp32",
        "version": "1.18.1"
      },
      {
        "aliases": [
          "CVE-2026-101908"
        ],
        "ecosystem": "npm",
        "epss": {
          "cve": "CVE-2026-101908",
          "percentile": 0.40711,
          "score": 0.00471
        },
        "fix_state": "fixed",
        "fixed_in": [
          "1.20.0"
        ],
        "id": "GHSA-vh66-26gq-q6x8",
        "kev": null,
        "location": "pnpm-lock.yaml",
        "osv_confirmed": true,
        "package": "axios",
        "severity": "Medium",
        "summary": "Axios: Prototype pollution gadget in fetch adapter can alter outbound requests",
        "url": "https://github.com/advisories/GHSA-vh66-26gq-q6x8",
        "version": "1.18.1"
      },
      {
        "aliases": [
          "CVE-2026-102277"
        ],
        "ecosystem": "npm",
        "epss": {
          "cve": "CVE-2026-102277",
          "percentile": 0.37116,
          "score": 0.00428
        },
        "fix_state": "fixed",
        "fixed_in": [
          "5.0.12"
        ],
        "id": "GHSA-q2hr-2g5m-vwhr",
        "kev": null,
        "location": "pnpm-lock.yaml",
        "osv_confirmed": true,
        "package": "brace-expansion",
        "severity": "Medium",
        "summary": "brace-expansion: Quadratic-time expansion of the `{a},b}` rewrite causes CPU denial of service",
        "url": "https://github.com/advisories/GHSA-q2hr-2g5m-vwhr",
        "version": "5.0.9"
      },
      {
        "aliases": [],
        "ecosystem": "golang",
        "epss": {
          "cve": "CVE-2026-33481",
          "percentile": 0.36677,
          "score": 0.00423
        },
        "fix_state": "fixed",
        "fixed_in": [
          "1.42.3"
        ],
        "id": "CVE-2026-33481",
        "in_binary": "module in binary",
        "kev": null,
        "location": "go.mod",
        "osv_confirmed": true,
        "package": "github.com/anchore/syft",
        "severity": "Medium",
        "summary": "Syft is a a CLI tool and Go library for generating a Software Bill of Materials (SBOM) from container images and filesystems. Syft versions before v1.42.3 would not properly cleanup temporary storage if the temporary storage was exhausted during a scan. When scanning archives Syft will unpack those ",
        "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33481",
        "version": "v1.40.0"
      },
      {
        "aliases": [
          "CVE-2026-33481"
        ],
        "ecosystem": "golang",
        "epss": {
          "cve": "CVE-2026-33481",
          "percentile": 0.36677,
          "score": 0.00423
        },
        "fix_state": "fixed",
        "fixed_in": [
          "1.42.3"
        ],
        "id": "GHSA-rjcw-vg7j-m9rc",
        "in_binary": "module in binary",
        "kev": null,
        "location": "go.mod",
        "osv_confirmed": true,
        "package": "github.com/anchore/syft",
        "severity": "Medium",
        "summary": "Syft improper temporary file cleanup",
        "url": "https://github.com/advisories/GHSA-rjcw-vg7j-m9rc",
        "version": "v1.40.0"
      },
      {
        "aliases": [
          "CVE-2026-53495"
        ],
        "ecosystem": "golang",
        "epss": {
          "cve": "CVE-2026-53495",
          "percentile": 0.05332,
          "score": 0.00162
        },
        "fix_state": "fixed",
        "fixed_in": [
          "1.7.35"
        ],
        "id": "GHSA-7jxh-36q5-gcqv",
        "in_binary": "module in binary",
        "kev": null,
        "location": "go.mod",
        "osv_confirmed": true,
        "package": "github.com/containerd/containerd",
        "severity": "Medium",
        "summary": "containerd: CRI ExecSync Goroutine Leak Leads to Node-Level Denial of Service",
        "url": "https://github.com/advisories/GHSA-7jxh-36q5-gcqv",
        "version": "v1.7.30"
      },
      {
        "aliases": [
          "CVE-2026-47262"
        ],
        "ecosystem": "golang",
        "epss": {
          "cve": "CVE-2026-47262",
          "percentile": 0.18457,
          "score": 0.00265
        },
        "fix_state": "fixed",
        "fixed_in": [
          "1.7.33"
        ],
        "id": "GHSA-jpcc-p29g-p8mq",
        "in_binary": "module in binary",
        "kev": null,
        "location": "go.mod",
        "osv_confirmed": true,
        "package": "github.com/containerd/containerd",
        "severity": "Medium",
        "summary": "containerd image-triggered runtime DoS via unbounded group parsing",
        "url": "https://github.com/advisories/GHSA-jpcc-p29g-p8mq",
        "version": "v1.7.30"
      },
      {
        "aliases": [
          "CVE-2026-53493"
        ],
        "ecosystem": "golang",
        "epss": {
          "cve": "CVE-2026-53493",
          "percentile": 0.29375,
          "score": 0.00356
        },
        "fix_state": "fixed",
        "fixed_in": [
          "1.7.36"
        ],
        "id": "GHSA-pg57-6jwg-q645",
        "in_binary": "module in binary",
        "kev": null,
        "location": "go.mod",
        "osv_confirmed": true,
        "package": "github.com/containerd/containerd",
        "severity": "Medium",
        "summary": "Containerd has image-pull DoS via crafted OCI index graph amplification",
        "url": "https://github.com/advisories/GHSA-pg57-6jwg-q645",
        "version": "v1.7.30"
      },
      {
        "aliases": [
          "CVE-2026-95838"
        ],
        "ecosystem": "golang",
        "epss": {
          "cve": "CVE-2026-95838",
          "percentile": 0.1296,
          "score": 0.00223
        },
        "fix_state": "fixed",
        "fixed_in": [
          "1.7.35"
        ],
        "id": "GHSA-rp3h-jf77-q9p4",
        "in_binary": "module in binary",
        "kev": null,
        "location": "go.mod",
        "osv_confirmed": true,
        "package": "github.com/containerd/containerd",
        "severity": "Medium",
        "summary": "containerd: Unpack DoS via repeated opaque whiteouts",
        "url": "https://github.com/advisories/GHSA-rp3h-jf77-q9p4",
        "version": "v1.7.30"
      },
      {
        "aliases": [
          "CVE-2026-53489",
          "GHSA-rgh6-rfwx-v388"
        ],
        "ecosystem": "golang",
        "epss": {
          "cve": "CVE-2026-53489",
          "percentile": 0.06876,
          "score": 0.00174
        },
        "fix_state": "unknown",
        "fixed_in": [],
        "id": "GO-2026-5622",
        "in_binary": "module in binary",
        "kev": null,
        "location": "go.mod",
        "osv_confirmed": true,
        "package": "github.com/containerd/containerd",
        "severity": "Medium",
        "summary": "Arbitrary host CRI log file read via symlink following in CRI checkpoint restore in github.com/containerd/containerd",
        "url": "https://github.com/containerd/containerd/security/advisories/GHSA-rgh6-rfwx-v388",
        "version": "v1.7.30"
      },
      {
        "aliases": [
          "CVE-2026-85747"
        ],
        "ecosystem": "golang",
        "epss": {
          "cve": "CVE-2026-85747",
          "percentile": 0.12276,
          "score": 0.00218
        },
        "fix_state": "not-fixed",
        "fixed_in": [],
        "id": "GHSA-685w-q87j-wqw3",
        "in_binary": "vulnerable code not in binary",
        "kev": null,
        "location": "go.mod",
        "osv_confirmed": true,
        "package": "github.com/docker/distribution",
        "severity": "Medium",
        "summary": "Distribution: Client `manifests.Get()` does not verify returned content against requested digest",
        "url": "https://github.com/advisories/GHSA-685w-q87j-wqw3",
        "version": "v2.8.3+incompatible"
      },
      {
        "aliases": [
          "CVE-2026-33997"
        ],
        "ecosystem": "golang",
        "epss": {
          "cve": "CVE-2026-33997",
          "percentile": 0.34433,
          "score": 0.00402
        },
        "fix_state": "not-fixed",
        "fixed_in": [],
        "id": "GHSA-pxq6-2prw-chj9",
        "in_binary": "vulnerable code in binary",
        "kev": null,
        "location": "go.mod",
        "osv_confirmed": true,
        "package": "github.com/docker/docker",
        "severity": "Medium",
        "summary": "Moby has an Off-by-one error in its plugin privilege validation",
        "url": "https://github.com/advisories/GHSA-pxq6-2prw-chj9",
        "version": "v28.5.2+incompatible"
      },
      {
        "aliases": [
          "CVE-2026-41568"
        ],
        "ecosystem": "golang",
        "epss": {
          "cve": "CVE-2026-41568",
          "percentile": 0.01188,
          "score": 0.00108
        },
        "fix_state": "not-fixed",
        "fixed_in": [],
        "id": "GHSA-vp62-88p7-qqf5",
        "in_binary": "vulnerable code in binary",
        "kev": null,
        "location": "go.mod",
        "osv_confirmed": true,
        "package": "github.com/docker/docker",
        "severity": "Medium",
        "summary": "Docker: Race condition in docker cp allows creation of arbitrary empty files on the host via symlink swap",
        "url": "https://github.com/advisories/GHSA-vp62-88p7-qqf5",
        "version": "v28.5.2+incompatible"
      },
      {
        "aliases": [
          "CVE-2026-116585"
        ],
        "ecosystem": "golang",
        "epss": {
          "cve": "CVE-2026-116585",
          "percentile": 0.18368,
          "score": 0.00264
        },
        "fix_state": "fixed",
        "fixed_in": [
          "4.1.5"
        ],
        "id": "GHSA-4w3g-jfj2-cw2q",
        "in_binary": "vulnerable code not in binary",
        "kev": null,
        "location": "go.mod",
        "osv_confirmed": true,
        "package": "github.com/go-jose/go-jose/v4",
        "severity": "Medium",
        "summary": "Go JOSE: Panic during CBC-HMAC processing",
        "url": "https://github.com/advisories/GHSA-4w3g-jfj2-cw2q",
        "version": "v4.1.4"
      },
      {
        "aliases": [
          "CVE-2026-116586"
        ],
        "ecosystem": "golang",
        "epss": {
          "cve": "CVE-2026-116586",
          "percentile": 0.21769,
          "score": 0.00292
        },
        "fix_state": "fixed",
        "fixed_in": [
          "4.1.5"
        ],
        "id": "GHSA-vvm8-gf78-28g4",
        "in_binary": "vulnerable code not in binary",
        "kev": null,
        "location": "go.mod",
        "osv_confirmed": true,
        "package": "github.com/go-jose/go-jose/v4",
        "severity": "Medium",
        "summary": "Go JOSE: Panics in JSON parsing",
        "url": "https://github.com/advisories/GHSA-vvm8-gf78-28g4",
        "version": "v4.1.4"
      },
      {
        "aliases": [],
        "ecosystem": "golang",
        "epss": null,
        "fix_state": "fixed",
        "fixed_in": [
          "0.29.0"
        ],
        "id": "GHSA-gcjh-h69q-9w9g",
        "in_binary": "vulnerable code in binary",
        "kev": null,
        "location": "go.mod",
        "osv_confirmed": true,
        "package": "github.com/google/cel-go",
        "severity": "Medium",
        "summary": "cel-go: JSON Private Fields Exposed via NativeTypes and ParseStructTag",
        "url": "https://github.com/advisories/GHSA-gcjh-h69q-9w9g",
        "version": "v0.27.0"
      },
      {
        "aliases": [
          "CVE-2026-118658"
        ],
        "ecosystem": "golang",
        "epss": {
          "cve": "CVE-2026-118658",
          "percentile": 0.08179,
          "score": 0.00186
        },
        "fix_state": "fixed",
        "fixed_in": [
          "4.15.2"
        ],
        "id": "GHSA-23wf-92cp-8pcj",
        "in_binary": "vulnerable code not in binary",
        "kev": null,
        "location": "go.mod",
        "osv_confirmed": true,
        "package": "github.com/labstack/echo/v4",
        "severity": "Medium",
        "summary": "Echo has Arbitrary Scheme Injection in WWWRedirect/NonWWWRedirect Middlewares via X-Forwarded-Proto",
        "url": "https://github.com/advisories/GHSA-23wf-92cp-8pcj",
        "version": "v4.15.1"
      },
      {
        "aliases": [
          "CVE-2026-118653"
        ],
        "ecosystem": "golang",
        "epss": {
          "cve": "CVE-2026-118653",
          "percentile": 0.35838,
          "score": 0.00415
        },
        "fix_state": "not-fixed",
        "fixed_in": [],
        "id": "GHSA-246p-cpwv-v3jq",
        "in_binary": "vulnerable code not in binary",
        "kev": null,
        "location": "go.mod",
        "osv_confirmed": true,
        "package": "github.com/labstack/echo/v4",
        "severity": "Medium",
        "summary": "Echo has Rate Limiter Bypass via Spoofed X-Forwarded-For Header in Default Configuration",
        "url": "https://github.com/advisories/GHSA-246p-cpwv-v3jq",
        "version": "v4.15.1"
      },
      {
        "aliases": [
          "CVE-2026-118657"
        ],
        "ecosystem": "golang",
        "epss": {
          "cve": "CVE-2026-118657",
          "percentile": 0.02835,
          "score": 0.00133
        },
        "fix_state": "fixed",
        "fixed_in": [
          "4.16.0"
        ],
        "id": "GHSA-2ffq-g2xg-c22p",
        "in_binary": "vulnerable code not in binary",
        "kev": null,
        "location": "go.mod",
        "osv_confirmed": true,
        "package": "github.com/labstack/echo/v4",
        "severity": "Medium",
        "summary": "Echo: HTTPS Redirect and HSTS Bypass via Unconditional Trust of Forwarded Scheme Headers",
        "url": "https://github.com/advisories/GHSA-2ffq-g2xg-c22p",
        "version": "v4.15.1"
      },
      {
        "aliases": [
          "CVE-2026-118654"
        ],
        "ecosystem": "golang",
        "epss": {
          "cve": "CVE-2026-118654",
          "percentile": 0.28268,
          "score": 0.00347
        },
        "fix_state": "fixed",
        "fixed_in": [
          "4.16.0"
        ],
        "id": "GHSA-3pmx-cf9f-34xr",
        "in_binary": "vulnerable code not in binary",
        "kev": null,
        "location": "go.mod",
        "osv_confirmed": true,
        "package": "github.com/labstack/echo/v4",
        "severity": "Medium",
        "summary": "Echo static file middleware route protection bypass via encoded dot-dot traversal",
        "url": "https://github.com/advisories/GHSA-3pmx-cf9f-34xr",
        "version": "v4.15.1"
      },
      {
        "aliases": [
          "CVE-2026-118651"
        ],
        "ecosystem": "golang",
        "epss": {
          "cve": "CVE-2026-118651",
          "percentile": 0.10806,
          "score": 0.00207
        },
        "fix_state": "not-fixed",
        "fixed_in": [],
        "id": "GHSA-99jh-6h7p-pp36",
        "in_binary": "vulnerable code not in binary",
        "kev": null,
        "location": "go.mod",
        "osv_confirmed": true,
        "package": "github.com/labstack/echo/v4",
        "severity": "Medium",
        "summary": "Echo: Reverse Proxy Forwards Attacker-Supplied X-Real-IP to Upstream by Default",
        "url": "https://github.com/advisories/GHSA-99jh-6h7p-pp36",
        "version": "v4.15.1"
      },
      {
        "aliases": [
          "CVE-2026-118652"
        ],
        "ecosystem": "golang",
        "epss": {
          "cve": "CVE-2026-118652",
          "percentile": 0.15054,
          "score": 0.00239
        },
        "fix_state": "fixed",
        "fixed_in": [
          "4.16.0"
        ],
        "id": "GHSA-h9g5-28mm-hx3g",
        "in_binary": "vulnerable code not in binary",
        "kev": null,
        "location": "go.mod",
        "osv_confirmed": true,
        "package": "github.com/labstack/echo/v4",
        "severity": "Medium",
        "summary": "Echo vulnerable to Reflected Cross-Site Scripting (XSS) via unsanitized JSONP callback in Context.JSONP / Context.JSONPBlob",
        "url": "https://github.com/advisories/GHSA-h9g5-28mm-hx3g",
        "version": "v4.15.1"
      },
      {
        "aliases": [
          "CVE-2026-118266"
        ],
        "ecosystem": "golang",
        "epss": {
          "cve": "CVE-2026-118266",
          "percentile": 0.05504,
          "score": 0.00163
        },
        "fix_state": "fixed",
        "fixed_in": [
          "4.16.0"
        ],
        "id": "GHSA-r7w9-592q-9vg4",
        "in_binary": "vulnerable code not in binary",
        "kev": null,
        "location": "go.mod",
        "osv_confirmed": true,
        "package": "github.com/labstack/echo/v4",
        "severity": "Medium",
        "summary": "Echo has CSRF Protection Bypass via MethodOverride Rewriting POST to Safe Method",
        "url": "https://github.com/advisories/GHSA-r7w9-592q-9vg4",
        "version": "v4.15.1"
      },
      {
        "aliases": [
          "CVE-2026-118656"
        ],
        "ecosystem": "golang",
        "epss": {
          "cve": "CVE-2026-118656",
          "percentile": 0.09443,
          "score": 0.00197
        },
        "fix_state": "fixed",
        "fixed_in": [
          "4.16.0"
        ],
        "id": "GHSA-v753-g4cw-jm48",
        "in_binary": "vulnerable code not in binary",
        "kev": null,
        "location": "go.mod",
        "osv_confirmed": true,
        "package": "github.com/labstack/echo/v4",
        "severity": "Medium",
        "summary": "Echo has Open Redirect via Control-Character Prefix Defeating sanitizeURI",
        "url": "https://github.com/advisories/GHSA-v753-g4cw-jm48",
        "version": "v4.15.1"
      },
      {
        "aliases": [
          "CVE-2026-118655"
        ],
        "ecosystem": "golang",
        "epss": {
          "cve": "CVE-2026-118655",
          "percentile": 0.23118,
          "score": 0.00303
        },
        "fix_state": "fixed",
        "fixed_in": [
          "4.15.3"
        ],
        "id": "GHSA-xwq5-6cqp-vx96",
        "in_binary": "vulnerable code not in binary",
        "kev": null,
        "location": "go.mod",
        "osv_confirmed": true,
        "package": "github.com/labstack/echo/v4",
        "severity": "Medium",
        "summary": "Echo has a Static Middleware Double-Unescape Path Traversal",
        "url": "https://github.com/advisories/GHSA-xwq5-6cqp-vx96",
        "version": "v4.15.1"
      },
      {
        "aliases": [
          "CVE-2026-61711"
        ],
        "ecosystem": "golang",
        "epss": {
          "cve": "CVE-2026-61711",
          "percentile": 0.29451,
          "score": 0.00357
        },
        "fix_state": "fixed",
        "fixed_in": [
          "0.31.1"
        ],
        "id": "GHSA-7236-3392-c5c6",
        "in_binary": "vulnerable code in binary",
        "kev": null,
        "location": "go.mod",
        "osv_confirmed": true,
        "package": "github.com/moby/buildkit",
        "severity": "Medium",
        "summary": "BuildKit: Custom frontend could bypass Seccomp/AppArmor",
        "url": "https://github.com/advisories/GHSA-7236-3392-c5c6",
        "version": "v0.26.3"
      },
      {
        "aliases": [
          "CVE-2026-61801"
        ],
        "ecosystem": "golang",
        "epss": {
          "cve": "CVE-2026-61801",
          "percentile": 0.01634,
          "score": 0.00117
        },
        "fix_state": "fixed",
        "fixed_in": [
          "0.4.1"
        ],
        "id": "GHSA-mjcv-p78q-w5fw",
        "in_binary": "vulnerable code in binary",
        "kev": null,
        "location": "go.mod",
        "osv_confirmed": true,
        "package": "github.com/moby/sys/user",
        "severity": "Medium",
        "summary": "github.com/moby/sys/user has a possible DoS via unbounded parsing of user and group database files",
        "url": "https://github.com/advisories/GHSA-mjcv-p78q-w5fw",
        "version": "v0.4.0"
      },
      {
        "aliases": [
          "CVE-2026-40898"
        ],
        "ecosystem": "golang",
        "epss": {
          "cve": "CVE-2026-40898",
          "percentile": 0.33786,
          "score": 0.00396
        },
        "fix_state": "fixed",
        "fixed_in": [
          "0.59.1"
        ],
        "id": "GHSA-vvgj-x9jq-8cj9",
        "in_binary": "vulnerable code in binary",
        "kev": null,
        "location": "go.mod",
        "osv_confirmed": true,
        "package": "github.com/quic-go/quic-go",
        "severity": "Medium",
        "summary": "quic-go: HTTP/3 QPACK Trailer Expansion Memory Exhaustion",
        "url": "https://github.com/advisories/GHSA-vvgj-x9jq-8cj9",
        "version": "v0.59.0"
      },
      {
        "aliases": [
          "CVE-2026-5160",
          "GHSA-c97m-vxhj-p7j6"
        ],
        "ecosystem": "golang",
        "epss": {
          "cve": "CVE-2026-5160",
          "percentile": 0.21228,
          "score": 0.00287
        },
        "fix_state": "fixed",
        "fixed_in": [
          "1.7.17"
        ],
        "id": "GO-2026-5320",
        "in_binary": "vulnerable code in binary",
        "kev": null,
        "location": "go.mod",
        "osv_confirmed": true,
        "package": "github.com/yuin/goldmark",
        "severity": "Medium",
        "summary": "Cross-site Scripting (XSS) in github.com/yuin/goldmark",
        "url": "https://github.com/advisories/GHSA-c97m-vxhj-p7j6",
        "version": "v1.7.16"
      },
      {
        "aliases": [
          "CVE-2026-118764"
        ],
        "ecosystem": "npm",
        "epss": {
          "cve": "CVE-2026-118764",
          "percentile": 0.21751,
          "score": 0.00291
        },
        "fix_state": "fixed",
        "fixed_in": [
          "11.0.1"
        ],
        "id": "GHSA-g3hv-75wg-m249",
        "kev": null,
        "location": "pnpm-lock.yaml",
        "osv_confirmed": true,
        "package": "minimatch",
        "severity": "Medium",
        "summary": "minimatch has potential denial of service via globparts amplification",
        "url": "https://github.com/advisories/GHSA-g3hv-75wg-m249",
        "version": "10.2.5"
      },
      {
        "aliases": [
          "CVE-2026-104853"
        ],
        "ecosystem": "npm",
        "epss": {
          "cve": "CVE-2026-104853",
          "percentile": 0.06559,
          "score": 0.00172
        },
        "fix_state": "fixed",
        "fixed_in": [
          "23.2.1"
        ],
        "id": "GHSA-hrvq-x7jp-36xv",
        "kev": null,
        "location": "pnpm-lock.yaml",
        "osv_confirmed": true,
        "package": "nx",
        "severity": "Medium",
        "summary": "Nx: Path traversal in nx migrate package-migrations extraction",
        "url": "https://github.com/advisories/GHSA-hrvq-x7jp-36xv",
        "version": "23.1.1"
      },
      {
        "aliases": [],
        "ecosystem": "npm",
        "epss": null,
        "fix_state": "fixed",
        "fixed_in": [
          "1.9.0"
        ],
        "id": "GHSA-r4xh-jqrq-34v2",
        "kev": null,
        "location": "pnpm-lock.yaml",
        "osv_confirmed": true,
        "package": "smol-toml",
        "severity": "Medium",
        "summary": "smol-toml: Quadratic-time parse() from parseKey rescanning to end of document on each key line",
        "url": "https://github.com/advisories/GHSA-r4xh-jqrq-34v2",
        "version": "1.6.1"
      },
      {
        "aliases": [
          "CVE-2026-61712"
        ],
        "ecosystem": "golang",
        "epss": {
          "cve": "CVE-2026-61712",
          "percentile": 0.34089,
          "score": 0.00399
        },
        "fix_state": "fixed",
        "fixed_in": [
          "0.31.1"
        ],
        "id": "GHSA-72x6-4j93-7w86",
        "in_binary": "vulnerable code in binary",
        "kev": null,
        "location": "go.mod",
        "osv_confirmed": true,
        "package": "github.com/moby/buildkit",
        "severity": "Low",
        "summary": "BuildKit has a possible runtime DoS via unbounded group parsing",
        "url": "https://github.com/advisories/GHSA-72x6-4j93-7w86",
        "version": "v0.26.3"
      },
      {
        "aliases": [],
        "ecosystem": "golang",
        "epss": null,
        "fix_state": "unknown",
        "fixed_in": [],
        "id": "GO-2026-5932",
        "in_binary": "vulnerable code in binary",
        "kev": null,
        "location": "go.mod",
        "osv_confirmed": true,
        "package": "golang.org/x/crypto",
        "severity": "Unknown",
        "summary": "The golang.org/x/crypto/openpgp package is unsafe by design, has numerous known security issues, is not maintained, and should not be used. If you are required to interoperate with OpenPGP systems and need a maintained package, consider github.com/ProtonMail/go-crypto/openpgp which is a maintained f",
        "url": "https://go.dev/issue/44226",
        "version": "v0.55.0"
      },
      {
        "aliases": [
          "CVE-2026-78661"
        ],
        "ecosystem": "golang",
        "epss": {
          "cve": "CVE-2026-78661",
          "percentile": 0.08063,
          "score": 0.00185
        },
        "fix_state": "fixed",
        "fixed_in": [
          "0.62.0"
        ],
        "id": "GO-2026-6860",
        "in_binary": "vulnerable code in binary",
        "kev": null,
        "location": "go.mod",
        "osv_confirmed": true,
        "package": "golang.org/x/net",
        "severity": "Unknown",
        "summary": "When coalescing adjacent text nodes in addText and fosterParent, appending to an existing TextNode's Data via string concatenation (n.Data += text) reallocated and copied the accumulated string on every token. Inputs containing many short text runs separated by ignored end tags (such as \"a</x>\") cau",
        "url": "https://go.dev/cl/849365",
        "version": "v0.58.0"
      },
      {
        "aliases": [
          "CVE-2026-97045"
        ],
        "ecosystem": "golang",
        "epss": {
          "cve": "CVE-2026-97045",
          "percentile": 0.10117,
          "score": 0.00202
        },
        "fix_state": "fixed",
        "fixed_in": [
          "0.62.0"
        ],
        "id": "GO-2026-6866",
        "in_binary": "vulnerable code in binary",
        "kev": null,
        "location": "go.mod",
        "osv_confirmed": true,
        "package": "golang.org/x/net",
        "severity": "Unknown",
        "summary": "In childTextNodesAreLiteral, walking up the tree previously stopped at the nearest foreign ancestor once an HTML integration point was found. However, that integration point may itself be a descendant of an element that was foster-parented into a foreign namespace (such as <mglyph> or <malignmark> f",
        "url": "https://go.dev/cl/855121",
        "version": "v0.58.0"
      }
    ],
    "workflow_audit": {
      "files": 12,
      "findings": [
        {
          "confidence": "High",
          "description": "code injection via template expansion",
          "file": ".github/workflows/container.yml",
          "line": 48,
          "note": "this step",
          "rule": "template-injection",
          "severity": "High",
          "url": "https://docs.zizmor.sh/audits/#template-injection"
        },
        {
          "confidence": "High",
          "description": "code injection via template expansion",
          "file": ".github/workflows/container.yml",
          "line": 48,
          "note": "this step",
          "rule": "template-injection",
          "severity": "High",
          "url": "https://docs.zizmor.sh/audits/#template-injection"
        },
        {
          "confidence": "High",
          "description": "overly broad permissions",
          "file": ".github/workflows/gh-pages-deploy.yml",
          "line": 9,
          "note": "pages: write is overly broad at the workflow level",
          "rule": "excessive-permissions",
          "severity": "High",
          "url": "https://docs.zizmor.sh/audits/#excessive-permissions"
        },
        {
          "confidence": "High",
          "description": "overly broad permissions",
          "file": ".github/workflows/gh-pages-deploy.yml",
          "line": 10,
          "note": "id-token: write is overly broad at the workflow level",
          "rule": "excessive-permissions",
          "severity": "High",
          "url": "https://docs.zizmor.sh/audits/#excessive-permissions"
        },
        {
          "confidence": "High",
          "description": "spoofable bot actor check",
          "file": ".github/workflows/vet-ci.yml",
          "line": 28,
          "note": "this step",
          "rule": "bot-conditions",
          "severity": "High",
          "url": "https://docs.zizmor.sh/audits/#bot-conditions"
        },
        {
          "confidence": "High",
          "description": "ad-hoc installation of packages",
          "file": ".github/workflows/goreleaser.yml",
          "line": 157,
          "note": "this step",
          "rule": "adhoc-packages",
          "severity": "Low",
          "url": "https://docs.zizmor.sh/audits/#adhoc-packages"
        }
      ]
    }
  },
  "updated": "2026-11-02"
}