{ "history": [ { "added": 0, "commit": "0e48502cf5ef34e2e60bbd3617aa19945712f705", "date": "2026-11-01", "dependencies": 319, "errors": [], "fixable": 3, "go_version": "go1.27.3", "in_binary": { "dependencies": 1, "stdlib": 0, "total": 1 }, "new_vulnerabilities": 0, "osv_confirmed": 5, "osv_only": 0, "ref": "v3.1.4", "release_changed": false, "release_integrity": "verified", "removed": 0, "resolved_vulnerabilities": 0, "scorecard": 8.2, "upgraded": 0, "vulnerabilities": { "Critical": 0, "High": 0, "Low": 0, "Medium": 1, "Negligible": 0, "Unknown": 4 }, "workflow": { "High": 7, "Low": 0, "Medium": 5, "files": 17 } }, { "added": 0, "commit": "0e48502cf5ef34e2e60bbd3617aa19945712f705", "date": "2026-11-02", "dependencies": 319, "errors": [], "fixable": 3, "go_version": "go1.27.3", "in_binary": { "dependencies": 1, "stdlib": 0, "total": 1 }, "kev": 0, "kev_new": 0, "new_vulnerabilities": 0, "osv_confirmed": 5, "osv_only": 0, "ref": "v3.1.4", "release_changed": false, "release_integrity": "signed", "removed": 0, "resolved_vulnerabilities": 0, "scorecard": 8.2, "scorecard_date": "2026-10-31", "scorecard_note": null, "scorecard_source": "openssf-api", "upgraded": 0, "vulnerabilities": { "Critical": 0, "High": 0, "Low": 0, "Medium": 1, "Negligible": 0, "Unknown": 4 }, "vulnerable_packages": 4, "workflow": { "High": 7, "Low": 0, "Medium": 5, "files": 17 } } ], "latest": { "archived": false, "category": "Artifact Signing & Verification", "changes": { "added": [], "any": true, "baseline": false, "in_binary_new": [], "in_binary_resolved": [], "integrity_drift": 0, "license_changes": [], "new_vulnerabilities": [], "previous_ref": "v3.1.4", "release_changed": false, "release_integrity": { "from": "verified", "to": "signed" }, "removed": [], "resolved_vulnerabilities": [], "upgraded": [], "workflow_new": 0, "workflow_resolved": 0 }, "commit": "0e48502cf5ef34e2e60bbd3617aa19945712f705", "compliance": { "overall_score": 55, "standards": { "bsi_tr03183": { "failed_checks": [ "Component Creator", "Distribution Licences", "SHA-512 Hash", "Dependency Relationship", "SBOM Creator Contact" ], "passed": 4, "score": 44, "total": 9 }, "cisa": { "failed_checks": [ "Software Producer", "Dependency Relationship", "License Information", "Component Hash", "SBOM Author" ], "passed": 5, "score": 50, "total": 10 }, "ntia": { "failed_checks": [ "Supplier Name", "Dependency Relationship" ], "passed": 5, "score": 71, "total": 7 } } }, "components": [ { "ecosystem": "github", "licenses": [], "location": ".github/workflows/codeql-analysis.yml", "name": "actions/cache", "purl": "pkg:github/actions/cache@v6.1.0", "version": "v6.1.0" }, { "ecosystem": "github", "licenses": [], "location": ".github/workflows/donotsubmit.yaml", "name": "actions/checkout", "purl": "pkg:github/actions/checkout@v2.4.0", "version": "v2.4.0" }, { "ecosystem": "github", "licenses": [], "location": ".github/workflows/build.yaml", "name": "actions/checkout", "purl": "pkg:github/actions/checkout@v7.0.1", "version": "v7.0.1" }, { "ecosystem": "github", "licenses": [], "location": ".github/workflows/conformance-nightly.yml", "name": "actions/github-script", "purl": "pkg:github/actions/github-script@v9.0.0", "version": "v9.0.0" }, { "ecosystem": "github", "licenses": [], "location": ".github/workflows/build.yaml", "name": "actions/setup-go", "purl": "pkg:github/actions/setup-go@v7.0.0", "version": "v7.0.0" }, { "ecosystem": "github", "licenses": [], "location": ".github/workflows/scorecard-action.yml", "name": "actions/upload-artifact", "purl": "pkg:github/actions/upload-artifact@v7.0.2", "version": "v7.0.2" }, { "ecosystem": "github", "licenses": [], "location": ".github/workflows/donotsubmit.yaml", "name": "chainguard-dev/actions/donotsubmit", "purl": "pkg:github/chainguard-dev/actions@v1.6.41#donotsubmit", "version": "v1.6.41" }, { "ecosystem": "github", "licenses": [], "location": ".github/workflows/whitespace.yaml", "name": "chainguard-dev/actions/eof-newline", "purl": "pkg:github/chainguard-dev/actions@v1.6.41#eof-newline", "version": "v1.6.41" }, { "ecosystem": "github", "licenses": [], "location": ".github/workflows/e2e-tests.yml", "name": "chainguard-dev/actions/kind-diag", "purl": "pkg:github/chainguard-dev/actions@v1.6.41#kind-diag", "version": "v1.6.41" }, { "ecosystem": "github", "licenses": [], "location": ".github/workflows/e2e-tests.yml", "name": "chainguard-dev/actions/setup-mirror", "purl": "pkg:github/chainguard-dev/actions@v1.6.41#setup-mirror", "version": "v1.6.41" }, { "ecosystem": "github", "licenses": [], "location": ".github/workflows/whitespace.yaml", "name": "chainguard-dev/actions/trailing-space", "purl": "pkg:github/chainguard-dev/actions@v1.6.41#trailing-space", "version": "v1.6.41" }, { "ecosystem": "github", "licenses": [], "location": ".github/workflows/tests.yaml", "name": "codecov/codecov-action", "purl": "pkg:github/codecov/codecov-action@v7.1.1", "version": "v7.1.1" }, { "ecosystem": "github", "licenses": [], "location": ".github/workflows/e2e-tests.yml", "name": "cpanato/vault-installer", "purl": "pkg:github/cpanato/vault-installer@v1.4.0", "version": "v1.4.0" }, { "ecosystem": "github", "licenses": [], "location": ".github/workflows/build.yaml", "name": "docker/login-action", "purl": "pkg:github/docker/login-action@v4.6.0", "version": "v4.6.0" }, { "ecosystem": "github", "licenses": [], "location": ".github/workflows/codeql-analysis.yml", "name": "github/codeql-action/analyze", "purl": "pkg:github/github/codeql-action@v2.16.1#analyze", "version": "v2.16.1" }, { "ecosystem": "github", "licenses": [], "location": ".github/workflows/codeql-analysis.yml", "name": "github/codeql-action/init", "purl": "pkg:github/github/codeql-action@v2.16.1#init", "version": "v2.16.1" }, { "ecosystem": "github", "licenses": [], "location": ".github/workflows/scorecard-action.yml", "name": "github/codeql-action/upload-sarif", "purl": "pkg:github/github/codeql-action@v2.16.1#upload-sarif", "version": "v2.16.1" }, { "ecosystem": "github", "licenses": [], "location": ".github/workflows/golangci-lint.yml", "name": "golangci/golangci-lint-action", "purl": "pkg:github/golangci/golangci-lint-action@v9.3.0", "version": "v9.3.0" }, { "ecosystem": "github", "licenses": [], "location": ".github/workflows/build.yaml", "name": "google-github-actions/auth", "purl": "pkg:github/google-github-actions/auth@v3.0.0", "version": "v3.0.0" }, { "ecosystem": "github", "licenses": [], "location": ".github/workflows/e2e-tests.yml", "name": "imjasonh/setup-crane", "purl": "pkg:github/imjasonh/setup-crane@v0.7", "version": "v0.7" }, { "ecosystem": "github", "licenses": [], "location": ".github/workflows/build.yaml", "name": "ko-build/setup-ko", "purl": "pkg:github/ko-build/setup-ko@v0.10", "version": "v0.10" }, { "ecosystem": "github", "licenses": [], "location": ".github/workflows/kind-verify-attestation.yaml", "name": "mikefarah/yq", "purl": "pkg:github/mikefarah/yq@v4.54.1", "version": "v4.54.1" }, { "ecosystem": "github", "licenses": [], "location": ".github/workflows/scorecard-action.yml", "name": "ossf/scorecard-action", "purl": "pkg:github/ossf/scorecard-action@v2.5.0", "version": "v2.5.0" }, { "ecosystem": "github", "licenses": [], "location": ".github/workflows/depsreview.yml", "name": "sigstore/community/.github/workflows/reusable-dependency-review.yml", "purl": "pkg:github/sigstore/community@main#.github/workflows/reusable-dependency-review.yml", "version": "main" }, { "ecosystem": "github", "licenses": [], "location": ".github/workflows/cut-release.yml", "name": "sigstore/community/.github/workflows/reusable-release.yml", "purl": "pkg:github/sigstore/community@main#.github/workflows/reusable-release.yml", "version": "main" }, { "ecosystem": "github", "licenses": [], "location": ".github/workflows/build.yaml", "name": "sigstore/cosign-installer", "purl": "pkg:github/sigstore/cosign-installer@v4.1.2", "version": "v4.1.2" }, { "ecosystem": "github", "licenses": [], "location": ".github/workflows/e2e-tests.yml", "name": "sigstore/scaffolding/actions/setup", "purl": "pkg:github/sigstore/scaffolding@main#actions/setup", "version": "main" }, { "ecosystem": "github", "licenses": [], "location": ".github/workflows/conformance-nightly.yml", "name": "sigstore/sigstore-conformance", "purl": "pkg:github/sigstore/sigstore-conformance@main", "version": "main" }, { "ecosystem": "github", "licenses": [], "location": ".github/workflows/conformance.yml", "name": "sigstore/sigstore-conformance", "purl": "pkg:github/sigstore/sigstore-conformance@v0.0.29", "version": "v0.0.29" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "buf.build/gen/go/bufbuild/protovalidate/protocolbuffers/go", "purl": "pkg:golang/buf.build/gen/go/bufbuild/protovalidate/protocolbuffers/go@v1.36.11-20260709200747-435963d16310.1", "version": "v1.36.11-20260709200747-435963d16310.1" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "cloud.google.com/go", "purl": "pkg:golang/cloud.google.com/go@v0.123.0", "version": "v0.123.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "cloud.google.com/go/auth", "purl": "pkg:golang/cloud.google.com/go/auth@v0.24.1-0.20261001053825-dbc26066f70a", "version": "v0.24.1-0.20261001053825-dbc26066f70a" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "cloud.google.com/go/auth/oauth2adapt", "purl": "pkg:golang/cloud.google.com/go/auth/oauth2adapt@v0.3.0", "version": "v0.3.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "cloud.google.com/go/compute/metadata", "purl": "pkg:golang/cloud.google.com/go/compute/metadata@v0.10.0", "version": "v0.10.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "cloud.google.com/go/iam", "purl": "pkg:golang/cloud.google.com/go/iam@v1.13.0", "version": "v1.13.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "cloud.google.com/go/kms", "purl": "pkg:golang/cloud.google.com/go/kms@v1.33.0", "version": "v1.33.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "cloud.google.com/go/longrunning", "purl": "pkg:golang/cloud.google.com/go/longrunning@v1.2.0", "version": "v1.2.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "connectrpc.com/connect", "purl": "pkg:golang/connectrpc.com/connect@v1.20.0", "version": "v1.20.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "cuelabs.dev/go/oci/ociregistry", "purl": "pkg:golang/cuelabs.dev/go/oci/ociregistry@v0.0.0-20260601085548-328ff8e2c943", "version": "v0.0.0-20260601085548-328ff8e2c943" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "cuelang.org/go", "purl": "pkg:golang/cuelang.org/go@v0.17.1", "version": "v0.17.1" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/agnivade/levenshtein", "purl": "pkg:golang/github.com/agnivade/levenshtein@v1.2.1", "version": "v1.2.1" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/alibabacloud-go/alibabacloud-gateway-spi", "purl": "pkg:golang/github.com/alibabacloud-go/alibabacloud-gateway-spi@v0.0.4", "version": "v0.0.4" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/alibabacloud-go/cr-20160607", "purl": "pkg:golang/github.com/alibabacloud-go/cr-20160607@v1.0.1", "version": "v1.0.1" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/alibabacloud-go/cr-20181201", "purl": "pkg:golang/github.com/alibabacloud-go/cr-20181201@v1.0.10", "version": "v1.0.10" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/alibabacloud-go/darabonba-openapi", "purl": "pkg:golang/github.com/alibabacloud-go/darabonba-openapi@v0.2.1", "version": "v0.2.1" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/alibabacloud-go/debug", "purl": "pkg:golang/github.com/alibabacloud-go/debug@v1.0.1", "version": "v1.0.1" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/alibabacloud-go/endpoint-util", "purl": "pkg:golang/github.com/alibabacloud-go/endpoint-util@v1.1.1", "version": "v1.1.1" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/alibabacloud-go/openapi-util", "purl": "pkg:golang/github.com/alibabacloud-go/openapi-util@v0.1.0", "version": "v0.1.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/alibabacloud-go/tea", "purl": "pkg:golang/github.com/alibabacloud-go/tea@v1.3.12", "version": "v1.3.12" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/alibabacloud-go/tea-utils", "purl": "pkg:golang/github.com/alibabacloud-go/tea-utils@v1.4.5", "version": "v1.4.5" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/alibabacloud-go/tea-xml", "purl": "pkg:golang/github.com/alibabacloud-go/tea-xml@v1.1.3", "version": "v1.1.3" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/aliyun/credentials-go", "purl": "pkg:golang/github.com/aliyun/credentials-go@v1.4.7", "version": "v1.4.7" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/AliyunContainerService/ack-ram-tool/pkg/credentials/provider", "purl": "pkg:golang/github.com/AliyunContainerService/ack-ram-tool/pkg/credentials/provider@v0.18.1", "version": "v0.18.1" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/AliyunContainerService/ack-ram-tool/pkg/ecsmetadata", "purl": "pkg:golang/github.com/AliyunContainerService/ack-ram-tool/pkg/ecsmetadata@v0.0.9", "version": "v0.0.9" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/asaskevich/govalidator", "purl": "pkg:golang/github.com/asaskevich/govalidator@v0.0.0-20230301143203-a9d515a09cc2", "version": "v0.0.0-20230301143203-a9d515a09cc2" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/aws/aws-sdk-go-v2", "purl": "pkg:golang/github.com/aws/aws-sdk-go-v2@v1.47.3", "version": "v1.47.3" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/aws/aws-sdk-go-v2/config", "purl": "pkg:golang/github.com/aws/aws-sdk-go-v2/config@v1.33.9", "version": "v1.33.9" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/aws/aws-sdk-go-v2/credentials", "purl": "pkg:golang/github.com/aws/aws-sdk-go-v2/credentials@v1.20.9", "version": "v1.20.9" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/aws/aws-sdk-go-v2/feature/ec2/imds", "purl": "pkg:golang/github.com/aws/aws-sdk-go-v2/feature/ec2/imds@v1.20.3", "version": "v1.20.3" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/aws/aws-sdk-go-v2/internal/configsources", "purl": "pkg:golang/github.com/aws/aws-sdk-go-v2/internal/configsources@v1.5.6", "version": "v1.5.6" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/aws/aws-sdk-go-v2/internal/endpoints/v2", "purl": "pkg:golang/github.com/aws/aws-sdk-go-v2/internal/endpoints/v2@v2.8.6", "version": "v2.8.6" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/aws/aws-sdk-go-v2/internal/v4a", "purl": "pkg:golang/github.com/aws/aws-sdk-go-v2/internal/v4a@v1.5.6", "version": "v1.5.6" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/aws/aws-sdk-go-v2/service/ecr", "purl": "pkg:golang/github.com/aws/aws-sdk-go-v2/service/ecr@v1.55.3", "version": "v1.55.3" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/aws/aws-sdk-go-v2/service/ecrpublic", "purl": "pkg:golang/github.com/aws/aws-sdk-go-v2/service/ecrpublic@v1.38.10", "version": "v1.38.10" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding", "purl": "pkg:golang/github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding@v1.13.21", "version": "v1.13.21" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/aws/aws-sdk-go-v2/service/internal/presigned-url", "purl": "pkg:golang/github.com/aws/aws-sdk-go-v2/service/internal/presigned-url@v1.14.6", "version": "v1.14.6" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/aws/aws-sdk-go-v2/service/kms", "purl": "pkg:golang/github.com/aws/aws-sdk-go-v2/service/kms@v1.61.4", "version": "v1.61.4" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/aws/aws-sdk-go-v2/service/signin", "purl": "pkg:golang/github.com/aws/aws-sdk-go-v2/service/signin@v1.10.4", "version": "v1.10.4" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/aws/aws-sdk-go-v2/service/sso", "purl": "pkg:golang/github.com/aws/aws-sdk-go-v2/service/sso@v1.38.4", "version": "v1.38.4" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/aws/aws-sdk-go-v2/service/ssooidc", "purl": "pkg:golang/github.com/aws/aws-sdk-go-v2/service/ssooidc@v1.43.4", "version": "v1.43.4" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/aws/aws-sdk-go-v2/service/sts", "purl": "pkg:golang/github.com/aws/aws-sdk-go-v2/service/sts@v1.51.4", "version": "v1.51.4" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/aws/smithy-go", "purl": "pkg:golang/github.com/aws/smithy-go@v1.28.5", "version": "v1.28.5" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/awslabs/amazon-ecr-credential-helper/ecr-login", "purl": "pkg:golang/github.com/awslabs/amazon-ecr-credential-helper/ecr-login@v0.12.0", "version": "v0.12.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/Azure/azure-sdk-for-go", "purl": "pkg:golang/github.com/Azure/azure-sdk-for-go@v68.0.0%2Bincompatible", "version": "v68.0.0+incompatible" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/Azure/azure-sdk-for-go/sdk/azcore", "purl": "pkg:golang/github.com/Azure/azure-sdk-for-go/sdk/azcore@v1.23.1", "version": "v1.23.1" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/Azure/azure-sdk-for-go/sdk/azidentity", "purl": "pkg:golang/github.com/Azure/azure-sdk-for-go/sdk/azidentity@v1.14.1", "version": "v1.14.1" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/Azure/azure-sdk-for-go/sdk/internal", "purl": "pkg:golang/github.com/Azure/azure-sdk-for-go/sdk/internal@v1.12.0", "version": "v1.12.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/azkeys", "purl": "pkg:golang/github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/azkeys@v1.5.0", "version": "v1.5.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/internal", "purl": "pkg:golang/github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/internal@v1.2.0", "version": "v1.2.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/Azure/go-ansiterm", "purl": "pkg:golang/github.com/Azure/go-ansiterm@v0.0.0-20250102033503-faa5f7b0171c", "version": "v0.0.0-20250102033503-faa5f7b0171c" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/Azure/go-autorest", "purl": "pkg:golang/github.com/Azure/go-autorest@v14.2.0%2Bincompatible", "version": "v14.2.0+incompatible" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/Azure/go-autorest/autorest", "purl": "pkg:golang/github.com/Azure/go-autorest/autorest@v0.11.29", "version": "v0.11.29" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/Azure/go-autorest/autorest/adal", "purl": "pkg:golang/github.com/Azure/go-autorest/autorest/adal@v0.9.23", "version": "v0.9.23" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/Azure/go-autorest/autorest/azure/auth", "purl": "pkg:golang/github.com/Azure/go-autorest/autorest/azure/auth@v0.5.12", "version": "v0.5.12" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/Azure/go-autorest/autorest/azure/cli", "purl": "pkg:golang/github.com/Azure/go-autorest/autorest/azure/cli@v0.4.6", "version": "v0.4.6" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/Azure/go-autorest/autorest/date", "purl": "pkg:golang/github.com/Azure/go-autorest/autorest/date@v0.3.0", "version": "v0.3.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/Azure/go-autorest/logger", "purl": "pkg:golang/github.com/Azure/go-autorest/logger@v0.2.1", "version": "v0.2.1" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/Azure/go-autorest/tracing", "purl": "pkg:golang/github.com/Azure/go-autorest/tracing@v0.6.0", "version": "v0.6.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/AzureAD/microsoft-authentication-library-for-go", "purl": "pkg:golang/github.com/AzureAD/microsoft-authentication-library-for-go@v1.8.0", "version": "v1.8.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/beorn7/perks", "purl": "pkg:golang/github.com/beorn7/perks@v1.0.1", "version": "v1.0.1" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/buildkite/agent/v3", "purl": "pkg:golang/github.com/buildkite/agent/v3@v3.130.0", "version": "v3.130.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/buildkite/go-pipeline", "purl": "pkg:golang/github.com/buildkite/go-pipeline@v0.17.1", "version": "v0.17.1" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/buildkite/interpolate", "purl": "pkg:golang/github.com/buildkite/interpolate@v0.1.5", "version": "v0.1.5" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/buildkite/roko", "purl": "pkg:golang/github.com/buildkite/roko@v1.4.0", "version": "v1.4.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/cenkalti/backoff/v4", "purl": "pkg:golang/github.com/cenkalti/backoff/v4@v4.3.0", "version": "v4.3.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/cenkalti/backoff/v5", "purl": "pkg:golang/github.com/cenkalti/backoff/v5@v5.0.3", "version": "v5.0.3" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/cespare/xxhash/v2", "purl": "pkg:golang/github.com/cespare/xxhash/v2@v2.3.0", "version": "v2.3.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/chrismellard/docker-credential-acr-env", "purl": "pkg:golang/github.com/chrismellard/docker-credential-acr-env@v0.0.0-20230304212654-82a0ddb27589", "version": "v0.0.0-20230304212654-82a0ddb27589" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/chzyer/readline", "purl": "pkg:golang/github.com/chzyer/readline@v1.5.1", "version": "v1.5.1" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/clbanning/mxj/v2", "purl": "pkg:golang/github.com/clbanning/mxj/v2@v2.7.0", "version": "v2.7.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/cloudflare/circl", "purl": "pkg:golang/github.com/cloudflare/circl@v1.6.3", "version": "v1.6.3" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/cockroachdb/apd/v3", "purl": "pkg:golang/github.com/cockroachdb/apd/v3@v3.2.3", "version": "v3.2.3" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/common-nighthawk/go-figure", "purl": "pkg:golang/github.com/common-nighthawk/go-figure@v0.0.0-20210622060536-734e95fb86be", "version": "v0.0.0-20210622060536-734e95fb86be" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/coreos/go-oidc/v3", "purl": "pkg:golang/github.com/coreos/go-oidc/v3@v3.21.0", "version": "v3.21.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/cpuguy83/go-md2man/v2", "purl": "pkg:golang/github.com/cpuguy83/go-md2man/v2@v2.0.7", "version": "v2.0.7" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/creack/pty", "purl": "pkg:golang/github.com/creack/pty@v1.1.24", "version": "v1.1.24" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/cyberphone/json-canonicalization", "purl": "pkg:golang/github.com/cyberphone/json-canonicalization@v0.0.0-20241213102144-19d51d7fe467", "version": "v0.0.0-20241213102144-19d51d7fe467" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/davecgh/go-spew", "purl": "pkg:golang/github.com/davecgh/go-spew@v1.1.2-0.20180830191138-d8f796af33cc", "version": "v1.1.2-0.20180830191138-d8f796af33cc" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/decred/dcrd/dcrec/secp256k1/v4", "purl": "pkg:golang/github.com/decred/dcrd/dcrec/secp256k1/v4@v4.4.1", "version": "v4.4.1" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/depcheck-test/depcheck-test", "purl": "pkg:golang/github.com/depcheck-test/depcheck-test@v0.0.0-20220607135614-199033aaa936", "version": "v0.0.0-20220607135614-199033aaa936" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/digitorus/pkcs7", "purl": "pkg:golang/github.com/digitorus/pkcs7@v0.0.0-20230818184609-3a137a874352", "version": "v0.0.0-20230818184609-3a137a874352" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/digitorus/timestamp", "purl": "pkg:golang/github.com/digitorus/timestamp@v0.0.0-20231217203849-220c5c2851b7", "version": "v0.0.0-20231217203849-220c5c2851b7" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/dimchansky/utfbom", "purl": "pkg:golang/github.com/dimchansky/utfbom@v1.1.1", "version": "v1.1.1" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/docker/cli", "purl": "pkg:golang/github.com/docker/cli@v29.7.2%2Bincompatible", "version": "v29.7.2+incompatible" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/docker/docker-credential-helpers", "purl": "pkg:golang/github.com/docker/docker-credential-helpers@v0.9.5", "version": "v0.9.5" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/docker/go-units", "purl": "pkg:golang/github.com/docker/go-units@v0.5.0", "version": "v0.5.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/dustin/go-humanize", "purl": "pkg:golang/github.com/dustin/go-humanize@v1.0.1", "version": "v1.0.1" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/eclipse-keypont/crypto11", "purl": "pkg:golang/github.com/eclipse-keypont/crypto11@v1.6.8", "version": "v1.6.8" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/emicklei/go-restful/v3", "purl": "pkg:golang/github.com/emicklei/go-restful/v3@v3.13.0", "version": "v3.13.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/emicklei/proto", "purl": "pkg:golang/github.com/emicklei/proto@v1.14.3", "version": "v1.14.3" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/felixge/httpsnoop", "purl": "pkg:golang/github.com/felixge/httpsnoop@v1.1.0", "version": "v1.1.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/fsnotify/fsnotify", "purl": "pkg:golang/github.com/fsnotify/fsnotify@v1.10.1", "version": "v1.10.1" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/fxamacker/cbor/v2", "purl": "pkg:golang/github.com/fxamacker/cbor/v2@v2.9.0", "version": "v2.9.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/go-chi/chi/v5", "purl": "pkg:golang/github.com/go-chi/chi/v5@v5.3.2", "version": "v5.3.2" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/go-jose/go-jose/v4", "purl": "pkg:golang/github.com/go-jose/go-jose/v4@v4.1.6", "version": "v4.1.6" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/go-logr/logr", "purl": "pkg:golang/github.com/go-logr/logr@v1.4.4", "version": "v1.4.4" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/go-logr/stdr", "purl": "pkg:golang/github.com/go-logr/stdr@v1.2.2", "version": "v1.2.2" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/go-openapi/analysis", "purl": "pkg:golang/github.com/go-openapi/analysis@v1.0.0", "version": "v1.0.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/go-openapi/errors", "purl": "pkg:golang/github.com/go-openapi/errors@v0.22.9", "version": "v0.22.9" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/go-openapi/jsonpointer", "purl": "pkg:golang/github.com/go-openapi/jsonpointer@v1.0.1", "version": "v1.0.1" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/go-openapi/jsonreference", "purl": "pkg:golang/github.com/go-openapi/jsonreference@v1.0.2", "version": "v1.0.2" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/go-openapi/loads", "purl": "pkg:golang/github.com/go-openapi/loads@v0.25.3", "version": "v0.25.3" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/go-openapi/runtime", "purl": "pkg:golang/github.com/go-openapi/runtime@v0.33.3", "version": "v0.33.3" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/go-openapi/runtime/server-middleware", "purl": "pkg:golang/github.com/go-openapi/runtime/server-middleware@v0.33.3", "version": "v0.33.3" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/go-openapi/spec", "purl": "pkg:golang/github.com/go-openapi/spec@v1.0.1", "version": "v1.0.1" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/go-openapi/strfmt", "purl": "pkg:golang/github.com/go-openapi/strfmt@v0.27.3", "version": "v0.27.3" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/go-openapi/swag", "purl": "pkg:golang/github.com/go-openapi/swag@v0.28.0", "version": "v0.28.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/go-openapi/swag/cmdutils", "purl": "pkg:golang/github.com/go-openapi/swag/cmdutils@v0.29.2", "version": "v0.29.2" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/go-openapi/swag/conv", "purl": "pkg:golang/github.com/go-openapi/swag/conv@v0.29.2", "version": "v0.29.2" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/go-openapi/swag/fileutils", "purl": "pkg:golang/github.com/go-openapi/swag/fileutils@v0.29.2", "version": "v0.29.2" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/go-openapi/swag/jsonutils", "purl": "pkg:golang/github.com/go-openapi/swag/jsonutils@v0.29.2", "version": "v0.29.2" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/go-openapi/swag/loading", "purl": "pkg:golang/github.com/go-openapi/swag/loading@v0.29.1", "version": "v0.29.1" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/go-openapi/swag/mangling", "purl": "pkg:golang/github.com/go-openapi/swag/mangling@v0.29.1", "version": "v0.29.1" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/go-openapi/swag/netutils", "purl": "pkg:golang/github.com/go-openapi/swag/netutils@v0.29.2", "version": "v0.29.2" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/go-openapi/swag/pools", "purl": "pkg:golang/github.com/go-openapi/swag/pools@v0.29.2", "version": "v0.29.2" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/go-openapi/swag/stringutils", "purl": "pkg:golang/github.com/go-openapi/swag/stringutils@v0.29.2", "version": "v0.29.2" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/go-openapi/swag/typeutils", "purl": "pkg:golang/github.com/go-openapi/swag/typeutils@v0.29.2", "version": "v0.29.2" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/go-openapi/swag/yamlutils", "purl": "pkg:golang/github.com/go-openapi/swag/yamlutils@v0.29.1", "version": "v0.29.1" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/go-openapi/validate", "purl": "pkg:golang/github.com/go-openapi/validate@v1.0.0", "version": "v1.0.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/go-piv/piv-go/v2", "purl": "pkg:golang/github.com/go-piv/piv-go/v2@v2.6.0", "version": "v2.6.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/go-viper/mapstructure/v2", "purl": "pkg:golang/github.com/go-viper/mapstructure/v2@v2.5.0", "version": "v2.5.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/gobwas/glob", "purl": "pkg:golang/github.com/gobwas/glob@v0.2.3", "version": "v0.2.3" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/goccy/go-json", "purl": "pkg:golang/github.com/goccy/go-json@v0.10.6", "version": "v0.10.6" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/golang-jwt/jwt/v4", "purl": "pkg:golang/github.com/golang-jwt/jwt/v4@v4.5.2", "version": "v4.5.2" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/golang-jwt/jwt/v5", "purl": "pkg:golang/github.com/golang-jwt/jwt/v5@v5.3.1", "version": "v5.3.1" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/golang/snappy", "purl": "pkg:golang/github.com/golang/snappy@v1.0.0", "version": "v1.0.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/google/certificate-transparency-go", "purl": "pkg:golang/github.com/google/certificate-transparency-go@v1.3.3", "version": "v1.3.3" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/google/gnostic-models", "purl": "pkg:golang/github.com/google/gnostic-models@v0.7.0", "version": "v0.7.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/google/go-cmp", "purl": "pkg:golang/github.com/google/go-cmp@v0.7.0", "version": "v0.7.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/google/go-containerregistry", "purl": "pkg:golang/github.com/google/go-containerregistry@v0.22.1", "version": "v0.22.1" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/google/go-github/v88", "purl": "pkg:golang/github.com/google/go-github/v88@v88.0.0", "version": "v88.0.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/google/go-querystring", "purl": "pkg:golang/github.com/google/go-querystring@v1.2.0", "version": "v1.2.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/google/s2a-go", "purl": "pkg:golang/github.com/google/s2a-go@v0.1.11", "version": "v0.1.11" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/google/uuid", "purl": "pkg:golang/github.com/google/uuid@v1.6.0", "version": "v1.6.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/googleapis/enterprise-certificate-proxy", "purl": "pkg:golang/github.com/googleapis/enterprise-certificate-proxy@v0.3.22", "version": "v0.3.22" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/googleapis/gax-go/v2", "purl": "pkg:golang/github.com/googleapis/gax-go/v2@v2.26.2", "version": "v2.26.2" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/grpc-ecosystem/grpc-gateway/v2", "purl": "pkg:golang/github.com/grpc-ecosystem/grpc-gateway/v2@v2.30.0", "version": "v2.30.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/hashicorp/errwrap", "purl": "pkg:golang/github.com/hashicorp/errwrap@v1.1.0", "version": "v1.1.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/hashicorp/go-cleanhttp", "purl": "pkg:golang/github.com/hashicorp/go-cleanhttp@v0.5.2", "version": "v0.5.2" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/hashicorp/go-multierror", "purl": "pkg:golang/github.com/hashicorp/go-multierror@v1.1.1", "version": "v1.1.1" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/hashicorp/go-retryablehttp", "purl": "pkg:golang/github.com/hashicorp/go-retryablehttp@v0.7.8", "version": "v0.7.8" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/hashicorp/go-rootcerts", "purl": "pkg:golang/github.com/hashicorp/go-rootcerts@v1.0.2", "version": "v1.0.2" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/hashicorp/go-secure-stdlib/parseutil", "purl": "pkg:golang/github.com/hashicorp/go-secure-stdlib/parseutil@v0.2.0", "version": "v0.2.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/hashicorp/go-secure-stdlib/strutil", "purl": "pkg:golang/github.com/hashicorp/go-secure-stdlib/strutil@v0.1.2", "version": "v0.1.2" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/hashicorp/go-sockaddr", "purl": "pkg:golang/github.com/hashicorp/go-sockaddr@v1.0.7", "version": "v1.0.7" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/hashicorp/hcl", "purl": "pkg:golang/github.com/hashicorp/hcl@v1.0.1-vault-7", "version": "v1.0.1-vault-7" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/hashicorp/vault/api", "purl": "pkg:golang/github.com/hashicorp/vault/api@v1.23.0", "version": "v1.23.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/in-toto/attestation", "purl": "pkg:golang/github.com/in-toto/attestation@v1.2.0", "version": "v1.2.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/in-toto/in-toto-golang", "purl": "pkg:golang/github.com/in-toto/in-toto-golang@v0.11.0", "version": "v0.11.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/inconshreveable/mousetrap", "purl": "pkg:golang/github.com/inconshreveable/mousetrap@v1.1.0", "version": "v1.1.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/jedisct1/go-minisign", "purl": "pkg:golang/github.com/jedisct1/go-minisign@v0.0.0-20230811132847-661be99b8267", "version": "v0.0.0-20230811132847-661be99b8267" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/jellydator/ttlcache/v3", "purl": "pkg:golang/github.com/jellydator/ttlcache/v3@v3.4.1", "version": "v3.4.1" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/json-iterator/go", "purl": "pkg:golang/github.com/json-iterator/go@v1.1.12", "version": "v1.1.12" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/kelseyhightower/envconfig", "purl": "pkg:golang/github.com/kelseyhightower/envconfig@v1.4.0", "version": "v1.4.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/klauspost/compress", "purl": "pkg:golang/github.com/klauspost/compress@v1.20.1", "version": "v1.20.1" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/kylelemons/godebug", "purl": "pkg:golang/github.com/kylelemons/godebug@v1.1.0", "version": "v1.1.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/lestrrat-go/blackmagic", "purl": "pkg:golang/github.com/lestrrat-go/blackmagic@v1.0.4", "version": "v1.0.4" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/lestrrat-go/dsig", "purl": "pkg:golang/github.com/lestrrat-go/dsig@v1.3.0", "version": "v1.3.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/lestrrat-go/dsig-secp256k1", "purl": "pkg:golang/github.com/lestrrat-go/dsig-secp256k1@v1.0.0", "version": "v1.0.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/lestrrat-go/httpcc", "purl": "pkg:golang/github.com/lestrrat-go/httpcc@v1.0.1", "version": "v1.0.1" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/lestrrat-go/httprc/v3", "purl": "pkg:golang/github.com/lestrrat-go/httprc/v3@v3.0.6", "version": "v3.0.6" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/lestrrat-go/jwx/v3", "purl": "pkg:golang/github.com/lestrrat-go/jwx/v3@v3.2.0", "version": "v3.2.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/lestrrat-go/option/v2", "purl": "pkg:golang/github.com/lestrrat-go/option/v2@v2.0.0", "version": "v2.0.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/lib/pq", "purl": "pkg:golang/github.com/lib/pq@v1.12.0", "version": "v1.12.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/manifoldco/promptui", "purl": "pkg:golang/github.com/manifoldco/promptui@v0.9.0", "version": "v0.9.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/Microsoft/go-winio", "purl": "pkg:golang/github.com/Microsoft/go-winio@v0.6.2", "version": "v0.6.2" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/miekg/dns", "purl": "pkg:golang/github.com/miekg/dns@v1.1.62", "version": "v1.1.62" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/miekg/pkcs11", "purl": "pkg:golang/github.com/miekg/pkcs11@v1.1.2", "version": "v1.1.2" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/mitchellh/go-homedir", "purl": "pkg:golang/github.com/mitchellh/go-homedir@v1.1.0", "version": "v1.1.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/mitchellh/go-wordwrap", "purl": "pkg:golang/github.com/mitchellh/go-wordwrap@v1.0.1", "version": "v1.0.1" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/mitchellh/mapstructure", "purl": "pkg:golang/github.com/mitchellh/mapstructure@v1.5.1-0.20231216201459-8508981c8b6c", "version": "v1.5.1-0.20231216201459-8508981c8b6c" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/moby/term", "purl": "pkg:golang/github.com/moby/term@v0.5.2", "version": "v0.5.2" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/modern-go/concurrent", "purl": "pkg:golang/github.com/modern-go/concurrent@v0.0.0-20180306012644-bacd9c7ef1dd", "version": "v0.0.0-20180306012644-bacd9c7ef1dd" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/modern-go/reflect2", "purl": "pkg:golang/github.com/modern-go/reflect2@v1.0.3-0.20250322232337-35a7c28c31ee", "version": "v1.0.3-0.20250322232337-35a7c28c31ee" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/mozillazg/docker-credential-acr-helper", "purl": "pkg:golang/github.com/mozillazg/docker-credential-acr-helper@v0.4.1", "version": "v0.4.1" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/mozillazg/docker-credential-acr-helper/pkg/acr", "purl": "pkg:golang/github.com/mozillazg/docker-credential-acr-helper/pkg/acr@v0.2.2", "version": "v0.2.2" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/munnerz/goautoneg", "purl": "pkg:golang/github.com/munnerz/goautoneg@v0.0.0-20191010083416-a7dc8b61c822", "version": "v0.0.0-20191010083416-a7dc8b61c822" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/natefinch/atomic", "purl": "pkg:golang/github.com/natefinch/atomic@v1.0.1", "version": "v1.0.1" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/nozzle/throttler", "purl": "pkg:golang/github.com/nozzle/throttler@v0.0.0-20180817012639-2ea982251481", "version": "v0.0.0-20180817012639-2ea982251481" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/oklog/ulid/v2", "purl": "pkg:golang/github.com/oklog/ulid/v2@v2.1.2", "version": "v2.1.2" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/oleiade/reflections", "purl": "pkg:golang/github.com/oleiade/reflections@v1.1.0", "version": "v1.1.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/open-policy-agent/opa", "purl": "pkg:golang/github.com/open-policy-agent/opa@v1.20.2", "version": "v1.20.2" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/opencontainers/go-digest", "purl": "pkg:golang/github.com/opencontainers/go-digest@v1.0.0", "version": "v1.0.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/opencontainers/image-spec", "purl": "pkg:golang/github.com/opencontainers/image-spec@v1.1.1", "version": "v1.1.1" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/pborman/uuid", "purl": "pkg:golang/github.com/pborman/uuid@v1.2.1", "version": "v1.2.1" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/pelletier/go-toml/v2", "purl": "pkg:golang/github.com/pelletier/go-toml/v2@v2.3.1", "version": "v2.3.1" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/phuslu/lru", "purl": "pkg:golang/github.com/phuslu/lru@v1.0.18", "version": "v1.0.18" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/pkg/browser", "purl": "pkg:golang/github.com/pkg/browser@v0.0.0-20240102092130-5ac0b6a4141c", "version": "v0.0.0-20240102092130-5ac0b6a4141c" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/pkg/errors", "purl": "pkg:golang/github.com/pkg/errors@v0.9.1", "version": "v0.9.1" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/prometheus/client_golang", "purl": "pkg:golang/github.com/prometheus/client_golang@v1.25.0", "version": "v1.25.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/prometheus/client_model", "purl": "pkg:golang/github.com/prometheus/client_model@v0.6.3", "version": "v0.6.3" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/prometheus/common", "purl": "pkg:golang/github.com/prometheus/common@v0.72.0", "version": "v0.72.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/prometheus/procfs", "purl": "pkg:golang/github.com/prometheus/procfs@v0.22.0", "version": "v0.22.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/protocolbuffers/txtpbfmt", "purl": "pkg:golang/github.com/protocolbuffers/txtpbfmt@v0.0.0-20260420112717-c39628bde8b5", "version": "v0.0.0-20260420112717-c39628bde8b5" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/ProtonMail/go-crypto", "purl": "pkg:golang/github.com/ProtonMail/go-crypto@v1.4.1", "version": "v1.4.1" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/rcrowley/go-metrics", "purl": "pkg:golang/github.com/rcrowley/go-metrics@v0.0.0-20250401214520-65e299d6c5c9", "version": "v0.0.0-20250401214520-65e299d6c5c9" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/rogpeppe/go-internal", "purl": "pkg:golang/github.com/rogpeppe/go-internal@v1.16.0", "version": "v1.16.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/rs/cors", "purl": "pkg:golang/github.com/rs/cors@v1.11.1", "version": "v1.11.1" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/russross/blackfriday/v2", "purl": "pkg:golang/github.com/russross/blackfriday/v2@v2.1.0", "version": "v2.1.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/ryanuber/go-glob", "purl": "pkg:golang/github.com/ryanuber/go-glob@v1.0.0", "version": "v1.0.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/sagikazarmark/locafero", "purl": "pkg:golang/github.com/sagikazarmark/locafero@v0.11.0", "version": "v0.11.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/sassoftware/relic/v8", "purl": "pkg:golang/github.com/sassoftware/relic/v8@v8.2.0", "version": "v8.2.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/secure-systems-lab/go-securesystemslib", "purl": "pkg:golang/github.com/secure-systems-lab/go-securesystemslib@v0.11.1", "version": "v0.11.1" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/segmentio/asm", "purl": "pkg:golang/github.com/segmentio/asm@v1.2.1", "version": "v1.2.1" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/shibumi/go-pathspec", "purl": "pkg:golang/github.com/shibumi/go-pathspec@v1.3.0", "version": "v1.3.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/sigstore/protobuf-specs", "purl": "pkg:golang/github.com/sigstore/protobuf-specs@v0.5.2", "version": "v0.5.2" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/sigstore/rekor", "purl": "pkg:golang/github.com/sigstore/rekor@v1.5.4", "version": "v1.5.4" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/sigstore/rekor-tiles/v2", "purl": "pkg:golang/github.com/sigstore/rekor-tiles/v2@v2.3.0", "version": "v2.3.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/sigstore/sigstore", "purl": "pkg:golang/github.com/sigstore/sigstore@v1.11.1", "version": "v1.11.1" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/sigstore/sigstore-go", "purl": "pkg:golang/github.com/sigstore/sigstore-go@v1.3.0", "version": "v1.3.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/sigstore/sigstore/pkg/signature/kms/aws", "purl": "pkg:golang/github.com/sigstore/sigstore/pkg/signature/kms/aws@v1.11.1", "version": "v1.11.1" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/sigstore/sigstore/pkg/signature/kms/azure", "purl": "pkg:golang/github.com/sigstore/sigstore/pkg/signature/kms/azure@v1.11.1", "version": "v1.11.1" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/sigstore/sigstore/pkg/signature/kms/gcp", "purl": "pkg:golang/github.com/sigstore/sigstore/pkg/signature/kms/gcp@v1.11.1", "version": "v1.11.1" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/sigstore/sigstore/pkg/signature/kms/hashivault", "purl": "pkg:golang/github.com/sigstore/sigstore/pkg/signature/kms/hashivault@v1.11.1", "version": "v1.11.1" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/sigstore/timestamp-authority/v2", "purl": "pkg:golang/github.com/sigstore/timestamp-authority/v2@v2.1.5", "version": "v2.1.5" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/sirupsen/logrus", "purl": "pkg:golang/github.com/sirupsen/logrus@v1.10.2", "version": "v1.10.2" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/sourcegraph/conc", "purl": "pkg:golang/github.com/sourcegraph/conc@v0.3.1-0.20240121214520-5f936abd7ae8", "version": "v0.3.1-0.20240121214520-5f936abd7ae8" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/spf13/afero", "purl": "pkg:golang/github.com/spf13/afero@v1.15.0", "version": "v1.15.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/spf13/cast", "purl": "pkg:golang/github.com/spf13/cast@v1.10.0", "version": "v1.10.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/spf13/cobra", "purl": "pkg:golang/github.com/spf13/cobra@v1.10.2", "version": "v1.10.2" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/spf13/pflag", "purl": "pkg:golang/github.com/spf13/pflag@v1.0.10", "version": "v1.0.10" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/spf13/viper", "purl": "pkg:golang/github.com/spf13/viper@v1.21.0", "version": "v1.21.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/spiffe/go-spiffe/v2", "purl": "pkg:golang/github.com/spiffe/go-spiffe/v2@v2.8.2", "version": "v2.8.2" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/stretchr/testify", "purl": "pkg:golang/github.com/stretchr/testify@v1.12.1", "version": "v1.12.1" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/subosito/gotenv", "purl": "pkg:golang/github.com/subosito/gotenv@v1.6.0", "version": "v1.6.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/syndtr/goleveldb", "purl": "pkg:golang/github.com/syndtr/goleveldb@v1.0.1-0.20220721030215-126854af5e6d", "version": "v1.0.1-0.20220721030215-126854af5e6d" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/tchap/go-patricia/v2", "purl": "pkg:golang/github.com/tchap/go-patricia/v2@v2.3.3", "version": "v2.3.3" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/thales-e-security/pool", "purl": "pkg:golang/github.com/thales-e-security/pool@v0.0.2", "version": "v0.0.2" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/theupdateframework/go-tuf", "purl": "pkg:golang/github.com/theupdateframework/go-tuf@v0.7.0", "version": "v0.7.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/theupdateframework/go-tuf/v2", "purl": "pkg:golang/github.com/theupdateframework/go-tuf/v2@v2.4.2", "version": "v2.4.2" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/tink-crypto/tink-go-awskms/v3", "purl": "pkg:golang/github.com/tink-crypto/tink-go-awskms/v3@v3.0.0", "version": "v3.0.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/tink-crypto/tink-go-gcpkms/v2", "purl": "pkg:golang/github.com/tink-crypto/tink-go-gcpkms/v2@v2.4.0", "version": "v2.4.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/tink-crypto/tink-go-hcvault/v2", "purl": "pkg:golang/github.com/tink-crypto/tink-go-hcvault/v2@v2.5.0", "version": "v2.5.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/tink-crypto/tink-go/v2", "purl": "pkg:golang/github.com/tink-crypto/tink-go/v2@v2.8.0", "version": "v2.8.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/tjfoc/gmsm", "purl": "pkg:golang/github.com/tjfoc/gmsm@v1.4.1", "version": "v1.4.1" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/transparency-dev/formats", "purl": "pkg:golang/github.com/transparency-dev/formats@v0.1.1", "version": "v0.1.1" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/transparency-dev/merkle", "purl": "pkg:golang/github.com/transparency-dev/merkle@v0.0.2", "version": "v0.0.2" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/urfave/negroni", "purl": "pkg:golang/github.com/urfave/negroni@v1.0.0", "version": "v1.0.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/valyala/fastjson", "purl": "pkg:golang/github.com/valyala/fastjson@v1.6.10", "version": "v1.6.10" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/vektah/gqlparser/v2", "purl": "pkg:golang/github.com/vektah/gqlparser/v2@v2.5.36", "version": "v2.5.36" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/withfig/autocomplete-tools/integrations/cobra", "purl": "pkg:golang/github.com/withfig/autocomplete-tools/integrations/cobra@v1.2.1", "version": "v1.2.1" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/x448/float16", "purl": "pkg:golang/github.com/x448/float16@v0.8.4", "version": "v0.8.4" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/xeipuuv/gojsonpointer", "purl": "pkg:golang/github.com/xeipuuv/gojsonpointer@v0.0.0-20190905194746-02993c407bfb", "version": "v0.0.0-20190905194746-02993c407bfb" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/xeipuuv/gojsonreference", "purl": "pkg:golang/github.com/xeipuuv/gojsonreference@v0.0.0-20180127040603-bd5ef7bd5415", "version": "v0.0.0-20180127040603-bd5ef7bd5415" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/yashtewari/glob-intersection", "purl": "pkg:golang/github.com/yashtewari/glob-intersection@v0.2.0", "version": "v0.2.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/youmark/pkcs8", "purl": "pkg:golang/github.com/youmark/pkcs8@v0.0.0-20240726163527-a2c0da244d78", "version": "v0.0.0-20240726163527-a2c0da244d78" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/zalando/go-keyring", "purl": "pkg:golang/github.com/zalando/go-keyring@v0.2.8", "version": "v0.2.8" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "gitlab.com/gitlab-org/api/client-go/v3", "purl": "pkg:golang/gitlab.com/gitlab-org/api/client-go/v3@v3.13.0", "version": "v3.13.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "go.opentelemetry.io/auto/sdk", "purl": "pkg:golang/go.opentelemetry.io/auto/sdk@v1.2.1", "version": "v1.2.1" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc", "purl": "pkg:golang/go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc@v0.70.0", "version": "v0.70.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp", "purl": "pkg:golang/go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp@v0.71.0", "version": "v0.71.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "go.opentelemetry.io/otel", "purl": "pkg:golang/go.opentelemetry.io/otel@v1.46.0", "version": "v1.46.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "go.opentelemetry.io/otel/metric", "purl": "pkg:golang/go.opentelemetry.io/otel/metric@v1.46.0", "version": "v1.46.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "go.opentelemetry.io/otel/trace", "purl": "pkg:golang/go.opentelemetry.io/otel/trace@v1.46.0", "version": "v1.46.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "go.uber.org/multierr", "purl": "pkg:golang/go.uber.org/multierr@v1.11.0", "version": "v1.11.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "go.uber.org/zap", "purl": "pkg:golang/go.uber.org/zap@v1.28.0", "version": "v1.28.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "go.yaml.in/yaml/v2", "purl": "pkg:golang/go.yaml.in/yaml/v2@v2.4.4", "version": "v2.4.4" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "go.yaml.in/yaml/v3", "purl": "pkg:golang/go.yaml.in/yaml/v3@v3.0.5", "version": "v3.0.5" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "golang.org/x/crypto", "purl": "pkg:golang/golang.org/x/crypto@v0.58.0", "version": "v0.58.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "golang.org/x/mod", "purl": "pkg:golang/golang.org/x/mod@v0.41.0", "version": "v0.41.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "golang.org/x/net", "purl": "pkg:golang/golang.org/x/net@v0.61.0", "version": "v0.61.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "golang.org/x/oauth2", "purl": "pkg:golang/golang.org/x/oauth2@v0.37.0", "version": "v0.37.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "golang.org/x/sync", "purl": "pkg:golang/golang.org/x/sync@v0.24.0", "version": "v0.24.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "golang.org/x/sys", "purl": "pkg:golang/golang.org/x/sys@v0.49.0", "version": "v0.49.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "golang.org/x/term", "purl": "pkg:golang/golang.org/x/term@v0.47.0", "version": "v0.47.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "golang.org/x/text", "purl": "pkg:golang/golang.org/x/text@v0.43.0", "version": "v0.43.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "golang.org/x/time", "purl": "pkg:golang/golang.org/x/time@v0.16.0", "version": "v0.16.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "golang.org/x/tools", "purl": "pkg:golang/golang.org/x/tools@v0.51.0", "version": "v0.51.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "google.golang.org/api", "purl": "pkg:golang/google.golang.org/api@v0.301.0", "version": "v0.301.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "google.golang.org/genproto", "purl": "pkg:golang/google.golang.org/genproto@v0.0.0-20260715232425-e75dac1f907d", "version": "v0.0.0-20260715232425-e75dac1f907d" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "google.golang.org/genproto/googleapis/api", "purl": "pkg:golang/google.golang.org/genproto/googleapis/api@v0.0.0-20260819154853-08b0e4226688", "version": "v0.0.0-20260819154853-08b0e4226688" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "google.golang.org/genproto/googleapis/rpc", "purl": "pkg:golang/google.golang.org/genproto/googleapis/rpc@v0.0.0-20260928230214-8a89bd6388cc", "version": "v0.0.0-20260928230214-8a89bd6388cc" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "google.golang.org/grpc", "purl": "pkg:golang/google.golang.org/grpc@v1.84.0", "version": "v1.84.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "google.golang.org/protobuf", "purl": "pkg:golang/google.golang.org/protobuf@v1.36.12", "version": "v1.36.12" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "gopkg.in/evanphx/json-patch.v4", "purl": "pkg:golang/gopkg.in/evanphx/json-patch.v4@v4.13.0", "version": "v4.13.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "gopkg.in/inf.v0", "purl": "pkg:golang/gopkg.in/inf.v0@v0.9.1", "version": "v0.9.1" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "gopkg.in/ini.v1", "purl": "pkg:golang/gopkg.in/ini.v1@v1.67.3", "version": "v1.67.3" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "gopkg.in/yaml.v3", "purl": "pkg:golang/gopkg.in/yaml.v3@v3.0.1", "version": "v3.0.1" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "k8s.io/api", "purl": "pkg:golang/k8s.io/api@v0.36.2", "version": "v0.36.2" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "k8s.io/apimachinery", "purl": "pkg:golang/k8s.io/apimachinery@v0.36.2", "version": "v0.36.2" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "k8s.io/client-go", "purl": "pkg:golang/k8s.io/client-go@v0.36.2", "version": "v0.36.2" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "k8s.io/klog/v2", "purl": "pkg:golang/k8s.io/klog/v2@v2.140.0", "version": "v2.140.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "k8s.io/kube-openapi", "purl": "pkg:golang/k8s.io/kube-openapi@v0.0.0-20260317180543-43fb72c5454a", "version": "v0.0.0-20260317180543-43fb72c5454a" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "k8s.io/utils", "purl": "pkg:golang/k8s.io/utils@v0.0.0-20260210185600-b8788abfbbc2", "version": "v0.0.0-20260210185600-b8788abfbbc2" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "sigs.k8s.io/json", "purl": "pkg:golang/sigs.k8s.io/json@v0.0.0-20250730193827-2d320260d730", "version": "v0.0.0-20250730193827-2d320260d730" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "sigs.k8s.io/randfill", "purl": "pkg:golang/sigs.k8s.io/randfill@v1.0.0", "version": "v1.0.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "sigs.k8s.io/release-utils", "purl": "pkg:golang/sigs.k8s.io/release-utils@v0.12.5", "version": "v0.12.5" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "sigs.k8s.io/structured-merge-diff/v6", "purl": "pkg:golang/sigs.k8s.io/structured-merge-diff/v6@v6.3.2", "version": "v6.3.2" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "sigs.k8s.io/yaml", "purl": "pkg:golang/sigs.k8s.io/yaml@v1.6.0", "version": "v1.6.0" } ], "description": "Sign and verify container images", "errors": [], "go_binary": { "asset": "cosign-linux-amd64", "binary": "cosign-linux-amd64", "db": "https://vuln.go.dev", "db_last_modified": "2026-10-27T21:16:18Z", "findings": [ { "aliases": [], "epss": null, "fixed_version": "", "id": "GO-2026-6225", "kev": null, "level": "symbol", "module": "github.com/chrismellard/docker-credential-acr-env", "summary": "Credential leakage to untrusted hosts in github.com/chrismellard/docker-credential-acr-env", "version": "v0.0.0-20230304212654-82a0ddb27589" }, { "aliases": [], "epss": null, "fixed_version": "", "id": "GO-2026-5932", "kev": null, "level": "module", "module": "golang.org/x/crypto", "summary": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "version": "v0.58.0" }, { "aliases": [ "CVE-2026-78661" ], "epss": { "cve": "CVE-2026-78661", "percentile": 0.08063, "score": 0.00185 }, "fixed_version": "v0.62.0", "id": "GO-2026-6860", "kev": null, "level": "module", "module": "golang.org/x/net", "summary": "Avoid quadratic complexity when coalescing text nodes in html in golang.org/x/net", "version": "v0.61.0" }, { "aliases": [ "CVE-2026-97045" ], "epss": { "cve": "CVE-2026-97045", "percentile": 0.10117, "score": 0.00202 }, "fixed_version": "v0.62.0", "id": "GO-2026-6866", "kev": null, "level": "module", "module": "golang.org/x/net", "summary": "Check all ancestor namespace transitions when rendering raw text in html in golang.org/x/net", "version": "v0.61.0" } ], "go_version": "go1.27.3", "main_module": "github.com/sigstore/cosign/v3" }, "id": "sigstore__cosign", "manifests": [ ".github/workflows/build.yaml", ".github/workflows/codeql-analysis.yml", ".github/workflows/conformance-nightly.yml", ".github/workflows/conformance.yml", ".github/workflows/cut-release.yml", ".github/workflows/depsreview.yml", ".github/workflows/donotsubmit.yaml", ".github/workflows/e2e-tests.yml", ".github/workflows/e2e-with-binary.yml", ".github/workflows/github-oidc.yaml", ".github/workflows/golangci-lint.yml", ".github/workflows/kind-verify-attestation.yaml", ".github/workflows/scorecard-action.yml", ".github/workflows/tests.yaml", ".github/workflows/validate-release.yml", ".github/workflows/verify-docgen.yaml", ".github/workflows/whitespace.yaml", "go.mod", "go.sum" ], "name": "cosign", "osv": { "advisories": 5, "available": true, "confirmed": 5, "osv_only": [], "warning": null }, "ref": "v3.1.4", "ref_kind": "release", "release_integrity": { "asset": "cosign-linux-amd64", "assets": 83, "build_provenance": null, "checksums_published": true, "digest_matches_github": true, "immutable_release": true, "methods": [ { "covers": "asset", "detail": "valid Sigstore signature from an identity outside this repository's GitHub workflows", "method": "cosign", "signer": "email:keyless@projectsigstore.iam.gserviceaccount.com", "status": "signed-other-identity" }, { "detail": "GitHub attests the file is unchanged since the release was published", "method": "github-immutable-release", "status": "verified" } ], "provenance_published": false, "sbom_published": true, "signature": "other-identity", "signatures_published": true, "signer": "email:keyless@projectsigstore.iam.gserviceaccount.com", "verdict": "signed" }, "released_at": "2026-10-20T18:27:42Z", "repository": "sigstore/cosign", "sbomlyze_diff": { "added": 0, "changed": 0, "drift": {}, "findings": [ "0 version changes among 367 shared packages \u2014 no actual upgrades", "Core system packages stable: golang (290), github (59), file (18) unchanged" ], "removed": 0 }, "scanned_at": "2026-11-02T03:07:49+00:00", "scorecard": { "checks": [ { "name": "Token-Permissions", "reason": "detected GitHub workflow tokens with excessive permissions", "score": 0 }, { "name": "CII-Best-Practices", "reason": "badge detected: InProgress", "score": 2 }, { "name": "Vulnerabilities", "reason": "5 existing vulnerabilities detected", "score": 5 }, { "name": "SAST", "reason": "SAST tool detected but not run on all commits", "score": 7 }, { "name": "Pinned-Dependencies", "reason": "dependency not pinned by hash detected -- score normalized to 8", "score": 8 }, { "name": "Signed-Releases", "reason": "5 out of the last 5 releases have a total of 5 signed artifacts.", "score": 8 }, { "name": "Binary-Artifacts", "reason": "no binaries found in the repo", "score": 10 }, { "name": "CI-Tests", "reason": "30 out of 30 merged PRs checked by a CI test -- score normalized to 10", "score": 10 }, { "name": "Code-Review", "reason": "all changesets reviewed", "score": 10 }, { "name": "Contributors", "reason": "project has 75 contributing companies or organizations", "score": 10 }, { "name": "Dangerous-Workflow", "reason": "no dangerous workflow patterns detected", "score": 10 }, { "name": "Dependency-Update-Tool", "reason": "update tool detected", "score": 10 }, { "name": "Fuzzing", "reason": "project is fuzzed", "score": 10 }, { "name": "License", "reason": "license file detected", "score": 10 }, { "name": "Maintained", "reason": "30 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 10", "score": 10 }, { "name": "Packaging", "reason": "packaging workflow detected", "score": 10 }, { "name": "Security-Policy", "reason": "security policy file detected", "score": 10 }, { "name": "Branch-Protection", "reason": "internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md", "score": -1 } ], "date": "2026-10-31", "score": 8.2, "source": "openssf-api", "version": "v5.6.0" }, "vulnerabilities": [ { "aliases": [ "CVE-2026-114437" ], "ecosystem": "golang", "epss": { "cve": "CVE-2026-114437", "percentile": 0.02563, "score": 0.00129 }, "fix_state": "fixed", "fixed_in": [ "5.4.0" ], "id": "GHSA-j6qf-3m9c-vwj3", "in_binary": "vulnerable code not in binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "github.com/go-chi/chi/v5", "severity": "Medium", "summary": "chi: Client IP spoofing in ClientIPFromXFF via X-Forwarded-For", "url": "https://github.com/advisories/GHSA-j6qf-3m9c-vwj3", "version": "v5.3.2" }, { "aliases": [], "ecosystem": "golang", "epss": null, "fix_state": "unknown", "fixed_in": [], "id": "GO-2026-6225", "in_binary": "vulnerable code in binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "github.com/chrismellard/docker-credential-acr-env", "severity": "Unknown", "summary": "In github.com/chrismellard/docker-credential-acr-env/pkg/credhelper, the regular expression used by isACRRegistry to validate Azure Container Registry hostnames is unanchored. As a result, arbitrary hostnames containing the substring \".azurecr.io\" (such as evil.azurecr.io.attacker.com) are treated a", "url": "https://github.com/chrismellard/docker-credential-acr-env/issues/21", "version": "v0.0.0-20230304212654-82a0ddb27589" }, { "aliases": [], "ecosystem": "golang", "epss": null, "fix_state": "unknown", "fixed_in": [], "id": "GO-2026-5932", "in_binary": "module in binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "golang.org/x/crypto", "severity": "Unknown", "summary": "The golang.org/x/crypto/openpgp package is unsafe by design, has numerous known security issues, is not maintained, and should not be used. If you are required to interoperate with OpenPGP systems and need a maintained package, consider github.com/ProtonMail/go-crypto/openpgp which is a maintained f", "url": "https://go.dev/issue/44226", "version": "v0.58.0" }, { "aliases": [ "CVE-2026-78661" ], "ecosystem": "golang", "epss": { "cve": "CVE-2026-78661", "percentile": 0.08063, "score": 0.00185 }, "fix_state": "fixed", "fixed_in": [ "0.62.0" ], "id": "GO-2026-6860", "in_binary": "module in binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "golang.org/x/net", "severity": "Unknown", "summary": "When coalescing adjacent text nodes in addText and fosterParent, appending to an existing TextNode's Data via string concatenation (n.Data += text) reallocated and copied the accumulated string on every token. Inputs containing many short text runs separated by ignored end tags (such as \"a\") cau", "url": "https://go.dev/cl/849365", "version": "v0.61.0" }, { "aliases": [ "CVE-2026-97045" ], "ecosystem": "golang", "epss": { "cve": "CVE-2026-97045", "percentile": 0.10117, "score": 0.00202 }, "fix_state": "fixed", "fixed_in": [ "0.62.0" ], "id": "GO-2026-6866", "in_binary": "module in binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "golang.org/x/net", "severity": "Unknown", "summary": "In childTextNodesAreLiteral, walking up the tree previously stopped at the nearest foreign ancestor once an HTML integration point was found. However, that integration point may itself be a descendant of an element that was foster-parented into a foreign namespace (such as or f", "url": "https://go.dev/cl/855121", "version": "v0.61.0" } ], "workflow_audit": { "files": 17, "findings": [ { "confidence": "High", "description": "unpinned action reference", "file": ".github/workflows/conformance-nightly.yml", "line": 48, "note": "this step", "rule": "unpinned-uses", "severity": "High", "url": "https://docs.zizmor.sh/audits/#unpinned-uses" }, { "confidence": "High", "description": "unpinned action reference", "file": ".github/workflows/cut-release.yml", "line": 37, "note": "this job", "rule": "unpinned-uses", "severity": "High", "url": "https://docs.zizmor.sh/audits/#unpinned-uses" }, { "confidence": "High", "description": "unpinned action reference", "file": ".github/workflows/depsreview.yml", "line": 21, "note": "this job", "rule": "unpinned-uses", "severity": "High", "url": "https://docs.zizmor.sh/audits/#unpinned-uses" }, { "confidence": "High", "description": "unpinned image references", "file": ".github/workflows/e2e-tests.yml", "line": 83, "note": "container image uses the floating 'latest' tag", "rule": "unpinned-images", "severity": "High", "url": "https://docs.zizmor.sh/audits/#unpinned-images" }, { "confidence": "High", "description": "unpinned action reference", "file": ".github/workflows/e2e-tests.yml", "line": 121, "note": "this step", "rule": "unpinned-uses", "severity": "High", "url": "https://docs.zizmor.sh/audits/#unpinned-uses" }, { "confidence": "High", "description": "unpinned action reference", "file": ".github/workflows/e2e-tests.yml", "line": 157, "note": "this step", "rule": "unpinned-uses", "severity": "High", "url": "https://docs.zizmor.sh/audits/#unpinned-uses" }, { "confidence": "High", "description": "unpinned action reference", "file": ".github/workflows/kind-verify-attestation.yaml", "line": 79, "note": "this step", "rule": "unpinned-uses", "severity": "High", "url": "https://docs.zizmor.sh/audits/#unpinned-uses" }, { "confidence": "Medium", "description": "overly broad permissions", "file": ".github/workflows/e2e-tests.yml", "line": 16, "note": "default permissions used due to no permissions: block", "rule": "excessive-permissions", "severity": "Medium", "url": "https://docs.zizmor.sh/audits/#excessive-permissions" }, { "confidence": "Medium", "description": "overly broad permissions", "file": ".github/workflows/e2e-tests.yml", "line": 35, "note": "this job", "rule": "excessive-permissions", "severity": "Medium", "url": "https://docs.zizmor.sh/audits/#excessive-permissions" }, { "confidence": "Medium", "description": "overly broad permissions", "file": ".github/workflows/e2e-tests.yml", "line": 58, "note": "this job", "rule": "excessive-permissions", "severity": "Medium", "url": "https://docs.zizmor.sh/audits/#excessive-permissions" }, { "confidence": "Medium", "description": "overly broad permissions", "file": ".github/workflows/e2e-tests.yml", "line": 79, "note": "this job", "rule": "excessive-permissions", "severity": "Medium", "url": "https://docs.zizmor.sh/audits/#excessive-permissions" }, { "confidence": "Medium", "description": "overly broad permissions", "file": ".github/workflows/e2e-tests.yml", "line": 132, "note": "this job", "rule": "excessive-permissions", "severity": "Medium", "url": "https://docs.zizmor.sh/audits/#excessive-permissions" } ] } }, "updated": "2026-11-02" }