{
  "history": [
    {
      "added": 0,
      "commit": "10ae003038c81855aca8489df5e35da150f4dc2e",
      "date": "2026-11-01",
      "dependencies": 621,
      "errors": [],
      "fixable": 142,
      "go_version": "go1.26.1",
      "in_binary": {
        "dependencies": 42,
        "stdlib": 40,
        "total": 82
      },
      "new_vulnerabilities": 0,
      "osv_confirmed": 157,
      "osv_only": 2,
      "ref": "v0.8.3",
      "release_changed": false,
      "release_integrity": "signed",
      "removed": 0,
      "resolved_vulnerabilities": 0,
      "scorecard": 7.4,
      "upgraded": 0,
      "vulnerabilities": {
        "Critical": 20,
        "High": 58,
        "Low": 12,
        "Medium": 60,
        "Negligible": 0,
        "Unknown": 7
      },
      "workflow": {
        "High": 21,
        "Low": 0,
        "Medium": 4,
        "files": 3
      }
    },
    {
      "added": 0,
      "commit": "10ae003038c81855aca8489df5e35da150f4dc2e",
      "date": "2026-11-02",
      "dependencies": 621,
      "errors": [],
      "fixable": 142,
      "go_version": "go1.26.1",
      "in_binary": {
        "dependencies": 42,
        "stdlib": 40,
        "total": 82
      },
      "kev": 0,
      "kev_new": 0,
      "new_vulnerabilities": 0,
      "osv_confirmed": 157,
      "osv_only": 2,
      "ref": "v0.8.3",
      "release_changed": false,
      "release_integrity": "signed",
      "removed": 0,
      "resolved_vulnerabilities": 0,
      "scorecard": 7.4,
      "scorecard_date": "2026-10-19",
      "scorecard_note": null,
      "scorecard_source": "openssf-api",
      "upgraded": 0,
      "vulnerabilities": {
        "Critical": 20,
        "High": 58,
        "Low": 12,
        "Medium": 60,
        "Negligible": 0,
        "Unknown": 7
      },
      "vulnerable_packages": 41,
      "workflow": {
        "High": 21,
        "Low": 0,
        "Medium": 4,
        "files": 3
      }
    }
  ],
  "latest": {
    "archived": false,
    "category": "Kubernetes Security",
    "changes": {
      "added": [],
      "any": false,
      "baseline": false,
      "in_binary_new": [],
      "in_binary_resolved": [],
      "integrity_drift": 0,
      "license_changes": [],
      "new_vulnerabilities": [],
      "previous_ref": "v0.8.3",
      "release_changed": false,
      "removed": [],
      "resolved_vulnerabilities": [],
      "upgraded": [],
      "workflow_new": 0,
      "workflow_resolved": 0
    },
    "commit": "10ae003038c81855aca8489df5e35da150f4dc2e",
    "compliance": {
      "overall_score": 55,
      "standards": {
        "bsi_tr03183": {
          "failed_checks": [
            "Component Creator",
            "Distribution Licences",
            "SHA-512 Hash",
            "Dependency Relationship",
            "SBOM Creator Contact"
          ],
          "passed": 4,
          "score": 44,
          "total": 9
        },
        "cisa": {
          "failed_checks": [
            "Software Producer",
            "Dependency Relationship",
            "License Information",
            "Component Hash",
            "SBOM Author"
          ],
          "passed": 5,
          "score": 50,
          "total": 10
        },
        "ntia": {
          "failed_checks": [
            "Supplier Name",
            "Dependency Relationship"
          ],
          "passed": 5,
          "score": 71,
          "total": 7
        }
      }
    },
    "components": [
      {
        "ecosystem": "github",
        "licenses": [],
        "location": ".github/workflows/build.yaml",
        "name": "actions/cache",
        "purl": "pkg:github/actions/cache@v5",
        "version": "v5"
      },
      {
        "ecosystem": "github",
        "licenses": [],
        "location": ".github/workflows/build.yaml",
        "name": "actions/checkout",
        "purl": "pkg:github/actions/checkout@v6",
        "version": "v6"
      },
      {
        "ecosystem": "github",
        "licenses": [],
        "location": ".github/workflows/build.yaml",
        "name": "actions/download-artifact",
        "purl": "pkg:github/actions/download-artifact@v8",
        "version": "v8"
      },
      {
        "ecosystem": "github",
        "licenses": [],
        "location": ".github/workflows/build.yaml",
        "name": "actions/setup-go",
        "purl": "pkg:github/actions/setup-go@v6",
        "version": "v6"
      },
      {
        "ecosystem": "github",
        "licenses": [],
        "location": ".github/workflows/build.yaml",
        "name": "actions/upload-artifact",
        "purl": "pkg:github/actions/upload-artifact@v7",
        "version": "v7"
      },
      {
        "ecosystem": "github",
        "licenses": [],
        "location": ".github/workflows/build.yaml",
        "name": "codecov/codecov-action",
        "purl": "pkg:github/codecov/codecov-action@v5.5.2",
        "version": "v5.5.2"
      },
      {
        "ecosystem": "github",
        "licenses": [],
        "location": ".github/workflows/release.yaml",
        "name": "docker/login-action",
        "purl": "pkg:github/docker/login-action@b45d80f862d83dbcd57f89517bcf500b2ab88fb2",
        "version": "b45d80f862d83dbcd57f89517bcf500b2ab88fb2"
      },
      {
        "ecosystem": "github",
        "licenses": [],
        "location": ".github/workflows/release.yaml",
        "name": "docker/setup-buildx-action",
        "purl": "pkg:github/docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f",
        "version": "8d2750c68a42422c14e847fe6c8ac0403b4cbd6f"
      },
      {
        "ecosystem": "github",
        "licenses": [],
        "location": ".github/workflows/build.yaml",
        "name": "github/codeql-action/upload-sarif",
        "purl": "pkg:github/github/codeql-action@v4#upload-sarif",
        "version": "v4"
      },
      {
        "ecosystem": "github",
        "licenses": [],
        "location": ".github/workflows/release.yaml",
        "name": "goreleaser/goreleaser-action",
        "purl": "pkg:github/goreleaser/goreleaser-action@v7",
        "version": "v7"
      },
      {
        "ecosystem": "github",
        "licenses": [],
        "location": ".github/workflows/build.yaml",
        "name": "mig4/setup-bats",
        "purl": "pkg:github/mig4/setup-bats@v1",
        "version": "v1"
      },
      {
        "ecosystem": "github",
        "licenses": [],
        "location": ".github/workflows/release.yaml",
        "name": "sigstore/cosign-installer",
        "purl": "pkg:github/sigstore/cosign-installer@v4.0.0",
        "version": "v4.0.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "4d63.com/gocheckcompilerdirectives",
        "purl": "pkg:golang/4d63.com/gocheckcompilerdirectives@v1.3.0",
        "version": "v1.3.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "4d63.com/gochecknoglobals",
        "purl": "pkg:golang/4d63.com/gochecknoglobals@v0.2.2",
        "version": "v0.2.2"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "al.essio.dev/pkg/shellescape",
        "purl": "pkg:golang/al.essio.dev/pkg/shellescape@v1.6.0",
        "version": "v1.6.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "cel.dev/expr",
        "purl": "pkg:golang/cel.dev/expr@v0.25.1",
        "version": "v0.25.1"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "cloud.google.com/go",
        "purl": "pkg:golang/cloud.google.com/go@v0.121.6",
        "version": "v0.121.6"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "cloud.google.com/go/auth",
        "purl": "pkg:golang/cloud.google.com/go/auth@v0.18.0",
        "version": "v0.18.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "cloud.google.com/go/auth/oauth2adapt",
        "purl": "pkg:golang/cloud.google.com/go/auth/oauth2adapt@v0.2.8",
        "version": "v0.2.8"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "cloud.google.com/go/compute/metadata",
        "purl": "pkg:golang/cloud.google.com/go/compute/metadata@v0.9.0",
        "version": "v0.9.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "cloud.google.com/go/iam",
        "purl": "pkg:golang/cloud.google.com/go/iam@v1.5.3",
        "version": "v1.5.3"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "cloud.google.com/go/kms",
        "purl": "pkg:golang/cloud.google.com/go/kms@v1.23.2",
        "version": "v1.23.2"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "cloud.google.com/go/longrunning",
        "purl": "pkg:golang/cloud.google.com/go/longrunning@v0.7.0",
        "version": "v0.7.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "cloud.google.com/go/monitoring",
        "purl": "pkg:golang/cloud.google.com/go/monitoring@v1.24.3",
        "version": "v1.24.3"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "cloud.google.com/go/storage",
        "purl": "pkg:golang/cloud.google.com/go/storage@v1.57.1",
        "version": "v1.57.1"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "code.gitea.io/sdk/gitea",
        "purl": "pkg:golang/code.gitea.io/sdk/gitea@v0.22.1",
        "version": "v0.22.1"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "codeberg.org/chavacava/garif",
        "purl": "pkg:golang/codeberg.org/chavacava/garif@v0.2.0",
        "version": "v0.2.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "codeberg.org/polyfloyd/go-errorlint",
        "purl": "pkg:golang/codeberg.org/polyfloyd/go-errorlint@v1.9.0",
        "version": "v1.9.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "dario.cat/mergo",
        "purl": "pkg:golang/dario.cat/mergo@v1.0.2",
        "version": "v1.0.2"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "dev.gaijin.team/go/exhaustruct/v4",
        "purl": "pkg:golang/dev.gaijin.team/go/exhaustruct/v4@v4.0.0",
        "version": "v4.0.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "dev.gaijin.team/go/golib",
        "purl": "pkg:golang/dev.gaijin.team/go/golib@v0.6.0",
        "version": "v0.6.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/42wim/httpsig",
        "purl": "pkg:golang/github.com/42wim/httpsig@v1.2.3",
        "version": "v1.2.3"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/4meepo/tagalign",
        "purl": "pkg:golang/github.com/4meepo/tagalign@v1.4.3",
        "version": "v1.4.3"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/Abirdcfly/dupword",
        "purl": "pkg:golang/github.com/Abirdcfly/dupword@v0.1.7",
        "version": "v0.1.7"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/AdminBenni/iota-mixing",
        "purl": "pkg:golang/github.com/AdminBenni/iota-mixing@v1.0.0",
        "version": "v1.0.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/agnivade/levenshtein",
        "purl": "pkg:golang/github.com/agnivade/levenshtein@v1.2.1",
        "version": "v1.2.1"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/alecthomas/chroma/v2",
        "purl": "pkg:golang/github.com/alecthomas/chroma/v2@v2.23.1",
        "version": "v2.23.1"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/alecthomas/go-check-sumtype",
        "purl": "pkg:golang/github.com/alecthomas/go-check-sumtype@v0.3.1",
        "version": "v0.3.1"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/AlekSi/pointer",
        "purl": "pkg:golang/github.com/AlekSi/pointer@v1.2.0",
        "version": "v1.2.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/alexkohler/nakedret/v2",
        "purl": "pkg:golang/github.com/alexkohler/nakedret/v2@v2.0.6",
        "version": "v2.0.6"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/alexkohler/prealloc",
        "purl": "pkg:golang/github.com/alexkohler/prealloc@v1.0.2",
        "version": "v1.0.2"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/alfatraining/structtag",
        "purl": "pkg:golang/github.com/alfatraining/structtag@v1.0.0",
        "version": "v1.0.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/alingse/asasalint",
        "purl": "pkg:golang/github.com/alingse/asasalint@v0.0.11",
        "version": "v0.0.11"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/alingse/nilnesserr",
        "purl": "pkg:golang/github.com/alingse/nilnesserr@v0.2.0",
        "version": "v0.2.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/AlwxSin/noinlineerr",
        "purl": "pkg:golang/github.com/AlwxSin/noinlineerr@v1.0.5",
        "version": "v1.0.5"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/anchore/bubbly",
        "purl": "pkg:golang/github.com/anchore/bubbly@v0.0.0-20241107060245-f2a5536f366a",
        "version": "v0.0.0-20241107060245-f2a5536f366a"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/anchore/go-logger",
        "purl": "pkg:golang/github.com/anchore/go-logger@v0.0.0-20241005132348-65b4486fbb28",
        "version": "v0.0.0-20241005132348-65b4486fbb28"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/anchore/go-macholibre",
        "purl": "pkg:golang/github.com/anchore/go-macholibre@v0.0.0-20220308212642-53e6d0aaf6fb",
        "version": "v0.0.0-20220308212642-53e6d0aaf6fb"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/anchore/quill",
        "purl": "pkg:golang/github.com/anchore/quill@v0.5.1",
        "version": "v0.5.1"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/antlr4-go/antlr/v4",
        "purl": "pkg:golang/github.com/antlr4-go/antlr/v4@v4.13.1",
        "version": "v4.13.1"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/Antonboom/errname",
        "purl": "pkg:golang/github.com/Antonboom/errname@v1.1.1",
        "version": "v1.1.1"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/Antonboom/nilnil",
        "purl": "pkg:golang/github.com/Antonboom/nilnil@v1.1.1",
        "version": "v1.1.1"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/Antonboom/testifylint",
        "purl": "pkg:golang/github.com/Antonboom/testifylint@v1.6.4",
        "version": "v1.6.4"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/asaskevich/govalidator",
        "purl": "pkg:golang/github.com/asaskevich/govalidator@v0.0.0-20230301143203-a9d515a09cc2",
        "version": "v0.0.0-20230301143203-a9d515a09cc2"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/ashanbrown/forbidigo/v2",
        "purl": "pkg:golang/github.com/ashanbrown/forbidigo/v2@v2.3.0",
        "version": "v2.3.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/ashanbrown/makezero/v2",
        "purl": "pkg:golang/github.com/ashanbrown/makezero/v2@v2.1.0",
        "version": "v2.1.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/atc0005/go-teams-notify/v2",
        "purl": "pkg:golang/github.com/atc0005/go-teams-notify/v2@v2.14.0",
        "version": "v2.14.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/avast/retry-go/v4",
        "purl": "pkg:golang/github.com/avast/retry-go/v4@v4.7.0",
        "version": "v4.7.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/aws/aws-sdk-go",
        "purl": "pkg:golang/github.com/aws/aws-sdk-go@v1.55.8",
        "version": "v1.55.8"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/aws/aws-sdk-go-v2",
        "purl": "pkg:golang/github.com/aws/aws-sdk-go-v2@v1.41.0",
        "version": "v1.41.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream",
        "purl": "pkg:golang/github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.7.4",
        "version": "v1.7.4"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/aws/aws-sdk-go-v2/config",
        "purl": "pkg:golang/github.com/aws/aws-sdk-go-v2/config@v1.32.5",
        "version": "v1.32.5"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/aws/aws-sdk-go-v2/credentials",
        "purl": "pkg:golang/github.com/aws/aws-sdk-go-v2/credentials@v1.19.5",
        "version": "v1.19.5"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/aws/aws-sdk-go-v2/feature/ec2/imds",
        "purl": "pkg:golang/github.com/aws/aws-sdk-go-v2/feature/ec2/imds@v1.18.16",
        "version": "v1.18.16"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/aws/aws-sdk-go-v2/feature/s3/manager",
        "purl": "pkg:golang/github.com/aws/aws-sdk-go-v2/feature/s3/manager@v1.20.3",
        "version": "v1.20.3"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/aws/aws-sdk-go-v2/internal/configsources",
        "purl": "pkg:golang/github.com/aws/aws-sdk-go-v2/internal/configsources@v1.4.16",
        "version": "v1.4.16"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/aws/aws-sdk-go-v2/internal/endpoints/v2",
        "purl": "pkg:golang/github.com/aws/aws-sdk-go-v2/internal/endpoints/v2@v2.7.16",
        "version": "v2.7.16"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/aws/aws-sdk-go-v2/internal/ini",
        "purl": "pkg:golang/github.com/aws/aws-sdk-go-v2/internal/ini@v1.8.4",
        "version": "v1.8.4"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/aws/aws-sdk-go-v2/internal/v4a",
        "purl": "pkg:golang/github.com/aws/aws-sdk-go-v2/internal/v4a@v1.4.15",
        "version": "v1.4.15"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/aws/aws-sdk-go-v2/service/ecr",
        "purl": "pkg:golang/github.com/aws/aws-sdk-go-v2/service/ecr@v1.51.2",
        "version": "v1.51.2"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/aws/aws-sdk-go-v2/service/ecrpublic",
        "purl": "pkg:golang/github.com/aws/aws-sdk-go-v2/service/ecrpublic@v1.38.2",
        "version": "v1.38.2"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding",
        "purl": "pkg:golang/github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding@v1.13.4",
        "version": "v1.13.4"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/aws/aws-sdk-go-v2/service/internal/checksum",
        "purl": "pkg:golang/github.com/aws/aws-sdk-go-v2/service/internal/checksum@v1.9.6",
        "version": "v1.9.6"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/aws/aws-sdk-go-v2/service/internal/presigned-url",
        "purl": "pkg:golang/github.com/aws/aws-sdk-go-v2/service/internal/presigned-url@v1.13.16",
        "version": "v1.13.16"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/aws/aws-sdk-go-v2/service/internal/s3shared",
        "purl": "pkg:golang/github.com/aws/aws-sdk-go-v2/service/internal/s3shared@v1.19.15",
        "version": "v1.19.15"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/aws/aws-sdk-go-v2/service/kms",
        "purl": "pkg:golang/github.com/aws/aws-sdk-go-v2/service/kms@v1.49.1",
        "version": "v1.49.1"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/aws/aws-sdk-go-v2/service/s3",
        "purl": "pkg:golang/github.com/aws/aws-sdk-go-v2/service/s3@v1.93.0",
        "version": "v1.93.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/aws/aws-sdk-go-v2/service/signin",
        "purl": "pkg:golang/github.com/aws/aws-sdk-go-v2/service/signin@v1.0.4",
        "version": "v1.0.4"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/aws/aws-sdk-go-v2/service/sso",
        "purl": "pkg:golang/github.com/aws/aws-sdk-go-v2/service/sso@v1.30.7",
        "version": "v1.30.7"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/aws/aws-sdk-go-v2/service/ssooidc",
        "purl": "pkg:golang/github.com/aws/aws-sdk-go-v2/service/ssooidc@v1.35.12",
        "version": "v1.35.12"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/aws/aws-sdk-go-v2/service/sts",
        "purl": "pkg:golang/github.com/aws/aws-sdk-go-v2/service/sts@v1.41.5",
        "version": "v1.41.5"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/aws/smithy-go",
        "purl": "pkg:golang/github.com/aws/smithy-go@v1.24.0",
        "version": "v1.24.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/awslabs/amazon-ecr-credential-helper/ecr-login",
        "purl": "pkg:golang/github.com/awslabs/amazon-ecr-credential-helper/ecr-login@v0.11.0",
        "version": "v0.11.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/aymanbagabas/go-osc52/v2",
        "purl": "pkg:golang/github.com/aymanbagabas/go-osc52/v2@v2.0.1",
        "version": "v2.0.1"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/Azure/azure-sdk-for-go",
        "purl": "pkg:golang/github.com/Azure/azure-sdk-for-go@v68.0.0%2Bincompatible",
        "version": "v68.0.0+incompatible"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/Azure/azure-sdk-for-go/sdk/azcore",
        "purl": "pkg:golang/github.com/Azure/azure-sdk-for-go/sdk/azcore@v1.20.0",
        "version": "v1.20.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/Azure/azure-sdk-for-go/sdk/azidentity",
        "purl": "pkg:golang/github.com/Azure/azure-sdk-for-go/sdk/azidentity@v1.13.1",
        "version": "v1.13.1"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/Azure/azure-sdk-for-go/sdk/internal",
        "purl": "pkg:golang/github.com/Azure/azure-sdk-for-go/sdk/internal@v1.11.2",
        "version": "v1.11.2"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/Azure/azure-sdk-for-go/sdk/keyvault/azkeys",
        "purl": "pkg:golang/github.com/Azure/azure-sdk-for-go/sdk/keyvault/azkeys@v0.10.0",
        "version": "v0.10.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/Azure/azure-sdk-for-go/sdk/keyvault/internal",
        "purl": "pkg:golang/github.com/Azure/azure-sdk-for-go/sdk/keyvault/internal@v0.7.1",
        "version": "v0.7.1"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/azkeys",
        "purl": "pkg:golang/github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/azkeys@v1.4.0",
        "version": "v1.4.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/internal",
        "purl": "pkg:golang/github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/internal@v1.2.0",
        "version": "v1.2.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/Azure/azure-sdk-for-go/sdk/storage/azblob",
        "purl": "pkg:golang/github.com/Azure/azure-sdk-for-go/sdk/storage/azblob@v1.6.1",
        "version": "v1.6.1"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/Azure/go-ansiterm",
        "purl": "pkg:golang/github.com/Azure/go-ansiterm@v0.0.0-20250102033503-faa5f7b0171c",
        "version": "v0.0.0-20250102033503-faa5f7b0171c"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/Azure/go-autorest",
        "purl": "pkg:golang/github.com/Azure/go-autorest@v14.2.0%2Bincompatible",
        "version": "v14.2.0+incompatible"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/Azure/go-autorest/autorest",
        "purl": "pkg:golang/github.com/Azure/go-autorest/autorest@v0.11.30",
        "version": "v0.11.30"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/Azure/go-autorest/autorest/adal",
        "purl": "pkg:golang/github.com/Azure/go-autorest/autorest/adal@v0.9.24",
        "version": "v0.9.24"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/Azure/go-autorest/autorest/azure/auth",
        "purl": "pkg:golang/github.com/Azure/go-autorest/autorest/azure/auth@v0.5.13",
        "version": "v0.5.13"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/Azure/go-autorest/autorest/azure/cli",
        "purl": "pkg:golang/github.com/Azure/go-autorest/autorest/azure/cli@v0.4.7",
        "version": "v0.4.7"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/Azure/go-autorest/autorest/date",
        "purl": "pkg:golang/github.com/Azure/go-autorest/autorest/date@v0.3.1",
        "version": "v0.3.1"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/Azure/go-autorest/autorest/to",
        "purl": "pkg:golang/github.com/Azure/go-autorest/autorest/to@v0.4.1",
        "version": "v0.4.1"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/Azure/go-autorest/logger",
        "purl": "pkg:golang/github.com/Azure/go-autorest/logger@v0.2.2",
        "version": "v0.2.2"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/Azure/go-autorest/tracing",
        "purl": "pkg:golang/github.com/Azure/go-autorest/tracing@v0.6.1",
        "version": "v0.6.1"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/AzureAD/microsoft-authentication-library-for-go",
        "purl": "pkg:golang/github.com/AzureAD/microsoft-authentication-library-for-go@v1.6.0",
        "version": "v1.6.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/bahlo/generic-list-go",
        "purl": "pkg:golang/github.com/bahlo/generic-list-go@v0.2.0",
        "version": "v0.2.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/beorn7/perks",
        "purl": "pkg:golang/github.com/beorn7/perks@v1.0.1",
        "version": "v1.0.1"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/bkielbasa/cyclop",
        "purl": "pkg:golang/github.com/bkielbasa/cyclop@v1.2.3",
        "version": "v1.2.3"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/blacktop/go-dwarf",
        "purl": "pkg:golang/github.com/blacktop/go-dwarf@v1.0.10",
        "version": "v1.0.10"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/blacktop/go-macho",
        "purl": "pkg:golang/github.com/blacktop/go-macho@v1.1.238",
        "version": "v1.1.238"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/blakesmith/ar",
        "purl": "pkg:golang/github.com/blakesmith/ar@v0.0.0-20190502131153-809d4375e1fb",
        "version": "v0.0.0-20190502131153-809d4375e1fb"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/blang/semver",
        "purl": "pkg:golang/github.com/blang/semver@v3.5.1%2Bincompatible",
        "version": "v3.5.1+incompatible"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/blang/semver/v4",
        "purl": "pkg:golang/github.com/blang/semver/v4@v4.0.0",
        "version": "v4.0.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/blizzy78/varnamelen",
        "purl": "pkg:golang/github.com/blizzy78/varnamelen@v0.8.0",
        "version": "v0.8.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/bluesky-social/indigo",
        "purl": "pkg:golang/github.com/bluesky-social/indigo@v0.0.0-20240813042137-4006c0eca043",
        "version": "v0.0.0-20240813042137-4006c0eca043"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/bmatcuk/doublestar/v4",
        "purl": "pkg:golang/github.com/bmatcuk/doublestar/v4@v4.10.0",
        "version": "v4.10.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/bombsimon/wsl/v4",
        "purl": "pkg:golang/github.com/bombsimon/wsl/v4@v4.7.0",
        "version": "v4.7.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/bombsimon/wsl/v5",
        "purl": "pkg:golang/github.com/bombsimon/wsl/v5@v5.6.0",
        "version": "v5.6.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/breml/bidichk",
        "purl": "pkg:golang/github.com/breml/bidichk@v0.3.3",
        "version": "v0.3.3"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/breml/errchkjson",
        "purl": "pkg:golang/github.com/breml/errchkjson@v0.4.1",
        "version": "v0.4.1"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/buger/jsonparser",
        "purl": "pkg:golang/github.com/buger/jsonparser@v1.1.1",
        "version": "v1.1.1"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/BurntSushi/toml",
        "purl": "pkg:golang/github.com/BurntSushi/toml@v1.6.0",
        "version": "v1.6.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/butuzov/ireturn",
        "purl": "pkg:golang/github.com/butuzov/ireturn@v0.4.0",
        "version": "v0.4.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/butuzov/mirror",
        "purl": "pkg:golang/github.com/butuzov/mirror@v1.3.0",
        "version": "v1.3.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/caarlos0/env/v11",
        "purl": "pkg:golang/github.com/caarlos0/env/v11@v11.3.1",
        "version": "v11.3.1"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/caarlos0/go-reddit/v3",
        "purl": "pkg:golang/github.com/caarlos0/go-reddit/v3@v3.0.1",
        "version": "v3.0.1"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/caarlos0/go-shellwords",
        "purl": "pkg:golang/github.com/caarlos0/go-shellwords@v1.0.12",
        "version": "v1.0.12"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/caarlos0/go-version",
        "purl": "pkg:golang/github.com/caarlos0/go-version@v0.2.2",
        "version": "v0.2.2"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/caarlos0/log",
        "purl": "pkg:golang/github.com/caarlos0/log@v0.5.2",
        "version": "v0.5.2"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/carlmjohnson/versioninfo",
        "purl": "pkg:golang/github.com/carlmjohnson/versioninfo@v0.22.5",
        "version": "v0.22.5"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/catenacyber/perfsprint",
        "purl": "pkg:golang/github.com/catenacyber/perfsprint@v0.10.1",
        "version": "v0.10.1"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/cavaliergopher/cpio",
        "purl": "pkg:golang/github.com/cavaliergopher/cpio@v1.0.1",
        "version": "v1.0.1"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/ccojocar/zxcvbn-go",
        "purl": "pkg:golang/github.com/ccojocar/zxcvbn-go@v1.0.4",
        "version": "v1.0.4"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/cenkalti/backoff/v4",
        "purl": "pkg:golang/github.com/cenkalti/backoff/v4@v4.3.0",
        "version": "v4.3.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/cenkalti/backoff/v5",
        "purl": "pkg:golang/github.com/cenkalti/backoff/v5@v5.0.3",
        "version": "v5.0.3"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/cert-manager/cert-manager",
        "purl": "pkg:golang/github.com/cert-manager/cert-manager@v1.19.4",
        "version": "v1.19.4"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/cespare/xxhash/v2",
        "purl": "pkg:golang/github.com/cespare/xxhash/v2@v2.3.0",
        "version": "v2.3.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/chai2010/gettext-go",
        "purl": "pkg:golang/github.com/chai2010/gettext-go@v1.0.3",
        "version": "v1.0.3"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/charithe/durationcheck",
        "purl": "pkg:golang/github.com/charithe/durationcheck@v0.0.11",
        "version": "v0.0.11"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/charmbracelet/bubbletea",
        "purl": "pkg:golang/github.com/charmbracelet/bubbletea@v1.3.10",
        "version": "v1.3.10"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/charmbracelet/colorprofile",
        "purl": "pkg:golang/github.com/charmbracelet/colorprofile@v0.3.2",
        "version": "v0.3.2"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/charmbracelet/fang",
        "purl": "pkg:golang/github.com/charmbracelet/fang@v0.4.3",
        "version": "v0.4.3"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/charmbracelet/lipgloss",
        "purl": "pkg:golang/github.com/charmbracelet/lipgloss@v1.1.0",
        "version": "v1.1.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/charmbracelet/lipgloss/v2",
        "purl": "pkg:golang/github.com/charmbracelet/lipgloss/v2@v2.0.0-beta.3.0.20250917201909-41ff0bf215ea",
        "version": "v2.0.0-beta.3.0.20250917201909-41ff0bf215ea"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/charmbracelet/ultraviolet",
        "purl": "pkg:golang/github.com/charmbracelet/ultraviolet@v0.0.0-20250915111650-81d4262876ef",
        "version": "v0.0.0-20250915111650-81d4262876ef"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/charmbracelet/x/ansi",
        "purl": "pkg:golang/github.com/charmbracelet/x/ansi@v0.10.1",
        "version": "v0.10.1"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/charmbracelet/x/cellbuf",
        "purl": "pkg:golang/github.com/charmbracelet/x/cellbuf@v0.0.13",
        "version": "v0.0.13"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/charmbracelet/x/exp/charmtone",
        "purl": "pkg:golang/github.com/charmbracelet/x/exp/charmtone@v0.0.0-20250603201427-c31516f43444",
        "version": "v0.0.0-20250603201427-c31516f43444"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/charmbracelet/x/term",
        "purl": "pkg:golang/github.com/charmbracelet/x/term@v0.2.1",
        "version": "v0.2.1"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/charmbracelet/x/termios",
        "purl": "pkg:golang/github.com/charmbracelet/x/termios@v0.1.1",
        "version": "v0.1.1"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/charmbracelet/x/windows",
        "purl": "pkg:golang/github.com/charmbracelet/x/windows@v0.2.2",
        "version": "v0.2.2"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/chrismellard/docker-credential-acr-env",
        "purl": "pkg:golang/github.com/chrismellard/docker-credential-acr-env@v0.0.0-20230304212654-82a0ddb27589",
        "version": "v0.0.0-20230304212654-82a0ddb27589"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/ckaznocha/intrange",
        "purl": "pkg:golang/github.com/ckaznocha/intrange@v0.3.1",
        "version": "v0.3.1"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/cloudflare/circl",
        "purl": "pkg:golang/github.com/cloudflare/circl@v1.6.3",
        "version": "v1.6.3"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/cncf/xds/go",
        "purl": "pkg:golang/github.com/cncf/xds/go@v0.0.0-20251022180443-0feb69152e9f",
        "version": "v0.0.0-20251022180443-0feb69152e9f"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/containerd/containerd",
        "purl": "pkg:golang/github.com/containerd/containerd@v1.7.30",
        "version": "v1.7.30"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/containerd/errdefs",
        "purl": "pkg:golang/github.com/containerd/errdefs@v1.0.0",
        "version": "v1.0.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/containerd/errdefs/pkg",
        "purl": "pkg:golang/github.com/containerd/errdefs/pkg@v0.3.0",
        "version": "v0.3.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/containerd/log",
        "purl": "pkg:golang/github.com/containerd/log@v0.1.0",
        "version": "v0.1.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/containerd/platforms",
        "purl": "pkg:golang/github.com/containerd/platforms@v0.2.1",
        "version": "v0.2.1"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/containerd/stargz-snapshotter/estargz",
        "purl": "pkg:golang/github.com/containerd/stargz-snapshotter/estargz@v0.18.1",
        "version": "v0.18.1"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/coreos/go-oidc/v3",
        "purl": "pkg:golang/github.com/coreos/go-oidc/v3@v3.17.0",
        "version": "v3.17.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/cpuguy83/go-md2man/v2",
        "purl": "pkg:golang/github.com/cpuguy83/go-md2man/v2@v2.0.7",
        "version": "v2.0.7"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/curioswitch/go-reassign",
        "purl": "pkg:golang/github.com/curioswitch/go-reassign@v0.3.0",
        "version": "v0.3.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/cyberphone/json-canonicalization",
        "purl": "pkg:golang/github.com/cyberphone/json-canonicalization@v0.0.0-20241213102144-19d51d7fe467",
        "version": "v0.0.0-20241213102144-19d51d7fe467"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/cyphar/filepath-securejoin",
        "purl": "pkg:golang/github.com/cyphar/filepath-securejoin@v0.5.1",
        "version": "v0.5.1"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/cyphar/filepath-securejoin",
        "purl": "pkg:golang/github.com/cyphar/filepath-securejoin@v0.6.1",
        "version": "v0.6.1"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/daixiang0/gci",
        "purl": "pkg:golang/github.com/daixiang0/gci@v0.13.7",
        "version": "v0.13.7"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/dave/dst",
        "purl": "pkg:golang/github.com/dave/dst@v0.27.3",
        "version": "v0.27.3"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/davecgh/go-spew",
        "purl": "pkg:golang/github.com/davecgh/go-spew@v1.1.2-0.20180830191138-d8f796af33cc",
        "version": "v1.1.2-0.20180830191138-d8f796af33cc"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/davidmz/go-pageant",
        "purl": "pkg:golang/github.com/davidmz/go-pageant@v1.0.2",
        "version": "v1.0.2"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/denis-tingaikin/go-header",
        "purl": "pkg:golang/github.com/denis-tingaikin/go-header@v0.5.0",
        "version": "v0.5.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/dghubble/go-twitter",
        "purl": "pkg:golang/github.com/dghubble/go-twitter@v0.0.0-20211115160449-93a8679adecb",
        "version": "v0.0.0-20211115160449-93a8679adecb"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/dghubble/oauth1",
        "purl": "pkg:golang/github.com/dghubble/oauth1@v0.7.3",
        "version": "v0.7.3"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/dghubble/sling",
        "purl": "pkg:golang/github.com/dghubble/sling@v1.4.0",
        "version": "v1.4.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/digitorus/pkcs7",
        "purl": "pkg:golang/github.com/digitorus/pkcs7@v0.0.0-20230818184609-3a137a874352",
        "version": "v0.0.0-20230818184609-3a137a874352"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/digitorus/timestamp",
        "purl": "pkg:golang/github.com/digitorus/timestamp@v0.0.0-20231217203849-220c5c2851b7",
        "version": "v0.0.0-20231217203849-220c5c2851b7"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/dimchansky/utfbom",
        "purl": "pkg:golang/github.com/dimchansky/utfbom@v1.1.1",
        "version": "v1.1.1"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/distribution/reference",
        "purl": "pkg:golang/github.com/distribution/reference@v0.6.0",
        "version": "v0.6.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/Djarvur/go-err113",
        "purl": "pkg:golang/github.com/Djarvur/go-err113@v0.1.1",
        "version": "v0.1.1"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/dlclark/regexp2",
        "purl": "pkg:golang/github.com/dlclark/regexp2@v1.11.5",
        "version": "v1.11.5"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/docker/cli",
        "purl": "pkg:golang/github.com/docker/cli@v29.2.0%2Bincompatible",
        "version": "v29.2.0+incompatible"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/docker/distribution",
        "purl": "pkg:golang/github.com/docker/distribution@v2.8.3%2Bincompatible",
        "version": "v2.8.3+incompatible"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/docker/docker",
        "purl": "pkg:golang/github.com/docker/docker@v28.5.2%2Bincompatible",
        "version": "v28.5.2+incompatible"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/docker/docker-credential-helpers",
        "purl": "pkg:golang/github.com/docker/docker-credential-helpers@v0.9.4",
        "version": "v0.9.4"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/docker/go-connections",
        "purl": "pkg:golang/github.com/docker/go-connections@v0.6.0",
        "version": "v0.6.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/docker/go-units",
        "purl": "pkg:golang/github.com/docker/go-units@v0.5.0",
        "version": "v0.5.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/dustin/go-humanize",
        "purl": "pkg:golang/github.com/dustin/go-humanize@v1.0.1",
        "version": "v1.0.1"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/emicklei/go-restful/v3",
        "purl": "pkg:golang/github.com/emicklei/go-restful/v3@v3.13.0",
        "version": "v3.13.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/emirpasic/gods",
        "purl": "pkg:golang/github.com/emirpasic/gods@v1.18.1",
        "version": "v1.18.1"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/envoyproxy/go-control-plane/envoy",
        "purl": "pkg:golang/github.com/envoyproxy/go-control-plane/envoy@v1.35.0",
        "version": "v1.35.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/envoyproxy/protoc-gen-validate",
        "purl": "pkg:golang/github.com/envoyproxy/protoc-gen-validate@v1.2.1",
        "version": "v1.2.1"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/erikgeiser/coninput",
        "purl": "pkg:golang/github.com/erikgeiser/coninput@v0.0.0-20211004153227-1c3628e74d0f",
        "version": "v0.0.0-20211004153227-1c3628e74d0f"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/ettle/strcase",
        "purl": "pkg:golang/github.com/ettle/strcase@v0.2.0",
        "version": "v0.2.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/evanphx/json-patch",
        "purl": "pkg:golang/github.com/evanphx/json-patch@v5.9.11%2Bincompatible",
        "version": "v5.9.11+incompatible"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/evanphx/json-patch/v5",
        "purl": "pkg:golang/github.com/evanphx/json-patch/v5@v5.9.11",
        "version": "v5.9.11"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/exponent-io/jsonpath",
        "purl": "pkg:golang/github.com/exponent-io/jsonpath@v0.0.0-20210407135951-1de76d718b3f",
        "version": "v0.0.0-20210407135951-1de76d718b3f"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/fatih/color",
        "purl": "pkg:golang/github.com/fatih/color@v1.18.0",
        "version": "v1.18.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/fatih/structtag",
        "purl": "pkg:golang/github.com/fatih/structtag@v1.2.0",
        "version": "v1.2.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/felixge/httpsnoop",
        "purl": "pkg:golang/github.com/felixge/httpsnoop@v1.0.4",
        "version": "v1.0.4"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/firefart/nonamedreturns",
        "purl": "pkg:golang/github.com/firefart/nonamedreturns@v1.0.6",
        "version": "v1.0.6"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/fsnotify/fsnotify",
        "purl": "pkg:golang/github.com/fsnotify/fsnotify@v1.9.0",
        "version": "v1.9.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/fxamacker/cbor/v2",
        "purl": "pkg:golang/github.com/fxamacker/cbor/v2@v2.9.0",
        "version": "v2.9.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/fzipp/gocyclo",
        "purl": "pkg:golang/github.com/fzipp/gocyclo@v0.6.0",
        "version": "v0.6.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/gabriel-vasile/mimetype",
        "purl": "pkg:golang/github.com/gabriel-vasile/mimetype@v1.4.10",
        "version": "v1.4.10"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/ghostiam/protogetter",
        "purl": "pkg:golang/github.com/ghostiam/protogetter@v0.3.20",
        "version": "v0.3.20"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/github/smimesign",
        "purl": "pkg:golang/github.com/github/smimesign@v0.2.0",
        "version": "v0.2.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/go-critic/go-critic",
        "purl": "pkg:golang/github.com/go-critic/go-critic@v0.14.3",
        "version": "v0.14.3"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/go-errors/errors",
        "purl": "pkg:golang/github.com/go-errors/errors@v1.5.1",
        "version": "v1.5.1"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/go-fed/httpsig",
        "purl": "pkg:golang/github.com/go-fed/httpsig@v1.1.0",
        "version": "v1.1.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/go-git/gcfg",
        "purl": "pkg:golang/github.com/go-git/gcfg@v1.5.1-0.20230307220236-3a3c6141e376",
        "version": "v1.5.1-0.20230307220236-3a3c6141e376"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/go-git/go-billy/v5",
        "purl": "pkg:golang/github.com/go-git/go-billy/v5@v5.6.2",
        "version": "v5.6.2"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/go-git/go-git/v5",
        "purl": "pkg:golang/github.com/go-git/go-git/v5@v5.16.5",
        "version": "v5.16.5"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/go-gorp/gorp/v3",
        "purl": "pkg:golang/github.com/go-gorp/gorp/v3@v3.1.0",
        "version": "v3.1.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/go-jose/go-jose/v4",
        "purl": "pkg:golang/github.com/go-jose/go-jose/v4@v4.1.3",
        "version": "v4.1.3"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/go-logr/logr",
        "purl": "pkg:golang/github.com/go-logr/logr@v1.4.3",
        "version": "v1.4.3"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/go-logr/stdr",
        "purl": "pkg:golang/github.com/go-logr/stdr@v1.2.2",
        "version": "v1.2.2"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/go-openapi/analysis",
        "purl": "pkg:golang/github.com/go-openapi/analysis@v0.24.1",
        "version": "v0.24.1"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/go-openapi/errors",
        "purl": "pkg:golang/github.com/go-openapi/errors@v0.22.6",
        "version": "v0.22.6"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/go-openapi/jsonpointer",
        "purl": "pkg:golang/github.com/go-openapi/jsonpointer@v0.22.1",
        "version": "v0.22.1"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/go-openapi/jsonpointer",
        "purl": "pkg:golang/github.com/go-openapi/jsonpointer@v0.22.4",
        "version": "v0.22.4"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/go-openapi/jsonreference",
        "purl": "pkg:golang/github.com/go-openapi/jsonreference@v0.21.2",
        "version": "v0.21.2"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/go-openapi/jsonreference",
        "purl": "pkg:golang/github.com/go-openapi/jsonreference@v0.21.4",
        "version": "v0.21.4"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/go-openapi/loads",
        "purl": "pkg:golang/github.com/go-openapi/loads@v0.23.2",
        "version": "v0.23.2"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/go-openapi/runtime",
        "purl": "pkg:golang/github.com/go-openapi/runtime@v0.29.2",
        "version": "v0.29.2"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/go-openapi/spec",
        "purl": "pkg:golang/github.com/go-openapi/spec@v0.22.3",
        "version": "v0.22.3"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/go-openapi/strfmt",
        "purl": "pkg:golang/github.com/go-openapi/strfmt@v0.25.0",
        "version": "v0.25.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/go-openapi/swag",
        "purl": "pkg:golang/github.com/go-openapi/swag@v0.25.1",
        "version": "v0.25.1"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/go-openapi/swag",
        "purl": "pkg:golang/github.com/go-openapi/swag@v0.25.4",
        "version": "v0.25.4"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/go-openapi/swag/cmdutils",
        "purl": "pkg:golang/github.com/go-openapi/swag/cmdutils@v0.25.1",
        "version": "v0.25.1"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/go-openapi/swag/cmdutils",
        "purl": "pkg:golang/github.com/go-openapi/swag/cmdutils@v0.25.4",
        "version": "v0.25.4"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/go-openapi/swag/conv",
        "purl": "pkg:golang/github.com/go-openapi/swag/conv@v0.25.1",
        "version": "v0.25.1"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/go-openapi/swag/conv",
        "purl": "pkg:golang/github.com/go-openapi/swag/conv@v0.25.4",
        "version": "v0.25.4"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/go-openapi/swag/fileutils",
        "purl": "pkg:golang/github.com/go-openapi/swag/fileutils@v0.25.1",
        "version": "v0.25.1"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/go-openapi/swag/fileutils",
        "purl": "pkg:golang/github.com/go-openapi/swag/fileutils@v0.25.4",
        "version": "v0.25.4"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/go-openapi/swag/jsonname",
        "purl": "pkg:golang/github.com/go-openapi/swag/jsonname@v0.25.1",
        "version": "v0.25.1"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/go-openapi/swag/jsonname",
        "purl": "pkg:golang/github.com/go-openapi/swag/jsonname@v0.25.4",
        "version": "v0.25.4"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/go-openapi/swag/jsonutils",
        "purl": "pkg:golang/github.com/go-openapi/swag/jsonutils@v0.25.1",
        "version": "v0.25.1"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/go-openapi/swag/jsonutils",
        "purl": "pkg:golang/github.com/go-openapi/swag/jsonutils@v0.25.4",
        "version": "v0.25.4"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/go-openapi/swag/loading",
        "purl": "pkg:golang/github.com/go-openapi/swag/loading@v0.25.1",
        "version": "v0.25.1"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/go-openapi/swag/loading",
        "purl": "pkg:golang/github.com/go-openapi/swag/loading@v0.25.4",
        "version": "v0.25.4"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/go-openapi/swag/mangling",
        "purl": "pkg:golang/github.com/go-openapi/swag/mangling@v0.25.1",
        "version": "v0.25.1"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/go-openapi/swag/mangling",
        "purl": "pkg:golang/github.com/go-openapi/swag/mangling@v0.25.4",
        "version": "v0.25.4"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/go-openapi/swag/netutils",
        "purl": "pkg:golang/github.com/go-openapi/swag/netutils@v0.25.1",
        "version": "v0.25.1"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/go-openapi/swag/netutils",
        "purl": "pkg:golang/github.com/go-openapi/swag/netutils@v0.25.4",
        "version": "v0.25.4"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/go-openapi/swag/stringutils",
        "purl": "pkg:golang/github.com/go-openapi/swag/stringutils@v0.25.1",
        "version": "v0.25.1"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/go-openapi/swag/stringutils",
        "purl": "pkg:golang/github.com/go-openapi/swag/stringutils@v0.25.4",
        "version": "v0.25.4"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/go-openapi/swag/typeutils",
        "purl": "pkg:golang/github.com/go-openapi/swag/typeutils@v0.25.1",
        "version": "v0.25.1"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/go-openapi/swag/typeutils",
        "purl": "pkg:golang/github.com/go-openapi/swag/typeutils@v0.25.4",
        "version": "v0.25.4"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/go-openapi/swag/yamlutils",
        "purl": "pkg:golang/github.com/go-openapi/swag/yamlutils@v0.25.1",
        "version": "v0.25.1"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/go-openapi/swag/yamlutils",
        "purl": "pkg:golang/github.com/go-openapi/swag/yamlutils@v0.25.4",
        "version": "v0.25.4"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/go-openapi/validate",
        "purl": "pkg:golang/github.com/go-openapi/validate@v0.25.1",
        "version": "v0.25.1"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/go-restruct/restruct",
        "purl": "pkg:golang/github.com/go-restruct/restruct@v1.2.0-alpha",
        "version": "v1.2.0-alpha"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/go-telegram-bot-api/telegram-bot-api/v5",
        "purl": "pkg:golang/github.com/go-telegram-bot-api/telegram-bot-api/v5@v5.5.1",
        "version": "v5.5.1"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/go-toolsmith/astcast",
        "purl": "pkg:golang/github.com/go-toolsmith/astcast@v1.1.0",
        "version": "v1.1.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/go-toolsmith/astcopy",
        "purl": "pkg:golang/github.com/go-toolsmith/astcopy@v1.1.0",
        "version": "v1.1.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/go-toolsmith/astequal",
        "purl": "pkg:golang/github.com/go-toolsmith/astequal@v1.2.0",
        "version": "v1.2.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/go-toolsmith/astfmt",
        "purl": "pkg:golang/github.com/go-toolsmith/astfmt@v1.1.0",
        "version": "v1.1.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/go-toolsmith/astp",
        "purl": "pkg:golang/github.com/go-toolsmith/astp@v1.1.0",
        "version": "v1.1.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/go-toolsmith/strparse",
        "purl": "pkg:golang/github.com/go-toolsmith/strparse@v1.1.0",
        "version": "v1.1.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/go-toolsmith/typep",
        "purl": "pkg:golang/github.com/go-toolsmith/typep@v1.1.0",
        "version": "v1.1.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/go-viper/mapstructure/v2",
        "purl": "pkg:golang/github.com/go-viper/mapstructure/v2@v2.5.0",
        "version": "v2.5.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/go-xmlfmt/xmlfmt",
        "purl": "pkg:golang/github.com/go-xmlfmt/xmlfmt@v1.1.3",
        "version": "v1.1.3"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/gobwas/glob",
        "purl": "pkg:golang/github.com/gobwas/glob@v0.2.3",
        "version": "v0.2.3"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/goccy/go-yaml",
        "purl": "pkg:golang/github.com/goccy/go-yaml@v1.19.2",
        "version": "v1.19.2"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/godoc-lint/godoc-lint",
        "purl": "pkg:golang/github.com/godoc-lint/godoc-lint@v0.11.2",
        "version": "v0.11.2"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/gofrs/flock",
        "purl": "pkg:golang/github.com/gofrs/flock@v0.13.0",
        "version": "v0.13.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/gogo/protobuf",
        "purl": "pkg:golang/github.com/gogo/protobuf@v1.3.2",
        "version": "v1.3.2"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/golang-jwt/jwt/v4",
        "purl": "pkg:golang/github.com/golang-jwt/jwt/v4@v4.5.2",
        "version": "v4.5.2"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/golang-jwt/jwt/v5",
        "purl": "pkg:golang/github.com/golang-jwt/jwt/v5@v5.3.0",
        "version": "v5.3.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/golang/groupcache",
        "purl": "pkg:golang/github.com/golang/groupcache@v0.0.0-20241129210726-2c02b8208cf8",
        "version": "v0.0.0-20241129210726-2c02b8208cf8"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/golangci/asciicheck",
        "purl": "pkg:golang/github.com/golangci/asciicheck@v0.5.0",
        "version": "v0.5.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/golangci/dupl",
        "purl": "pkg:golang/github.com/golangci/dupl@v0.0.0-20250308024227-f665c8d69b32",
        "version": "v0.0.0-20250308024227-f665c8d69b32"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/golangci/go-printf-func-name",
        "purl": "pkg:golang/github.com/golangci/go-printf-func-name@v0.1.1",
        "version": "v0.1.1"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/golangci/gofmt",
        "purl": "pkg:golang/github.com/golangci/gofmt@v0.0.0-20250106114630-d62b90e6713d",
        "version": "v0.0.0-20250106114630-d62b90e6713d"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/golangci/golangci-lint/v2",
        "purl": "pkg:golang/github.com/golangci/golangci-lint/v2@v2.10.1",
        "version": "v2.10.1"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/golangci/golines",
        "purl": "pkg:golang/github.com/golangci/golines@v0.15.0",
        "version": "v0.15.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/golangci/misspell",
        "purl": "pkg:golang/github.com/golangci/misspell@v0.8.0",
        "version": "v0.8.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/golangci/plugin-module-register",
        "purl": "pkg:golang/github.com/golangci/plugin-module-register@v0.1.2",
        "version": "v0.1.2"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/golangci/revgrep",
        "purl": "pkg:golang/github.com/golangci/revgrep@v0.8.0",
        "version": "v0.8.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/golangci/swaggoswag",
        "purl": "pkg:golang/github.com/golangci/swaggoswag@v0.0.0-20250504205917-77f2aca3143e",
        "version": "v0.0.0-20250504205917-77f2aca3143e"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/golangci/unconvert",
        "purl": "pkg:golang/github.com/golangci/unconvert@v0.0.0-20250410112200-a129a6e6413e",
        "version": "v0.0.0-20250410112200-a129a6e6413e"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/google/btree",
        "purl": "pkg:golang/github.com/google/btree@v1.1.3",
        "version": "v1.1.3"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/google/cel-go",
        "purl": "pkg:golang/github.com/google/cel-go@v0.27.0",
        "version": "v0.27.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/google/certificate-transparency-go",
        "purl": "pkg:golang/github.com/google/certificate-transparency-go@v1.3.2",
        "version": "v1.3.2"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/google/gnostic-models",
        "purl": "pkg:golang/github.com/google/gnostic-models@v0.7.0",
        "version": "v0.7.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/google/go-cmp",
        "purl": "pkg:golang/github.com/google/go-cmp@v0.7.0",
        "version": "v0.7.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/google/go-containerregistry",
        "purl": "pkg:golang/github.com/google/go-containerregistry@v0.20.7",
        "version": "v0.20.7"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/google/go-github/v78",
        "purl": "pkg:golang/github.com/google/go-github/v78@v78.0.0",
        "version": "v78.0.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/google/go-querystring",
        "purl": "pkg:golang/github.com/google/go-querystring@v1.1.0",
        "version": "v1.1.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/google/ko",
        "purl": "pkg:golang/github.com/google/ko@v0.18.0",
        "version": "v0.18.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/google/rpmpack",
        "purl": "pkg:golang/github.com/google/rpmpack@v0.7.1",
        "version": "v0.7.1"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/google/s2a-go",
        "purl": "pkg:golang/github.com/google/s2a-go@v0.1.9",
        "version": "v0.1.9"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/google/safetext",
        "purl": "pkg:golang/github.com/google/safetext@v0.0.0-20240722112252-5a72de7e7962",
        "version": "v0.0.0-20240722112252-5a72de7e7962"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/google/uuid",
        "purl": "pkg:golang/github.com/google/uuid@v1.6.0",
        "version": "v1.6.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/google/wire",
        "purl": "pkg:golang/github.com/google/wire@v0.7.0",
        "version": "v0.7.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/googleapis/enterprise-certificate-proxy",
        "purl": "pkg:golang/github.com/googleapis/enterprise-certificate-proxy@v0.3.9",
        "version": "v0.3.9"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/googleapis/gax-go/v2",
        "purl": "pkg:golang/github.com/googleapis/gax-go/v2@v2.16.0",
        "version": "v2.16.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp",
        "purl": "pkg:golang/github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp@v1.30.0",
        "version": "v1.30.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/GoogleCloudPlatform/opentelemetry-operations-go/exporter/metric",
        "purl": "pkg:golang/github.com/GoogleCloudPlatform/opentelemetry-operations-go/exporter/metric@v0.54.0",
        "version": "v0.54.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/resourcemapping",
        "purl": "pkg:golang/github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/resourcemapping@v0.54.0",
        "version": "v0.54.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/gordonklaus/ineffassign",
        "purl": "pkg:golang/github.com/gordonklaus/ineffassign@v0.2.0",
        "version": "v0.2.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/goreleaser/chglog",
        "purl": "pkg:golang/github.com/goreleaser/chglog@v0.7.3",
        "version": "v0.7.3"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/goreleaser/fileglob",
        "purl": "pkg:golang/github.com/goreleaser/fileglob@v1.4.0",
        "version": "v1.4.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/goreleaser/goreleaser/v2",
        "purl": "pkg:golang/github.com/goreleaser/goreleaser/v2@v2.13.1",
        "version": "v2.13.1"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/goreleaser/nfpm/v2",
        "purl": "pkg:golang/github.com/goreleaser/nfpm/v2@v2.44.0",
        "version": "v2.44.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/gorilla/websocket",
        "purl": "pkg:golang/github.com/gorilla/websocket@v1.5.3",
        "version": "v1.5.3"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/gostaticanalysis/analysisutil",
        "purl": "pkg:golang/github.com/gostaticanalysis/analysisutil@v0.7.1",
        "version": "v0.7.1"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/gostaticanalysis/comment",
        "purl": "pkg:golang/github.com/gostaticanalysis/comment@v1.5.0",
        "version": "v1.5.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/gostaticanalysis/forcetypeassert",
        "purl": "pkg:golang/github.com/gostaticanalysis/forcetypeassert@v0.2.0",
        "version": "v0.2.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/gostaticanalysis/nilerr",
        "purl": "pkg:golang/github.com/gostaticanalysis/nilerr@v0.1.2",
        "version": "v0.1.2"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/gosuri/uitable",
        "purl": "pkg:golang/github.com/gosuri/uitable@v0.0.4",
        "version": "v0.0.4"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/gregjones/httpcache",
        "purl": "pkg:golang/github.com/gregjones/httpcache@v0.0.0-20190611155906-901d90724c79",
        "version": "v0.0.0-20190611155906-901d90724c79"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/grpc-ecosystem/grpc-gateway/v2",
        "purl": "pkg:golang/github.com/grpc-ecosystem/grpc-gateway/v2@v2.27.3",
        "version": "v2.27.3"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/hashicorp/errwrap",
        "purl": "pkg:golang/github.com/hashicorp/errwrap@v1.1.0",
        "version": "v1.1.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/hashicorp/go-cleanhttp",
        "purl": "pkg:golang/github.com/hashicorp/go-cleanhttp@v0.5.2",
        "version": "v0.5.2"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/hashicorp/go-immutable-radix/v2",
        "purl": "pkg:golang/github.com/hashicorp/go-immutable-radix/v2@v2.1.0",
        "version": "v2.1.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/hashicorp/go-multierror",
        "purl": "pkg:golang/github.com/hashicorp/go-multierror@v1.1.1",
        "version": "v1.1.1"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/hashicorp/go-retryablehttp",
        "purl": "pkg:golang/github.com/hashicorp/go-retryablehttp@v0.7.8",
        "version": "v0.7.8"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/hashicorp/go-version",
        "purl": "pkg:golang/github.com/hashicorp/go-version@v1.8.0",
        "version": "v1.8.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/hashicorp/golang-lru",
        "purl": "pkg:golang/github.com/hashicorp/golang-lru@v1.0.2",
        "version": "v1.0.2"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/hashicorp/golang-lru/v2",
        "purl": "pkg:golang/github.com/hashicorp/golang-lru/v2@v2.0.7",
        "version": "v2.0.7"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/hexops/gotextdiff",
        "purl": "pkg:golang/github.com/hexops/gotextdiff@v1.0.3",
        "version": "v1.0.3"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/huandu/xstrings",
        "purl": "pkg:golang/github.com/huandu/xstrings@v1.5.0",
        "version": "v1.5.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/in-toto/attestation",
        "purl": "pkg:golang/github.com/in-toto/attestation@v1.1.2",
        "version": "v1.1.2"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/in-toto/in-toto-golang",
        "purl": "pkg:golang/github.com/in-toto/in-toto-golang@v0.9.0",
        "version": "v0.9.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/inconshreveable/mousetrap",
        "purl": "pkg:golang/github.com/inconshreveable/mousetrap@v1.1.0",
        "version": "v1.1.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/invopop/jsonschema",
        "purl": "pkg:golang/github.com/invopop/jsonschema@v0.13.0",
        "version": "v0.13.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/ipfs/bbloom",
        "purl": "pkg:golang/github.com/ipfs/bbloom@v0.0.4",
        "version": "v0.0.4"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/ipfs/go-block-format",
        "purl": "pkg:golang/github.com/ipfs/go-block-format@v0.2.0",
        "version": "v0.2.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/ipfs/go-cid",
        "purl": "pkg:golang/github.com/ipfs/go-cid@v0.4.1",
        "version": "v0.4.1"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/ipfs/go-datastore",
        "purl": "pkg:golang/github.com/ipfs/go-datastore@v0.6.0",
        "version": "v0.6.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/ipfs/go-ipfs-blockstore",
        "purl": "pkg:golang/github.com/ipfs/go-ipfs-blockstore@v1.3.1",
        "version": "v1.3.1"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/ipfs/go-ipfs-ds-help",
        "purl": "pkg:golang/github.com/ipfs/go-ipfs-ds-help@v1.1.1",
        "version": "v1.1.1"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/ipfs/go-ipfs-util",
        "purl": "pkg:golang/github.com/ipfs/go-ipfs-util@v0.0.3",
        "version": "v0.0.3"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/ipfs/go-ipld-cbor",
        "purl": "pkg:golang/github.com/ipfs/go-ipld-cbor@v0.1.0",
        "version": "v0.1.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/ipfs/go-ipld-format",
        "purl": "pkg:golang/github.com/ipfs/go-ipld-format@v0.6.0",
        "version": "v0.6.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/ipfs/go-log",
        "purl": "pkg:golang/github.com/ipfs/go-log@v1.0.5",
        "version": "v1.0.5"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/ipfs/go-log/v2",
        "purl": "pkg:golang/github.com/ipfs/go-log/v2@v2.5.1",
        "version": "v2.5.1"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/ipfs/go-metrics-interface",
        "purl": "pkg:golang/github.com/ipfs/go-metrics-interface@v0.0.1",
        "version": "v0.0.1"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/jbenet/go-context",
        "purl": "pkg:golang/github.com/jbenet/go-context@v0.0.0-20150711004518-d14ea06fba99",
        "version": "v0.0.0-20150711004518-d14ea06fba99"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/jbenet/goprocess",
        "purl": "pkg:golang/github.com/jbenet/goprocess@v0.1.4",
        "version": "v0.1.4"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/jedisct1/go-minisign",
        "purl": "pkg:golang/github.com/jedisct1/go-minisign@v0.0.0-20241212093149-d2f9f49435c7",
        "version": "v0.0.0-20241212093149-d2f9f49435c7"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/jgautheron/goconst",
        "purl": "pkg:golang/github.com/jgautheron/goconst@v1.8.2",
        "version": "v1.8.2"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/jingyugao/rowserrcheck",
        "purl": "pkg:golang/github.com/jingyugao/rowserrcheck@v1.1.1",
        "version": "v1.1.1"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/jjti/go-spancheck",
        "purl": "pkg:golang/github.com/jjti/go-spancheck@v0.6.5",
        "version": "v0.6.5"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/jmespath/go-jmespath",
        "purl": "pkg:golang/github.com/jmespath/go-jmespath@v0.4.1-0.20220621161143-b0104c826a24",
        "version": "v0.4.1-0.20220621161143-b0104c826a24"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/jmoiron/sqlx",
        "purl": "pkg:golang/github.com/jmoiron/sqlx@v1.4.0",
        "version": "v1.4.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/json-iterator/go",
        "purl": "pkg:golang/github.com/json-iterator/go@v1.1.12",
        "version": "v1.1.12"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/julz/importas",
        "purl": "pkg:golang/github.com/julz/importas@v0.2.0",
        "version": "v0.2.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/karamaru-alpha/copyloopvar",
        "purl": "pkg:golang/github.com/karamaru-alpha/copyloopvar@v1.2.2",
        "version": "v1.2.2"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/kevinburke/ssh_config",
        "purl": "pkg:golang/github.com/kevinburke/ssh_config@v1.2.0",
        "version": "v1.2.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/kisielk/errcheck",
        "purl": "pkg:golang/github.com/kisielk/errcheck@v1.9.0",
        "version": "v1.9.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/kkHAIKE/contextcheck",
        "purl": "pkg:golang/github.com/kkHAIKE/contextcheck@v1.1.6",
        "version": "v1.1.6"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/klauspost/compress",
        "purl": "pkg:golang/github.com/klauspost/compress@v1.18.0",
        "version": "v1.18.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/klauspost/compress",
        "purl": "pkg:golang/github.com/klauspost/compress@v1.18.2",
        "version": "v1.18.2"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/klauspost/cpuid/v2",
        "purl": "pkg:golang/github.com/klauspost/cpuid/v2@v2.2.7",
        "version": "v2.2.7"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/klauspost/pgzip",
        "purl": "pkg:golang/github.com/klauspost/pgzip@v1.2.6",
        "version": "v1.2.6"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/kulti/thelper",
        "purl": "pkg:golang/github.com/kulti/thelper@v0.7.1",
        "version": "v0.7.1"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/kunwardeep/paralleltest",
        "purl": "pkg:golang/github.com/kunwardeep/paralleltest@v1.0.15",
        "version": "v1.0.15"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/kylelemons/godebug",
        "purl": "pkg:golang/github.com/kylelemons/godebug@v1.1.0",
        "version": "v1.1.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/lann/builder",
        "purl": "pkg:golang/github.com/lann/builder@v0.0.0-20180802200727-47ae307949d0",
        "version": "v0.0.0-20180802200727-47ae307949d0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/lann/ps",
        "purl": "pkg:golang/github.com/lann/ps@v0.0.0-20150810152359-62de8c46ede0",
        "version": "v0.0.0-20150810152359-62de8c46ede0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/lasiar/canonicalheader",
        "purl": "pkg:golang/github.com/lasiar/canonicalheader@v1.1.2",
        "version": "v1.1.2"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/lburgazzoli/k8s-manifests-lib",
        "purl": "pkg:golang/github.com/lburgazzoli/k8s-manifests-lib@v0.1.4-0.20251117120254-104132b6a2be",
        "version": "v0.1.4-0.20251117120254-104132b6a2be"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/ldez/exptostd",
        "purl": "pkg:golang/github.com/ldez/exptostd@v0.4.5",
        "version": "v0.4.5"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/ldez/gomoddirectives",
        "purl": "pkg:golang/github.com/ldez/gomoddirectives@v0.8.0",
        "version": "v0.8.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/ldez/grignotin",
        "purl": "pkg:golang/github.com/ldez/grignotin@v0.10.1",
        "version": "v0.10.1"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/ldez/structtags",
        "purl": "pkg:golang/github.com/ldez/structtags@v0.6.1",
        "version": "v0.6.1"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/ldez/tagliatelle",
        "purl": "pkg:golang/github.com/ldez/tagliatelle@v0.7.2",
        "version": "v0.7.2"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/ldez/usetesting",
        "purl": "pkg:golang/github.com/ldez/usetesting@v0.5.0",
        "version": "v0.5.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/leonklingele/grouper",
        "purl": "pkg:golang/github.com/leonklingele/grouper@v1.1.2",
        "version": "v1.1.2"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/lib/pq",
        "purl": "pkg:golang/github.com/lib/pq@v1.10.9",
        "version": "v1.10.9"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/liggitt/tabwriter",
        "purl": "pkg:golang/github.com/liggitt/tabwriter@v0.0.0-20181228230101-89fcab3d43de",
        "version": "v0.0.0-20181228230101-89fcab3d43de"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/lucasb-eyer/go-colorful",
        "purl": "pkg:golang/github.com/lucasb-eyer/go-colorful@v1.3.0",
        "version": "v1.3.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/macabu/inamedparam",
        "purl": "pkg:golang/github.com/macabu/inamedparam@v0.2.0",
        "version": "v0.2.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/mailru/easyjson",
        "purl": "pkg:golang/github.com/mailru/easyjson@v0.9.0",
        "version": "v0.9.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/MakeNowJust/heredoc",
        "purl": "pkg:golang/github.com/MakeNowJust/heredoc@v1.0.0",
        "version": "v1.0.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/manuelarte/embeddedstructfieldcheck",
        "purl": "pkg:golang/github.com/manuelarte/embeddedstructfieldcheck@v0.4.0",
        "version": "v0.4.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/manuelarte/funcorder",
        "purl": "pkg:golang/github.com/manuelarte/funcorder@v0.5.0",
        "version": "v0.5.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/maratori/testableexamples",
        "purl": "pkg:golang/github.com/maratori/testableexamples@v1.0.1",
        "version": "v1.0.1"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/maratori/testpackage",
        "purl": "pkg:golang/github.com/maratori/testpackage@v1.1.2",
        "version": "v1.1.2"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/Masterminds/goutils",
        "purl": "pkg:golang/github.com/Masterminds/goutils@v1.1.1",
        "version": "v1.1.1"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/Masterminds/semver/v3",
        "purl": "pkg:golang/github.com/Masterminds/semver/v3@v3.4.0",
        "version": "v3.4.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/Masterminds/sprig/v3",
        "purl": "pkg:golang/github.com/Masterminds/sprig/v3@v3.3.0",
        "version": "v3.3.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/Masterminds/squirrel",
        "purl": "pkg:golang/github.com/Masterminds/squirrel@v1.5.4",
        "version": "v1.5.4"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/matoous/godox",
        "purl": "pkg:golang/github.com/matoous/godox@v1.1.0",
        "version": "v1.1.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/mattn/go-colorable",
        "purl": "pkg:golang/github.com/mattn/go-colorable@v0.1.13",
        "version": "v0.1.13"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/mattn/go-colorable",
        "purl": "pkg:golang/github.com/mattn/go-colorable@v0.1.14",
        "version": "v0.1.14"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/mattn/go-isatty",
        "purl": "pkg:golang/github.com/mattn/go-isatty@v0.0.20",
        "version": "v0.0.20"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/mattn/go-localereader",
        "purl": "pkg:golang/github.com/mattn/go-localereader@v0.0.2-0.20220822084749-2491eb6c1c75",
        "version": "v0.0.2-0.20220822084749-2491eb6c1c75"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/mattn/go-mastodon",
        "purl": "pkg:golang/github.com/mattn/go-mastodon@v0.0.10",
        "version": "v0.0.10"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/mattn/go-runewidth",
        "purl": "pkg:golang/github.com/mattn/go-runewidth@v0.0.15",
        "version": "v0.0.15"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/mattn/go-runewidth",
        "purl": "pkg:golang/github.com/mattn/go-runewidth@v0.0.16",
        "version": "v0.0.16"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/mgechev/revive",
        "purl": "pkg:golang/github.com/mgechev/revive@v1.14.0",
        "version": "v1.14.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/Microsoft/go-winio",
        "purl": "pkg:golang/github.com/Microsoft/go-winio@v0.6.2",
        "version": "v0.6.2"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/minio/sha256-simd",
        "purl": "pkg:golang/github.com/minio/sha256-simd@v1.0.1",
        "version": "v1.0.1"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/MirrexOne/unqueryvet",
        "purl": "pkg:golang/github.com/MirrexOne/unqueryvet@v1.5.3",
        "version": "v1.5.3"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/mitchellh/copystructure",
        "purl": "pkg:golang/github.com/mitchellh/copystructure@v1.2.0",
        "version": "v1.2.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/mitchellh/go-homedir",
        "purl": "pkg:golang/github.com/mitchellh/go-homedir@v1.1.0",
        "version": "v1.1.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/mitchellh/go-wordwrap",
        "purl": "pkg:golang/github.com/mitchellh/go-wordwrap@v1.0.1",
        "version": "v1.0.1"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/mitchellh/mapstructure",
        "purl": "pkg:golang/github.com/mitchellh/mapstructure@v1.5.0",
        "version": "v1.5.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/mitchellh/reflectwalk",
        "purl": "pkg:golang/github.com/mitchellh/reflectwalk@v1.0.2",
        "version": "v1.0.2"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/moby/docker-image-spec",
        "purl": "pkg:golang/github.com/moby/docker-image-spec@v1.3.1",
        "version": "v1.3.1"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/moby/term",
        "purl": "pkg:golang/github.com/moby/term@v0.5.2",
        "version": "v0.5.2"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/modelcontextprotocol/registry",
        "purl": "pkg:golang/github.com/modelcontextprotocol/registry@v1.3.10",
        "version": "v1.3.10"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/modern-go/concurrent",
        "purl": "pkg:golang/github.com/modern-go/concurrent@v0.0.0-20180306012644-bacd9c7ef1dd",
        "version": "v0.0.0-20180306012644-bacd9c7ef1dd"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/modern-go/reflect2",
        "purl": "pkg:golang/github.com/modern-go/reflect2@v1.0.3-0.20250322232337-35a7c28c31ee",
        "version": "v1.0.3-0.20250322232337-35a7c28c31ee"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/monochromegane/go-gitignore",
        "purl": "pkg:golang/github.com/monochromegane/go-gitignore@v0.0.0-20200626010858-205db1a8cc00",
        "version": "v0.0.0-20200626010858-205db1a8cc00"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/moricho/tparallel",
        "purl": "pkg:golang/github.com/moricho/tparallel@v0.3.2",
        "version": "v0.3.2"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/mr-tron/base58",
        "purl": "pkg:golang/github.com/mr-tron/base58@v1.2.0",
        "version": "v1.2.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/muesli/ansi",
        "purl": "pkg:golang/github.com/muesli/ansi@v0.0.0-20230316100256-276c6243b2f6",
        "version": "v0.0.0-20230316100256-276c6243b2f6"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/muesli/cancelreader",
        "purl": "pkg:golang/github.com/muesli/cancelreader@v0.2.2",
        "version": "v0.2.2"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/muesli/mango",
        "purl": "pkg:golang/github.com/muesli/mango@v0.2.0",
        "version": "v0.2.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/muesli/mango-cobra",
        "purl": "pkg:golang/github.com/muesli/mango-cobra@v1.3.0",
        "version": "v1.3.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/muesli/mango-pflag",
        "purl": "pkg:golang/github.com/muesli/mango-pflag@v0.1.0",
        "version": "v0.1.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/muesli/roff",
        "purl": "pkg:golang/github.com/muesli/roff@v0.1.0",
        "version": "v0.1.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/muesli/termenv",
        "purl": "pkg:golang/github.com/muesli/termenv@v0.16.0",
        "version": "v0.16.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/multiformats/go-base32",
        "purl": "pkg:golang/github.com/multiformats/go-base32@v0.1.0",
        "version": "v0.1.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/multiformats/go-base36",
        "purl": "pkg:golang/github.com/multiformats/go-base36@v0.2.0",
        "version": "v0.2.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/multiformats/go-multibase",
        "purl": "pkg:golang/github.com/multiformats/go-multibase@v0.2.0",
        "version": "v0.2.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/multiformats/go-multihash",
        "purl": "pkg:golang/github.com/multiformats/go-multihash@v0.2.3",
        "version": "v0.2.3"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/multiformats/go-varint",
        "purl": "pkg:golang/github.com/multiformats/go-varint@v0.0.7",
        "version": "v0.0.7"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/munnerz/goautoneg",
        "purl": "pkg:golang/github.com/munnerz/goautoneg@v0.0.0-20191010083416-a7dc8b61c822",
        "version": "v0.0.0-20191010083416-a7dc8b61c822"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/nakabonne/nestif",
        "purl": "pkg:golang/github.com/nakabonne/nestif@v0.3.1",
        "version": "v0.3.1"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/nishanths/exhaustive",
        "purl": "pkg:golang/github.com/nishanths/exhaustive@v0.12.0",
        "version": "v0.12.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/nishanths/predeclared",
        "purl": "pkg:golang/github.com/nishanths/predeclared@v0.2.2",
        "version": "v0.2.2"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/nunnatsa/ginkgolinter",
        "purl": "pkg:golang/github.com/nunnatsa/ginkgolinter@v0.23.0",
        "version": "v0.23.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/oklog/ulid",
        "purl": "pkg:golang/github.com/oklog/ulid@v1.3.1",
        "version": "v1.3.1"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/opencontainers/go-digest",
        "purl": "pkg:golang/github.com/opencontainers/go-digest@v1.0.0",
        "version": "v1.0.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/opencontainers/image-spec",
        "purl": "pkg:golang/github.com/opencontainers/image-spec@v1.1.1",
        "version": "v1.1.1"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/OpenPeeDeeP/depguard/v2",
        "purl": "pkg:golang/github.com/OpenPeeDeeP/depguard/v2@v2.2.1",
        "version": "v2.2.1"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/openshift/api",
        "purl": "pkg:golang/github.com/openshift/api@v0.0.0-20230406152840-ce21e3fe5da2",
        "version": "v0.0.0-20230406152840-ce21e3fe5da2"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/opentracing/opentracing-go",
        "purl": "pkg:golang/github.com/opentracing/opentracing-go@v1.2.0",
        "version": "v1.2.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/owenrumney/go-sarif/v2",
        "purl": "pkg:golang/github.com/owenrumney/go-sarif/v2@v2.3.3",
        "version": "v2.3.3"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/pborman/uuid",
        "purl": "pkg:golang/github.com/pborman/uuid@v1.2.1",
        "version": "v1.2.1"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/pelletier/go-toml",
        "purl": "pkg:golang/github.com/pelletier/go-toml@v1.9.5",
        "version": "v1.9.5"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/pelletier/go-toml/v2",
        "purl": "pkg:golang/github.com/pelletier/go-toml/v2@v2.2.4",
        "version": "v2.2.4"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/peterbourgon/diskv",
        "purl": "pkg:golang/github.com/peterbourgon/diskv@v2.0.1%2Bincompatible",
        "version": "v2.0.1+incompatible"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/pjbgf/sha1cd",
        "purl": "pkg:golang/github.com/pjbgf/sha1cd@v0.3.2",
        "version": "v0.3.2"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/pkg/browser",
        "purl": "pkg:golang/github.com/pkg/browser@v0.0.0-20240102092130-5ac0b6a4141c",
        "version": "v0.0.0-20240102092130-5ac0b6a4141c"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/pkg/errors",
        "purl": "pkg:golang/github.com/pkg/errors@v0.9.1",
        "version": "v0.9.1"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/planetscale/vtprotobuf",
        "purl": "pkg:golang/github.com/planetscale/vtprotobuf@v0.6.1-0.20240319094008-0393e58bdf10",
        "version": "v0.6.1-0.20240319094008-0393e58bdf10"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/pmezard/go-difflib",
        "purl": "pkg:golang/github.com/pmezard/go-difflib@v1.0.1-0.20181226105442-5d4384ee4fb2",
        "version": "v1.0.1-0.20181226105442-5d4384ee4fb2"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/polydawn/refmt",
        "purl": "pkg:golang/github.com/polydawn/refmt@v0.89.1-0.20221221234430-40501e09de1f",
        "version": "v0.89.1-0.20221221234430-40501e09de1f"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/prometheus-operator/prometheus-operator/pkg/apis/monitoring",
        "purl": "pkg:golang/github.com/prometheus-operator/prometheus-operator/pkg/apis/monitoring@v0.89.0",
        "version": "v0.89.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/prometheus/client_golang",
        "purl": "pkg:golang/github.com/prometheus/client_golang@v1.23.2",
        "version": "v1.23.2"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/prometheus/client_model",
        "purl": "pkg:golang/github.com/prometheus/client_model@v0.6.2",
        "version": "v0.6.2"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/prometheus/common",
        "purl": "pkg:golang/github.com/prometheus/common@v0.67.4",
        "version": "v0.67.4"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/prometheus/procfs",
        "purl": "pkg:golang/github.com/prometheus/procfs@v0.17.0",
        "version": "v0.17.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/ProtonMail/go-crypto",
        "purl": "pkg:golang/github.com/ProtonMail/go-crypto@v1.3.0",
        "version": "v1.3.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/quasilyte/go-ruleguard",
        "purl": "pkg:golang/github.com/quasilyte/go-ruleguard@v0.4.5",
        "version": "v0.4.5"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/quasilyte/go-ruleguard/dsl",
        "purl": "pkg:golang/github.com/quasilyte/go-ruleguard/dsl@v0.3.23",
        "version": "v0.3.23"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/quasilyte/gogrep",
        "purl": "pkg:golang/github.com/quasilyte/gogrep@v0.5.0",
        "version": "v0.5.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/quasilyte/regex/syntax",
        "purl": "pkg:golang/github.com/quasilyte/regex/syntax@v0.0.0-20210819130434-b3f0c404a727",
        "version": "v0.0.0-20210819130434-b3f0c404a727"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/quasilyte/stdinfo",
        "purl": "pkg:golang/github.com/quasilyte/stdinfo@v0.0.0-20220114132959-f7386bf02567",
        "version": "v0.0.0-20220114132959-f7386bf02567"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/raeperd/recvcheck",
        "purl": "pkg:golang/github.com/raeperd/recvcheck@v0.2.0",
        "version": "v0.2.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/rivo/uniseg",
        "purl": "pkg:golang/github.com/rivo/uniseg@v0.4.7",
        "version": "v0.4.7"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/rogpeppe/go-internal",
        "purl": "pkg:golang/github.com/rogpeppe/go-internal@v1.14.1",
        "version": "v1.14.1"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/rubenv/sql-migrate",
        "purl": "pkg:golang/github.com/rubenv/sql-migrate@v1.8.1",
        "version": "v1.8.1"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/russross/blackfriday/v2",
        "purl": "pkg:golang/github.com/russross/blackfriday/v2@v2.1.0",
        "version": "v2.1.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/ryancurrah/gomodguard",
        "purl": "pkg:golang/github.com/ryancurrah/gomodguard@v1.4.1",
        "version": "v1.4.1"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/ryanrolds/sqlclosecheck",
        "purl": "pkg:golang/github.com/ryanrolds/sqlclosecheck@v0.5.1",
        "version": "v0.5.1"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/sagikazarmark/locafero",
        "purl": "pkg:golang/github.com/sagikazarmark/locafero@v0.11.0",
        "version": "v0.11.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/sanposhiho/wastedassign/v2",
        "purl": "pkg:golang/github.com/sanposhiho/wastedassign/v2@v2.1.0",
        "version": "v2.1.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/santhosh-tekuri/jsonschema/v6",
        "purl": "pkg:golang/github.com/santhosh-tekuri/jsonschema/v6@v6.0.2",
        "version": "v6.0.2"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/sashamelentyev/interfacebloat",
        "purl": "pkg:golang/github.com/sashamelentyev/interfacebloat@v1.1.0",
        "version": "v1.1.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/sashamelentyev/usestdlibvars",
        "purl": "pkg:golang/github.com/sashamelentyev/usestdlibvars@v1.29.0",
        "version": "v1.29.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/sassoftware/relic",
        "purl": "pkg:golang/github.com/sassoftware/relic@v7.2.1%2Bincompatible",
        "version": "v7.2.1+incompatible"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/scylladb/go-set",
        "purl": "pkg:golang/github.com/scylladb/go-set@v1.0.3-0.20200225121959-cc7b2070d91e",
        "version": "v1.0.3-0.20200225121959-cc7b2070d91e"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/secure-systems-lab/go-securesystemslib",
        "purl": "pkg:golang/github.com/secure-systems-lab/go-securesystemslib@v0.10.0",
        "version": "v0.10.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/securego/gosec/v2",
        "purl": "pkg:golang/github.com/securego/gosec/v2@v2.23.0",
        "version": "v2.23.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/sergi/go-diff",
        "purl": "pkg:golang/github.com/sergi/go-diff@v1.3.2-0.20230802210424-5b0b94c5c0d3",
        "version": "v1.3.2-0.20230802210424-5b0b94c5c0d3"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/shibumi/go-pathspec",
        "purl": "pkg:golang/github.com/shibumi/go-pathspec@v1.3.0",
        "version": "v1.3.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/shopspring/decimal",
        "purl": "pkg:golang/github.com/shopspring/decimal@v1.4.0",
        "version": "v1.4.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/sigstore/cosign/v2",
        "purl": "pkg:golang/github.com/sigstore/cosign/v2@v2.6.2",
        "version": "v2.6.2"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/sigstore/protobuf-specs",
        "purl": "pkg:golang/github.com/sigstore/protobuf-specs@v0.5.0",
        "version": "v0.5.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/sigstore/rekor",
        "purl": "pkg:golang/github.com/sigstore/rekor@v1.5.0",
        "version": "v1.5.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/sigstore/rekor-tiles/v2",
        "purl": "pkg:golang/github.com/sigstore/rekor-tiles/v2@v2.0.1",
        "version": "v2.0.1"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/sigstore/sigstore",
        "purl": "pkg:golang/github.com/sigstore/sigstore@v1.10.4",
        "version": "v1.10.4"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/sigstore/sigstore-go",
        "purl": "pkg:golang/github.com/sigstore/sigstore-go@v1.1.4",
        "version": "v1.1.4"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/sigstore/timestamp-authority/v2",
        "purl": "pkg:golang/github.com/sigstore/timestamp-authority/v2@v2.0.3",
        "version": "v2.0.3"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/sirupsen/logrus",
        "purl": "pkg:golang/github.com/sirupsen/logrus@v1.9.3",
        "version": "v1.9.3"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/sirupsen/logrus",
        "purl": "pkg:golang/github.com/sirupsen/logrus@v1.9.4",
        "version": "v1.9.4"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/sivchari/containedctx",
        "purl": "pkg:golang/github.com/sivchari/containedctx@v1.0.3",
        "version": "v1.0.3"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/skeema/knownhosts",
        "purl": "pkg:golang/github.com/skeema/knownhosts@v1.3.1",
        "version": "v1.3.1"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/slack-go/slack",
        "purl": "pkg:golang/github.com/slack-go/slack@v0.17.3",
        "version": "v0.17.3"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/sonatard/noctx",
        "purl": "pkg:golang/github.com/sonatard/noctx@v0.4.0",
        "version": "v0.4.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/sourcegraph/conc",
        "purl": "pkg:golang/github.com/sourcegraph/conc@v0.3.1-0.20240121214520-5f936abd7ae8",
        "version": "v0.3.1-0.20240121214520-5f936abd7ae8"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/sourcegraph/go-diff",
        "purl": "pkg:golang/github.com/sourcegraph/go-diff@v0.7.0",
        "version": "v0.7.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/spaolacci/murmur3",
        "purl": "pkg:golang/github.com/spaolacci/murmur3@v1.1.0",
        "version": "v1.1.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/spf13/afero",
        "purl": "pkg:golang/github.com/spf13/afero@v1.15.0",
        "version": "v1.15.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/spf13/cast",
        "purl": "pkg:golang/github.com/spf13/cast@v1.10.0",
        "version": "v1.10.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/spf13/cobra",
        "purl": "pkg:golang/github.com/spf13/cobra@v1.10.2",
        "version": "v1.10.2"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/spf13/pflag",
        "purl": "pkg:golang/github.com/spf13/pflag@v1.0.10",
        "version": "v1.0.10"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/spf13/viper",
        "purl": "pkg:golang/github.com/spf13/viper@v1.21.0",
        "version": "v1.21.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/spiffe/go-spiffe/v2",
        "purl": "pkg:golang/github.com/spiffe/go-spiffe/v2@v2.6.0",
        "version": "v2.6.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/ssgreg/nlreturn/v2",
        "purl": "pkg:golang/github.com/ssgreg/nlreturn/v2@v2.2.1",
        "version": "v2.2.1"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/stbenjam/no-sprintf-host-port",
        "purl": "pkg:golang/github.com/stbenjam/no-sprintf-host-port@v0.3.1",
        "version": "v0.3.1"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/stretchr/objx",
        "purl": "pkg:golang/github.com/stretchr/objx@v0.5.2",
        "version": "v0.5.2"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/stretchr/testify",
        "purl": "pkg:golang/github.com/stretchr/testify@v1.11.1",
        "version": "v1.11.1"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/subosito/gotenv",
        "purl": "pkg:golang/github.com/subosito/gotenv@v1.6.0",
        "version": "v1.6.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/tetafro/godot",
        "purl": "pkg:golang/github.com/tetafro/godot@v1.5.4",
        "version": "v1.5.4"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/theupdateframework/go-tuf",
        "purl": "pkg:golang/github.com/theupdateframework/go-tuf@v0.7.0",
        "version": "v0.7.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/theupdateframework/go-tuf/v2",
        "purl": "pkg:golang/github.com/theupdateframework/go-tuf/v2@v2.4.1",
        "version": "v2.4.1"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/timakin/bodyclose",
        "purl": "pkg:golang/github.com/timakin/bodyclose@v0.0.0-20241222091800-1db5c5ca4d67",
        "version": "v0.0.0-20241222091800-1db5c5ca4d67"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/timonwong/loggercheck",
        "purl": "pkg:golang/github.com/timonwong/loggercheck@v0.11.0",
        "version": "v0.11.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/tomarrell/wrapcheck/v2",
        "purl": "pkg:golang/github.com/tomarrell/wrapcheck/v2@v2.12.0",
        "version": "v2.12.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/tommy-muehle/go-mnd/v2",
        "purl": "pkg:golang/github.com/tommy-muehle/go-mnd/v2@v2.5.1",
        "version": "v2.5.1"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/tomnomnom/linkheader",
        "purl": "pkg:golang/github.com/tomnomnom/linkheader@v0.0.0-20180905144013-02ca5825eb80",
        "version": "v0.0.0-20180905144013-02ca5825eb80"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/transparency-dev/formats",
        "purl": "pkg:golang/github.com/transparency-dev/formats@v0.0.0-20251017110053-404c0d5b696c",
        "version": "v0.0.0-20251017110053-404c0d5b696c"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/transparency-dev/merkle",
        "purl": "pkg:golang/github.com/transparency-dev/merkle@v0.0.2",
        "version": "v0.0.2"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/ulikunitz/xz",
        "purl": "pkg:golang/github.com/ulikunitz/xz@v0.5.15",
        "version": "v0.5.15"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/ultraware/funlen",
        "purl": "pkg:golang/github.com/ultraware/funlen@v0.2.0",
        "version": "v0.2.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/ultraware/whitespace",
        "purl": "pkg:golang/github.com/ultraware/whitespace@v0.2.0",
        "version": "v0.2.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/uudashr/gocognit",
        "purl": "pkg:golang/github.com/uudashr/gocognit@v1.2.0",
        "version": "v1.2.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/uudashr/iface",
        "purl": "pkg:golang/github.com/uudashr/iface@v1.4.1",
        "version": "v1.4.1"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/vbatts/tar-split",
        "purl": "pkg:golang/github.com/vbatts/tar-split@v0.12.2",
        "version": "v0.12.2"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/wagoodman/go-partybus",
        "purl": "pkg:golang/github.com/wagoodman/go-partybus@v0.0.0-20230516145632-8ccac152c651",
        "version": "v0.0.0-20230516145632-8ccac152c651"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/wagoodman/go-progress",
        "purl": "pkg:golang/github.com/wagoodman/go-progress@v0.0.0-20220614130704-4b1c25a33c7c",
        "version": "v0.0.0-20220614130704-4b1c25a33c7c"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/whyrusleeping/cbor-gen",
        "purl": "pkg:golang/github.com/whyrusleeping/cbor-gen@v0.1.3-0.20240731173018-74d74643234c",
        "version": "v0.1.3-0.20240731173018-74d74643234c"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/wk8/go-ordered-map/v2",
        "purl": "pkg:golang/github.com/wk8/go-ordered-map/v2@v2.1.8",
        "version": "v2.1.8"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/x448/float16",
        "purl": "pkg:golang/github.com/x448/float16@v0.8.4",
        "version": "v0.8.4"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/xanzy/ssh-agent",
        "purl": "pkg:golang/github.com/xanzy/ssh-agent@v0.3.3",
        "version": "v0.3.3"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/xen0n/gosmopolitan",
        "purl": "pkg:golang/github.com/xen0n/gosmopolitan@v1.3.0",
        "version": "v1.3.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/xlab/treeprint",
        "purl": "pkg:golang/github.com/xlab/treeprint@v1.2.0",
        "version": "v1.2.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/xo/terminfo",
        "purl": "pkg:golang/github.com/xo/terminfo@v0.0.0-20220910002029-abceb7e1c41e",
        "version": "v0.0.0-20220910002029-abceb7e1c41e"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/yagipy/maintidx",
        "purl": "pkg:golang/github.com/yagipy/maintidx@v1.0.0",
        "version": "v1.0.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/yannh/kubeconform",
        "purl": "pkg:golang/github.com/yannh/kubeconform@v0.7.0",
        "version": "v0.7.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/yeya24/promlinter",
        "purl": "pkg:golang/github.com/yeya24/promlinter@v0.3.0",
        "version": "v0.3.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "github.com/ykadowak/zerologlint",
        "purl": "pkg:golang/github.com/ykadowak/zerologlint@v0.1.5",
        "version": "v0.1.5"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "gitlab.com/bosi/decorder",
        "purl": "pkg:golang/gitlab.com/bosi/decorder@v0.4.2",
        "version": "v0.4.2"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "gitlab.com/digitalxero/go-conventional-commit",
        "purl": "pkg:golang/gitlab.com/digitalxero/go-conventional-commit@v1.0.7",
        "version": "v1.0.7"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "gitlab.com/gitlab-org/api/client-go",
        "purl": "pkg:golang/gitlab.com/gitlab-org/api/client-go@v1.6.0",
        "version": "v1.6.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "go-simpler.org/musttag",
        "purl": "pkg:golang/go-simpler.org/musttag@v0.14.0",
        "version": "v0.14.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "go-simpler.org/sloglint",
        "purl": "pkg:golang/go-simpler.org/sloglint@v0.11.1",
        "version": "v0.11.1"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "go.augendre.info/arangolint",
        "purl": "pkg:golang/go.augendre.info/arangolint@v0.4.0",
        "version": "v0.4.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "go.augendre.info/fatcontext",
        "purl": "pkg:golang/go.augendre.info/fatcontext@v0.9.0",
        "version": "v0.9.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "go.mongodb.org/mongo-driver",
        "purl": "pkg:golang/go.mongodb.org/mongo-driver@v1.17.6",
        "version": "v1.17.6"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "go.opentelemetry.io/auto/sdk",
        "purl": "pkg:golang/go.opentelemetry.io/auto/sdk@v1.2.1",
        "version": "v1.2.1"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "go.opentelemetry.io/contrib/detectors/gcp",
        "purl": "pkg:golang/go.opentelemetry.io/contrib/detectors/gcp@v1.38.0",
        "version": "v1.38.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc",
        "purl": "pkg:golang/go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc@v0.63.0",
        "version": "v0.63.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp",
        "purl": "pkg:golang/go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp@v0.63.0",
        "version": "v0.63.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "go.opentelemetry.io/otel",
        "purl": "pkg:golang/go.opentelemetry.io/otel@v1.40.0",
        "version": "v1.40.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc",
        "purl": "pkg:golang/go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc@v1.35.0",
        "version": "v1.35.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp",
        "purl": "pkg:golang/go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp@v1.35.0",
        "version": "v1.35.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "go.opentelemetry.io/otel/exporters/otlp/otlptrace",
        "purl": "pkg:golang/go.opentelemetry.io/otel/exporters/otlp/otlptrace@v1.38.0",
        "version": "v1.38.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc",
        "purl": "pkg:golang/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc@v1.38.0",
        "version": "v1.38.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "go.opentelemetry.io/otel/metric",
        "purl": "pkg:golang/go.opentelemetry.io/otel/metric@v1.40.0",
        "version": "v1.40.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "go.opentelemetry.io/otel/sdk",
        "purl": "pkg:golang/go.opentelemetry.io/otel/sdk@v1.40.0",
        "version": "v1.40.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "go.opentelemetry.io/otel/sdk/metric",
        "purl": "pkg:golang/go.opentelemetry.io/otel/sdk/metric@v1.40.0",
        "version": "v1.40.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "go.opentelemetry.io/otel/trace",
        "purl": "pkg:golang/go.opentelemetry.io/otel/trace@v1.40.0",
        "version": "v1.40.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "go.uber.org/atomic",
        "purl": "pkg:golang/go.uber.org/atomic@v1.11.0",
        "version": "v1.11.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "go.uber.org/multierr",
        "purl": "pkg:golang/go.uber.org/multierr@v1.11.0",
        "version": "v1.11.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "go.uber.org/zap",
        "purl": "pkg:golang/go.uber.org/zap@v1.27.1",
        "version": "v1.27.1"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "go.yaml.in/yaml/v2",
        "purl": "pkg:golang/go.yaml.in/yaml/v2@v2.4.3",
        "version": "v2.4.3"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "go.yaml.in/yaml/v3",
        "purl": "pkg:golang/go.yaml.in/yaml/v3@v3.0.4",
        "version": "v3.0.4"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "gocloud.dev",
        "purl": "pkg:golang/gocloud.dev@v0.44.0",
        "version": "v0.44.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "golang.org/x/crypto",
        "purl": "pkg:golang/golang.org/x/crypto@v0.46.0",
        "version": "v0.46.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "golang.org/x/crypto",
        "purl": "pkg:golang/golang.org/x/crypto@v0.48.0",
        "version": "v0.48.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "golang.org/x/exp",
        "purl": "pkg:golang/golang.org/x/exp@v0.0.0-20250718183923-645b1fa84792",
        "version": "v0.0.0-20250718183923-645b1fa84792"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "golang.org/x/exp",
        "purl": "pkg:golang/golang.org/x/exp@v0.0.0-20250813145105-42675adae3e6",
        "version": "v0.0.0-20250813145105-42675adae3e6"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "golang.org/x/exp/typeparams",
        "purl": "pkg:golang/golang.org/x/exp/typeparams@v0.0.0-20260209203927-2842357ff358",
        "version": "v0.0.0-20260209203927-2842357ff358"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "golang.org/x/mod",
        "purl": "pkg:golang/golang.org/x/mod@v0.33.0",
        "version": "v0.33.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "golang.org/x/net",
        "purl": "pkg:golang/golang.org/x/net@v0.48.0",
        "version": "v0.48.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "golang.org/x/net",
        "purl": "pkg:golang/golang.org/x/net@v0.50.0",
        "version": "v0.50.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "golang.org/x/oauth2",
        "purl": "pkg:golang/golang.org/x/oauth2@v0.31.0",
        "version": "v0.31.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "golang.org/x/oauth2",
        "purl": "pkg:golang/golang.org/x/oauth2@v0.34.0",
        "version": "v0.34.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "golang.org/x/sync",
        "purl": "pkg:golang/golang.org/x/sync@v0.19.0",
        "version": "v0.19.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "golang.org/x/sys",
        "purl": "pkg:golang/golang.org/x/sys@v0.40.0",
        "version": "v0.40.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "golang.org/x/sys",
        "purl": "pkg:golang/golang.org/x/sys@v0.41.0",
        "version": "v0.41.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "golang.org/x/term",
        "purl": "pkg:golang/golang.org/x/term@v0.39.0",
        "version": "v0.39.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "golang.org/x/term",
        "purl": "pkg:golang/golang.org/x/term@v0.40.0",
        "version": "v0.40.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "golang.org/x/text",
        "purl": "pkg:golang/golang.org/x/text@v0.33.0",
        "version": "v0.33.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "golang.org/x/text",
        "purl": "pkg:golang/golang.org/x/text@v0.34.0",
        "version": "v0.34.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "golang.org/x/time",
        "purl": "pkg:golang/golang.org/x/time@v0.13.0",
        "version": "v0.13.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "golang.org/x/time",
        "purl": "pkg:golang/golang.org/x/time@v0.14.0",
        "version": "v0.14.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "golang.org/x/tools",
        "purl": "pkg:golang/golang.org/x/tools@v0.42.0",
        "version": "v0.42.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "golang.org/x/xerrors",
        "purl": "pkg:golang/golang.org/x/xerrors@v0.0.0-20240903120638-7835f813f4da",
        "version": "v0.0.0-20240903120638-7835f813f4da"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "google.golang.org/api",
        "purl": "pkg:golang/google.golang.org/api@v0.260.0",
        "version": "v0.260.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "google.golang.org/genproto",
        "purl": "pkg:golang/google.golang.org/genproto@v0.0.0-20251202230838-ff82c1b0f217",
        "version": "v0.0.0-20251202230838-ff82c1b0f217"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "google.golang.org/genproto/googleapis/api",
        "purl": "pkg:golang/google.golang.org/genproto/googleapis/api@v0.0.0-20250721164621-a45f3dfb1074",
        "version": "v0.0.0-20250721164621-a45f3dfb1074"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "google.golang.org/genproto/googleapis/api",
        "purl": "pkg:golang/google.golang.org/genproto/googleapis/api@v0.0.0-20251202230838-ff82c1b0f217",
        "version": "v0.0.0-20251202230838-ff82c1b0f217"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "google.golang.org/genproto/googleapis/rpc",
        "purl": "pkg:golang/google.golang.org/genproto/googleapis/rpc@v0.0.0-20250929231259-57b25ae835d4",
        "version": "v0.0.0-20250929231259-57b25ae835d4"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "google.golang.org/genproto/googleapis/rpc",
        "purl": "pkg:golang/google.golang.org/genproto/googleapis/rpc@v0.0.0-20251222181119-0a764e51fe1b",
        "version": "v0.0.0-20251222181119-0a764e51fe1b"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "google.golang.org/grpc",
        "purl": "pkg:golang/google.golang.org/grpc@v1.75.1",
        "version": "v1.75.1"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "google.golang.org/grpc",
        "purl": "pkg:golang/google.golang.org/grpc@v1.78.0",
        "version": "v1.78.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "google.golang.org/protobuf",
        "purl": "pkg:golang/google.golang.org/protobuf@v1.36.10",
        "version": "v1.36.10"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "google.golang.org/protobuf",
        "purl": "pkg:golang/google.golang.org/protobuf@v1.36.11",
        "version": "v1.36.11"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "gopkg.in/alexcesaro/quotedprintable.v3",
        "purl": "pkg:golang/gopkg.in/alexcesaro/quotedprintable.v3@v3.0.0-20150716171945-2caba252f4dc",
        "version": "v3.0.0-20150716171945-2caba252f4dc"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "gopkg.in/evanphx/json-patch.v4",
        "purl": "pkg:golang/gopkg.in/evanphx/json-patch.v4@v4.13.0",
        "version": "v4.13.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "gopkg.in/inf.v0",
        "purl": "pkg:golang/gopkg.in/inf.v0@v0.9.1",
        "version": "v0.9.1"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "gopkg.in/mail.v2",
        "purl": "pkg:golang/gopkg.in/mail.v2@v2.3.1",
        "version": "v2.3.1"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "gopkg.in/warnings.v0",
        "purl": "pkg:golang/gopkg.in/warnings.v0@v0.1.2",
        "version": "v0.1.2"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "gopkg.in/yaml.v3",
        "purl": "pkg:golang/gopkg.in/yaml.v3@v3.0.1",
        "version": "v3.0.1"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "helm.sh/helm/v3",
        "purl": "pkg:golang/helm.sh/helm/v3@v3.20.0",
        "version": "v3.20.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "honnef.co/go/tools",
        "purl": "pkg:golang/honnef.co/go/tools@v0.7.0",
        "version": "v0.7.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "k8s.io/api",
        "purl": "pkg:golang/k8s.io/api@v0.35.2",
        "version": "v0.35.2"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "k8s.io/apiextensions-apiserver",
        "purl": "pkg:golang/k8s.io/apiextensions-apiserver@v0.35.0",
        "version": "v0.35.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "k8s.io/apimachinery",
        "purl": "pkg:golang/k8s.io/apimachinery@v0.35.2",
        "version": "v0.35.2"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "k8s.io/apiserver",
        "purl": "pkg:golang/k8s.io/apiserver@v0.35.0",
        "version": "v0.35.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "k8s.io/cli-runtime",
        "purl": "pkg:golang/k8s.io/cli-runtime@v0.35.0",
        "version": "v0.35.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "k8s.io/client-go",
        "purl": "pkg:golang/k8s.io/client-go@v0.35.2",
        "version": "v0.35.2"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "k8s.io/component-base",
        "purl": "pkg:golang/k8s.io/component-base@v0.35.0",
        "version": "v0.35.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "k8s.io/gengo",
        "purl": "pkg:golang/k8s.io/gengo@v0.0.0-20240404160639-a0386bf69313",
        "version": "v0.0.0-20240404160639-a0386bf69313"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "k8s.io/klog/v2",
        "purl": "pkg:golang/k8s.io/klog/v2@v2.130.1",
        "version": "v2.130.1"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "k8s.io/kube-openapi",
        "purl": "pkg:golang/k8s.io/kube-openapi@v0.0.0-20250910181357-589584f1c912",
        "version": "v0.0.0-20250910181357-589584f1c912"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "k8s.io/kubectl",
        "purl": "pkg:golang/k8s.io/kubectl@v0.35.0",
        "version": "v0.35.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "k8s.io/utils",
        "purl": "pkg:golang/k8s.io/utils@v0.0.0-20251002143259-bc988d571ff4",
        "version": "v0.0.0-20251002143259-bc988d571ff4"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "lukechampine.com/blake3",
        "purl": "pkg:golang/lukechampine.com/blake3@v1.2.1",
        "version": "v1.2.1"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "mvdan.cc/gofumpt",
        "purl": "pkg:golang/mvdan.cc/gofumpt@v0.9.2",
        "version": "v0.9.2"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "mvdan.cc/unparam",
        "purl": "pkg:golang/mvdan.cc/unparam@v0.0.0-20251027182757-5beb8c8f8f15",
        "version": "v0.0.0-20251027182757-5beb8c8f8f15"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "oras.land/oras-go/v2",
        "purl": "pkg:golang/oras.land/oras-go/v2@v2.6.0",
        "version": "v2.6.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "sigs.k8s.io/gateway-api",
        "purl": "pkg:golang/sigs.k8s.io/gateway-api@v1.4.0",
        "version": "v1.4.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "sigs.k8s.io/json",
        "purl": "pkg:golang/sigs.k8s.io/json@v0.0.0-20250730193827-2d320260d730",
        "version": "v0.0.0-20250730193827-2d320260d730"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "sigs.k8s.io/kind",
        "purl": "pkg:golang/sigs.k8s.io/kind@v0.27.0",
        "version": "v0.27.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "sigs.k8s.io/kustomize/api",
        "purl": "pkg:golang/sigs.k8s.io/kustomize/api@v0.20.1",
        "version": "v0.20.1"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "sigs.k8s.io/kustomize/kyaml",
        "purl": "pkg:golang/sigs.k8s.io/kustomize/kyaml@v0.20.1",
        "version": "v0.20.1"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "sigs.k8s.io/randfill",
        "purl": "pkg:golang/sigs.k8s.io/randfill@v1.0.0",
        "version": "v1.0.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "sigs.k8s.io/structured-merge-diff/v6",
        "purl": "pkg:golang/sigs.k8s.io/structured-merge-diff/v6@v6.3.0",
        "version": "v6.3.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "sigs.k8s.io/yaml",
        "purl": "pkg:golang/sigs.k8s.io/yaml@v1.6.0",
        "version": "v1.6.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "tool-imports/go.mod",
        "name": "software.sslmate.com/src/go-pkcs12",
        "purl": "pkg:golang/software.sslmate.com/src/go-pkcs12@v0.5.0",
        "version": "v0.5.0"
      }
    ],
    "description": "Analyze Kubernetes YAML and Helm charts before deployment",
    "errors": [],
    "go_binary": {
      "asset": "kube-linter-linux",
      "binary": "kube-linter-linux",
      "db": "https://vuln.go.dev",
      "db_last_modified": "2026-10-27T21:16:18Z",
      "findings": [
        {
          "aliases": [
            "CVE-2026-32282"
          ],
          "epss": {
            "cve": "CVE-2026-32282",
            "percentile": 0.21771,
            "score": 0.00292
          },
          "fixed_version": "v1.26.2",
          "id": "GO-2026-4864",
          "kev": null,
          "level": "symbol",
          "module": "stdlib",
          "summary": "TOCTOU permits root escape on Linux via Root.Chmod in os in internal/syscall/unix",
          "version": "v1.26.1"
        },
        {
          "aliases": [
            "CVE-2026-32289"
          ],
          "epss": {
            "cve": "CVE-2026-32289",
            "percentile": 0.21611,
            "score": 0.0029
          },
          "fixed_version": "v1.26.2",
          "id": "GO-2026-4865",
          "kev": null,
          "level": "symbol",
          "module": "stdlib",
          "summary": "JsBraceDepth Context Tracking Bugs (XSS) in html/template",
          "version": "v1.26.1"
        },
        {
          "aliases": [
            "CVE-2026-33810"
          ],
          "epss": {
            "cve": "CVE-2026-33810",
            "percentile": 0.27513,
            "score": 0.0034
          },
          "fixed_version": "v1.26.2",
          "id": "GO-2026-4866",
          "kev": null,
          "level": "symbol",
          "module": "stdlib",
          "summary": "Case-sensitive excludedSubtrees name constraints cause Auth Bypass in crypto/x509",
          "version": "v1.26.1"
        },
        {
          "aliases": [
            "CVE-2026-32288"
          ],
          "epss": {
            "cve": "CVE-2026-32288",
            "percentile": 0.21609,
            "score": 0.0029
          },
          "fixed_version": "v1.26.2",
          "id": "GO-2026-4869",
          "kev": null,
          "level": "symbol",
          "module": "stdlib",
          "summary": "Unbounded allocation for old GNU sparse in archive/tar",
          "version": "v1.26.1"
        },
        {
          "aliases": [
            "CVE-2026-32283"
          ],
          "epss": {
            "cve": "CVE-2026-32283",
            "percentile": 0.49799,
            "score": 0.00621
          },
          "fixed_version": "v1.26.2",
          "id": "GO-2026-4870",
          "kev": null,
          "level": "symbol",
          "module": "stdlib",
          "summary": "Unauthenticated TLS 1.3 KeyUpdate record can cause persistent connection retention and DoS in crypto/tls",
          "version": "v1.26.1"
        },
        {
          "aliases": [
            "CVE-2026-33814"
          ],
          "epss": {
            "cve": "CVE-2026-33814",
            "percentile": 0.57885,
            "score": 0.0084
          },
          "fixed_version": "v1.26.3",
          "id": "GO-2026-4918",
          "kev": null,
          "level": "symbol",
          "module": "stdlib",
          "summary": "Infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in net/http/internal/http2 in golang.org/x/net",
          "version": "v1.26.1"
        },
        {
          "aliases": [
            "CVE-2026-32281"
          ],
          "epss": {
            "cve": "CVE-2026-32281",
            "percentile": 0.2925,
            "score": 0.00355
          },
          "fixed_version": "v1.26.2",
          "id": "GO-2026-4946",
          "kev": null,
          "level": "symbol",
          "module": "stdlib",
          "summary": "Inefficient policy validation in crypto/x509",
          "version": "v1.26.1"
        },
        {
          "aliases": [
            "CVE-2026-32280"
          ],
          "epss": {
            "cve": "CVE-2026-32280",
            "percentile": 0.49458,
            "score": 0.00615
          },
          "fixed_version": "v1.26.2",
          "id": "GO-2026-4947",
          "kev": null,
          "level": "symbol",
          "module": "stdlib",
          "summary": "Unexpected work during chain building in crypto/x509",
          "version": "v1.26.1"
        },
        {
          "aliases": [
            "CVE-2026-39822"
          ],
          "epss": {
            "cve": "CVE-2026-39822",
            "percentile": 0.14177,
            "score": 0.00232
          },
          "fixed_version": "v1.26.5",
          "id": "GO-2026-4970",
          "kev": null,
          "level": "symbol",
          "module": "stdlib",
          "summary": "Root escape via symlink plus trailing slash in os",
          "version": "v1.26.1"
        },
        {
          "aliases": [
            "CVE-2026-39836"
          ],
          "epss": {
            "cve": "CVE-2026-39836",
            "percentile": 0.50332,
            "score": 0.00633
          },
          "fixed_version": "v1.26.3",
          "id": "GO-2026-4971",
          "kev": null,
          "level": "symbol",
          "module": "stdlib",
          "summary": "Panic in Dial and LookupPort when handling NUL byte on Windows in net",
          "version": "v1.26.1"
        },
        {
          "aliases": [
            "CVE-2026-39825"
          ],
          "epss": {
            "cve": "CVE-2026-39825",
            "percentile": 0.33182,
            "score": 0.0039
          },
          "fixed_version": "v1.26.3",
          "id": "GO-2026-4976",
          "kev": null,
          "level": "symbol",
          "module": "stdlib",
          "summary": "ReverseProxy forwards queries with more than urlmaxqueryparams parameters in net/http/httputil",
          "version": "v1.26.1"
        },
        {
          "aliases": [
            "CVE-2026-42499"
          ],
          "epss": {
            "cve": "CVE-2026-42499",
            "percentile": 0.56521,
            "score": 0.00798
          },
          "fixed_version": "v1.26.3",
          "id": "GO-2026-4977",
          "kev": null,
          "level": "symbol",
          "module": "stdlib",
          "summary": "Quadratic string concatenation in consumePhrase in net/mail",
          "version": "v1.26.1"
        },
        {
          "aliases": [
            "CVE-2026-39826"
          ],
          "epss": {
            "cve": "CVE-2026-39826",
            "percentile": 0.31066,
            "score": 0.00371
          },
          "fixed_version": "v1.26.3",
          "id": "GO-2026-4980",
          "kev": null,
          "level": "symbol",
          "module": "stdlib",
          "summary": "Escaper bypass leads to XSS in html/template",
          "version": "v1.26.1"
        },
        {
          "aliases": [
            "CVE-2026-33811"
          ],
          "epss": {
            "cve": "CVE-2026-33811",
            "percentile": 0.58975,
            "score": 0.00875
          },
          "fixed_version": "v1.26.3",
          "id": "GO-2026-4981",
          "kev": null,
          "level": "symbol",
          "module": "stdlib",
          "summary": "Crash when handling long CNAME response in net",
          "version": "v1.26.1"
        },
        {
          "aliases": [
            "CVE-2026-39823"
          ],
          "epss": {
            "cve": "CVE-2026-39823",
            "percentile": 0.24388,
            "score": 0.00314
          },
          "fixed_version": "v1.26.3",
          "id": "GO-2026-4982",
          "kev": null,
          "level": "symbol",
          "module": "stdlib",
          "summary": "Bypass of meta content URL escaping causes XSS in html/template",
          "version": "v1.26.1"
        },
        {
          "aliases": [
            "CVE-2026-39820"
          ],
          "epss": {
            "cve": "CVE-2026-39820",
            "percentile": 0.56059,
            "score": 0.00784
          },
          "fixed_version": "v1.26.3",
          "id": "GO-2026-4986",
          "kev": null,
          "level": "symbol",
          "module": "stdlib",
          "summary": "Quadratic string concatentation in consumeComment in net/mail",
          "version": "v1.26.1"
        },
        {
          "aliases": [
            "CVE-2026-39821"
          ],
          "epss": {
            "cve": "CVE-2026-39821",
            "percentile": 0.78915,
            "score": 0.01834
          },
          "fixed_version": "v1.26.6",
          "id": "GO-2026-5026",
          "kev": null,
          "level": "symbol",
          "module": "stdlib",
          "summary": "Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna",
          "version": "v1.26.1"
        },
        {
          "aliases": [
            "CVE-2026-27145"
          ],
          "epss": {
            "cve": "CVE-2026-27145",
            "percentile": 0.48256,
            "score": 0.00591
          },
          "fixed_version": "v1.26.4",
          "id": "GO-2026-5037",
          "kev": null,
          "level": "symbol",
          "module": "stdlib",
          "summary": "Inefficient candidate hostname parsing in crypto/x509",
          "version": "v1.26.1"
        },
        {
          "aliases": [
            "CVE-2026-42504"
          ],
          "epss": {
            "cve": "CVE-2026-42504",
            "percentile": 0.46636,
            "score": 0.0056
          },
          "fixed_version": "v1.26.4",
          "id": "GO-2026-5038",
          "kev": null,
          "level": "symbol",
          "module": "stdlib",
          "summary": "Quadratic complexity in WordDecoder.DecodeHeader in mime",
          "version": "v1.26.1"
        },
        {
          "aliases": [
            "CVE-2026-42507"
          ],
          "epss": {
            "cve": "CVE-2026-42507",
            "percentile": 0.30985,
            "score": 0.0037
          },
          "fixed_version": "v1.26.4",
          "id": "GO-2026-5039",
          "kev": null,
          "level": "symbol",
          "module": "stdlib",
          "summary": "Arbitrary inputs are included in errors without any escaping in net/textproto",
          "version": "v1.26.1"
        },
        {
          "aliases": [
            "CVE-2026-42505"
          ],
          "epss": {
            "cve": "CVE-2026-42505",
            "percentile": 0.32254,
            "score": 0.00382
          },
          "fixed_version": "v1.26.5",
          "id": "GO-2026-5856",
          "kev": null,
          "level": "symbol",
          "module": "stdlib",
          "summary": "Invoking Encrypted Client Hello privacy leak in crypto/tls",
          "version": "v1.26.1"
        },
        {
          "aliases": [
            "CVE-2026-33818"
          ],
          "epss": {
            "cve": "CVE-2026-33818",
            "percentile": 0.47077,
            "score": 0.00568
          },
          "fixed_version": "v1.26.6",
          "id": "GO-2026-5972",
          "kev": null,
          "level": "symbol",
          "module": "stdlib",
          "summary": "Enforce maximum recursion depth in encoding/asn1",
          "version": "v1.26.1"
        },
        {
          "aliases": [
            "CVE-2026-56859"
          ],
          "epss": {
            "cve": "CVE-2026-56859",
            "percentile": 0.47076,
            "score": 0.00568
          },
          "fixed_version": "v1.26.6",
          "id": "GO-2026-6088",
          "kev": null,
          "level": "symbol",
          "module": "stdlib",
          "summary": "Add recursion depth guard during decode in encoding/xml",
          "version": "v1.26.1"
        },
        {
          "aliases": [
            "CVE-2026-56853"
          ],
          "epss": {
            "cve": "CVE-2026-56853",
            "percentile": 0.47076,
            "score": 0.00568
          },
          "fixed_version": "v1.26.6",
          "id": "GO-2026-6089",
          "kev": null,
          "level": "symbol",
          "module": "stdlib",
          "summary": "Apply ReadHeaderTimeout when doing unencrypted HTTP/2 check in net/http",
          "version": "v1.26.1"
        },
        {
          "aliases": [
            "CVE-2026-56862"
          ],
          "epss": {
            "cve": "CVE-2026-56862",
            "percentile": 0.47076,
            "score": 0.00568
          },
          "fixed_version": "v1.26.6",
          "id": "GO-2026-6090",
          "kev": null,
          "level": "symbol",
          "module": "stdlib",
          "summary": "Limit handshake messages we are willing to accept post-handshake in crypto/tls",
          "version": "v1.26.1"
        },
        {
          "aliases": [
            "CVE-2026-56858"
          ],
          "epss": {
            "cve": "CVE-2026-56858",
            "percentile": 0.23831,
            "score": 0.0031
          },
          "fixed_version": "v1.26.6",
          "id": "GO-2026-6091",
          "kev": null,
          "level": "symbol",
          "module": "stdlib",
          "summary": "Fix Javascript regexp context tracking in html/template",
          "version": "v1.26.1"
        },
        {
          "aliases": [
            "CVE-2026-56860"
          ],
          "epss": {
            "cve": "CVE-2026-56860",
            "percentile": 0.46041,
            "score": 0.0055
          },
          "fixed_version": "v1.26.6",
          "id": "GO-2026-6218",
          "kev": null,
          "level": "symbol",
          "module": "stdlib",
          "summary": "Avoid quadratic complexity in resolvePath in net/url",
          "version": "v1.26.1"
        },
        {
          "aliases": [
            "CVE-2026-94448"
          ],
          "epss": {
            "cve": "CVE-2026-94448",
            "percentile": 0.21475,
            "score": 0.00289
          },
          "fixed_version": "v1.26.9",
          "id": "GO-2026-6599",
          "kev": null,
          "level": "symbol",
          "module": "stdlib",
          "summary": "Reset context tracking on consecutive template expressions in html/template",
          "version": "v1.26.1"
        },
        {
          "aliases": [
            "CVE-2026-97030"
          ],
          "epss": {
            "cve": "CVE-2026-97030",
            "percentile": 0.21475,
            "score": 0.00289
          },
          "fixed_version": "v1.26.9",
          "id": "GO-2026-6600",
          "kev": null,
          "level": "symbol",
          "module": "stdlib",
          "summary": "Recognize yield as regexp preceder keyword in html/template",
          "version": "v1.26.1"
        },
        {
          "aliases": [
            "CVE-2026-78659"
          ],
          "epss": {
            "cve": "CVE-2026-78659",
            "percentile": 0.50082,
            "score": 0.00627
          },
          "fixed_version": "v1.26.9",
          "id": "GO-2026-6603",
          "kev": null,
          "level": "symbol",
          "module": "stdlib",
          "summary": "HTTP/2 server memory exhaustion due to Trailer headers in net/http",
          "version": "v1.26.1"
        },
        {
          "aliases": [
            "CVE-2026-56866"
          ],
          "epss": {
            "cve": "CVE-2026-56866",
            "percentile": 0.40968,
            "score": 0.00473
          },
          "fixed_version": "v1.26.9",
          "id": "GO-2026-6605",
          "kev": null,
          "level": "symbol",
          "module": "stdlib",
          "summary": "HTTP/1 client connection desynchronization after CONNECT rejection in net/http",
          "version": "v1.26.1"
        },
        {
          "aliases": [
            "CVE-2026-97031"
          ],
          "epss": {
            "cve": "CVE-2026-97031",
            "percentile": 0.44095,
            "score": 0.00519
          },
          "fixed_version": "v1.26.9",
          "id": "GO-2026-6607",
          "kev": null,
          "level": "symbol",
          "module": "stdlib",
          "summary": "Reject malformed ECH outer extension references in crypto/tls",
          "version": "v1.26.1"
        },
        {
          "aliases": [
            "CVE-2026-94440"
          ],
          "epss": {
            "cve": "CVE-2026-94440",
            "percentile": 0.4362,
            "score": 0.00511
          },
          "fixed_version": "v1.26.9",
          "id": "GO-2026-6608",
          "kev": null,
          "level": "symbol",
          "module": "stdlib",
          "summary": "Memory limit bypass when parsing MIME headers in net/textproto, mime/multipart",
          "version": "v1.26.1"
        },
        {
          "aliases": [
            "CVE-2026-78667"
          ],
          "epss": {
            "cve": "CVE-2026-78667",
            "percentile": 0.41455,
            "score": 0.0048
          },
          "fixed_version": "v1.26.9",
          "id": "GO-2026-6609",
          "kev": null,
          "level": "symbol",
          "module": "stdlib",
          "summary": "Lack of limit on size of parsed Range headers in net/http",
          "version": "v1.26.1"
        },
        {
          "aliases": [
            "CVE-2026-78660"
          ],
          "epss": {
            "cve": "CVE-2026-78660",
            "percentile": 0.36838,
            "score": 0.00425
          },
          "fixed_version": "v1.26.9",
          "id": "GO-2026-6610",
          "kev": null,
          "level": "symbol",
          "module": "stdlib",
          "summary": "HTTP/2 transport accepts malformed framing-related headers in net/http",
          "version": "v1.26.1"
        },
        {
          "aliases": [
            "CVE-2026-78669"
          ],
          "epss": {
            "cve": "CVE-2026-78669",
            "percentile": 0.49426,
            "score": 0.00614
          },
          "fixed_version": "v1.26.9",
          "id": "GO-2026-6611",
          "kev": null,
          "level": "symbol",
          "module": "stdlib",
          "summary": "Excessive CPU consumption from repeated initial window changes in net/http",
          "version": "v1.26.1"
        },
        {
          "aliases": [
            "CVE-2026-78663"
          ],
          "epss": {
            "cve": "CVE-2026-78663",
            "percentile": 0.49813,
            "score": 0.00622
          },
          "fixed_version": "v1.26.9",
          "id": "GO-2026-6612",
          "kev": null,
          "level": "symbol",
          "module": "stdlib",
          "summary": "Double flow control refund on HTTP/2 server streams in net/http",
          "version": "v1.26.1"
        },
        {
          "aliases": [
            "CVE-2026-94439"
          ],
          "epss": {
            "cve": "CVE-2026-94439",
            "percentile": 0.35772,
            "score": 0.00414
          },
          "fixed_version": "v1.26.9",
          "id": "GO-2026-6613",
          "kev": null,
          "level": "symbol",
          "module": "stdlib",
          "summary": "HTTP/1 server connection desynchronization after 2xx CONNECT response in net/http",
          "version": "v1.26.1"
        },
        {
          "aliases": [
            "CVE-2026-97032"
          ],
          "epss": {
            "cve": "CVE-2026-97032",
            "percentile": 0.42154,
            "score": 0.0049
          },
          "fixed_version": "v1.26.9",
          "id": "GO-2026-6617",
          "kev": null,
          "level": "symbol",
          "module": "stdlib",
          "summary": "HTTP/2 server crash due to HPACK encoder race in net/http",
          "version": "v1.26.1"
        },
        {
          "aliases": [
            "CVE-2026-111943"
          ],
          "epss": {
            "cve": "CVE-2026-111943",
            "percentile": 0.33793,
            "score": 0.00396
          },
          "fixed_version": "v1.26.10",
          "id": "GO-2026-6809",
          "kev": null,
          "level": "symbol",
          "module": "stdlib",
          "summary": "Distrust compromised intermediate certificates in crypto/x509",
          "version": "v1.26.1"
        },
        {
          "aliases": [
            "GHSA-gcjh-h69q-9w9g"
          ],
          "epss": null,
          "fixed_version": "v0.30.0",
          "id": "GO-2026-6094",
          "kev": null,
          "level": "symbol",
          "module": "github.com/google/cel-go",
          "summary": "JSON private fields exposed via NativeTypes and ParseStructTag in github.com/google/cel-go",
          "version": "v0.27.0"
        },
        {
          "aliases": [
            "GHSA-259r-337f-4rfw"
          ],
          "epss": null,
          "fixed_version": "v1.18.7",
          "id": "GO-2026-5841",
          "kev": null,
          "level": "symbol",
          "module": "github.com/klauspost/compress",
          "summary": "OOB read in github.com/klauspost/compress/s2",
          "version": "v1.18.0"
        },
        {
          "aliases": [
            "CVE-2026-39833",
            "GHSA-jppx-rxg9-jmrx"
          ],
          "epss": {
            "cve": "CVE-2026-39833",
            "percentile": 0.40584,
            "score": 0.00469
          },
          "fixed_version": "v0.52.0",
          "id": "GO-2026-5005",
          "kev": null,
          "level": "symbol",
          "module": "golang.org/x/crypto",
          "summary": "Invoking key constraints not enforced in golang.org/x/crypto/ssh/agent",
          "version": "v0.46.0"
        },
        {
          "aliases": [
            "CVE-2026-39832",
            "GHSA-f5wc-c3c7-36mc"
          ],
          "epss": {
            "cve": "CVE-2026-39832",
            "percentile": 0.52541,
            "score": 0.00683
          },
          "fixed_version": "v0.52.0",
          "id": "GO-2026-5006",
          "kev": null,
          "level": "symbol",
          "module": "golang.org/x/crypto",
          "summary": "Invoking agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agent",
          "version": "v0.46.0"
        },
        {
          "aliases": [
            "CVE-2026-46597"
          ],
          "epss": {
            "cve": "CVE-2026-46597",
            "percentile": 0.40897,
            "score": 0.00473
          },
          "fixed_version": "v0.52.0",
          "id": "GO-2026-5013",
          "kev": null,
          "level": "symbol",
          "module": "golang.org/x/crypto",
          "summary": "Invoking byte arithmetic causes underflow and panic in golang.org/x/crypto/ssh",
          "version": "v0.46.0"
        },
        {
          "aliases": [
            "CVE-2026-39828"
          ],
          "epss": {
            "cve": "CVE-2026-39828",
            "percentile": 0.3079,
            "score": 0.00369
          },
          "fixed_version": "v0.52.0",
          "id": "GO-2026-5014",
          "kev": null,
          "level": "symbol",
          "module": "golang.org/x/crypto",
          "summary": "Invoking bypass of certificate restrictions in golang.org/x/crypto/ssh",
          "version": "v0.46.0"
        },
        {
          "aliases": [
            "CVE-2026-39835"
          ],
          "epss": {
            "cve": "CVE-2026-39835",
            "percentile": 0.43087,
            "score": 0.00504
          },
          "fixed_version": "v0.52.0",
          "id": "GO-2026-5015",
          "kev": null,
          "level": "symbol",
          "module": "golang.org/x/crypto",
          "summary": "Invoking server panic during CheckHostKey/Authenticate in golang.org/x/crypto/ssh",
          "version": "v0.46.0"
        },
        {
          "aliases": [
            "CVE-2026-39827"
          ],
          "epss": {
            "cve": "CVE-2026-39827",
            "percentile": 0.20461,
            "score": 0.00279
          },
          "fixed_version": "v0.52.0",
          "id": "GO-2026-5016",
          "kev": null,
          "level": "symbol",
          "module": "golang.org/x/crypto",
          "summary": "Invoking memory leak when rejecting channels can lead to DoS in golang.org/x/crypto/ssh",
          "version": "v0.46.0"
        },
        {
          "aliases": [
            "CVE-2026-39830"
          ],
          "epss": {
            "cve": "CVE-2026-39830",
            "percentile": 0.52538,
            "score": 0.00683
          },
          "fixed_version": "v0.52.0",
          "id": "GO-2026-5017",
          "kev": null,
          "level": "symbol",
          "module": "golang.org/x/crypto",
          "summary": "Invoking client can cause server deadlock on unexpected responses in golang.org/x/crypto/ssh",
          "version": "v0.46.0"
        },
        {
          "aliases": [
            "CVE-2026-39829"
          ],
          "epss": {
            "cve": "CVE-2026-39829",
            "percentile": 0.40433,
            "score": 0.00467
          },
          "fixed_version": "v0.52.0",
          "id": "GO-2026-5018",
          "kev": null,
          "level": "symbol",
          "module": "golang.org/x/crypto",
          "summary": "Invoking pathological RSA/DSA parameters may cause DoS in golang.org/x/crypto/ssh",
          "version": "v0.46.0"
        },
        {
          "aliases": [
            "CVE-2026-39831"
          ],
          "epss": {
            "cve": "CVE-2026-39831",
            "percentile": 0.41307,
            "score": 0.00478
          },
          "fixed_version": "v0.52.0",
          "id": "GO-2026-5019",
          "kev": null,
          "level": "symbol",
          "module": "golang.org/x/crypto",
          "summary": "Invoking bypass of FIDO/U2F security keys physical interaction in golang.org/x/crypto/ssh",
          "version": "v0.46.0"
        },
        {
          "aliases": [
            "CVE-2026-39834"
          ],
          "epss": {
            "cve": "CVE-2026-39834",
            "percentile": 0.48587,
            "score": 0.00597
          },
          "fixed_version": "v0.52.0",
          "id": "GO-2026-5020",
          "kev": null,
          "level": "symbol",
          "module": "golang.org/x/crypto",
          "summary": "Invoking infinite loop on large channel writes in golang.org/x/crypto/ssh",
          "version": "v0.46.0"
        },
        {
          "aliases": [
            "CVE-2026-42508",
            "GHSA-5cgq-3rg8-m6cv"
          ],
          "epss": {
            "cve": "CVE-2026-42508",
            "percentile": 0.94092,
            "score": 0.0691
          },
          "fixed_version": "v0.52.0",
          "id": "GO-2026-5021",
          "kev": null,
          "level": "symbol",
          "module": "golang.org/x/crypto",
          "summary": "Invoking auth bypass via unenforced @revoked status in golang.org/x/crypto/ssh/knownhosts",
          "version": "v0.46.0"
        },
        {
          "aliases": [
            "CVE-2026-46595"
          ],
          "epss": {
            "cve": "CVE-2026-46595",
            "percentile": 0.4641,
            "score": 0.00556
          },
          "fixed_version": "v0.52.0",
          "id": "GO-2026-5023",
          "kev": null,
          "level": "symbol",
          "module": "golang.org/x/crypto",
          "summary": "Invoking VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/ssh",
          "version": "v0.46.0"
        },
        {
          "aliases": [
            "CVE-2026-46598"
          ],
          "epss": {
            "cve": "CVE-2026-46598",
            "percentile": 0.35509,
            "score": 0.00412
          },
          "fixed_version": "v0.52.0",
          "id": "GO-2026-5033",
          "kev": null,
          "level": "symbol",
          "module": "golang.org/x/crypto",
          "summary": "Invoking pathological inputs can lead to client panic in golang.org/x/crypto/ssh/agent",
          "version": "v0.46.0"
        },
        {
          "aliases": [],
          "epss": null,
          "fixed_version": "",
          "id": "GO-2026-5932",
          "kev": null,
          "level": "symbol",
          "module": "golang.org/x/crypto",
          "summary": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues",
          "version": "v0.46.0"
        },
        {
          "aliases": [
            "CVE-2026-56854"
          ],
          "epss": {
            "cve": "CVE-2026-56854",
            "percentile": 0.38024,
            "score": 0.00437
          },
          "fixed_version": "v0.55.0",
          "id": "GO-2026-6303",
          "kev": null,
          "level": "symbol",
          "module": "golang.org/x/crypto",
          "summary": "Source-address critical option not enforced for non-public-key auth callbacks in golang.org/x/crypto/ssh",
          "version": "v0.46.0"
        },
        {
          "aliases": [
            "CVE-2026-78662"
          ],
          "epss": {
            "cve": "CVE-2026-78662",
            "percentile": 0.37388,
            "score": 0.00431
          },
          "fixed_version": "v0.56.0",
          "id": "GO-2026-6354",
          "kev": null,
          "level": "symbol",
          "module": "golang.org/x/crypto",
          "summary": "Prevent DoS on deadlocked undecided channel in golang.org/x/crypto/ssh",
          "version": "v0.46.0"
        },
        {
          "aliases": [
            "CVE-2026-56855"
          ],
          "epss": {
            "cve": "CVE-2026-56855",
            "percentile": 0.42867,
            "score": 0.005
          },
          "fixed_version": "v0.56.0",
          "id": "GO-2026-6355",
          "kev": null,
          "level": "symbol",
          "module": "golang.org/x/crypto",
          "summary": "Prevent DoS on deadlocked established channel in golang.org/x/crypto/ssh",
          "version": "v0.46.0"
        },
        {
          "aliases": [
            "CVE-2026-42506"
          ],
          "epss": {
            "cve": "CVE-2026-42506",
            "percentile": 0.14566,
            "score": 0.00235
          },
          "fixed_version": "v0.55.0",
          "id": "GO-2026-5025",
          "kev": null,
          "level": "symbol",
          "module": "golang.org/x/net",
          "summary": "Invoking incorrect handling of namespaced elements in foreign content in golang.org/x/net/html",
          "version": "v0.48.0"
        },
        {
          "aliases": [
            "CVE-2026-42502"
          ],
          "epss": {
            "cve": "CVE-2026-42502",
            "percentile": 0.12982,
            "score": 0.00223
          },
          "fixed_version": "v0.55.0",
          "id": "GO-2026-5027",
          "kev": null,
          "level": "symbol",
          "module": "golang.org/x/net",
          "summary": "Invoking incorrect handling of HTML elements in foreign content in golang.org/x/net/html",
          "version": "v0.48.0"
        },
        {
          "aliases": [
            "CVE-2026-25680"
          ],
          "epss": {
            "cve": "CVE-2026-25680",
            "percentile": 0.25766,
            "score": 0.00326
          },
          "fixed_version": "v0.55.0",
          "id": "GO-2026-5028",
          "kev": null,
          "level": "symbol",
          "module": "golang.org/x/net",
          "summary": "Invoking denial of service when parsing arbitrary HTML in golang.org/x/net/html",
          "version": "v0.48.0"
        },
        {
          "aliases": [
            "CVE-2026-25681"
          ],
          "epss": {
            "cve": "CVE-2026-25681",
            "percentile": 0.12983,
            "score": 0.00223
          },
          "fixed_version": "v0.55.0",
          "id": "GO-2026-5029",
          "kev": null,
          "level": "symbol",
          "module": "golang.org/x/net",
          "summary": "Invoking incorrect handling of character references in DOCTYPE nodes in golang.org/x/net/html",
          "version": "v0.48.0"
        },
        {
          "aliases": [
            "CVE-2026-27136"
          ],
          "epss": {
            "cve": "CVE-2026-27136",
            "percentile": 0.12983,
            "score": 0.00223
          },
          "fixed_version": "v0.55.0",
          "id": "GO-2026-5030",
          "kev": null,
          "level": "symbol",
          "module": "golang.org/x/net",
          "summary": "Invoking duplicate attributes can cause XSS in golang.org/x/net/html",
          "version": "v0.48.0"
        },
        {
          "aliases": [
            "CVE-2026-46600"
          ],
          "epss": {
            "cve": "CVE-2026-46600",
            "percentile": 0.45991,
            "score": 0.00549
          },
          "fixed_version": "v0.56.0",
          "id": "GO-2026-5942",
          "kev": null,
          "level": "symbol",
          "module": "golang.org/x/net",
          "summary": "Parsing an invalid SVCB or HTTPS RR can panic in golang.org/x/net/dns/dnsmessage",
          "version": "v0.48.0"
        },
        {
          "aliases": [
            "CVE-2026-78661"
          ],
          "epss": {
            "cve": "CVE-2026-78661",
            "percentile": 0.08063,
            "score": 0.00185
          },
          "fixed_version": "v0.62.0",
          "id": "GO-2026-6860",
          "kev": null,
          "level": "symbol",
          "module": "golang.org/x/net",
          "summary": "Avoid quadratic complexity when coalescing text nodes in html in golang.org/x/net",
          "version": "v0.48.0"
        },
        {
          "aliases": [
            "CVE-2026-97045"
          ],
          "epss": {
            "cve": "CVE-2026-97045",
            "percentile": 0.10117,
            "score": 0.00202
          },
          "fixed_version": "v0.62.0",
          "id": "GO-2026-6866",
          "kev": null,
          "level": "symbol",
          "module": "golang.org/x/net",
          "summary": "Check all ancestor namespace transitions when rendering raw text in html in golang.org/x/net",
          "version": "v0.48.0"
        },
        {
          "aliases": [
            "CVE-2026-56852"
          ],
          "epss": {
            "cve": "CVE-2026-56852",
            "percentile": 0.41057,
            "score": 0.00475
          },
          "fixed_version": "v0.39.0",
          "id": "GO-2026-5970",
          "kev": null,
          "level": "symbol",
          "module": "golang.org/x/text",
          "summary": "Infinite loop on invalid input in golang.org/x/text",
          "version": "v0.33.0"
        },
        {
          "aliases": [
            "CVE-2026-56851"
          ],
          "epss": {
            "cve": "CVE-2026-56851",
            "percentile": 0.40313,
            "score": 0.00466
          },
          "fixed_version": "v0.41.0",
          "id": "GO-2026-6629",
          "kev": null,
          "level": "symbol",
          "module": "golang.org/x/text",
          "summary": "Panic parsing crafted input in x/text/secure/precis in golang.org/x/text",
          "version": "v0.33.0"
        },
        {
          "aliases": [
            "CVE-2026-33186",
            "GHSA-p77j-4mvh-x3m3"
          ],
          "epss": {
            "cve": "CVE-2026-33186",
            "percentile": 0.75569,
            "score": 0.01584
          },
          "fixed_version": "v1.79.3",
          "id": "GO-2026-4762",
          "kev": null,
          "level": "symbol",
          "module": "google.golang.org/grpc",
          "summary": "Authorization bypass in gRPC-Go via missing leading slash in :path in google.golang.org/grpc",
          "version": "v1.75.1"
        },
        {
          "aliases": [
            "GHSA-hrxh-6v49-42gf"
          ],
          "epss": null,
          "fixed_version": "v1.82.1",
          "id": "GO-2026-6061",
          "kev": null,
          "level": "symbol",
          "module": "google.golang.org/grpc",
          "summary": "Vulnerabilities in the xDS RBAC authorization engine and the HTTP/2 transport server implementation in google.golang.org/grpc",
          "version": "v1.75.1"
        },
        {
          "aliases": [
            "CVE-2026-84304",
            "GHSA-vp52-pcj8-j9qc"
          ],
          "epss": {
            "cve": "CVE-2026-84304",
            "percentile": 0.49152,
            "score": 0.00609
          },
          "fixed_version": "v1.83.1",
          "id": "GO-2026-6348",
          "kev": null,
          "level": "symbol",
          "module": "google.golang.org/grpc",
          "summary": "Heap Memory Exhaustion (OOM) via HTTP/2 DATA Frame Fragmentation in google.golang.org/grpc",
          "version": "v1.75.1"
        },
        {
          "aliases": [
            "CVE-2026-84303",
            "GHSA-qc2q-p7wx-3px3"
          ],
          "epss": {
            "cve": "CVE-2026-84303",
            "percentile": 0.23991,
            "score": 0.00311
          },
          "fixed_version": "v1.83.1",
          "id": "GO-2026-6441",
          "kev": null,
          "level": "symbol",
          "module": "google.golang.org/grpc",
          "summary": "Bypass of xDS RBAC HTTP filter header matching in google.golang.org/grpc",
          "version": "v1.75.1"
        },
        {
          "aliases": [
            "CVE-2026-84445",
            "GHSA-2v4p-qf9q-27wj"
          ],
          "epss": {
            "cve": "CVE-2026-84445",
            "percentile": 0.5072,
            "score": 0.00641
          },
          "fixed_version": "v1.82.2",
          "id": "GO-2026-6443",
          "kev": null,
          "level": "symbol",
          "module": "google.golang.org/grpc",
          "summary": "Server panic via missing authority or Host headers in google.golang.org/grpc",
          "version": "v1.75.1"
        },
        {
          "aliases": [
            "CVE-2026-35206",
            "GHSA-hr2v-4r36-88hr"
          ],
          "epss": {
            "cve": "CVE-2026-35206",
            "percentile": 0.09712,
            "score": 0.00199
          },
          "fixed_version": "v3.20.2",
          "id": "GO-2026-5435",
          "kev": null,
          "level": "symbol",
          "module": "helm.sh/helm/v3",
          "summary": "Helm Chart extraction output directory collapse via Chart.yaml name dot-segment in helm.sh/helm",
          "version": "v3.20.0"
        },
        {
          "aliases": [
            "CVE-2026-50162",
            "GHSA-8xwf-rjm4-xvhv"
          ],
          "epss": {
            "cve": "CVE-2026-50162",
            "percentile": 0.37983,
            "score": 0.00437
          },
          "fixed_version": "v2.6.1",
          "id": "GO-2026-5879",
          "kev": null,
          "level": "symbol",
          "module": "oras.land/oras-go/v2",
          "summary": "Oras-go: File store write outside workingDir via symlink traversal in oras.land/oras-go",
          "version": "v2.6.0"
        },
        {
          "aliases": [
            "CVE-2026-50163",
            "GHSA-fxhp-mv3v-67qp"
          ],
          "epss": {
            "cve": "CVE-2026-50163",
            "percentile": 0.34549,
            "score": 0.00403
          },
          "fixed_version": "v2.6.2",
          "id": "GO-2026-5880",
          "kev": null,
          "level": "symbol",
          "module": "oras.land/oras-go/v2",
          "summary": "Hardlink path traversal during tar extraction in oras.land/oras-go",
          "version": "v2.6.0"
        },
        {
          "aliases": [
            "CVE-2026-50151",
            "GHSA-jxpm-75mh-9fp7"
          ],
          "epss": {
            "cve": "CVE-2026-50151",
            "percentile": 0.3225,
            "score": 0.00382
          },
          "fixed_version": "v2.6.1",
          "id": "GO-2026-5882",
          "kev": null,
          "level": "symbol",
          "module": "oras.land/oras-go/v2",
          "summary": "Oras-go: Blob upload vulnerable to credential forwarding via unvalidated Location header in oras.land/oras-go",
          "version": "v2.6.0"
        },
        {
          "aliases": [
            "GHSA-vh4v-2xq2-g5cg"
          ],
          "epss": null,
          "fixed_version": "v2.6.1",
          "id": "GO-2026-5884",
          "kev": null,
          "level": "symbol",
          "module": "oras.land/oras-go/v2",
          "summary": "ORAS Go forwards registry credentials across registry redirects in oras.land/oras-go",
          "version": "v2.6.0"
        },
        {
          "aliases": [
            "CVE-2026-48978",
            "GHSA-xf85-363p-868w"
          ],
          "epss": {
            "cve": "CVE-2026-48978",
            "percentile": 0.11316,
            "score": 0.00211
          },
          "fixed_version": "v2.6.1",
          "id": "GO-2026-5885",
          "kev": null,
          "level": "symbol",
          "module": "oras.land/oras-go/v2",
          "summary": "Oras-go: Malicious registry can hijack Bearer token realm to exfiltrate credentials and refresh tokens in oras.land/oras-go",
          "version": "v2.6.0"
        },
        {
          "aliases": [
            "CVE-2026-85732",
            "GHSA-h7vf-4x9w-h99v"
          ],
          "epss": {
            "cve": "CVE-2026-85732",
            "percentile": 0.32493,
            "score": 0.00384
          },
          "fixed_version": "v2.6.2",
          "id": "GO-2026-6497",
          "kev": null,
          "level": "symbol",
          "module": "oras.land/oras-go/v2",
          "summary": "Blind SSRF via unvalidated Link header URL in pagination allows internal network probing in oras.land/oras-go",
          "version": "v2.6.0"
        },
        {
          "aliases": [
            "CVE-2026-85731",
            "GHSA-m37j-52j7-pjw7"
          ],
          "epss": {
            "cve": "CVE-2026-85731",
            "percentile": 0.52244,
            "score": 0.00676
          },
          "fixed_version": "v2.6.2",
          "id": "GO-2026-6499",
          "kev": null,
          "level": "symbol",
          "module": "oras.land/oras-go/v2",
          "summary": "Arbitrary file write outside file.Store root via symlink-chain bypass in tar extraction (pushDir) in oras.land/oras-go",
          "version": "v2.6.0"
        },
        {
          "aliases": [
            "CVE-2026-53492",
            "GHSA-33vj-92qq-66hc"
          ],
          "epss": {
            "cve": "CVE-2026-53492",
            "percentile": 0.28922,
            "score": 0.00353
          },
          "fixed_version": "",
          "id": "GO-2026-5064",
          "kev": null,
          "level": "module",
          "module": "github.com/containerd/containerd",
          "summary": "containerd CRI checkpoint restore CDI annotation smuggling in github.com/containerd/containerd",
          "version": "v1.7.30"
        },
        {
          "aliases": [
            "CVE-2026-50195",
            "GHSA-cvxm-645q-p574"
          ],
          "epss": {
            "cve": "CVE-2026-50195",
            "percentile": 0.23133,
            "score": 0.00303
          },
          "fixed_version": "",
          "id": "GO-2026-5338",
          "kev": null,
          "level": "module",
          "module": "github.com/containerd/containerd",
          "summary": "containerd: CRI checkpoint import allows local image tag poisoning in github.com/containerd/containerd",
          "version": "v1.7.30"
        },
        {
          "aliases": [
            "CVE-2026-46680",
            "GHSA-fqw6-gf59-qr4w"
          ],
          "epss": {
            "cve": "CVE-2026-46680",
            "percentile": 0.05463,
            "score": 0.00163
          },
          "fixed_version": "v1.7.32",
          "id": "GO-2026-5378",
          "kev": null,
          "level": "module",
          "module": "github.com/containerd/containerd",
          "summary": "containerd user ID handling bypass allows runAsNonRoot evasion in github.com/containerd/containerd",
          "version": "v1.7.30"
        },
        {
          "aliases": [
            "CVE-2026-47262",
            "GHSA-jpcc-p29g-p8mq"
          ],
          "epss": {
            "cve": "CVE-2026-47262",
            "percentile": 0.18457,
            "score": 0.00265
          },
          "fixed_version": "v1.7.33",
          "id": "GO-2026-5475",
          "kev": null,
          "level": "module",
          "module": "github.com/containerd/containerd",
          "summary": "containerd image-triggered runtime DoS via unbounded group parsing in github.com/containerd/containerd",
          "version": "v1.7.30"
        },
        {
          "aliases": [
            "CVE-2026-53489",
            "GHSA-rgh6-rfwx-v388"
          ],
          "epss": {
            "cve": "CVE-2026-53489",
            "percentile": 0.06876,
            "score": 0.00174
          },
          "fixed_version": "",
          "id": "GO-2026-5622",
          "kev": null,
          "level": "module",
          "module": "github.com/containerd/containerd",
          "summary": "Arbitrary host CRI log file read via symlink following in CRI checkpoint restore in github.com/containerd/containerd",
          "version": "v1.7.30"
        },
        {
          "aliases": [
            "CVE-2026-53488",
            "GHSA-xhf5-7wjv-pqxp"
          ],
          "epss": {
            "cve": "CVE-2026-53488",
            "percentile": 0.07132,
            "score": 0.00176
          },
          "fixed_version": "v1.7.33",
          "id": "GO-2026-5758",
          "kev": null,
          "level": "module",
          "module": "github.com/containerd/containerd",
          "summary": "containerd CRI \u2014 image-config `LABEL` flows to restart-monitor `binary://` logger: host-root command execution from an image pull in github.com/containerd/containerd",
          "version": "v1.7.30"
        },
        {
          "aliases": [
            "CVE-2026-53495",
            "GHSA-7jxh-36q5-gcqv"
          ],
          "epss": {
            "cve": "CVE-2026-53495",
            "percentile": 0.05332,
            "score": 0.00162
          },
          "fixed_version": "v1.7.35",
          "id": "GO-2026-6444",
          "kev": null,
          "level": "module",
          "module": "github.com/containerd/containerd",
          "summary": "containerd: CRI ExecSync Goroutine Leak Leads to Node-Level Denial of Service in github.com/containerd/containerd",
          "version": "v1.7.30"
        },
        {
          "aliases": [
            "CVE-2026-53493",
            "GHSA-pg57-6jwg-q645"
          ],
          "epss": {
            "cve": "CVE-2026-53493",
            "percentile": 0.29375,
            "score": 0.00356
          },
          "fixed_version": "v1.7.36",
          "id": "GO-2026-6597",
          "kev": null,
          "level": "module",
          "module": "github.com/containerd/containerd",
          "summary": "Containerd has image-pull DoS via crafted OCI index graph amplification in github.com/containerd/containerd",
          "version": "v1.7.30"
        },
        {
          "aliases": [
            "CVE-2026-95837",
            "GHSA-p7v4-vr35-mj6f"
          ],
          "epss": {
            "cve": "CVE-2026-95837",
            "percentile": 0.011,
            "score": 0.00106
          },
          "fixed_version": "",
          "id": "GO-2026-6791",
          "kev": null,
          "level": "module",
          "module": "github.com/containerd/containerd",
          "summary": "containerd CRI plugin: Checkpoint restore bypasses destination security context in github.com/containerd/containerd",
          "version": "v1.7.30"
        },
        {
          "aliases": [
            "CVE-2026-95838",
            "GHSA-rp3h-jf77-q9p4"
          ],
          "epss": {
            "cve": "CVE-2026-95838",
            "percentile": 0.1296,
            "score": 0.00223
          },
          "fixed_version": "v1.7.35",
          "id": "GO-2026-6796",
          "kev": null,
          "level": "module",
          "module": "github.com/containerd/containerd",
          "summary": "containerd: Unpack DoS via repeated opaque whiteouts in github.com/containerd/containerd",
          "version": "v1.7.30"
        }
      ],
      "go_version": "go1.26.1",
      "main_module": "golang.stackrox.io/kube-linter"
    },
    "id": "stackrox__kube-linter",
    "manifests": [
      ".github/workflows/auto-merge.yaml",
      ".github/workflows/build.yaml",
      ".github/workflows/release.yaml",
      "go.mod",
      "go.sum",
      "tool-imports/go.mod",
      "tool-imports/go.sum"
    ],
    "name": "kube-linter",
    "osv": {
      "advisories": 156,
      "available": true,
      "confirmed": 157,
      "osv_only": [
        {
          "ecosystem": "Go",
          "ids": [
            "CVE-2020-8912",
            "GHSA-7f33-f4f5-xwgw",
            "GO-2022-0635"
          ],
          "package": "github.com/aws/aws-sdk-go",
          "score": "",
          "severity": "Unknown",
          "version": "1.55.8"
        },
        {
          "ecosystem": "Go",
          "ids": [
            "CVE-2020-8911",
            "GHSA-f5pg-7wfw-84q9",
            "GO-2022-0646"
          ],
          "package": "github.com/aws/aws-sdk-go",
          "score": "",
          "severity": "Unknown",
          "version": "1.55.8"
        }
      ],
      "warning": null
    },
    "ref": "v0.8.3",
    "ref_kind": "release",
    "release_integrity": {
      "asset": "kube-linter-linux",
      "assets": 18,
      "build_provenance": null,
      "checksums_published": false,
      "digest_matches_github": true,
      "immutable_release": null,
      "methods": [
        {
          "covers": "asset",
          "detail": "signed with the project's own key; the public key is not checked",
          "method": "cosign",
          "status": "key-signature"
        }
      ],
      "provenance_published": false,
      "sbom_published": false,
      "signature": "key-unchecked",
      "signatures_published": true,
      "signer": null,
      "verdict": "signed"
    },
    "released_at": "2026-03-10T13:17:40Z",
    "repository": "stackrox/kube-linter",
    "sbomlyze_diff": {
      "added": 0,
      "changed": 0,
      "drift": {},
      "findings": [
        "0 version changes among 680 shared packages \u2014 no actual upgrades",
        "Core system packages stable: golang (662), github (14) unchanged"
      ],
      "removed": 0
    },
    "scanned_at": "2026-11-02T03:09:37+00:00",
    "scorecard": {
      "checks": [
        {
          "name": "CII-Best-Practices",
          "reason": "no effort to earn an OpenSSF best practices badge detected",
          "score": 0
        },
        {
          "name": "Fuzzing",
          "reason": "project is not fuzzed",
          "score": 0
        },
        {
          "name": "Token-Permissions",
          "reason": "detected GitHub workflow tokens with excessive permissions",
          "score": 0
        },
        {
          "name": "Pinned-Dependencies",
          "reason": "dependency not pinned by hash detected -- score normalized to 2",
          "score": 2
        },
        {
          "name": "Signed-Releases",
          "reason": "4 out of the last 4 releases have a total of 4 signed artifacts.",
          "score": 8
        },
        {
          "name": "Binary-Artifacts",
          "reason": "no binaries found in the repo",
          "score": 10
        },
        {
          "name": "Code-Review",
          "reason": "all changesets reviewed",
          "score": 10
        },
        {
          "name": "Dangerous-Workflow",
          "reason": "no dangerous workflow patterns detected",
          "score": 10
        },
        {
          "name": "License",
          "reason": "license file detected",
          "score": 10
        },
        {
          "name": "Maintained",
          "reason": "30 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10",
          "score": 10
        },
        {
          "name": "Packaging",
          "reason": "packaging workflow detected",
          "score": 10
        },
        {
          "name": "SAST",
          "reason": "SAST tool is run on all commits",
          "score": 10
        },
        {
          "name": "Security-Policy",
          "reason": "security policy file detected",
          "score": 10
        },
        {
          "name": "Branch-Protection",
          "reason": "internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md",
          "score": -1
        }
      ],
      "date": "2026-10-19",
      "score": 7.4,
      "source": "openssf-api",
      "version": "v5.6.0"
    },
    "vulnerabilities": [
      {
        "aliases": [
          "CVE-2026-53492",
          "GHSA-33vj-92qq-66hc"
        ],
        "ecosystem": "golang",
        "epss": {
          "cve": "CVE-2026-53492",
          "percentile": 0.28922,
          "score": 0.00353
        },
        "fix_state": "unknown",
        "fixed_in": [],
        "id": "GO-2026-5064",
        "in_binary": "module in binary",
        "kev": null,
        "location": "go.mod",
        "osv_confirmed": true,
        "package": "github.com/containerd/containerd",
        "severity": "Critical",
        "summary": "containerd CRI checkpoint restore CDI annotation smuggling in github.com/containerd/containerd",
        "url": "https://github.com/containerd/containerd/security/advisories/GHSA-33vj-92qq-66hc",
        "version": "v1.7.30"
      },
      {
        "aliases": [
          "CVE-2026-50195",
          "GHSA-cvxm-645q-p574"
        ],
        "ecosystem": "golang",
        "epss": {
          "cve": "CVE-2026-50195",
          "percentile": 0.23133,
          "score": 0.00303
        },
        "fix_state": "unknown",
        "fixed_in": [],
        "id": "GO-2026-5338",
        "in_binary": "module in binary",
        "kev": null,
        "location": "go.mod",
        "osv_confirmed": true,
        "package": "github.com/containerd/containerd",
        "severity": "Critical",
        "summary": "containerd: CRI checkpoint import allows local image tag poisoning in github.com/containerd/containerd",
        "url": "https://github.com/containerd/containerd/security/advisories/GHSA-cvxm-645q-p574",
        "version": "v1.7.30"
      },
      {
        "aliases": [
          "CVE-2026-42508"
        ],
        "ecosystem": "golang",
        "epss": {
          "cve": "CVE-2026-42508",
          "percentile": 0.94092,
          "score": 0.0691
        },
        "fix_state": "fixed",
        "fixed_in": [
          "0.52.0"
        ],
        "id": "GHSA-5cgq-3rg8-m6cv",
        "in_binary": "vulnerable code in binary",
        "kev": null,
        "location": "go.mod",
        "osv_confirmed": true,
        "package": "golang.org/x/crypto",
        "severity": "Critical",
        "summary": "golang.org/x/crypto vulnerable to auth bypass via unenforced @revoked status",
        "url": "https://github.com/advisories/GHSA-5cgq-3rg8-m6cv",
        "version": "v0.46.0"
      },
      {
        "aliases": [
          "CVE-2026-42508"
        ],
        "ecosystem": "golang",
        "epss": {
          "cve": "CVE-2026-42508",
          "percentile": 0.94092,
          "score": 0.0691
        },
        "fix_state": "fixed",
        "fixed_in": [
          "0.52.0"
        ],
        "id": "GHSA-5cgq-3rg8-m6cv",
        "in_binary": "vulnerable code in binary",
        "kev": null,
        "location": "tool-imports/go.mod",
        "osv_confirmed": true,
        "package": "golang.org/x/crypto",
        "severity": "Critical",
        "summary": "golang.org/x/crypto vulnerable to auth bypass via unenforced @revoked status",
        "url": "https://github.com/advisories/GHSA-5cgq-3rg8-m6cv",
        "version": "v0.48.0"
      },
      {
        "aliases": [
          "CVE-2026-39831"
        ],
        "ecosystem": "golang",
        "epss": {
          "cve": "CVE-2026-39831",
          "percentile": 0.41307,
          "score": 0.00478
        },
        "fix_state": "fixed",
        "fixed_in": [
          "0.52.0"
        ],
        "id": "GHSA-89gr-r52h-f8rx",
        "in_binary": "vulnerable code in binary",
        "kev": null,
        "location": "go.mod",
        "osv_confirmed": true,
        "package": "golang.org/x/crypto",
        "severity": "Critical",
        "summary": "golang.org/x/crypto: FIDO/U2F security key physical presence check can be bypassed",
        "url": "https://github.com/advisories/GHSA-89gr-r52h-f8rx",
        "version": "v0.46.0"
      },
      {
        "aliases": [
          "CVE-2026-39831"
        ],
        "ecosystem": "golang",
        "epss": {
          "cve": "CVE-2026-39831",
          "percentile": 0.41307,
          "score": 0.00478
        },
        "fix_state": "fixed",
        "fixed_in": [
          "0.52.0"
        ],
        "id": "GHSA-89gr-r52h-f8rx",
        "in_binary": "vulnerable code in binary",
        "kev": null,
        "location": "tool-imports/go.mod",
        "osv_confirmed": true,
        "package": "golang.org/x/crypto",
        "severity": "Critical",
        "summary": "golang.org/x/crypto: FIDO/U2F security key physical presence check can be bypassed",
        "url": "https://github.com/advisories/GHSA-89gr-r52h-f8rx",
        "version": "v0.48.0"
      },
      {
        "aliases": [
          "CVE-2026-39832"
        ],
        "ecosystem": "golang",
        "epss": {
          "cve": "CVE-2026-39832",
          "percentile": 0.52541,
          "score": 0.00683
        },
        "fix_state": "fixed",
        "fixed_in": [
          "0.52.0"
        ],
        "id": "GHSA-f5wc-c3c7-36mc",
        "in_binary": "vulnerable code in binary",
        "kev": null,
        "location": "go.mod",
        "osv_confirmed": true,
        "package": "golang.org/x/crypto",
        "severity": "Critical",
        "summary": "golang.org/x/crypto doesn't drop invoking agent constraints when forwarding keys",
        "url": "https://github.com/advisories/GHSA-f5wc-c3c7-36mc",
        "version": "v0.46.0"
      },
      {
        "aliases": [
          "CVE-2026-39832"
        ],
        "ecosystem": "golang",
        "epss": {
          "cve": "CVE-2026-39832",
          "percentile": 0.52541,
          "score": 0.00683
        },
        "fix_state": "fixed",
        "fixed_in": [
          "0.52.0"
        ],
        "id": "GHSA-f5wc-c3c7-36mc",
        "in_binary": "vulnerable code in binary",
        "kev": null,
        "location": "tool-imports/go.mod",
        "osv_confirmed": true,
        "package": "golang.org/x/crypto",
        "severity": "Critical",
        "summary": "golang.org/x/crypto doesn't drop invoking agent constraints when forwarding keys",
        "url": "https://github.com/advisories/GHSA-f5wc-c3c7-36mc",
        "version": "v0.48.0"
      },
      {
        "aliases": [
          "CVE-2026-39833"
        ],
        "ecosystem": "golang",
        "epss": {
          "cve": "CVE-2026-39833",
          "percentile": 0.40584,
          "score": 0.00469
        },
        "fix_state": "fixed",
        "fixed_in": [
          "0.52.0"
        ],
        "id": "GHSA-jppx-rxg9-jmrx",
        "in_binary": "vulnerable code in binary",
        "kev": null,
        "location": "go.mod",
        "osv_confirmed": true,
        "package": "golang.org/x/crypto",
        "severity": "Critical",
        "summary": "golang.org/x/crypto doesn't enforce invoking key constraints",
        "url": "https://github.com/advisories/GHSA-jppx-rxg9-jmrx",
        "version": "v0.46.0"
      },
      {
        "aliases": [
          "CVE-2026-39833"
        ],
        "ecosystem": "golang",
        "epss": {
          "cve": "CVE-2026-39833",
          "percentile": 0.40584,
          "score": 0.00469
        },
        "fix_state": "fixed",
        "fixed_in": [
          "0.52.0"
        ],
        "id": "GHSA-jppx-rxg9-jmrx",
        "in_binary": "vulnerable code in binary",
        "kev": null,
        "location": "tool-imports/go.mod",
        "osv_confirmed": true,
        "package": "golang.org/x/crypto",
        "severity": "Critical",
        "summary": "golang.org/x/crypto doesn't enforce invoking key constraints",
        "url": "https://github.com/advisories/GHSA-jppx-rxg9-jmrx",
        "version": "v0.48.0"
      },
      {
        "aliases": [
          "CVE-2026-39834"
        ],
        "ecosystem": "golang",
        "epss": {
          "cve": "CVE-2026-39834",
          "percentile": 0.48587,
          "score": 0.00597
        },
        "fix_state": "fixed",
        "fixed_in": [
          "0.52.0"
        ],
        "id": "GHSA-rm3j-f69w-wqmq",
        "in_binary": "vulnerable code in binary",
        "kev": null,
        "location": "go.mod",
        "osv_confirmed": true,
        "package": "golang.org/x/crypto",
        "severity": "Critical",
        "summary": "golang.org/x/crypto vulnerable to infinite loop on large channel writes",
        "url": "https://github.com/advisories/GHSA-rm3j-f69w-wqmq",
        "version": "v0.46.0"
      },
      {
        "aliases": [
          "CVE-2026-39834"
        ],
        "ecosystem": "golang",
        "epss": {
          "cve": "CVE-2026-39834",
          "percentile": 0.48587,
          "score": 0.00597
        },
        "fix_state": "fixed",
        "fixed_in": [
          "0.52.0"
        ],
        "id": "GHSA-rm3j-f69w-wqmq",
        "in_binary": "vulnerable code in binary",
        "kev": null,
        "location": "tool-imports/go.mod",
        "osv_confirmed": true,
        "package": "golang.org/x/crypto",
        "severity": "Critical",
        "summary": "golang.org/x/crypto vulnerable to infinite loop on large channel writes",
        "url": "https://github.com/advisories/GHSA-rm3j-f69w-wqmq",
        "version": "v0.48.0"
      },
      {
        "aliases": [
          "CVE-2026-39830"
        ],
        "ecosystem": "golang",
        "epss": {
          "cve": "CVE-2026-39830",
          "percentile": 0.52538,
          "score": 0.00683
        },
        "fix_state": "fixed",
        "fixed_in": [
          "0.52.0"
        ],
        "id": "GHSA-vgwf-h737-ff37",
        "in_binary": "vulnerable code in binary",
        "kev": null,
        "location": "go.mod",
        "osv_confirmed": true,
        "package": "golang.org/x/crypto",
        "severity": "Critical",
        "summary": "golang.org/x/crypto: Invoking client can cause server deadlock on unexpected responses",
        "url": "https://github.com/advisories/GHSA-vgwf-h737-ff37",
        "version": "v0.46.0"
      },
      {
        "aliases": [
          "CVE-2026-39830"
        ],
        "ecosystem": "golang",
        "epss": {
          "cve": "CVE-2026-39830",
          "percentile": 0.52538,
          "score": 0.00683
        },
        "fix_state": "fixed",
        "fixed_in": [
          "0.52.0"
        ],
        "id": "GHSA-vgwf-h737-ff37",
        "in_binary": "vulnerable code in binary",
        "kev": null,
        "location": "tool-imports/go.mod",
        "osv_confirmed": true,
        "package": "golang.org/x/crypto",
        "severity": "Critical",
        "summary": "golang.org/x/crypto: Invoking client can cause server deadlock on unexpected responses",
        "url": "https://github.com/advisories/GHSA-vgwf-h737-ff37",
        "version": "v0.48.0"
      },
      {
        "aliases": [
          "CVE-2026-46595"
        ],
        "ecosystem": "golang",
        "epss": {
          "cve": "CVE-2026-46595",
          "percentile": 0.4641,
          "score": 0.00556
        },
        "fix_state": "fixed",
        "fixed_in": [
          "0.52.0"
        ],
        "id": "GHSA-x527-x647-q7gg",
        "in_binary": "vulnerable code in binary",
        "kev": null,
        "location": "go.mod",
        "osv_confirmed": true,
        "package": "golang.org/x/crypto",
        "severity": "Critical",
        "summary": "golang.org/x/crypto: Invoking VerifiedPublicKeyCallback permissions skip enforcement",
        "url": "https://github.com/advisories/GHSA-x527-x647-q7gg",
        "version": "v0.46.0"
      },
      {
        "aliases": [
          "CVE-2026-46595"
        ],
        "ecosystem": "golang",
        "epss": {
          "cve": "CVE-2026-46595",
          "percentile": 0.4641,
          "score": 0.00556
        },
        "fix_state": "fixed",
        "fixed_in": [
          "0.52.0"
        ],
        "id": "GHSA-x527-x647-q7gg",
        "in_binary": "vulnerable code in binary",
        "kev": null,
        "location": "tool-imports/go.mod",
        "osv_confirmed": true,
        "package": "golang.org/x/crypto",
        "severity": "Critical",
        "summary": "golang.org/x/crypto: Invoking VerifiedPublicKeyCallback permissions skip enforcement",
        "url": "https://github.com/advisories/GHSA-x527-x647-q7gg",
        "version": "v0.48.0"
      },
      {
        "aliases": [
          "CVE-2026-78663"
        ],
        "ecosystem": "golang",
        "epss": {
          "cve": "CVE-2026-78663",
          "percentile": 0.49813,
          "score": 0.00622
        },
        "fix_state": "fixed",
        "fixed_in": [
          "0.60.0"
        ],
        "id": "GO-2026-6612",
        "in_binary": "vulnerable code in binary",
        "kev": null,
        "location": "go.mod",
        "osv_confirmed": true,
        "package": "golang.org/x/net",
        "severity": "Critical",
        "summary": "The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a request handler reads the buffered data. A malicious client can exploit this to bypass the configure",
        "url": "https://go.dev/cl/847187",
        "version": "v0.48.0"
      },
      {
        "aliases": [
          "CVE-2026-78663"
        ],
        "ecosystem": "golang",
        "epss": {
          "cve": "CVE-2026-78663",
          "percentile": 0.49813,
          "score": 0.00622
        },
        "fix_state": "fixed",
        "fixed_in": [
          "0.60.0"
        ],
        "id": "GO-2026-6612",
        "in_binary": "vulnerable code in binary",
        "kev": null,
        "location": "tool-imports/go.mod",
        "osv_confirmed": true,
        "package": "golang.org/x/net",
        "severity": "Critical",
        "summary": "The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a request handler reads the buffered data. A malicious client can exploit this to bypass the configure",
        "url": "https://go.dev/cl/847187",
        "version": "v0.50.0"
      },
      {
        "aliases": [
          "CVE-2026-33186"
        ],
        "ecosystem": "golang",
        "epss": {
          "cve": "CVE-2026-33186",
          "percentile": 0.75569,
          "score": 0.01584
        },
        "fix_state": "fixed",
        "fixed_in": [
          "1.79.3"
        ],
        "id": "GHSA-p77j-4mvh-x3m3",
        "in_binary": "vulnerable code in binary",
        "kev": null,
        "location": "go.mod",
        "osv_confirmed": true,
        "package": "google.golang.org/grpc",
        "severity": "Critical",
        "summary": "gRPC-Go has an authorization bypass via missing leading slash in :path",
        "url": "https://github.com/advisories/GHSA-p77j-4mvh-x3m3",
        "version": "v1.75.1"
      },
      {
        "aliases": [
          "CVE-2026-33186"
        ],
        "ecosystem": "golang",
        "epss": {
          "cve": "CVE-2026-33186",
          "percentile": 0.75569,
          "score": 0.01584
        },
        "fix_state": "fixed",
        "fixed_in": [
          "1.79.3"
        ],
        "id": "GHSA-p77j-4mvh-x3m3",
        "in_binary": "vulnerable code in binary",
        "kev": null,
        "location": "tool-imports/go.mod",
        "osv_confirmed": true,
        "package": "google.golang.org/grpc",
        "severity": "Critical",
        "summary": "gRPC-Go has an authorization bypass via missing leading slash in :path",
        "url": "https://github.com/advisories/GHSA-p77j-4mvh-x3m3",
        "version": "v1.78.0"
      },
      {
        "aliases": [
          "CVE-2026-32285"
        ],
        "ecosystem": "golang",
        "epss": {
          "cve": "CVE-2026-32285",
          "percentile": 0.55918,
          "score": 0.00779
        },
        "fix_state": "fixed",
        "fixed_in": [
          "1.1.2"
        ],
        "id": "GHSA-6g7g-w4f8-9c9x",
        "in_binary": "not in released binary",
        "kev": null,
        "location": "tool-imports/go.mod",
        "osv_confirmed": true,
        "package": "github.com/buger/jsonparser",
        "severity": "High",
        "summary": "github.com/buger/jsonparser has a denial of service vulnerability",
        "url": "https://github.com/advisories/GHSA-6g7g-w4f8-9c9x",
        "version": "v1.1.1"
      },
      {
        "aliases": [
          "CVE-2026-62290"
        ],
        "ecosystem": "golang",
        "epss": {
          "cve": "CVE-2026-62290",
          "percentile": 0.01349,
          "score": 0.00112
        },
        "fix_state": "fixed",
        "fixed_in": [
          "1.19.6"
        ],
        "id": "GHSA-8rvj-mm4h-c258",
        "in_binary": "not in released binary",
        "kev": null,
        "location": "go.mod",
        "osv_confirmed": true,
        "package": "github.com/cert-manager/cert-manager",
        "severity": "High",
        "summary": "cert-manager: Direct ACME Challenge resources can bypass Issuer DNS01 solver policy and use ClusterIssuer DNS credentials",
        "url": "https://github.com/advisories/GHSA-8rvj-mm4h-c258",
        "version": "v1.19.4"
      },
      {
        "aliases": [
          "CVE-2026-46680"
        ],
        "ecosystem": "golang",
        "epss": {
          "cve": "CVE-2026-46680",
          "percentile": 0.05463,
          "score": 0.00163
        },
        "fix_state": "fixed",
        "fixed_in": [
          "1.7.32"
        ],
        "id": "GHSA-fqw6-gf59-qr4w",
        "in_binary": "module in binary",
        "kev": null,
        "location": "go.mod",
        "osv_confirmed": true,
        "package": "github.com/containerd/containerd",
        "severity": "High",
        "summary": "containerd user ID handling bypass allows runAsNonRoot evasion",
        "url": "https://github.com/advisories/GHSA-fqw6-gf59-qr4w",
        "version": "v1.7.30"
      },
      {
        "aliases": [
          "CVE-2026-53488"
        ],
        "ecosystem": "golang",
        "epss": {
          "cve": "CVE-2026-53488",
          "percentile": 0.07132,
          "score": 0.00176
        },
        "fix_state": "fixed",
        "fixed_in": [
          "1.7.33"
        ],
        "id": "GHSA-xhf5-7wjv-pqxp",
        "in_binary": "module in binary",
        "kev": null,
        "location": "go.mod",
        "osv_confirmed": true,
        "package": "github.com/containerd/containerd",
        "severity": "High",
        "summary": "containerd CRI \u2014 image-config `LABEL` flows to restart-monitor `binary://` logger: host-root command execution from an image pull",
        "url": "https://github.com/advisories/GHSA-xhf5-7wjv-pqxp",
        "version": "v1.7.30"
      },
      {
        "aliases": [
          "CVE-2026-95837",
          "GHSA-p7v4-vr35-mj6f"
        ],
        "ecosystem": "golang",
        "epss": {
          "cve": "CVE-2026-95837",
          "percentile": 0.011,
          "score": 0.00106
        },
        "fix_state": "unknown",
        "fixed_in": [],
        "id": "GO-2026-6791",
        "in_binary": "module in binary",
        "kev": null,
        "location": "go.mod",
        "osv_confirmed": true,
        "package": "github.com/containerd/containerd",
        "severity": "High",
        "summary": "containerd CRI plugin: Checkpoint restore bypasses destination security context in github.com/containerd/containerd",
        "url": "https://github.com/containerd/containerd/security/advisories/GHSA-p7v4-vr35-mj6f",
        "version": "v1.7.30"
      },
      {
        "aliases": [
          "CVE-2026-42306"
        ],
        "ecosystem": "golang",
        "epss": {
          "cve": "CVE-2026-42306",
          "percentile": 0.01018,
          "score": 0.00104
        },
        "fix_state": "not-fixed",
        "fixed_in": [],
        "id": "GHSA-rg2x-37c3-w2rh",
        "in_binary": "not in released binary",
        "kev": null,
        "location": "tool-imports/go.mod",
        "osv_confirmed": true,
        "package": "github.com/docker/docker",
        "severity": "High",
        "summary": "Docker: Race condition in docker cp allows bind mount redirection to host path",
        "url": "https://github.com/advisories/GHSA-rg2x-37c3-w2rh",
        "version": "v28.5.2+incompatible"
      },
      {
        "aliases": [
          "CVE-2026-41567"
        ],
        "ecosystem": "golang",
        "epss": {
          "cve": "CVE-2026-41567",
          "percentile": 0.04603,
          "score": 0.00155
        },
        "fix_state": "not-fixed",
        "fixed_in": [],
        "id": "GHSA-x86f-5xw2-fm2r",
        "in_binary": "not in released binary",
        "kev": null,
        "location": "tool-imports/go.mod",
        "osv_confirmed": true,
        "package": "github.com/docker/docker",
        "severity": "High",
        "summary": "Docker: `PUT /containers/{id}/archive` executes container binary on the host",
        "url": "https://github.com/advisories/GHSA-x86f-5xw2-fm2r",
        "version": "v28.5.2+incompatible"
      },
      {
        "aliases": [
          "CVE-2026-34040",
          "GHSA-x744-4wpc-v9h2"
        ],
        "ecosystem": "golang",
        "epss": {
          "cve": "CVE-2026-34040",
          "percentile": 0.95361,
          "score": 0.0927
        },
        "fix_state": "unknown",
        "fixed_in": [],
        "id": "GO-2026-4887",
        "in_binary": "not in released binary",
        "kev": null,
        "location": "tool-imports/go.mod",
        "osv_confirmed": true,
        "package": "github.com/docker/docker",
        "severity": "High",
        "summary": "Moby has AuthZ plugin bypass when provided oversized request bodies in github.com/docker/docker",
        "url": "https://github.com/moby/moby/security/advisories/GHSA-x744-4wpc-v9h2",
        "version": "v28.5.2+incompatible"
      },
      {
        "aliases": [
          "CVE-2026-44973"
        ],
        "ecosystem": "golang",
        "epss": {
          "cve": "CVE-2026-44973",
          "percentile": 0.23927,
          "score": 0.0031
        },
        "fix_state": "fixed",
        "fixed_in": [
          "5.9.0"
        ],
        "id": "GHSA-qw64-3x98-g7q2",
        "in_binary": "not in released binary",
        "kev": null,
        "location": "tool-imports/go.mod",
        "osv_confirmed": true,
        "package": "github.com/go-git/go-billy/v5",
        "severity": "High",
        "summary": "go-billy has path traversal vulnerabilities",
        "url": "https://github.com/advisories/GHSA-qw64-3x98-g7q2",
        "version": "v5.6.2"
      },
      {
        "aliases": [
          "CVE-2026-45022"
        ],
        "ecosystem": "golang",
        "epss": {
          "cve": "CVE-2026-45022",
          "percentile": 0.05077,
          "score": 0.00159
        },
        "fix_state": "fixed",
        "fixed_in": [
          "5.19.0"
        ],
        "id": "GHSA-389r-gv7p-r3rp",
        "in_binary": "not in released binary",
        "kev": null,
        "location": "tool-imports/go.mod",
        "osv_confirmed": true,
        "package": "github.com/go-git/go-git/v5",
        "severity": "High",
        "summary": "go-git's improper parsing of specially crafted objects may lead to inconsistent interpretation compared to upstream Git",
        "url": "https://github.com/advisories/GHSA-389r-gv7p-r3rp",
        "version": "v5.16.5"
      },
      {
        "aliases": [
          "CVE-2026-71556"
        ],
        "ecosystem": "golang",
        "epss": {
          "cve": "CVE-2026-71556",
          "percentile": 0.29467,
          "score": 0.00357
        },
        "fix_state": "fixed",
        "fixed_in": [
          "5.19.2"
        ],
        "id": "GHSA-hc8v-wwc9-vgxm",
        "in_binary": "not in released binary",
        "kev": null,
        "location": "tool-imports/go.mod",
        "osv_confirmed": true,
        "package": "github.com/go-git/go-git/v5",
        "severity": "High",
        "summary": "go-git: Worktree operations may follow symlinks",
        "url": "https://github.com/advisories/GHSA-hc8v-wwc9-vgxm",
        "version": "v5.16.5"
      },
      {
        "aliases": [
          "CVE-2026-34986"
        ],
        "ecosystem": "golang",
        "epss": {
          "cve": "CVE-2026-34986",
          "percentile": 0.51213,
          "score": 0.00651
        },
        "fix_state": "fixed",
        "fixed_in": [
          "4.1.4"
        ],
        "id": "GHSA-78h2-9frx-2jm8",
        "in_binary": "not in released binary",
        "kev": null,
        "location": "tool-imports/go.mod",
        "osv_confirmed": true,
        "package": "github.com/go-jose/go-jose/v4",
        "severity": "High",
        "summary": "Go JOSE Panics in JWE decryption",
        "url": "https://github.com/advisories/GHSA-78h2-9frx-2jm8",
        "version": "v4.1.3"
      },
      {
        "aliases": [
          "CVE-2026-116587"
        ],
        "ecosystem": "golang",
        "epss": {
          "cve": "CVE-2026-116587",
          "percentile": 0.3048,
          "score": 0.00366
        },
        "fix_state": "fixed",
        "fixed_in": [
          "4.1.6"
        ],
        "id": "GHSA-mgcc-cww5-fp2q",
        "in_binary": "not in released binary",
        "kev": null,
        "location": "tool-imports/go.mod",
        "osv_confirmed": true,
        "package": "github.com/go-jose/go-jose/v4",
        "severity": "High",
        "summary": "Go JOSE: DoS when parsing JWKs that contain RSA keys",
        "url": "https://github.com/advisories/GHSA-mgcc-cww5-fp2q",
        "version": "v4.1.3"
      },
      {
        "aliases": [
          "CVE-2026-63209"
        ],
        "ecosystem": "golang",
        "epss": {
          "cve": "CVE-2026-63209",
          "percentile": 0.47329,
          "score": 0.00572
        },
        "fix_state": "fixed",
        "fixed_in": [
          "1.18.7"
        ],
        "id": "GHSA-259r-337f-4rfw",
        "in_binary": "vulnerable code in binary",
        "kev": null,
        "location": "go.mod",
        "osv_confirmed": true,
        "package": "github.com/klauspost/compress",
        "severity": "High",
        "summary": "Compress/s2: Integer Overflow or Wraparound and Out-of-bounds Write in compress",
        "url": "https://github.com/advisories/GHSA-259r-337f-4rfw",
        "version": "v1.18.0"
      },
      {
        "aliases": [
          "CVE-2026-63209"
        ],
        "ecosystem": "golang",
        "epss": {
          "cve": "CVE-2026-63209",
          "percentile": 0.47329,
          "score": 0.00572
        },
        "fix_state": "fixed",
        "fixed_in": [
          "1.18.7"
        ],
        "id": "GHSA-259r-337f-4rfw",
        "in_binary": "vulnerable code in binary",
        "kev": null,
        "location": "tool-imports/go.mod",
        "osv_confirmed": true,
        "package": "github.com/klauspost/compress",
        "severity": "High",
        "summary": "Compress/s2: Integer Overflow or Wraparound and Out-of-bounds Write in compress",
        "url": "https://github.com/advisories/GHSA-259r-337f-4rfw",
        "version": "v1.18.2"
      },
      {
        "aliases": [
          "CVE-2026-48702"
        ],
        "ecosystem": "golang",
        "epss": {
          "cve": "CVE-2026-48702",
          "percentile": 0.39891,
          "score": 0.0046
        },
        "fix_state": "fixed",
        "fixed_in": [
          "1.5.2"
        ],
        "id": "GHSA-47q9-m4ww-924m",
        "in_binary": "not in released binary",
        "kev": null,
        "location": "tool-imports/go.mod",
        "osv_confirmed": true,
        "package": "github.com/sigstore/rekor",
        "severity": "High",
        "summary": "Rekor has an OOM Condition due to Unbounded gzip Decompression in Alpine APK Parsing Logic",
        "url": "https://github.com/advisories/GHSA-47q9-m4ww-924m",
        "version": "v1.5.0"
      },
      {
        "aliases": [
          "CVE-2026-29181"
        ],
        "ecosystem": "golang",
        "epss": {
          "cve": "CVE-2026-29181",
          "percentile": 0.5628,
          "score": 0.0079
        },
        "fix_state": "fixed",
        "fixed_in": [
          "1.41.0"
        ],
        "id": "GHSA-mh2q-q3fh-2475",
        "in_binary": "not in released binary",
        "kev": null,
        "location": "tool-imports/go.mod",
        "osv_confirmed": true,
        "package": "go.opentelemetry.io/otel",
        "severity": "High",
        "summary": "OpenTelemetry-Go: multi-value `baggage` header extraction causes excessive allocations (remote dos amplification)",
        "url": "https://github.com/advisories/GHSA-mh2q-q3fh-2475",
        "version": "v1.40.0"
      },
      {
        "aliases": [
          "CVE-2026-39883"
        ],
        "ecosystem": "golang",
        "epss": {
          "cve": "CVE-2026-39883",
          "percentile": 0.16781,
          "score": 0.00252
        },
        "fix_state": "fixed",
        "fixed_in": [
          "1.43.0"
        ],
        "id": "GHSA-hfvc-g4fc-pqhx",
        "in_binary": "not in released binary",
        "kev": null,
        "location": "tool-imports/go.mod",
        "osv_confirmed": true,
        "package": "go.opentelemetry.io/otel/sdk",
        "severity": "High",
        "summary": "opentelemetry-go: BSD kenv command not using absolute path enables PATH hijacking",
        "url": "https://github.com/advisories/GHSA-hfvc-g4fc-pqhx",
        "version": "v1.40.0"
      },
      {
        "aliases": [
          "CVE-2026-46597"
        ],
        "ecosystem": "golang",
        "epss": {
          "cve": "CVE-2026-46597",
          "percentile": 0.40897,
          "score": 0.00473
        },
        "fix_state": "fixed",
        "fixed_in": [
          "0.52.0"
        ],
        "id": "GHSA-q4h4-gmj2-qvw2",
        "in_binary": "vulnerable code in binary",
        "kev": null,
        "location": "go.mod",
        "osv_confirmed": true,
        "package": "golang.org/x/crypto",
        "severity": "High",
        "summary": "golang.org/x/crypto: Invoking byte arithmetic causes underflow and panic",
        "url": "https://github.com/advisories/GHSA-q4h4-gmj2-qvw2",
        "version": "v0.46.0"
      },
      {
        "aliases": [
          "CVE-2026-46597"
        ],
        "ecosystem": "golang",
        "epss": {
          "cve": "CVE-2026-46597",
          "percentile": 0.40897,
          "score": 0.00473
        },
        "fix_state": "fixed",
        "fixed_in": [
          "0.52.0"
        ],
        "id": "GHSA-q4h4-gmj2-qvw2",
        "in_binary": "vulnerable code in binary",
        "kev": null,
        "location": "tool-imports/go.mod",
        "osv_confirmed": true,
        "package": "golang.org/x/crypto",
        "severity": "High",
        "summary": "golang.org/x/crypto: Invoking byte arithmetic causes underflow and panic",
        "url": "https://github.com/advisories/GHSA-q4h4-gmj2-qvw2",
        "version": "v0.48.0"
      },
      {
        "aliases": [
          "CVE-2026-39829"
        ],
        "ecosystem": "golang",
        "epss": {
          "cve": "CVE-2026-39829",
          "percentile": 0.40433,
          "score": 0.00467
        },
        "fix_state": "fixed",
        "fixed_in": [
          "0.52.0"
        ],
        "id": "GHSA-w879-237q-wc7r",
        "in_binary": "vulnerable code in binary",
        "kev": null,
        "location": "go.mod",
        "osv_confirmed": true,
        "package": "golang.org/x/crypto",
        "severity": "High",
        "summary": "golang.org/x/crypto: Invoking pathological RSA/DSA parameters may cause DoS",
        "url": "https://github.com/advisories/GHSA-w879-237q-wc7r",
        "version": "v0.46.0"
      },
      {
        "aliases": [
          "CVE-2026-39829"
        ],
        "ecosystem": "golang",
        "epss": {
          "cve": "CVE-2026-39829",
          "percentile": 0.40433,
          "score": 0.00467
        },
        "fix_state": "fixed",
        "fixed_in": [
          "0.52.0"
        ],
        "id": "GHSA-w879-237q-wc7r",
        "in_binary": "vulnerable code in binary",
        "kev": null,
        "location": "tool-imports/go.mod",
        "osv_confirmed": true,
        "package": "golang.org/x/crypto",
        "severity": "High",
        "summary": "golang.org/x/crypto: Invoking pathological RSA/DSA parameters may cause DoS",
        "url": "https://github.com/advisories/GHSA-w879-237q-wc7r",
        "version": "v0.48.0"
      },
      {
        "aliases": [
          "CVE-2026-56854"
        ],
        "ecosystem": "golang",
        "epss": {
          "cve": "CVE-2026-56854",
          "percentile": 0.38024,
          "score": 0.00437
        },
        "fix_state": "fixed",
        "fixed_in": [
          "0.55.0"
        ],
        "id": "GO-2026-6303",
        "in_binary": "vulnerable code in binary",
        "kev": null,
        "location": "go.mod",
        "osv_confirmed": true,
        "package": "golang.org/x/crypto",
        "severity": "High",
        "summary": "The source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths, extending the fix for CVE-2026-46595. Permissions returned by the PasswordCallback, KeyboardInteractiveCallback, NoClientAuthC",
        "url": "https://go.dev/issue/80213",
        "version": "v0.46.0"
      },
      {
        "aliases": [
          "CVE-2026-56854"
        ],
        "ecosystem": "golang",
        "epss": {
          "cve": "CVE-2026-56854",
          "percentile": 0.38024,
          "score": 0.00437
        },
        "fix_state": "fixed",
        "fixed_in": [
          "0.55.0"
        ],
        "id": "GO-2026-6303",
        "in_binary": "vulnerable code in binary",
        "kev": null,
        "location": "tool-imports/go.mod",
        "osv_confirmed": true,
        "package": "golang.org/x/crypto",
        "severity": "High",
        "summary": "The source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths, extending the fix for CVE-2026-46595. Permissions returned by the PasswordCallback, KeyboardInteractiveCallback, NoClientAuthC",
        "url": "https://go.dev/issue/80213",
        "version": "v0.48.0"
      },
      {
        "aliases": [
          "CVE-2026-78662"
        ],
        "ecosystem": "golang",
        "epss": {
          "cve": "CVE-2026-78662",
          "percentile": 0.37388,
          "score": 0.00431
        },
        "fix_state": "fixed",
        "fixed_in": [
          "0.56.0"
        ],
        "id": "GO-2026-6354",
        "in_binary": "vulnerable code in binary",
        "kev": null,
        "location": "go.mod",
        "osv_confirmed": true,
        "package": "golang.org/x/crypto",
        "severity": "High",
        "summary": "Previously, a channel registered in the mux's chanList is not usable until it is established. A malicious peer was able flood the channel's incomingRequests, deadlocking the entire connection. Now, we add an atomic established state, set when a channel becomes usable. Until such a time, handlePacket",
        "url": "https://go.dev/issue/81316",
        "version": "v0.46.0"
      },
      {
        "aliases": [
          "CVE-2026-78662"
        ],
        "ecosystem": "golang",
        "epss": {
          "cve": "CVE-2026-78662",
          "percentile": 0.37388,
          "score": 0.00431
        },
        "fix_state": "fixed",
        "fixed_in": [
          "0.56.0"
        ],
        "id": "GO-2026-6354",
        "in_binary": "vulnerable code in binary",
        "kev": null,
        "location": "tool-imports/go.mod",
        "osv_confirmed": true,
        "package": "golang.org/x/crypto",
        "severity": "High",
        "summary": "Previously, a channel registered in the mux's chanList is not usable until it is established. A malicious peer was able flood the channel's incomingRequests, deadlocking the entire connection. Now, we add an atomic established state, set when a channel becomes usable. Until such a time, handlePacket",
        "url": "https://go.dev/issue/81316",
        "version": "v0.48.0"
      },
      {
        "aliases": [
          "CVE-2026-56855"
        ],
        "ecosystem": "golang",
        "epss": {
          "cve": "CVE-2026-56855",
          "percentile": 0.42867,
          "score": 0.005
        },
        "fix_state": "fixed",
        "fixed_in": [
          "0.56.0"
        ],
        "id": "GO-2026-6355",
        "in_binary": "vulnerable code in binary",
        "kev": null,
        "location": "go.mod",
        "osv_confirmed": true,
        "package": "golang.org/x/crypto",
        "severity": "High",
        "summary": "Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection. Now, we handle all RFC 4254 channel messages; global requests are handled explicitly. Then, treat all other messages as a protocol error and tear the connection d",
        "url": "https://go.dev/issue/81317",
        "version": "v0.46.0"
      },
      {
        "aliases": [
          "CVE-2026-56855"
        ],
        "ecosystem": "golang",
        "epss": {
          "cve": "CVE-2026-56855",
          "percentile": 0.42867,
          "score": 0.005
        },
        "fix_state": "fixed",
        "fixed_in": [
          "0.56.0"
        ],
        "id": "GO-2026-6355",
        "in_binary": "vulnerable code in binary",
        "kev": null,
        "location": "tool-imports/go.mod",
        "osv_confirmed": true,
        "package": "golang.org/x/crypto",
        "severity": "High",
        "summary": "Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection. Now, we handle all RFC 4254 channel messages; global requests are handled explicitly. Then, treat all other messages as a protocol error and tear the connection d",
        "url": "https://go.dev/issue/81317",
        "version": "v0.48.0"
      },
      {
        "aliases": [
          "CVE-2026-56865"
        ],
        "ecosystem": "golang",
        "epss": {
          "cve": "CVE-2026-56865",
          "percentile": 0.02533,
          "score": 0.00129
        },
        "fix_state": "fixed",
        "fixed_in": [
          "0.40.0"
        ],
        "id": "GO-2026-6179",
        "in_binary": "not in released binary",
        "kev": null,
        "location": "tool-imports/go.mod",
        "osv_confirmed": true,
        "package": "golang.org/x/mod",
        "severity": "High",
        "summary": "A malicious GOPROXY was previously capable of forging up to two sumdb tiles that allow for a requested module to bypass the GOSUMDB check and persist attacker-controlled module content to a local Go module cache. This attack allows for a malicious GOPROXY to serve malicious module content that canno",
        "url": "https://go.dev/issue/80744",
        "version": "v0.33.0"
      },
      {
        "aliases": [
          "CVE-2026-56864"
        ],
        "ecosystem": "golang",
        "epss": {
          "cve": "CVE-2026-56864",
          "percentile": 0.22506,
          "score": 0.00298
        },
        "fix_state": "fixed",
        "fixed_in": [
          "0.40.0"
        ],
        "id": "GO-2026-6180",
        "in_binary": "not in released binary",
        "kev": null,
        "location": "tool-imports/go.mod",
        "osv_confirmed": true,
        "package": "golang.org/x/mod",
        "severity": "High",
        "summary": "A malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log. This attack allows for a coordinating GOPROXY and GOSUMDB to serve a client malicious module content that cannot be detected by evaluating the transparency log. In order to determine if you",
        "url": "https://go.dev/issue/80745",
        "version": "v0.33.0"
      },
      {
        "aliases": [
          "CVE-2026-27141"
        ],
        "ecosystem": "golang",
        "epss": {
          "cve": "CVE-2026-27141",
          "percentile": 0.4714,
          "score": 0.00569
        },
        "fix_state": "fixed",
        "fixed_in": [
          "0.51.0"
        ],
        "id": "GO-2026-4559",
        "in_binary": "vulnerable code not in binary",
        "kev": null,
        "location": "tool-imports/go.mod",
        "osv_confirmed": true,
        "package": "golang.org/x/net",
        "severity": "High",
        "summary": "Due to missing nil check, sending 0x0a-0x0f HTTP/2 frames will cause a running server to panic",
        "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-27141",
        "version": "v0.50.0"
      },
      {
        "aliases": [
          "CVE-2026-33814"
        ],
        "ecosystem": "golang",
        "epss": {
          "cve": "CVE-2026-33814",
          "percentile": 0.57885,
          "score": 0.0084
        },
        "fix_state": "fixed",
        "fixed_in": [
          "0.53.0"
        ],
        "id": "GO-2026-4918",
        "in_binary": "vulnerable code in binary",
        "kev": null,
        "location": "go.mod",
        "osv_confirmed": true,
        "package": "golang.org/x/net",
        "severity": "High",
        "summary": "When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGS_MAX_FRAME_SIZE with a value of 0.",
        "url": "https://go.dev/cl/761581",
        "version": "v0.48.0"
      },
      {
        "aliases": [
          "CVE-2026-33814"
        ],
        "ecosystem": "golang",
        "epss": {
          "cve": "CVE-2026-33814",
          "percentile": 0.57885,
          "score": 0.0084
        },
        "fix_state": "fixed",
        "fixed_in": [
          "0.53.0"
        ],
        "id": "GO-2026-4918",
        "in_binary": "vulnerable code in binary",
        "kev": null,
        "location": "tool-imports/go.mod",
        "osv_confirmed": true,
        "package": "golang.org/x/net",
        "severity": "High",
        "summary": "When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGS_MAX_FRAME_SIZE with a value of 0.",
        "url": "https://go.dev/cl/761581",
        "version": "v0.50.0"
      },
      {
        "aliases": [
          "CVE-2026-39821"
        ],
        "ecosystem": "golang",
        "epss": {
          "cve": "CVE-2026-39821",
          "percentile": 0.78915,
          "score": 0.01834
        },
        "fix_state": "fixed",
        "fixed_in": [
          "0.55.0"
        ],
        "id": "GO-2026-5026",
        "in_binary": "vulnerable code in binary",
        "kev": null,
        "location": "go.mod",
        "osv_confirmed": true,
        "package": "golang.org/x/net",
        "severity": "High",
        "summary": "The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode(\"xn--example-.com\") incorrectly returns the name \"example.com\" rather than an error. This behavior can lead to privilege escalation in programs using the idna pac",
        "url": "https://go.dev/cl/767220",
        "version": "v0.48.0"
      },
      {
        "aliases": [
          "CVE-2026-39821"
        ],
        "ecosystem": "golang",
        "epss": {
          "cve": "CVE-2026-39821",
          "percentile": 0.78915,
          "score": 0.01834
        },
        "fix_state": "fixed",
        "fixed_in": [
          "0.55.0"
        ],
        "id": "GO-2026-5026",
        "in_binary": "vulnerable code in binary",
        "kev": null,
        "location": "tool-imports/go.mod",
        "osv_confirmed": true,
        "package": "golang.org/x/net",
        "severity": "High",
        "summary": "The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode(\"xn--example-.com\") incorrectly returns the name \"example.com\" rather than an error. This behavior can lead to privilege escalation in programs using the idna pac",
        "url": "https://go.dev/cl/767220",
        "version": "v0.50.0"
      },
      {
        "aliases": [
          "CVE-2026-46600"
        ],
        "ecosystem": "golang",
        "epss": {
          "cve": "CVE-2026-46600",
          "percentile": 0.45991,
          "score": 0.00549
        },
        "fix_state": "fixed",
        "fixed_in": [
          "0.56.0"
        ],
        "id": "GO-2026-5942",
        "in_binary": "vulnerable code in binary",
        "kev": null,
        "location": "go.mod",
        "osv_confirmed": true,
        "package": "golang.org/x/net",
        "severity": "High",
        "summary": "Parsing an invalid SVCB or HTTPS RR can panic when the size of a parameter value overflows the message buffer.",
        "url": "https://go.dev/cl/786345",
        "version": "v0.48.0"
      },
      {
        "aliases": [
          "CVE-2026-46600"
        ],
        "ecosystem": "golang",
        "epss": {
          "cve": "CVE-2026-46600",
          "percentile": 0.45991,
          "score": 0.00549
        },
        "fix_state": "fixed",
        "fixed_in": [
          "0.56.0"
        ],
        "id": "GO-2026-5942",
        "in_binary": "vulnerable code in binary",
        "kev": null,
        "location": "tool-imports/go.mod",
        "osv_confirmed": true,
        "package": "golang.org/x/net",
        "severity": "High",
        "summary": "Parsing an invalid SVCB or HTTPS RR can panic when the size of a parameter value overflows the message buffer.",
        "url": "https://go.dev/cl/786345",
        "version": "v0.50.0"
      },
      {
        "aliases": [
          "CVE-2026-78659"
        ],
        "ecosystem": "golang",
        "epss": {
          "cve": "CVE-2026-78659",
          "percentile": 0.50082,
          "score": 0.00627
        },
        "fix_state": "fixed",
        "fixed_in": [
          "0.60.0"
        ],
        "id": "GO-2026-6603",
        "in_binary": "vulnerable code in binary",
        "kev": null,
        "location": "go.mod",
        "osv_confirmed": true,
        "package": "golang.org/x/net",
        "severity": "High",
        "summary": "When \"Trailer\" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs memory overhead. For HTTP/2 servers, a malicious client can exploit this by sending a \"",
        "url": "https://go.dev/cl/847185",
        "version": "v0.48.0"
      },
      {
        "aliases": [
          "CVE-2026-78659"
        ],
        "ecosystem": "golang",
        "epss": {
          "cve": "CVE-2026-78659",
          "percentile": 0.50082,
          "score": 0.00627
        },
        "fix_state": "fixed",
        "fixed_in": [
          "0.60.0"
        ],
        "id": "GO-2026-6603",
        "in_binary": "vulnerable code in binary",
        "kev": null,
        "location": "tool-imports/go.mod",
        "osv_confirmed": true,
        "package": "golang.org/x/net",
        "severity": "High",
        "summary": "When \"Trailer\" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs memory overhead. For HTTP/2 servers, a malicious client can exploit this by sending a \"",
        "url": "https://go.dev/cl/847185",
        "version": "v0.50.0"
      },
      {
        "aliases": [
          "CVE-2026-78660"
        ],
        "ecosystem": "golang",
        "epss": {
          "cve": "CVE-2026-78660",
          "percentile": 0.36838,
          "score": 0.00425
        },
        "fix_state": "fixed",
        "fixed_in": [
          "0.60.0"
        ],
        "id": "GO-2026-6610",
        "in_binary": "vulnerable code in binary",
        "kev": null,
        "location": "go.mod",
        "osv_confirmed": true,
        "package": "golang.org/x/net",
        "severity": "High",
        "summary": "Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing. However, this makes it possible for our HTTP/2 implementation to forward responses containing such headers to an HTTP/1 client when acting as a re",
        "url": "https://go.dev/cl/835145",
        "version": "v0.48.0"
      },
      {
        "aliases": [
          "CVE-2026-78660"
        ],
        "ecosystem": "golang",
        "epss": {
          "cve": "CVE-2026-78660",
          "percentile": 0.36838,
          "score": 0.00425
        },
        "fix_state": "fixed",
        "fixed_in": [
          "0.60.0"
        ],
        "id": "GO-2026-6610",
        "in_binary": "vulnerable code in binary",
        "kev": null,
        "location": "tool-imports/go.mod",
        "osv_confirmed": true,
        "package": "golang.org/x/net",
        "severity": "High",
        "summary": "Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing. However, this makes it possible for our HTTP/2 implementation to forward responses containing such headers to an HTTP/1 client when acting as a re",
        "url": "https://go.dev/cl/835145",
        "version": "v0.50.0"
      },
      {
        "aliases": [
          "CVE-2026-78669"
        ],
        "ecosystem": "golang",
        "epss": {
          "cve": "CVE-2026-78669",
          "percentile": 0.49426,
          "score": 0.00614
        },
        "fix_state": "fixed",
        "fixed_in": [
          "0.60.0"
        ],
        "id": "GO-2026-6611",
        "in_binary": "vulnerable code in binary",
        "kev": null,
        "location": "go.mod",
        "osv_confirmed": true,
        "package": "golang.org/x/net",
        "severity": "High",
        "summary": "A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGS_INITIAL_WINDOW_SIZE values.",
        "url": "https://go.dev/cl/847186",
        "version": "v0.48.0"
      },
      {
        "aliases": [
          "CVE-2026-78669"
        ],
        "ecosystem": "golang",
        "epss": {
          "cve": "CVE-2026-78669",
          "percentile": 0.49426,
          "score": 0.00614
        },
        "fix_state": "fixed",
        "fixed_in": [
          "0.60.0"
        ],
        "id": "GO-2026-6611",
        "in_binary": "vulnerable code in binary",
        "kev": null,
        "location": "tool-imports/go.mod",
        "osv_confirmed": true,
        "package": "golang.org/x/net",
        "severity": "High",
        "summary": "A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGS_INITIAL_WINDOW_SIZE values.",
        "url": "https://go.dev/cl/847186",
        "version": "v0.50.0"
      },
      {
        "aliases": [
          "CVE-2026-97032"
        ],
        "ecosystem": "golang",
        "epss": {
          "cve": "CVE-2026-97032",
          "percentile": 0.42154,
          "score": 0.0049
        },
        "fix_state": "fixed",
        "fixed_in": [
          "0.60.0"
        ],
        "id": "GO-2026-6617",
        "in_binary": "vulnerable code in binary",
        "kev": null,
        "location": "go.mod",
        "osv_confirmed": true,
        "package": "golang.org/x/net",
        "severity": "High",
        "summary": "HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently. This happens because the server modifies the HPACK encoder from two goroutines without synchronization: one uses the encoder to encode a HEADERS frame as part of a response sent to a client and the ot",
        "url": "https://go.dev/cl/847188",
        "version": "v0.48.0"
      },
      {
        "aliases": [
          "CVE-2026-97032"
        ],
        "ecosystem": "golang",
        "epss": {
          "cve": "CVE-2026-97032",
          "percentile": 0.42154,
          "score": 0.0049
        },
        "fix_state": "fixed",
        "fixed_in": [
          "0.60.0"
        ],
        "id": "GO-2026-6617",
        "in_binary": "vulnerable code in binary",
        "kev": null,
        "location": "tool-imports/go.mod",
        "osv_confirmed": true,
        "package": "golang.org/x/net",
        "severity": "High",
        "summary": "HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently. This happens because the server modifies the HPACK encoder from two goroutines without synchronization: one uses the encoder to encode a HEADERS frame as part of a response sent to a client and the ot",
        "url": "https://go.dev/cl/847188",
        "version": "v0.50.0"
      },
      {
        "aliases": [
          "CVE-2026-56852"
        ],
        "ecosystem": "golang",
        "epss": {
          "cve": "CVE-2026-56852",
          "percentile": 0.41057,
          "score": 0.00475
        },
        "fix_state": "fixed",
        "fixed_in": [
          "0.39.0"
        ],
        "id": "GO-2026-5970",
        "in_binary": "vulnerable code in binary",
        "kev": null,
        "location": "go.mod",
        "osv_confirmed": true,
        "package": "golang.org/x/text",
        "severity": "High",
        "summary": "A norm.Iter can enter an infinite loop when handling input containing invalid UTF-8 bytes.",
        "url": "https://go.dev/issue/80142",
        "version": "v0.33.0"
      },
      {
        "aliases": [
          "CVE-2026-56852"
        ],
        "ecosystem": "golang",
        "epss": {
          "cve": "CVE-2026-56852",
          "percentile": 0.41057,
          "score": 0.00475
        },
        "fix_state": "fixed",
        "fixed_in": [
          "0.39.0"
        ],
        "id": "GO-2026-5970",
        "in_binary": "vulnerable code in binary",
        "kev": null,
        "location": "tool-imports/go.mod",
        "osv_confirmed": true,
        "package": "golang.org/x/text",
        "severity": "High",
        "summary": "A norm.Iter can enter an infinite loop when handling input containing invalid UTF-8 bytes.",
        "url": "https://go.dev/issue/80142",
        "version": "v0.34.0"
      },
      {
        "aliases": [
          "CVE-2026-56851"
        ],
        "ecosystem": "golang",
        "epss": {
          "cve": "CVE-2026-56851",
          "percentile": 0.40313,
          "score": 0.00466
        },
        "fix_state": "fixed",
        "fixed_in": [
          "0.41.0"
        ],
        "id": "GO-2026-6629",
        "in_binary": "vulnerable code in binary",
        "kev": null,
        "location": "go.mod",
        "osv_confirmed": true,
        "package": "golang.org/x/text",
        "severity": "High",
        "summary": "The Nickname profile can panic with an out-of-bounds slice error when transforming crafted input into a short destination buffer.",
        "url": "https://go.dev/cl/793360",
        "version": "v0.33.0"
      },
      {
        "aliases": [
          "CVE-2026-56851"
        ],
        "ecosystem": "golang",
        "epss": {
          "cve": "CVE-2026-56851",
          "percentile": 0.40313,
          "score": 0.00466
        },
        "fix_state": "fixed",
        "fixed_in": [
          "0.41.0"
        ],
        "id": "GO-2026-6629",
        "in_binary": "vulnerable code in binary",
        "kev": null,
        "location": "tool-imports/go.mod",
        "osv_confirmed": true,
        "package": "golang.org/x/text",
        "severity": "High",
        "summary": "The Nickname profile can panic with an out-of-bounds slice error when transforming crafted input into a short destination buffer.",
        "url": "https://go.dev/cl/793360",
        "version": "v0.34.0"
      },
      {
        "aliases": [
          "CVE-2026-84445"
        ],
        "ecosystem": "golang",
        "epss": {
          "cve": "CVE-2026-84445",
          "percentile": 0.5072,
          "score": 0.00641
        },
        "fix_state": "fixed",
        "fixed_in": [
          "1.82.2"
        ],
        "id": "GHSA-2v4p-qf9q-27wj",
        "in_binary": "vulnerable code in binary",
        "kev": null,
        "location": "go.mod",
        "osv_confirmed": true,
        "package": "google.golang.org/grpc",
        "severity": "High",
        "summary": "gRPC-Go xDS servers: Denial of Service (DoS) via crash due to missing `:authority` and `Host` headers",
        "url": "https://github.com/advisories/GHSA-2v4p-qf9q-27wj",
        "version": "v1.75.1"
      },
      {
        "aliases": [
          "CVE-2026-84445"
        ],
        "ecosystem": "golang",
        "epss": {
          "cve": "CVE-2026-84445",
          "percentile": 0.5072,
          "score": 0.00641
        },
        "fix_state": "fixed",
        "fixed_in": [
          "1.82.2"
        ],
        "id": "GHSA-2v4p-qf9q-27wj",
        "in_binary": "vulnerable code in binary",
        "kev": null,
        "location": "tool-imports/go.mod",
        "osv_confirmed": true,
        "package": "google.golang.org/grpc",
        "severity": "High",
        "summary": "gRPC-Go xDS servers: Denial of Service (DoS) via crash due to missing `:authority` and `Host` headers",
        "url": "https://github.com/advisories/GHSA-2v4p-qf9q-27wj",
        "version": "v1.78.0"
      },
      {
        "aliases": [],
        "ecosystem": "golang",
        "epss": null,
        "fix_state": "fixed",
        "fixed_in": [
          "1.82.1"
        ],
        "id": "GHSA-hrxh-6v49-42gf",
        "in_binary": "vulnerable code in binary",
        "kev": null,
        "location": "go.mod",
        "osv_confirmed": true,
        "package": "google.golang.org/grpc",
        "severity": "High",
        "summary": "gRPC-Go: xDS RBAC and HTTP/2 Vulnerabilities",
        "url": "https://github.com/advisories/GHSA-hrxh-6v49-42gf",
        "version": "v1.75.1"
      },
      {
        "aliases": [],
        "ecosystem": "golang",
        "epss": null,
        "fix_state": "fixed",
        "fixed_in": [
          "1.82.1"
        ],
        "id": "GHSA-hrxh-6v49-42gf",
        "in_binary": "vulnerable code in binary",
        "kev": null,
        "location": "tool-imports/go.mod",
        "osv_confirmed": true,
        "package": "google.golang.org/grpc",
        "severity": "High",
        "summary": "gRPC-Go: xDS RBAC and HTTP/2 Vulnerabilities",
        "url": "https://github.com/advisories/GHSA-hrxh-6v49-42gf",
        "version": "v1.78.0"
      },
      {
        "aliases": [
          "CVE-2026-84304"
        ],
        "ecosystem": "golang",
        "epss": {
          "cve": "CVE-2026-84304",
          "percentile": 0.49152,
          "score": 0.00609
        },
        "fix_state": "fixed",
        "fixed_in": [
          "1.83.1"
        ],
        "id": "GHSA-vp52-pcj8-j9qc",
        "in_binary": "vulnerable code in binary",
        "kev": null,
        "location": "go.mod",
        "osv_confirmed": true,
        "package": "google.golang.org/grpc",
        "severity": "High",
        "summary": "gRPC-Go: Heap Memory Exhaustion (OOM) via HTTP/2 DATA Frame Fragmentation",
        "url": "https://github.com/advisories/GHSA-vp52-pcj8-j9qc",
        "version": "v1.75.1"
      },
      {
        "aliases": [
          "CVE-2026-84304"
        ],
        "ecosystem": "golang",
        "epss": {
          "cve": "CVE-2026-84304",
          "percentile": 0.49152,
          "score": 0.00609
        },
        "fix_state": "fixed",
        "fixed_in": [
          "1.83.1"
        ],
        "id": "GHSA-vp52-pcj8-j9qc",
        "in_binary": "vulnerable code in binary",
        "kev": null,
        "location": "tool-imports/go.mod",
        "osv_confirmed": true,
        "package": "google.golang.org/grpc",
        "severity": "High",
        "summary": "gRPC-Go: Heap Memory Exhaustion (OOM) via HTTP/2 DATA Frame Fragmentation",
        "url": "https://github.com/advisories/GHSA-vp52-pcj8-j9qc",
        "version": "v1.78.0"
      },
      {
        "aliases": [
          "CVE-2026-50163"
        ],
        "ecosystem": "golang",
        "epss": {
          "cve": "CVE-2026-50163",
          "percentile": 0.34549,
          "score": 0.00403
        },
        "fix_state": "fixed",
        "fixed_in": [
          "2.6.2"
        ],
        "id": "GHSA-fxhp-mv3v-67qp",
        "in_binary": "vulnerable code in binary",
        "kev": null,
        "location": "go.mod",
        "osv_confirmed": true,
        "package": "oras.land/oras-go/v2",
        "severity": "High",
        "summary": "`oras-go` tar extraction: Hardlink entry with relative Linkname escapes extract dir via process CWD resolution",
        "url": "https://github.com/advisories/GHSA-fxhp-mv3v-67qp",
        "version": "v2.6.0"
      },
      {
        "aliases": [
          "CVE-2026-50151"
        ],
        "ecosystem": "golang",
        "epss": {
          "cve": "CVE-2026-50151",
          "percentile": 0.3225,
          "score": 0.00382
        },
        "fix_state": "fixed",
        "fixed_in": [
          "2.6.1"
        ],
        "id": "GHSA-jxpm-75mh-9fp7",
        "in_binary": "vulnerable code in binary",
        "kev": null,
        "location": "go.mod",
        "osv_confirmed": true,
        "package": "oras.land/oras-go/v2",
        "severity": "High",
        "summary": "oras-go blob upload vulnerable to credential forwarding via unvalidated Location header",
        "url": "https://github.com/advisories/GHSA-jxpm-75mh-9fp7",
        "version": "v2.6.0"
      },
      {
        "aliases": [
          "CVE-2026-85731"
        ],
        "ecosystem": "golang",
        "epss": {
          "cve": "CVE-2026-85731",
          "percentile": 0.52244,
          "score": 0.00676
        },
        "fix_state": "fixed",
        "fixed_in": [
          "2.6.2"
        ],
        "id": "GHSA-m37j-52j7-pjw7",
        "in_binary": "vulnerable code in binary",
        "kev": null,
        "location": "go.mod",
        "osv_confirmed": true,
        "package": "oras.land/oras-go/v2",
        "severity": "High",
        "summary": "oras-go: Arbitrary file write outside file.Store root via symlink-chain bypass in tar extraction (pushDir)",
        "url": "https://github.com/advisories/GHSA-m37j-52j7-pjw7",
        "version": "v2.6.0"
      },
      {
        "aliases": [],
        "ecosystem": "golang",
        "epss": {
          "cve": "CVE-2026-31959",
          "percentile": 0.00919,
          "score": 0.00102
        },
        "fix_state": "unknown",
        "fixed_in": [],
        "id": "CVE-2026-31959",
        "in_binary": "not in released binary",
        "kev": null,
        "location": "tool-imports/go.mod",
        "osv_confirmed": true,
        "package": "github.com/anchore/quill",
        "severity": "Medium",
        "summary": "Quill provides simple mac binary signing and notarization from any platform. Quill before version v0.7.1 contains a Server-Side Request Forgery (SSRF) vulnerability when attempting to fetch the Apple notarization submission logs. Exploitation requires the ability to modify API responses from Apple's",
        "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-31959",
        "version": "v0.5.1"
      },
      {
        "aliases": [],
        "ecosystem": "golang",
        "epss": {
          "cve": "CVE-2026-31960",
          "percentile": 0.00479,
          "score": 0.00092
        },
        "fix_state": "fixed",
        "fixed_in": [
          "0.7.1"
        ],
        "id": "CVE-2026-31960",
        "in_binary": "not in released binary",
        "kev": null,
        "location": "tool-imports/go.mod",
        "osv_confirmed": true,
        "package": "github.com/anchore/quill",
        "severity": "Medium",
        "summary": "Quill provides simple mac binary signing and notarization from any platform. Quill before version v0.7.1 has unbounded reads of HTTP response bodies during the Apple notarization process. Exploitation requires the ability to modify API responses from Apple's notarization service, which is not possib",
        "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-31960",
        "version": "v0.5.1"
      },
      {
        "aliases": [],
        "ecosystem": "golang",
        "epss": {
          "cve": "CVE-2026-31961",
          "percentile": 0.01016,
          "score": 0.00104
        },
        "fix_state": "fixed",
        "fixed_in": [
          "0.7.1"
        ],
        "id": "CVE-2026-31961",
        "in_binary": "not in released binary",
        "kev": null,
        "location": "tool-imports/go.mod",
        "osv_confirmed": true,
        "package": "github.com/anchore/quill",
        "severity": "Medium",
        "summary": "Quill provides simple mac binary signing and notarization from any platform. Quill before version v0.7.1 contains an unbounded memory allocation vulnerability when parsing Mach-O binaries. Exploitation requires that Quill processes an attacker-supplied Mach-O binary, which is most likely in environm",
        "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-31961",
        "version": "v0.5.1"
      },
      {
        "aliases": [
          "CVE-2026-31959"
        ],
        "ecosystem": "golang",
        "epss": {
          "cve": "CVE-2026-31959",
          "percentile": 0.00919,
          "score": 0.00102
        },
        "fix_state": "fixed",
        "fixed_in": [
          "0.7.1"
        ],
        "id": "GHSA-7q3q-5px6-4c5p",
        "in_binary": "not in released binary",
        "kev": null,
        "location": "tool-imports/go.mod",
        "osv_confirmed": true,
        "package": "github.com/anchore/quill",
        "severity": "Medium",
        "summary": "Quill vulnerable to SSRF via unvalidated URL from Apple notarization log retrieval",
        "url": "https://github.com/advisories/GHSA-7q3q-5px6-4c5p",
        "version": "v0.5.1"
      },
      {
        "aliases": [
          "CVE-2026-31960"
        ],
        "ecosystem": "golang",
        "epss": {
          "cve": "CVE-2026-31960",
          "percentile": 0.00479,
          "score": 0.00092
        },
        "fix_state": "fixed",
        "fixed_in": [
          "0.7.1"
        ],
        "id": "GHSA-g32c-4pvp-769g",
        "in_binary": "not in released binary",
        "kev": null,
        "location": "tool-imports/go.mod",
        "osv_confirmed": true,
        "package": "github.com/anchore/quill",
        "severity": "Medium",
        "summary": "Quill has DoS via unbounded read of HTTP response body during notarization",
        "url": "https://github.com/advisories/GHSA-g32c-4pvp-769g",
        "version": "v0.5.1"
      },
      {
        "aliases": [
          "CVE-2026-31961"
        ],
        "ecosystem": "golang",
        "epss": {
          "cve": "CVE-2026-31961",
          "percentile": 0.01016,
          "score": 0.00104
        },
        "fix_state": "fixed",
        "fixed_in": [
          "0.7.1"
        ],
        "id": "GHSA-xj69-m9qq-8m94",
        "in_binary": "not in released binary",
        "kev": null,
        "location": "tool-imports/go.mod",
        "osv_confirmed": true,
        "package": "github.com/anchore/quill",
        "severity": "Medium",
        "summary": "Quill has unbounded memory allocation via unvalidated size fields in Mach-O binary parsing",
        "url": "https://github.com/advisories/GHSA-xj69-m9qq-8m94",
        "version": "v0.5.1"
      },
      {
        "aliases": [],
        "ecosystem": "golang",
        "epss": null,
        "fix_state": "fixed",
        "fixed_in": [
          "1.7.8"
        ],
        "id": "GHSA-xmrv-pmrh-hhx2",
        "in_binary": "not in released binary",
        "kev": null,
        "location": "tool-imports/go.mod",
        "osv_confirmed": true,
        "package": "github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream",
        "severity": "Medium",
        "summary": "Denial of Service due to Panic in AWS SDK for Go v2 SDK EventStream Decoder",
        "url": "https://github.com/advisories/GHSA-xmrv-pmrh-hhx2",
        "version": "v1.7.4"
      },
      {
        "aliases": [],
        "ecosystem": "golang",
        "epss": null,
        "fix_state": "fixed",
        "fixed_in": [
          "1.97.3"
        ],
        "id": "GHSA-xmrv-pmrh-hhx2",
        "in_binary": "not in released binary",
        "kev": null,
        "location": "tool-imports/go.mod",
        "osv_confirmed": true,
        "package": "github.com/aws/aws-sdk-go-v2/service/s3",
        "severity": "Medium",
        "summary": "Denial of Service due to Panic in AWS SDK for Go v2 SDK EventStream Decoder",
        "url": "https://github.com/advisories/GHSA-xmrv-pmrh-hhx2",
        "version": "v1.93.0"
      },
      {
        "aliases": [
          "CVE-2026-53495"
        ],
        "ecosystem": "golang",
        "epss": {
          "cve": "CVE-2026-53495",
          "percentile": 0.05332,
          "score": 0.00162
        },
        "fix_state": "fixed",
        "fixed_in": [
          "1.7.35"
        ],
        "id": "GHSA-7jxh-36q5-gcqv",
        "in_binary": "module in binary",
        "kev": null,
        "location": "go.mod",
        "osv_confirmed": true,
        "package": "github.com/containerd/containerd",
        "severity": "Medium",
        "summary": "containerd: CRI ExecSync Goroutine Leak Leads to Node-Level Denial of Service",
        "url": "https://github.com/advisories/GHSA-7jxh-36q5-gcqv",
        "version": "v1.7.30"
      },
      {
        "aliases": [
          "CVE-2026-47262"
        ],
        "ecosystem": "golang",
        "epss": {
          "cve": "CVE-2026-47262",
          "percentile": 0.18457,
          "score": 0.00265
        },
        "fix_state": "fixed",
        "fixed_in": [
          "1.7.33"
        ],
        "id": "GHSA-jpcc-p29g-p8mq",
        "in_binary": "module in binary",
        "kev": null,
        "location": "go.mod",
        "osv_confirmed": true,
        "package": "github.com/containerd/containerd",
        "severity": "Medium",
        "summary": "containerd image-triggered runtime DoS via unbounded group parsing",
        "url": "https://github.com/advisories/GHSA-jpcc-p29g-p8mq",
        "version": "v1.7.30"
      },
      {
        "aliases": [
          "CVE-2026-53493"
        ],
        "ecosystem": "golang",
        "epss": {
          "cve": "CVE-2026-53493",
          "percentile": 0.29375,
          "score": 0.00356
        },
        "fix_state": "fixed",
        "fixed_in": [
          "1.7.36"
        ],
        "id": "GHSA-pg57-6jwg-q645",
        "in_binary": "module in binary",
        "kev": null,
        "location": "go.mod",
        "osv_confirmed": true,
        "package": "github.com/containerd/containerd",
        "severity": "Medium",
        "summary": "Containerd has image-pull DoS via crafted OCI index graph amplification",
        "url": "https://github.com/advisories/GHSA-pg57-6jwg-q645",
        "version": "v1.7.30"
      },
      {
        "aliases": [
          "CVE-2026-95838"
        ],
        "ecosystem": "golang",
        "epss": {
          "cve": "CVE-2026-95838",
          "percentile": 0.1296,
          "score": 0.00223
        },
        "fix_state": "fixed",
        "fixed_in": [
          "1.7.35"
        ],
        "id": "GHSA-rp3h-jf77-q9p4",
        "in_binary": "module in binary",
        "kev": null,
        "location": "go.mod",
        "osv_confirmed": true,
        "package": "github.com/containerd/containerd",
        "severity": "Medium",
        "summary": "containerd: Unpack DoS via repeated opaque whiteouts",
        "url": "https://github.com/advisories/GHSA-rp3h-jf77-q9p4",
        "version": "v1.7.30"
      },
      {
        "aliases": [
          "CVE-2026-53489",
          "GHSA-rgh6-rfwx-v388"
        ],
        "ecosystem": "golang",
        "epss": {
          "cve": "CVE-2026-53489",
          "percentile": 0.06876,
          "score": 0.00174
        },
        "fix_state": "unknown",
        "fixed_in": [],
        "id": "GO-2026-5622",
        "in_binary": "module in binary",
        "kev": null,
        "location": "go.mod",
        "osv_confirmed": true,
        "package": "github.com/containerd/containerd",
        "severity": "Medium",
        "summary": "Arbitrary host CRI log file read via symlink following in CRI checkpoint restore in github.com/containerd/containerd",
        "url": "https://github.com/containerd/containerd/security/advisories/GHSA-rgh6-rfwx-v388",
        "version": "v1.7.30"
      },
      {
        "aliases": [
          "CVE-2026-85747"
        ],
        "ecosystem": "golang",
        "epss": {
          "cve": "CVE-2026-85747",
          "percentile": 0.12276,
          "score": 0.00218
        },
        "fix_state": "not-fixed",
        "fixed_in": [],
        "id": "GHSA-685w-q87j-wqw3",
        "in_binary": "not in released binary",
        "kev": null,
        "location": "tool-imports/go.mod",
        "osv_confirmed": true,
        "package": "github.com/docker/distribution",
        "severity": "Medium",
        "summary": "Distribution: Client `manifests.Get()` does not verify returned content against requested digest",
        "url": "https://github.com/advisories/GHSA-685w-q87j-wqw3",
        "version": "v2.8.3+incompatible"
      },
      {
        "aliases": [
          "CVE-2026-33997"
        ],
        "ecosystem": "golang",
        "epss": {
          "cve": "CVE-2026-33997",
          "percentile": 0.34433,
          "score": 0.00402
        },
        "fix_state": "not-fixed",
        "fixed_in": [],
        "id": "GHSA-pxq6-2prw-chj9",
        "in_binary": "not in released binary",
        "kev": null,
        "location": "tool-imports/go.mod",
        "osv_confirmed": true,
        "package": "github.com/docker/docker",
        "severity": "Medium",
        "summary": "Moby has an Off-by-one error in its plugin privilege validation",
        "url": "https://github.com/advisories/GHSA-pxq6-2prw-chj9",
        "version": "v28.5.2+incompatible"
      },
      {
        "aliases": [
          "CVE-2026-41568"
        ],
        "ecosystem": "golang",
        "epss": {
          "cve": "CVE-2026-41568",
          "percentile": 0.01188,
          "score": 0.00108
        },
        "fix_state": "not-fixed",
        "fixed_in": [],
        "id": "GHSA-vp62-88p7-qqf5",
        "in_binary": "not in released binary",
        "kev": null,
        "location": "tool-imports/go.mod",
        "osv_confirmed": true,
        "package": "github.com/docker/docker",
        "severity": "Medium",
        "summary": "Docker: Race condition in docker cp allows creation of arbitrary empty files on the host via symlink swap",
        "url": "https://github.com/advisories/GHSA-vp62-88p7-qqf5",
        "version": "v28.5.2+incompatible"
      },
      {
        "aliases": [
          "CVE-2026-44740"
        ],
        "ecosystem": "golang",
        "epss": {
          "cve": "CVE-2026-44740",
          "percentile": 0.32989,
          "score": 0.00389
        },
        "fix_state": "fixed",
        "fixed_in": [
          "5.9.0"
        ],
        "id": "GHSA-m3xc-h892-ggx6",
        "in_binary": "not in released binary",
        "kev": null,
        "location": "tool-imports/go.mod",
        "osv_confirmed": true,
        "package": "github.com/go-git/go-billy/v5",
        "severity": "Medium",
        "summary": "go-billy: Lack of depth and cycle detection in symlink resolution may lead to infinite loops and resource exhaustion",
        "url": "https://github.com/advisories/GHSA-m3xc-h892-ggx6",
        "version": "v5.6.2"
      },
      {
        "aliases": [
          "CVE-2026-41506"
        ],
        "ecosystem": "golang",
        "epss": {
          "cve": "CVE-2026-41506",
          "percentile": 0.17609,
          "score": 0.00259
        },
        "fix_state": "fixed",
        "fixed_in": [
          "5.18.0"
        ],
        "id": "GHSA-3xc5-wrhm-f963",
        "in_binary": "not in released binary",
        "kev": null,
        "location": "tool-imports/go.mod",
        "osv_confirmed": true,
        "package": "github.com/go-git/go-git/v5",
        "severity": "Medium",
        "summary": "go-git: Credential leak via cross-host redirect in smart HTTP transport",
        "url": "https://github.com/advisories/GHSA-3xc5-wrhm-f963",
        "version": "v5.16.5"
      },
      {
        "aliases": [
          "CVE-2026-45571"
        ],
        "ecosystem": "golang",
        "epss": {
          "cve": "CVE-2026-45571",
          "percentile": 0.22422,
          "score": 0.00297
        },
        "fix_state": "fixed",
        "fixed_in": [
          "5.19.1"
        ],
        "id": "GHSA-crhj-59gh-8x96",
        "in_binary": "not in released binary",
        "kev": null,
        "location": "tool-imports/go.mod",
        "osv_confirmed": true,
        "package": "github.com/go-git/go-git/v5",
        "severity": "Medium",
        "summary": "go-git: Crafted repositories may modify main and submodule .git directories",
        "url": "https://github.com/advisories/GHSA-crhj-59gh-8x96",
        "version": "v5.16.5"
      },
      {
        "aliases": [
          "CVE-2026-34165"
        ],
        "ecosystem": "golang",
        "epss": {
          "cve": "CVE-2026-34165",
          "percentile": 0.04428,
          "score": 0.00153
        },
        "fix_state": "fixed",
        "fixed_in": [
          "5.17.1"
        ],
        "id": "GHSA-jhf3-xxhw-2wpp",
        "in_binary": "not in released binary",
        "kev": null,
        "location": "tool-imports/go.mod",
        "osv_confirmed": true,
        "package": "github.com/go-git/go-git/v5",
        "severity": "Medium",
        "summary": "go-git: Maliciously crafted idx file can cause asymmetric memory consumption",
        "url": "https://github.com/advisories/GHSA-jhf3-xxhw-2wpp",
        "version": "v5.16.5"
      },
      {
        "aliases": [
          "CVE-2026-71557"
        ],
        "ecosystem": "golang",
        "epss": {
          "cve": "CVE-2026-71557",
          "percentile": 0.35651,
          "score": 0.00413
        },
        "fix_state": "fixed",
        "fixed_in": [
          "5.19.2"
        ],
        "id": "GHSA-qgq7-7hm3-q39j",
        "in_binary": "not in released binary",
        "kev": null,
        "location": "tool-imports/go.mod",
        "osv_confirmed": true,
        "package": "github.com/go-git/go-git/v5",
        "severity": "Medium",
        "summary": "go-git: Malicious reference names may modify files outside the reference storage",
        "url": "https://github.com/advisories/GHSA-qgq7-7hm3-q39j",
        "version": "v5.16.5"
      },
      {
        "aliases": [],
        "ecosystem": "golang",
        "epss": null,
        "fix_state": "fixed",
        "fixed_in": [
          "5.19.1"
        ],
        "id": "GHSA-w5pp-99ch-qj29",
        "in_binary": "not in released binary",
        "kev": null,
        "location": "tool-imports/go.mod",
        "osv_confirmed": true,
        "package": "github.com/go-git/go-git/v5",
        "severity": "Medium",
        "summary": "go-git: Malformed Git object data may cause panics or resource exhaustion",
        "url": "https://github.com/advisories/GHSA-w5pp-99ch-qj29",
        "version": "v5.16.5"
      },
      {
        "aliases": [
          "CVE-2026-116585"
        ],
        "ecosystem": "golang",
        "epss": {
          "cve": "CVE-2026-116585",
          "percentile": 0.18368,
          "score": 0.00264
        },
        "fix_state": "fixed",
        "fixed_in": [
          "4.1.5"
        ],
        "id": "GHSA-4w3g-jfj2-cw2q",
        "in_binary": "not in released binary",
        "kev": null,
        "location": "tool-imports/go.mod",
        "osv_confirmed": true,
        "package": "github.com/go-jose/go-jose/v4",
        "severity": "Medium",
        "summary": "Go JOSE: Panic during CBC-HMAC processing",
        "url": "https://github.com/advisories/GHSA-4w3g-jfj2-cw2q",
        "version": "v4.1.3"
      },
      {
        "aliases": [
          "CVE-2026-116586"
        ],
        "ecosystem": "golang",
        "epss": {
          "cve": "CVE-2026-116586",
          "percentile": 0.21769,
          "score": 0.00292
        },
        "fix_state": "fixed",
        "fixed_in": [
          "4.1.5"
        ],
        "id": "GHSA-vvm8-gf78-28g4",
        "in_binary": "not in released binary",
        "kev": null,
        "location": "tool-imports/go.mod",
        "osv_confirmed": true,
        "package": "github.com/go-jose/go-jose/v4",
        "severity": "Medium",
        "summary": "Go JOSE: Panics in JSON parsing",
        "url": "https://github.com/advisories/GHSA-vvm8-gf78-28g4",
        "version": "v4.1.3"
      },
      {
        "aliases": [],
        "ecosystem": "golang",
        "epss": null,
        "fix_state": "fixed",
        "fixed_in": [
          "0.29.0"
        ],
        "id": "GHSA-gcjh-h69q-9w9g",
        "in_binary": "vulnerable code in binary",
        "kev": null,
        "location": "go.mod",
        "osv_confirmed": true,
        "package": "github.com/google/cel-go",
        "severity": "Medium",
        "summary": "cel-go: JSON Private Fields Exposed via NativeTypes and ParseStructTag",
        "url": "https://github.com/advisories/GHSA-gcjh-h69q-9w9g",
        "version": "v0.27.0"
      },
      {
        "aliases": [],
        "ecosystem": "golang",
        "epss": null,
        "fix_state": "fixed",
        "fixed_in": [
          "0.11.0"
        ],
        "id": "GHSA-pmwq-pjrm-6p5r",
        "in_binary": "not in released binary",
        "kev": null,
        "location": "tool-imports/go.mod",
        "osv_confirmed": true,
        "package": "github.com/in-toto/in-toto-golang",
        "severity": "Medium",
        "summary": "in-toto-golang and in-toto-python have inconsistent negation behavior",
        "url": "https://github.com/advisories/GHSA-pmwq-pjrm-6p5r",
        "version": "v0.9.0"
      },
      {
        "aliases": [
          "CVE-2026-44430"
        ],
        "ecosystem": "golang",
        "epss": {
          "cve": "CVE-2026-44430",
          "percentile": 0.21041,
          "score": 0.00285
        },
        "fix_state": "fixed",
        "fixed_in": [
          "1.7.7"
        ],
        "id": "GHSA-r48c-v28r-pf6v",
        "in_binary": "not in released binary",
        "kev": null,
        "location": "tool-imports/go.mod",
        "osv_confirmed": true,
        "package": "github.com/modelcontextprotocol/registry",
        "severity": "Medium",
        "summary": "MCP Registry has an unauthenticated SSRF: HTTP namespace verification dials 6to4 / NAT64 / site-local IPv6 addresses, bypassing private-address allowlist",
        "url": "https://github.com/advisories/GHSA-r48c-v28r-pf6v",
        "version": "v1.3.10"
      },
      {
        "aliases": [
          "CVE-2026-44429"
        ],
        "ecosystem": "golang",
        "epss": {
          "cve": "CVE-2026-44429",
          "percentile": 0.05997,
          "score": 0.00167
        },
        "fix_state": "fixed",
        "fixed_in": [
          "1.7.7"
        ],
        "id": "GHSA-rqv2-m695-f8j4",
        "in_binary": "not in released binary",
        "kev": null,
        "location": "tool-imports/go.mod",
        "osv_confirmed": true,
        "package": "github.com/modelcontextprotocol/registry",
        "severity": "Medium",
        "summary": "MCP Registry vulnerable to stored XSS in catalogue UI via attribute-quote breakout in publisher-controlled `websiteUrl`",
        "url": "https://github.com/advisories/GHSA-rqv2-m695-f8j4",
        "version": "v1.3.10"
      },
      {
        "aliases": [
          "CVE-2026-44427"
        ],
        "ecosystem": "golang",
        "epss": {
          "cve": "CVE-2026-44427",
          "percentile": 0.4064,
          "score": 0.0047
        },
        "fix_state": "fixed",
        "fixed_in": [
          "1.7.5"
        ],
        "id": "GHSA-v8vw-gw5j-w7m6",
        "in_binary": "not in released binary",
        "kev": null,
        "location": "tool-imports/go.mod",
        "osv_confirmed": true,
        "package": "github.com/modelcontextprotocol/registry",
        "severity": "Medium",
        "summary": "MCP Registry has open redirect via protocol-relative path in trailing-slash middleware",
        "url": "https://github.com/advisories/GHSA-v8vw-gw5j-w7m6",
        "version": "v1.3.10"
      },
      {
        "aliases": [
          "CVE-2026-39395",
          "GHSA-w6c6-c85g-mmv6"
        ],
        "ecosystem": "golang",
        "epss": {
          "cve": "CVE-2026-39395",
          "percentile": 0.15235,
          "score": 0.00241
        },
        "fix_state": "fixed",
        "fixed_in": [
          "2.6.3"
        ],
        "id": "GO-2026-5694",
        "in_binary": "not in released binary",
        "kev": null,
        "location": "tool-imports/go.mod",
        "osv_confirmed": true,
        "package": "github.com/sigstore/cosign/v2",
        "severity": "Medium",
        "summary": "Cosign's verify-blob-attestation reports false positive when payload parsing fails in github.com/sigstore/cosign",
        "url": "https://github.com/sigstore/cosign/security/advisories/GHSA-w6c6-c85g-mmv6",
        "version": "v2.6.2"
      },
      {
        "aliases": [
          "CVE-2026-49834"
        ],
        "ecosystem": "golang",
        "epss": {
          "cve": "CVE-2026-49834",
          "percentile": 0.07665,
          "score": 0.00181
        },
        "fix_state": "fixed",
        "fixed_in": [
          "1.2.0"
        ],
        "id": "GHSA-9vcr-p3rj-q5q6",
        "in_binary": "not in released binary",
        "kev": null,
        "location": "tool-imports/go.mod",
        "osv_confirmed": true,
        "package": "github.com/sigstore/sigstore-go",
        "severity": "Medium",
        "summary": "sigstore-go has a multi-log threshold bypass via single compromised log",
        "url": "https://github.com/advisories/GHSA-9vcr-p3rj-q5q6",
        "version": "v1.1.4"
      },
      {
        "aliases": [
          "CVE-2026-49835"
        ],
        "ecosystem": "golang",
        "epss": {
          "cve": "CVE-2026-49835",
          "percentile": 0.54767,
          "score": 0.00744
        },
        "fix_state": "fixed",
        "fixed_in": [
          "2.1.0"
        ],
        "id": "GHSA-9c54-x2g4-v92j",
        "in_binary": "not in released binary",
        "kev": null,
        "location": "tool-imports/go.mod",
        "osv_confirmed": true,
        "package": "github.com/sigstore/timestamp-authority/v2",
        "severity": "Medium",
        "summary": "Sigstore Timestamp Authority has OOM due to unbounded metric label cardinality",
        "url": "https://github.com/advisories/GHSA-9c54-x2g4-v92j",
        "version": "v2.0.3"
      },
      {
        "aliases": [
          "CVE-2026-39984"
        ],
        "ecosystem": "golang",
        "epss": {
          "cve": "CVE-2026-39984",
          "percentile": 0.00795,
          "score": 0.00099
        },
        "fix_state": "fixed",
        "fixed_in": [
          "2.0.6"
        ],
        "id": "GHSA-xm5m-wgh2-rrg3",
        "in_binary": "not in released binary",
        "kev": null,
        "location": "tool-imports/go.mod",
        "osv_confirmed": true,
        "package": "github.com/sigstore/timestamp-authority/v2",
        "severity": "Medium",
        "summary": "Sigstore Timestamp Authority has Improper Certificate Validation in verifier",
        "url": "https://github.com/advisories/GHSA-xm5m-wgh2-rrg3",
        "version": "v2.0.3"
      },
      {
        "aliases": [],
        "ecosystem": "golang",
        "epss": null,
        "fix_state": "fixed",
        "fixed_in": [
          "0.23.1"
        ],
        "id": "GHSA-gxhx-2686-5h9g",
        "in_binary": "not in released binary",
        "kev": null,
        "location": "tool-imports/go.mod",
        "osv_confirmed": true,
        "package": "github.com/slack-go/slack",
        "severity": "Medium",
        "summary": "slack-go `SecretsVerifier` accepts empty signing secret without precondition",
        "url": "https://github.com/advisories/GHSA-gxhx-2686-5h9g",
        "version": "v0.17.3"
      },
      {
        "aliases": [
          "CVE-2026-2303"
        ],
        "ecosystem": "golang",
        "epss": {
          "cve": "CVE-2026-2303",
          "percentile": 0.24814,
          "score": 0.00318
        },
        "fix_state": "fixed",
        "fixed_in": [
          "1.17.7"
        ],
        "id": "GHSA-cp6g-7hqx-qxhp",
        "in_binary": "not in released binary",
        "kev": null,
        "location": "tool-imports/go.mod",
        "osv_confirmed": true,
        "package": "go.mongodb.org/mongo-driver",
        "severity": "Medium",
        "summary": "mongo-go-driver has Heap Out-of-Bounds Read in GSSAPI Error Handling",
        "url": "https://github.com/advisories/GHSA-cp6g-7hqx-qxhp",
        "version": "v1.17.6"
      },
      {
        "aliases": [
          "CVE-2026-39882"
        ],
        "ecosystem": "golang",
        "epss": {
          "cve": "CVE-2026-39882",
          "percentile": 0.08702,
          "score": 0.0019
        },
        "fix_state": "fixed",
        "fixed_in": [
          "1.43.0"
        ],
        "id": "GHSA-w8rr-5gcm-pp58",
        "in_binary": "not in released binary",
        "kev": null,
        "location": "go.mod",
        "osv_confirmed": true,
        "package": "go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp",
        "severity": "Medium",
        "summary": "opentelemetry-go: OTLP HTTP exporters read unbounded HTTP response bodies",
        "url": "https://github.com/advisories/GHSA-w8rr-5gcm-pp58",
        "version": "v1.35.0"
      },
      {
        "aliases": [
          "CVE-2026-39828"
        ],
        "ecosystem": "golang",
        "epss": {
          "cve": "CVE-2026-39828",
          "percentile": 0.3079,
          "score": 0.00369
        },
        "fix_state": "fixed",
        "fixed_in": [
          "0.52.0"
        ],
        "id": "GHSA-45gg-vh54-h5m9",
        "in_binary": "vulnerable code in binary",
        "kev": null,
        "location": "go.mod",
        "osv_confirmed": true,
        "package": "golang.org/x/crypto",
        "severity": "Medium",
        "summary": "golang.org/x/crypto vulnerable to invoking bypass of certificate restrictions",
        "url": "https://github.com/advisories/GHSA-45gg-vh54-h5m9",
        "version": "v0.46.0"
      },
      {
        "aliases": [
          "CVE-2026-39828"
        ],
        "ecosystem": "golang",
        "epss": {
          "cve": "CVE-2026-39828",
          "percentile": 0.3079,
          "score": 0.00369
        },
        "fix_state": "fixed",
        "fixed_in": [
          "0.52.0"
        ],
        "id": "GHSA-45gg-vh54-h5m9",
        "in_binary": "vulnerable code in binary",
        "kev": null,
        "location": "tool-imports/go.mod",
        "osv_confirmed": true,
        "package": "golang.org/x/crypto",
        "severity": "Medium",
        "summary": "golang.org/x/crypto vulnerable to invoking bypass of certificate restrictions",
        "url": "https://github.com/advisories/GHSA-45gg-vh54-h5m9",
        "version": "v0.48.0"
      },
      {
        "aliases": [
          "CVE-2026-39835"
        ],
        "ecosystem": "golang",
        "epss": {
          "cve": "CVE-2026-39835",
          "percentile": 0.43087,
          "score": 0.00504
        },
        "fix_state": "fixed",
        "fixed_in": [
          "0.52.0"
        ],
        "id": "GHSA-78mq-xcr3-xm33",
        "in_binary": "vulnerable code in binary",
        "kev": null,
        "location": "go.mod",
        "osv_confirmed": true,
        "package": "golang.org/x/crypto",
        "severity": "Medium",
        "summary": "golang.org/x/crypto is vulnerable to invoking server panic during CheckHostKey/Authenticate flow",
        "url": "https://github.com/advisories/GHSA-78mq-xcr3-xm33",
        "version": "v0.46.0"
      },
      {
        "aliases": [
          "CVE-2026-39835"
        ],
        "ecosystem": "golang",
        "epss": {
          "cve": "CVE-2026-39835",
          "percentile": 0.43087,
          "score": 0.00504
        },
        "fix_state": "fixed",
        "fixed_in": [
          "0.52.0"
        ],
        "id": "GHSA-78mq-xcr3-xm33",
        "in_binary": "vulnerable code in binary",
        "kev": null,
        "location": "tool-imports/go.mod",
        "osv_confirmed": true,
        "package": "golang.org/x/crypto",
        "severity": "Medium",
        "summary": "golang.org/x/crypto is vulnerable to invoking server panic during CheckHostKey/Authenticate flow",
        "url": "https://github.com/advisories/GHSA-78mq-xcr3-xm33",
        "version": "v0.48.0"
      },
      {
        "aliases": [
          "CVE-2026-46598"
        ],
        "ecosystem": "golang",
        "epss": {
          "cve": "CVE-2026-46598",
          "percentile": 0.35509,
          "score": 0.00412
        },
        "fix_state": "fixed",
        "fixed_in": [
          "0.52.0"
        ],
        "id": "GHSA-9m57-25v3-79x9",
        "in_binary": "vulnerable code in binary",
        "kev": null,
        "location": "go.mod",
        "osv_confirmed": true,
        "package": "golang.org/x/crypto",
        "severity": "Medium",
        "summary": "golang.org/x/crypto: Invoking pathological inputs can lead to client panic",
        "url": "https://github.com/advisories/GHSA-9m57-25v3-79x9",
        "version": "v0.46.0"
      },
      {
        "aliases": [
          "CVE-2026-46598"
        ],
        "ecosystem": "golang",
        "epss": {
          "cve": "CVE-2026-46598",
          "percentile": 0.35509,
          "score": 0.00412
        },
        "fix_state": "fixed",
        "fixed_in": [
          "0.52.0"
        ],
        "id": "GHSA-9m57-25v3-79x9",
        "in_binary": "vulnerable code in binary",
        "kev": null,
        "location": "tool-imports/go.mod",
        "osv_confirmed": true,
        "package": "golang.org/x/crypto",
        "severity": "Medium",
        "summary": "golang.org/x/crypto: Invoking pathological inputs can lead to client panic",
        "url": "https://github.com/advisories/GHSA-9m57-25v3-79x9",
        "version": "v0.48.0"
      },
      {
        "aliases": [
          "CVE-2026-39827"
        ],
        "ecosystem": "golang",
        "epss": {
          "cve": "CVE-2026-39827",
          "percentile": 0.20461,
          "score": 0.00279
        },
        "fix_state": "fixed",
        "fixed_in": [
          "0.52.0"
        ],
        "id": "GHSA-qpw4-5x99-6vjp",
        "in_binary": "vulnerable code in binary",
        "kev": null,
        "location": "go.mod",
        "osv_confirmed": true,
        "package": "golang.org/x/crypto",
        "severity": "Medium",
        "summary": "golang.org/x/crypto: Invoking memory leak when rejecting channels can lead to DoS",
        "url": "https://github.com/advisories/GHSA-qpw4-5x99-6vjp",
        "version": "v0.46.0"
      },
      {
        "aliases": [
          "CVE-2026-39827"
        ],
        "ecosystem": "golang",
        "epss": {
          "cve": "CVE-2026-39827",
          "percentile": 0.20461,
          "score": 0.00279
        },
        "fix_state": "fixed",
        "fixed_in": [
          "0.52.0"
        ],
        "id": "GHSA-qpw4-5x99-6vjp",
        "in_binary": "vulnerable code in binary",
        "kev": null,
        "location": "tool-imports/go.mod",
        "osv_confirmed": true,
        "package": "golang.org/x/crypto",
        "severity": "Medium",
        "summary": "golang.org/x/crypto: Invoking memory leak when rejecting channels can lead to DoS",
        "url": "https://github.com/advisories/GHSA-qpw4-5x99-6vjp",
        "version": "v0.48.0"
      },
      {
        "aliases": [
          "CVE-2026-25680"
        ],
        "ecosystem": "golang",
        "epss": {
          "cve": "CVE-2026-25680",
          "percentile": 0.25766,
          "score": 0.00326
        },
        "fix_state": "fixed",
        "fixed_in": [
          "0.55.0"
        ],
        "id": "GHSA-5cv4-jp36-h3mw",
        "in_binary": "vulnerable code in binary",
        "kev": null,
        "location": "go.mod",
        "osv_confirmed": true,
        "package": "golang.org/x/net",
        "severity": "Medium",
        "summary": "Go Net HTML parser is vulnerable to denial of service",
        "url": "https://github.com/advisories/GHSA-5cv4-jp36-h3mw",
        "version": "v0.48.0"
      },
      {
        "aliases": [
          "CVE-2026-25680"
        ],
        "ecosystem": "golang",
        "epss": {
          "cve": "CVE-2026-25680",
          "percentile": 0.25766,
          "score": 0.00326
        },
        "fix_state": "fixed",
        "fixed_in": [
          "0.55.0"
        ],
        "id": "GHSA-5cv4-jp36-h3mw",
        "in_binary": "vulnerable code in binary",
        "kev": null,
        "location": "tool-imports/go.mod",
        "osv_confirmed": true,
        "package": "golang.org/x/net",
        "severity": "Medium",
        "summary": "Go Net HTML parser is vulnerable to denial of service",
        "url": "https://github.com/advisories/GHSA-5cv4-jp36-h3mw",
        "version": "v0.50.0"
      },
      {
        "aliases": [
          "CVE-2026-42506"
        ],
        "ecosystem": "golang",
        "epss": {
          "cve": "CVE-2026-42506",
          "percentile": 0.14566,
          "score": 0.00235
        },
        "fix_state": "fixed",
        "fixed_in": [
          "0.55.0"
        ],
        "id": "GO-2026-5025",
        "in_binary": "vulnerable code in binary",
        "kev": null,
        "location": "go.mod",
        "osv_confirmed": true,
        "package": "golang.org/x/net",
        "severity": "Medium",
        "summary": "Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.",
        "url": "https://go.dev/issue/79571",
        "version": "v0.48.0"
      },
      {
        "aliases": [
          "CVE-2026-42506"
        ],
        "ecosystem": "golang",
        "epss": {
          "cve": "CVE-2026-42506",
          "percentile": 0.14566,
          "score": 0.00235
        },
        "fix_state": "fixed",
        "fixed_in": [
          "0.55.0"
        ],
        "id": "GO-2026-5025",
        "in_binary": "vulnerable code in binary",
        "kev": null,
        "location": "tool-imports/go.mod",
        "osv_confirmed": true,
        "package": "golang.org/x/net",
        "severity": "Medium",
        "summary": "Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.",
        "url": "https://go.dev/issue/79571",
        "version": "v0.50.0"
      },
      {
        "aliases": [
          "CVE-2026-42502"
        ],
        "ecosystem": "golang",
        "epss": {
          "cve": "CVE-2026-42502",
          "percentile": 0.12982,
          "score": 0.00223
        },
        "fix_state": "fixed",
        "fixed_in": [
          "0.55.0"
        ],
        "id": "GO-2026-5027",
        "in_binary": "vulnerable code in binary",
        "kev": null,
        "location": "go.mod",
        "osv_confirmed": true,
        "package": "golang.org/x/net",
        "severity": "Medium",
        "summary": "Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.",
        "url": "https://go.dev/issue/79572",
        "version": "v0.48.0"
      },
      {
        "aliases": [
          "CVE-2026-42502"
        ],
        "ecosystem": "golang",
        "epss": {
          "cve": "CVE-2026-42502",
          "percentile": 0.12982,
          "score": 0.00223
        },
        "fix_state": "fixed",
        "fixed_in": [
          "0.55.0"
        ],
        "id": "GO-2026-5027",
        "in_binary": "vulnerable code in binary",
        "kev": null,
        "location": "tool-imports/go.mod",
        "osv_confirmed": true,
        "package": "golang.org/x/net",
        "severity": "Medium",
        "summary": "Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.",
        "url": "https://go.dev/issue/79572",
        "version": "v0.50.0"
      },
      {
        "aliases": [
          "CVE-2026-25681"
        ],
        "ecosystem": "golang",
        "epss": {
          "cve": "CVE-2026-25681",
          "percentile": 0.12983,
          "score": 0.00223
        },
        "fix_state": "fixed",
        "fixed_in": [
          "0.55.0"
        ],
        "id": "GO-2026-5029",
        "in_binary": "vulnerable code in binary",
        "kev": null,
        "location": "go.mod",
        "osv_confirmed": true,
        "package": "golang.org/x/net",
        "severity": "Medium",
        "summary": "Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.",
        "url": "https://go.dev/issue/79574",
        "version": "v0.48.0"
      },
      {
        "aliases": [
          "CVE-2026-25681"
        ],
        "ecosystem": "golang",
        "epss": {
          "cve": "CVE-2026-25681",
          "percentile": 0.12983,
          "score": 0.00223
        },
        "fix_state": "fixed",
        "fixed_in": [
          "0.55.0"
        ],
        "id": "GO-2026-5029",
        "in_binary": "vulnerable code in binary",
        "kev": null,
        "location": "tool-imports/go.mod",
        "osv_confirmed": true,
        "package": "golang.org/x/net",
        "severity": "Medium",
        "summary": "Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.",
        "url": "https://go.dev/issue/79574",
        "version": "v0.50.0"
      },
      {
        "aliases": [
          "CVE-2026-27136"
        ],
        "ecosystem": "golang",
        "epss": {
          "cve": "CVE-2026-27136",
          "percentile": 0.12983,
          "score": 0.00223
        },
        "fix_state": "fixed",
        "fixed_in": [
          "0.55.0"
        ],
        "id": "GO-2026-5030",
        "in_binary": "vulnerable code in binary",
        "kev": null,
        "location": "go.mod",
        "osv_confirmed": true,
        "package": "golang.org/x/net",
        "severity": "Medium",
        "summary": "Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.",
        "url": "https://go.dev/issue/79575",
        "version": "v0.48.0"
      },
      {
        "aliases": [
          "CVE-2026-27136"
        ],
        "ecosystem": "golang",
        "epss": {
          "cve": "CVE-2026-27136",
          "percentile": 0.12983,
          "score": 0.00223
        },
        "fix_state": "fixed",
        "fixed_in": [
          "0.55.0"
        ],
        "id": "GO-2026-5030",
        "in_binary": "vulnerable code in binary",
        "kev": null,
        "location": "tool-imports/go.mod",
        "osv_confirmed": true,
        "package": "golang.org/x/net",
        "severity": "Medium",
        "summary": "Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.",
        "url": "https://go.dev/issue/79575",
        "version": "v0.50.0"
      },
      {
        "aliases": [
          "CVE-2026-84303"
        ],
        "ecosystem": "golang",
        "epss": {
          "cve": "CVE-2026-84303",
          "percentile": 0.23991,
          "score": 0.00311
        },
        "fix_state": "fixed",
        "fixed_in": [
          "1.83.1"
        ],
        "id": "GHSA-qc2q-p7wx-3px3",
        "in_binary": "vulnerable code in binary",
        "kev": null,
        "location": "go.mod",
        "osv_confirmed": true,
        "package": "google.golang.org/grpc",
        "severity": "Medium",
        "summary": "gRPC-Go: xDS RBAC HTTP Filter bypass via mixed-case Header Matching and gRFC A41 validation evasion",
        "url": "https://github.com/advisories/GHSA-qc2q-p7wx-3px3",
        "version": "v1.75.1"
      },
      {
        "aliases": [
          "CVE-2026-84303"
        ],
        "ecosystem": "golang",
        "epss": {
          "cve": "CVE-2026-84303",
          "percentile": 0.23991,
          "score": 0.00311
        },
        "fix_state": "fixed",
        "fixed_in": [
          "1.83.1"
        ],
        "id": "GHSA-qc2q-p7wx-3px3",
        "in_binary": "vulnerable code in binary",
        "kev": null,
        "location": "tool-imports/go.mod",
        "osv_confirmed": true,
        "package": "google.golang.org/grpc",
        "severity": "Medium",
        "summary": "gRPC-Go: xDS RBAC HTTP Filter bypass via mixed-case Header Matching and gRFC A41 validation evasion",
        "url": "https://github.com/advisories/GHSA-qc2q-p7wx-3px3",
        "version": "v1.78.0"
      },
      {
        "aliases": [
          "CVE-2026-35206"
        ],
        "ecosystem": "golang",
        "epss": {
          "cve": "CVE-2026-35206",
          "percentile": 0.09712,
          "score": 0.00199
        },
        "fix_state": "fixed",
        "fixed_in": [
          "3.20.2"
        ],
        "id": "GHSA-hr2v-4r36-88hr",
        "in_binary": "vulnerable code in binary",
        "kev": null,
        "location": "go.mod",
        "osv_confirmed": true,
        "package": "helm.sh/helm/v3",
        "severity": "Medium",
        "summary": "Helm Chart extraction output directory collapse via `Chart.yaml` name dot-segment",
        "url": "https://github.com/advisories/GHSA-hr2v-4r36-88hr",
        "version": "v3.20.0"
      },
      {
        "aliases": [
          "CVE-2026-50162"
        ],
        "ecosystem": "golang",
        "epss": {
          "cve": "CVE-2026-50162",
          "percentile": 0.37983,
          "score": 0.00437
        },
        "fix_state": "fixed",
        "fixed_in": [
          "2.6.1"
        ],
        "id": "GHSA-8xwf-rjm4-xvhv",
        "in_binary": "vulnerable code in binary",
        "kev": null,
        "location": "go.mod",
        "osv_confirmed": true,
        "package": "oras.land/oras-go/v2",
        "severity": "Medium",
        "summary": "oras-go has file store write outside workingDir via symlink traversal",
        "url": "https://github.com/advisories/GHSA-8xwf-rjm4-xvhv",
        "version": "v2.6.0"
      },
      {
        "aliases": [
          "CVE-2026-85732"
        ],
        "ecosystem": "golang",
        "epss": {
          "cve": "CVE-2026-85732",
          "percentile": 0.32493,
          "score": 0.00384
        },
        "fix_state": "fixed",
        "fixed_in": [
          "2.6.2"
        ],
        "id": "GHSA-h7vf-4x9w-h99v",
        "in_binary": "vulnerable code in binary",
        "kev": null,
        "location": "go.mod",
        "osv_confirmed": true,
        "package": "oras.land/oras-go/v2",
        "severity": "Medium",
        "summary": "oras-go: Blind SSRF via unvalidated Link header URL in pagination allows internal network probing",
        "url": "https://github.com/advisories/GHSA-h7vf-4x9w-h99v",
        "version": "v2.6.0"
      },
      {
        "aliases": [],
        "ecosystem": "golang",
        "epss": null,
        "fix_state": "fixed",
        "fixed_in": [
          "2.6.1"
        ],
        "id": "GHSA-vh4v-2xq2-g5cg",
        "in_binary": "vulnerable code in binary",
        "kev": null,
        "location": "go.mod",
        "osv_confirmed": true,
        "package": "oras.land/oras-go/v2",
        "severity": "Medium",
        "summary": "ORAS Go forwards registry credentials across registry redirects",
        "url": "https://github.com/advisories/GHSA-vh4v-2xq2-g5cg",
        "version": "v2.6.0"
      },
      {
        "aliases": [
          "CVE-2026-33762"
        ],
        "ecosystem": "golang",
        "epss": {
          "cve": "CVE-2026-33762",
          "percentile": 0.05043,
          "score": 0.00159
        },
        "fix_state": "fixed",
        "fixed_in": [
          "5.17.1"
        ],
        "id": "GHSA-gm2x-2g9h-ccm8",
        "in_binary": "not in released binary",
        "kev": null,
        "location": "tool-imports/go.mod",
        "osv_confirmed": true,
        "package": "github.com/go-git/go-git/v5",
        "severity": "Low",
        "summary": "go-git missing validation decoding Index v4 files leads to panic",
        "url": "https://github.com/advisories/GHSA-gm2x-2g9h-ccm8",
        "version": "v5.16.5"
      },
      {
        "aliases": [
          "CVE-2026-45570"
        ],
        "ecosystem": "golang",
        "epss": {
          "cve": "CVE-2026-45570",
          "percentile": 0.30405,
          "score": 0.00365
        },
        "fix_state": "fixed",
        "fixed_in": [
          "5.19.1"
        ],
        "id": "GHSA-m7cr-m3pv-hgrp",
        "in_binary": "not in released binary",
        "kev": null,
        "location": "tool-imports/go.mod",
        "osv_confirmed": true,
        "package": "github.com/go-git/go-git/v5",
        "severity": "Low",
        "summary": "go-git: Improper single-quote escaping in go-git SSH transport",
        "url": "https://github.com/advisories/GHSA-m7cr-m3pv-hgrp",
        "version": "v5.16.5"
      },
      {
        "aliases": [
          "CVE-2026-45781"
        ],
        "ecosystem": "golang",
        "epss": {
          "cve": "CVE-2026-45781",
          "percentile": 0.1429,
          "score": 0.00233
        },
        "fix_state": "fixed",
        "fixed_in": [
          "1.7.9"
        ],
        "id": "GHSA-2v5f-5r6w-p67r",
        "in_binary": "not in released binary",
        "kev": null,
        "location": "tool-imports/go.mod",
        "osv_confirmed": true,
        "package": "github.com/modelcontextprotocol/registry",
        "severity": "Low",
        "summary": "MCP Registry: OCI validator skips ownership check on upstream rate limits",
        "url": "https://github.com/advisories/GHSA-2v5f-5r6w-p67r",
        "version": "v1.3.10"
      },
      {
        "aliases": [
          "CVE-2026-44428"
        ],
        "ecosystem": "golang",
        "epss": {
          "cve": "CVE-2026-44428",
          "percentile": 0.12416,
          "score": 0.00219
        },
        "fix_state": "fixed",
        "fixed_in": [
          "1.7.6"
        ],
        "id": "GHSA-95c3-6vvw-4mrq",
        "in_binary": "not in released binary",
        "kev": null,
        "location": "tool-imports/go.mod",
        "osv_confirmed": true,
        "package": "github.com/modelcontextprotocol/registry",
        "severity": "Low",
        "summary": "MCP Registry's GitHub OIDC tokens are replayable across registry deployments due to shared audience",
        "url": "https://github.com/advisories/GHSA-95c3-6vvw-4mrq",
        "version": "v1.3.10"
      },
      {
        "aliases": [
          "CVE-2026-24122",
          "GHSA-wfqv-66vq-46rm"
        ],
        "ecosystem": "golang",
        "epss": {
          "cve": "CVE-2026-24122",
          "percentile": 0.11979,
          "score": 0.00215
        },
        "fix_state": "unknown",
        "fixed_in": [],
        "id": "GO-2026-4529",
        "in_binary": "not in released binary",
        "kev": null,
        "location": "tool-imports/go.mod",
        "osv_confirmed": true,
        "package": "github.com/sigstore/cosign/v2",
        "severity": "Low",
        "summary": "Cosign considered signatures valid with expired intermediate certificates when transparency log verification is skipped in github.com/sigstore/cosign",
        "url": "https://github.com/sigstore/cosign/security/advisories/GHSA-wfqv-66vq-46rm",
        "version": "v2.6.2"
      },
      {
        "aliases": [
          "CVE-2026-54787"
        ],
        "ecosystem": "golang",
        "epss": {
          "cve": "CVE-2026-54787",
          "percentile": 0.02863,
          "score": 0.00134
        },
        "fix_state": "fixed",
        "fixed_in": [
          "1.2.1"
        ],
        "id": "GHSA-wqqc-jjcq-vfxm",
        "in_binary": "not in released binary",
        "kev": null,
        "location": "tool-imports/go.mod",
        "osv_confirmed": true,
        "package": "github.com/sigstore/sigstore-go",
        "severity": "Low",
        "summary": "sigstore-go fails to check signature timestamps against a signing key's validity period",
        "url": "https://github.com/advisories/GHSA-wqqc-jjcq-vfxm",
        "version": "v1.1.4"
      },
      {
        "aliases": [
          "CVE-2026-81870"
        ],
        "ecosystem": "golang",
        "epss": {
          "cve": "CVE-2026-81870",
          "percentile": 0.18557,
          "score": 0.00266
        },
        "fix_state": "fixed",
        "fixed_in": [
          "1.45.0"
        ],
        "id": "GHSA-8wmf-6v46-5gfg",
        "in_binary": "not in released binary",
        "kev": null,
        "location": "tool-imports/go.mod",
        "osv_confirmed": true,
        "package": "go.opentelemetry.io/otel/exporters/otlp/otlptrace",
        "severity": "Low",
        "summary": "OpenTelemetry-Go: Exporter config logging may leak endpoint URLs in info logs",
        "url": "https://github.com/advisories/GHSA-8wmf-6v46-5gfg",
        "version": "v1.38.0"
      },
      {
        "aliases": [
          "CVE-2026-81870"
        ],
        "ecosystem": "golang",
        "epss": {
          "cve": "CVE-2026-81870",
          "percentile": 0.18557,
          "score": 0.00266
        },
        "fix_state": "fixed",
        "fixed_in": [
          "1.45.0"
        ],
        "id": "GHSA-8wmf-6v46-5gfg",
        "in_binary": "not in released binary",
        "kev": null,
        "location": "tool-imports/go.mod",
        "osv_confirmed": true,
        "package": "go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc",
        "severity": "Low",
        "summary": "OpenTelemetry-Go: Exporter config logging may leak endpoint URLs in info logs",
        "url": "https://github.com/advisories/GHSA-8wmf-6v46-5gfg",
        "version": "v1.38.0"
      },
      {
        "aliases": [
          "CVE-2026-81870"
        ],
        "ecosystem": "golang",
        "epss": {
          "cve": "CVE-2026-81870",
          "percentile": 0.18557,
          "score": 0.00266
        },
        "fix_state": "fixed",
        "fixed_in": [
          "1.45.0"
        ],
        "id": "GHSA-8wmf-6v46-5gfg",
        "in_binary": "not in released binary",
        "kev": null,
        "location": "tool-imports/go.mod",
        "osv_confirmed": true,
        "package": "go.opentelemetry.io/otel/sdk",
        "severity": "Low",
        "summary": "OpenTelemetry-Go: Exporter config logging may leak endpoint URLs in info logs",
        "url": "https://github.com/advisories/GHSA-8wmf-6v46-5gfg",
        "version": "v1.40.0"
      },
      {
        "aliases": [
          "CVE-2026-39824"
        ],
        "ecosystem": "golang",
        "epss": {
          "cve": "CVE-2026-39824",
          "percentile": 0.01457,
          "score": 0.00114
        },
        "fix_state": "fixed",
        "fixed_in": [
          "0.44.0"
        ],
        "id": "GO-2026-5024",
        "in_binary": "vulnerable code not in binary",
        "kev": null,
        "location": "go.mod",
        "osv_confirmed": true,
        "package": "golang.org/x/sys",
        "severity": "Low",
        "summary": "NewNTUnicodeString does not check for string length overflow. When provided with a string that overflows the maximum size of a NTUnicodeString (a 16-bit number of bytes), it returns a truncated string rather than an error.",
        "url": "https://go.dev/issue/78916",
        "version": "v0.40.0"
      },
      {
        "aliases": [
          "CVE-2026-39824"
        ],
        "ecosystem": "golang",
        "epss": {
          "cve": "CVE-2026-39824",
          "percentile": 0.01457,
          "score": 0.00114
        },
        "fix_state": "fixed",
        "fixed_in": [
          "0.44.0"
        ],
        "id": "GO-2026-5024",
        "in_binary": "vulnerable code not in binary",
        "kev": null,
        "location": "tool-imports/go.mod",
        "osv_confirmed": true,
        "package": "golang.org/x/sys",
        "severity": "Low",
        "summary": "NewNTUnicodeString does not check for string length overflow. When provided with a string that overflows the maximum size of a NTUnicodeString (a 16-bit number of bytes), it returns a truncated string rather than an error.",
        "url": "https://go.dev/issue/78916",
        "version": "v0.41.0"
      },
      {
        "aliases": [
          "CVE-2026-48978"
        ],
        "ecosystem": "golang",
        "epss": {
          "cve": "CVE-2026-48978",
          "percentile": 0.11316,
          "score": 0.00211
        },
        "fix_state": "fixed",
        "fixed_in": [
          "2.6.1"
        ],
        "id": "GHSA-xf85-363p-868w",
        "in_binary": "vulnerable code in binary",
        "kev": null,
        "location": "go.mod",
        "osv_confirmed": true,
        "package": "oras.land/oras-go/v2",
        "severity": "Low",
        "summary": "oras-go: Malicious registry can hijack Bearer token realm to exfiltrate credentials and refresh tokens",
        "url": "https://github.com/advisories/GHSA-xf85-363p-868w",
        "version": "v2.6.0"
      },
      {
        "aliases": [],
        "ecosystem": "golang",
        "epss": null,
        "fix_state": "unknown",
        "fixed_in": [],
        "id": "GO-2026-6225",
        "in_binary": "not in released binary",
        "kev": null,
        "location": "tool-imports/go.mod",
        "osv_confirmed": true,
        "package": "github.com/chrismellard/docker-credential-acr-env",
        "severity": "Unknown",
        "summary": "In github.com/chrismellard/docker-credential-acr-env/pkg/credhelper, the regular expression used by isACRRegistry to validate Azure Container Registry hostnames is unanchored. As a result, arbitrary hostnames containing the substring \".azurecr.io\" (such as evil.azurecr.io.attacker.com) are treated a",
        "url": "https://github.com/chrismellard/docker-credential-acr-env/issues/21",
        "version": "v0.0.0-20230304212654-82a0ddb27589"
      },
      {
        "aliases": [],
        "ecosystem": "golang",
        "epss": null,
        "fix_state": "unknown",
        "fixed_in": [],
        "id": "GO-2026-5932",
        "in_binary": "vulnerable code in binary",
        "kev": null,
        "location": "go.mod",
        "osv_confirmed": true,
        "package": "golang.org/x/crypto",
        "severity": "Unknown",
        "summary": "The golang.org/x/crypto/openpgp package is unsafe by design, has numerous known security issues, is not maintained, and should not be used. If you are required to interoperate with OpenPGP systems and need a maintained package, consider github.com/ProtonMail/go-crypto/openpgp which is a maintained f",
        "url": "https://go.dev/issue/44226",
        "version": "v0.46.0"
      },
      {
        "aliases": [],
        "ecosystem": "golang",
        "epss": null,
        "fix_state": "unknown",
        "fixed_in": [],
        "id": "GO-2026-5932",
        "in_binary": "vulnerable code in binary",
        "kev": null,
        "location": "tool-imports/go.mod",
        "osv_confirmed": true,
        "package": "golang.org/x/crypto",
        "severity": "Unknown",
        "summary": "The golang.org/x/crypto/openpgp package is unsafe by design, has numerous known security issues, is not maintained, and should not be used. If you are required to interoperate with OpenPGP systems and need a maintained package, consider github.com/ProtonMail/go-crypto/openpgp which is a maintained f",
        "url": "https://go.dev/issue/44226",
        "version": "v0.48.0"
      },
      {
        "aliases": [
          "CVE-2026-78661"
        ],
        "ecosystem": "golang",
        "epss": {
          "cve": "CVE-2026-78661",
          "percentile": 0.08063,
          "score": 0.00185
        },
        "fix_state": "fixed",
        "fixed_in": [
          "0.62.0"
        ],
        "id": "GO-2026-6860",
        "in_binary": "vulnerable code in binary",
        "kev": null,
        "location": "go.mod",
        "osv_confirmed": true,
        "package": "golang.org/x/net",
        "severity": "Unknown",
        "summary": "When coalescing adjacent text nodes in addText and fosterParent, appending to an existing TextNode's Data via string concatenation (n.Data += text) reallocated and copied the accumulated string on every token. Inputs containing many short text runs separated by ignored end tags (such as \"a</x>\") cau",
        "url": "https://go.dev/cl/849365",
        "version": "v0.48.0"
      },
      {
        "aliases": [
          "CVE-2026-78661"
        ],
        "ecosystem": "golang",
        "epss": {
          "cve": "CVE-2026-78661",
          "percentile": 0.08063,
          "score": 0.00185
        },
        "fix_state": "fixed",
        "fixed_in": [
          "0.62.0"
        ],
        "id": "GO-2026-6860",
        "in_binary": "vulnerable code in binary",
        "kev": null,
        "location": "tool-imports/go.mod",
        "osv_confirmed": true,
        "package": "golang.org/x/net",
        "severity": "Unknown",
        "summary": "When coalescing adjacent text nodes in addText and fosterParent, appending to an existing TextNode's Data via string concatenation (n.Data += text) reallocated and copied the accumulated string on every token. Inputs containing many short text runs separated by ignored end tags (such as \"a</x>\") cau",
        "url": "https://go.dev/cl/849365",
        "version": "v0.50.0"
      },
      {
        "aliases": [
          "CVE-2026-97045"
        ],
        "ecosystem": "golang",
        "epss": {
          "cve": "CVE-2026-97045",
          "percentile": 0.10117,
          "score": 0.00202
        },
        "fix_state": "fixed",
        "fixed_in": [
          "0.62.0"
        ],
        "id": "GO-2026-6866",
        "in_binary": "vulnerable code in binary",
        "kev": null,
        "location": "go.mod",
        "osv_confirmed": true,
        "package": "golang.org/x/net",
        "severity": "Unknown",
        "summary": "In childTextNodesAreLiteral, walking up the tree previously stopped at the nearest foreign ancestor once an HTML integration point was found. However, that integration point may itself be a descendant of an element that was foster-parented into a foreign namespace (such as <mglyph> or <malignmark> f",
        "url": "https://go.dev/cl/855121",
        "version": "v0.48.0"
      },
      {
        "aliases": [
          "CVE-2026-97045"
        ],
        "ecosystem": "golang",
        "epss": {
          "cve": "CVE-2026-97045",
          "percentile": 0.10117,
          "score": 0.00202
        },
        "fix_state": "fixed",
        "fixed_in": [
          "0.62.0"
        ],
        "id": "GO-2026-6866",
        "in_binary": "vulnerable code in binary",
        "kev": null,
        "location": "tool-imports/go.mod",
        "osv_confirmed": true,
        "package": "golang.org/x/net",
        "severity": "Unknown",
        "summary": "In childTextNodesAreLiteral, walking up the tree previously stopped at the nearest foreign ancestor once an HTML integration point was found. However, that integration point may itself be a descendant of an element that was foster-parented into a foreign namespace (such as <mglyph> or <malignmark> f",
        "url": "https://go.dev/cl/855121",
        "version": "v0.50.0"
      }
    ],
    "workflow_audit": {
      "files": 3,
      "findings": [
        {
          "confidence": "High",
          "description": "unpinned action reference",
          "file": ".github/workflows/build.yaml",
          "line": 22,
          "note": "this step",
          "rule": "unpinned-uses",
          "severity": "High",
          "url": "https://docs.zizmor.sh/audits/#unpinned-uses"
        },
        {
          "confidence": "High",
          "description": "unpinned action reference",
          "file": ".github/workflows/build.yaml",
          "line": 27,
          "note": "this step",
          "rule": "unpinned-uses",
          "severity": "High",
          "url": "https://docs.zizmor.sh/audits/#unpinned-uses"
        },
        {
          "confidence": "High",
          "description": "unpinned action reference",
          "file": ".github/workflows/build.yaml",
          "line": 32,
          "note": "this step",
          "rule": "unpinned-uses",
          "severity": "High",
          "url": "https://docs.zizmor.sh/audits/#unpinned-uses"
        },
        {
          "confidence": "High",
          "description": "unpinned action reference",
          "file": ".github/workflows/build.yaml",
          "line": 38,
          "note": "this step",
          "rule": "unpinned-uses",
          "severity": "High",
          "url": "https://docs.zizmor.sh/audits/#unpinned-uses"
        },
        {
          "confidence": "High",
          "description": "unpinned action reference",
          "file": ".github/workflows/build.yaml",
          "line": 47,
          "note": "this step",
          "rule": "unpinned-uses",
          "severity": "High",
          "url": "https://docs.zizmor.sh/audits/#unpinned-uses"
        },
        {
          "confidence": "High",
          "description": "unpinned action reference",
          "file": ".github/workflows/build.yaml",
          "line": 62,
          "note": "this step",
          "rule": "unpinned-uses",
          "severity": "High",
          "url": "https://docs.zizmor.sh/audits/#unpinned-uses"
        },
        {
          "confidence": "High",
          "description": "unpinned action reference",
          "file": ".github/workflows/build.yaml",
          "line": 72,
          "note": "this step",
          "rule": "unpinned-uses",
          "severity": "High",
          "url": "https://docs.zizmor.sh/audits/#unpinned-uses"
        },
        {
          "confidence": "High",
          "description": "unpinned action reference",
          "file": ".github/workflows/build.yaml",
          "line": 80,
          "note": "this step",
          "rule": "unpinned-uses",
          "severity": "High",
          "url": "https://docs.zizmor.sh/audits/#unpinned-uses"
        },
        {
          "confidence": "High",
          "description": "unpinned action reference",
          "file": ".github/workflows/build.yaml",
          "line": 87,
          "note": "this step",
          "rule": "unpinned-uses",
          "severity": "High",
          "url": "https://docs.zizmor.sh/audits/#unpinned-uses"
        },
        {
          "confidence": "High",
          "description": "unpinned action reference",
          "file": ".github/workflows/build.yaml",
          "line": 93,
          "note": "this step",
          "rule": "unpinned-uses",
          "severity": "High",
          "url": "https://docs.zizmor.sh/audits/#unpinned-uses"
        },
        {
          "confidence": "High",
          "description": "unpinned action reference",
          "file": ".github/workflows/build.yaml",
          "line": 103,
          "note": "this step",
          "rule": "unpinned-uses",
          "severity": "High",
          "url": "https://docs.zizmor.sh/audits/#unpinned-uses"
        },
        {
          "confidence": "High",
          "description": "unpinned action reference",
          "file": ".github/workflows/build.yaml",
          "line": 105,
          "note": "this step",
          "rule": "unpinned-uses",
          "severity": "High",
          "url": "https://docs.zizmor.sh/audits/#unpinned-uses"
        },
        {
          "confidence": "High",
          "description": "unpinned action reference",
          "file": ".github/workflows/build.yaml",
          "line": 124,
          "note": "this step",
          "rule": "unpinned-uses",
          "severity": "High",
          "url": "https://docs.zizmor.sh/audits/#unpinned-uses"
        },
        {
          "confidence": "High",
          "description": "unpinned action reference",
          "file": ".github/workflows/build.yaml",
          "line": 140,
          "note": "this step",
          "rule": "unpinned-uses",
          "severity": "High",
          "url": "https://docs.zizmor.sh/audits/#unpinned-uses"
        },
        {
          "confidence": "High",
          "description": "unpinned action reference",
          "file": ".github/workflows/build.yaml",
          "line": 150,
          "note": "this step",
          "rule": "unpinned-uses",
          "severity": "High",
          "url": "https://docs.zizmor.sh/audits/#unpinned-uses"
        },
        {
          "confidence": "High",
          "description": "unpinned action reference",
          "file": ".github/workflows/build.yaml",
          "line": 154,
          "note": "this step",
          "rule": "unpinned-uses",
          "severity": "High",
          "url": "https://docs.zizmor.sh/audits/#unpinned-uses"
        },
        {
          "confidence": "High",
          "description": "unpinned action reference",
          "file": ".github/workflows/release.yaml",
          "line": 26,
          "note": "this step",
          "rule": "unpinned-uses",
          "severity": "High",
          "url": "https://docs.zizmor.sh/audits/#unpinned-uses"
        },
        {
          "confidence": "High",
          "description": "unpinned action reference",
          "file": ".github/workflows/release.yaml",
          "line": 52,
          "note": "this step",
          "rule": "unpinned-uses",
          "severity": "High",
          "url": "https://docs.zizmor.sh/audits/#unpinned-uses"
        },
        {
          "confidence": "High",
          "description": "unpinned action reference",
          "file": ".github/workflows/release.yaml",
          "line": 55,
          "note": "this step",
          "rule": "unpinned-uses",
          "severity": "High",
          "url": "https://docs.zizmor.sh/audits/#unpinned-uses"
        },
        {
          "confidence": "High",
          "description": "unpinned action reference",
          "file": ".github/workflows/release.yaml",
          "line": 60,
          "note": "this step",
          "rule": "unpinned-uses",
          "severity": "High",
          "url": "https://docs.zizmor.sh/audits/#unpinned-uses"
        },
        {
          "confidence": "High",
          "description": "unpinned action reference",
          "file": ".github/workflows/release.yaml",
          "line": 65,
          "note": "this step",
          "rule": "unpinned-uses",
          "severity": "High",
          "url": "https://docs.zizmor.sh/audits/#unpinned-uses"
        },
        {
          "confidence": "Medium",
          "description": "overly broad permissions",
          "file": ".github/workflows/build.yaml",
          "line": 1,
          "note": "default permissions used due to no permissions: block",
          "rule": "excessive-permissions",
          "severity": "Medium",
          "url": "https://docs.zizmor.sh/audits/#excessive-permissions"
        },
        {
          "confidence": "Medium",
          "description": "overly broad permissions",
          "file": ".github/workflows/build.yaml",
          "line": 19,
          "note": "this job",
          "rule": "excessive-permissions",
          "severity": "Medium",
          "url": "https://docs.zizmor.sh/audits/#excessive-permissions"
        },
        {
          "confidence": "Medium",
          "description": "overly broad permissions",
          "file": ".github/workflows/build.yaml",
          "line": 99,
          "note": "this job",
          "rule": "excessive-permissions",
          "severity": "Medium",
          "url": "https://docs.zizmor.sh/audits/#excessive-permissions"
        },
        {
          "confidence": "Medium",
          "description": "overly broad permissions",
          "file": ".github/workflows/build.yaml",
          "line": 145,
          "note": "this job",
          "rule": "excessive-permissions",
          "severity": "Medium",
          "url": "https://docs.zizmor.sh/audits/#excessive-permissions"
        }
      ]
    }
  },
  "updated": "2026-11-02"
}