vet

Enforce dependency policies and report supply-chain risks

safedep/vet · Software Composition Analysis (SCA) · scanned v1.20.0 (released 2026-10-07) · commit 568cb0e1c906 · last scan 2026-11-02

712

declared dependencies

4 / 41

critical / high advisories

advisories with a fixed version

advisories with vulnerable code in the go1.26.2 binary

7.4

OpenSSF Scorecard (of 10); OpenSSF public dataset

verified

release verification

Changes since last week

no change.

Known vulnerabilities (84)

Vulnerabilities are known advisories that Grype matches against the dependencies declared in each project's release source (manifests and lockfiles, including development and build dependencies). A match does not mean the tool is exploitable: the vulnerable code may be unused, test-only, or not shipped in the released binary. OSV: also reported by OSV-Scanner. Released binary: for Go tools, whether govulncheck found the vulnerable code in the shipped Linux binary. KEV: listed in the CISA Known Exploited Vulnerabilities catalog. EPSS: FIRST's estimated probability of exploitation in the next 30 days. Both describe the vulnerability in general, not its exploitability through this tool; a match in a workflow file refers to a GitHub Action, not to shipped code. Select an advisory for every catalog tool it matches. If a match is wrong or does not apply, use Dispute; accepted disputes are annotated here and listed on the corrections page, and the match stays visible.

Severity	Advisory	Package	Version	Fixed in	OSV	Released binary	KEV	EPSS	Declared in	Dispute
Critical	`GO-2026-5064` source CVE-2026-53492, GHSA-33vj-92qq-66hc	`github.com/containerd/containerd` golang	`v1.7.30`	no fix listed	✓	module in binary	no	0.4%	`go.mod`	Dispute
Critical	`GO-2026-5338` source CVE-2026-50195, GHSA-cvxm-645q-p574	`github.com/containerd/containerd` golang	`v1.7.30`	no fix listed	✓	module in binary	no	0.3%	`go.mod`	Dispute
Critical	`GHSA-cxf3-9h37-7rr8` source CVE-2026-118264	`github.com/labstack/echo/v4` golang	`v4.15.1`	4.16.1	✓	vulnerable code not in binary	no	0.4%	`go.mod`	Dispute
Critical	`GO-2026-6612` source CVE-2026-78663	`golang.org/x/net` golang	`v0.58.0`	0.60.0	✓	vulnerable code in binary	no	0.6%	`go.mod`	Dispute
High	`GHSA-3pq3-5fj3-cg6v` source CVE-2026-101898	`axios` npm	`1.18.1`	1.20.0	✓	—	no	0.5%	`pnpm-lock.yaml`	Dispute
High	`GHSA-542g-h47m-68v8` source CVE-2026-101901	`axios` npm	`1.18.1`	1.20.0	✓	—	no	0.5%	`pnpm-lock.yaml`	Dispute
High	`GHSA-c29m-xwm3-cm6r` source CVE-2026-101903	`axios` npm	`1.18.1`	1.20.0	✓	—	no	0.4%	`pnpm-lock.yaml`	Dispute
High	`GHSA-m8m8-qj5v-23w3` source CVE-2026-101905	`axios` npm	`1.18.1`	1.20.0	✓	—	no	0.4%	`pnpm-lock.yaml`	Dispute
High	`GHSA-mghh-pgcx-3jjj` source CVE-2026-101906	`axios` npm	`1.18.1`	1.20.0	✓	—	no	0.5%	`pnpm-lock.yaml`	Dispute
High	`GHSA-r4gj-5m52-g5wh` source CVE-2026-101907	`axios` npm	`1.18.1`	1.20.0	✓	—	no	0.5%	`pnpm-lock.yaml`	Dispute
High	`GHSA-x97p-jq2g-jp4f` source CVE-2026-101909	`axios` npm	`1.18.1`	1.20.0	✓	—	no	0.5%	`pnpm-lock.yaml`	Dispute
High	`GHSA-6j4f-fj2g-mc7p` source CVE-2026-102276	`brace-expansion` npm	`5.0.9`	5.0.10	✓	—	no	0.5%	`pnpm-lock.yaml`	Dispute
High	`GHSA-qhr7-859c-m2p7` source CVE-2026-102278	`brace-expansion` npm	`5.0.9`	5.0.11	✓	—	no	0.5%	`pnpm-lock.yaml`	Dispute
High	`GHSA-8r9p-f939-6h3c` source CVE-2026-111755	`follow-redirects` npm	`1.16.0`	1.16.1	✓	—	no	0.5%	`pnpm-lock.yaml`	Dispute
High	`GHSA-mrwp-f3q8-3g9p` source CVE-2026-116689	`follow-redirects` npm	`1.16.0`	1.16.2	✓	—	no	0.3%	`pnpm-lock.yaml`	Dispute
High	`GHSA-q3jh-wrc6-jgq8` source CVE-2026-111756	`follow-redirects` npm	`1.16.0`	1.16.1	✓	—	no	0.5%	`pnpm-lock.yaml`	Dispute
High	`GHSA-6g7g-w4f8-9c9x` source CVE-2026-32285	`github.com/buger/jsonparser` golang	`v1.1.1`	1.1.2	✓	vulnerable code in binary	no	0.8%	`go.mod`	Dispute
High	`GHSA-fqw6-gf59-qr4w` source CVE-2026-46680	`github.com/containerd/containerd` golang	`v1.7.30`	1.7.32	✓	module in binary	no	0.2%	`go.mod`	Dispute
High	`GHSA-xhf5-7wjv-pqxp` source CVE-2026-53488	`github.com/containerd/containerd` golang	`v1.7.30`	1.7.33	✓	module in binary	no	0.2%	`go.mod`	Dispute
High	`GO-2026-6791` source CVE-2026-95837, GHSA-p7v4-vr35-mj6f	`github.com/containerd/containerd` golang	`v1.7.30`	no fix listed	✓	module in binary	no	0.1%	`go.mod`	Dispute
High	`GHSA-rg2x-37c3-w2rh` source CVE-2026-42306	`github.com/docker/docker` golang	`v28.5.2+incompatible`	no fix listed	✓	vulnerable code in binary	no	0.1%	`go.mod`	Dispute
High	`GHSA-x86f-5xw2-fm2r` source CVE-2026-41567	`github.com/docker/docker` golang	`v28.5.2+incompatible`	no fix listed	✓	vulnerable code in binary	no	0.2%	`go.mod`	Dispute
High	`GO-2026-4887` source CVE-2026-34040, GHSA-x744-4wpc-v9h2	`github.com/docker/docker` golang	`v28.5.2+incompatible`	no fix listed	✓	vulnerable code in binary	no	9.3%	`go.mod`	Dispute
High	`GHSA-mgcc-cww5-fp2q` source CVE-2026-116587	`github.com/go-jose/go-jose/v4` golang	`v4.1.4`	4.1.6	✓	vulnerable code not in binary	no	0.4%	`go.mod`	Dispute
High	`GHSA-77fj-vx54-gvh7` source CVE-2026-40890	`github.com/gomarkdown/markdown` golang	`v0.0.0-20260217112301-37c66b85d6ab`	0.0.0-20260411013819-759bbc3e3207	✓	vulnerable code in binary	no	0.3%	`go.mod`	Dispute
High	`GHSA-cv23-7vc5-jfh7` source CVE-2026-102941	`github.com/gomarkdown/markdown` golang	`v0.0.0-20260217112301-37c66b85d6ab`	0.0.0-20260724235538-61af6e1e6971	✓	vulnerable code not in binary	no	0.3%	`go.mod`	Dispute
High	`GHSA-92mm-2pjq-r785` source CVE-2026-4660	`github.com/hashicorp/go-getter` golang	`v1.8.4`	1.8.6	✓	module in binary	no	0.6%	`go.mod`	Dispute
High	`GHSA-259r-337f-4rfw` source CVE-2026-63209	`github.com/klauspost/compress` golang	`v1.18.4`	1.18.7	✓	vulnerable code in binary	no	0.6%	`go.mod`	Dispute
High	`GHSA-375p-5qhx-8wq4` source CVE-2026-118650	`github.com/labstack/echo/v4` golang	`v4.15.1`	4.16.0	✓	vulnerable code not in binary	no	0.4%	`go.mod`	Dispute
High	`GHSA-9969-6676-49h5` source CVE-2026-118262	`github.com/labstack/echo/v4` golang	`v4.15.1`	4.16.1	✓	vulnerable code not in binary	no	0.3%	`go.mod`	Dispute
High	`GHSA-f48p-c9v4-h7xv` source CVE-2026-118260	`github.com/labstack/echo/v4` golang	`v4.15.1`	4.16.1	✓	vulnerable code not in binary	no	0.4%	`go.mod`	Dispute
High	`GHSA-h7wr-284f-5qvc` source CVE-2026-118261	`github.com/labstack/echo/v4` golang	`v4.15.1`	4.16.1	✓	vulnerable code not in binary	no	0.4%	`go.mod`	Dispute
High	`GHSA-vfp3-v2gw-7wfq` source CVE-2026-55677	`github.com/labstack/echo/v4` golang	`v4.15.1`	4.15.3	✓	vulnerable code in binary	no	0.5%	`go.mod`	Dispute
High	`GHSA-4c29-8rgm-jvjj` source CVE-2026-33747	`github.com/moby/buildkit` golang	`v0.26.3`	0.28.1	✓	vulnerable code in binary	no	0.5%	`go.mod`	Dispute
High	`GHSA-4vrq-3vrq-g6gg` source CVE-2026-33748	`github.com/moby/buildkit` golang	`v0.26.3`	0.28.1	✓	vulnerable code in binary	no	0.5%	`go.mod`	Dispute
High	`GO-2026-6354` source CVE-2026-78662	`golang.org/x/crypto` golang	`v0.55.0`	0.56.0	✓	vulnerable code in binary	no	0.4%	`go.mod`	Dispute
High	`GO-2026-6355` source CVE-2026-56855	`golang.org/x/crypto` golang	`v0.55.0`	0.56.0	✓	vulnerable code in binary	no	0.5%	`go.mod`	Dispute
High	`GO-2026-6179` source CVE-2026-56865	`golang.org/x/mod` golang	`v0.38.0`	0.40.0	✓	vulnerable code in binary	no	0.1%	`go.mod`	Dispute
High	`GO-2026-6180` source CVE-2026-56864	`golang.org/x/mod` golang	`v0.38.0`	0.40.0	✓	vulnerable code in binary	no	0.3%	`go.mod`	Dispute
High	`GO-2026-6603` source CVE-2026-78659	`golang.org/x/net` golang	`v0.58.0`	0.60.0	✓	vulnerable code in binary	no	0.6%	`go.mod`	Dispute
High	`GO-2026-6610` source CVE-2026-78660	`golang.org/x/net` golang	`v0.58.0`	0.60.0	✓	vulnerable code in binary	no	0.4%	`go.mod`	Dispute
High	`GO-2026-6611` source CVE-2026-78669	`golang.org/x/net` golang	`v0.58.0`	0.60.0	✓	vulnerable code in binary	no	0.6%	`go.mod`	Dispute
High	`GO-2026-6617` source CVE-2026-97032	`golang.org/x/net` golang	`v0.58.0`	0.60.0	✓	vulnerable code in binary	no	0.5%	`go.mod`	Dispute
High	`GHSA-w3vv-58gj-gw77` source CVE-2026-104854	`nx` npm	`23.1.1`	23.1.2	✓	—	no	0.1%	`pnpm-lock.yaml`	Dispute
High	`GHSA-7w5x-hrqm-74c2` source CVE-2026-85730	`smol-toml` npm	`1.6.1`	1.7.1	✓	—	no	0.5%	`pnpm-lock.yaml`	Dispute
Medium	`GHSA-44g4-m2mj-wpvx` source CVE-2026-101899	`axios` npm	`1.18.1`	1.20.0	✓	—	no	0.5%	`pnpm-lock.yaml`	Dispute
Medium	`GHSA-4hqw-qxg8-jxx2` source CVE-2026-101900	`axios` npm	`1.18.1`	1.20.0	✓	—	no	0.5%	`pnpm-lock.yaml`	Dispute
Medium	`GHSA-9fr6-4gfg-395g` source CVE-2026-101902	`axios` npm	`1.18.1`	1.20.0	✓	—	no	0.4%	`pnpm-lock.yaml`	Dispute
Medium	`GHSA-j8rh-479h-cp32` source CVE-2026-101904	`axios` npm	`1.18.1`	1.20.0	✓	—	no	0.5%	`pnpm-lock.yaml`	Dispute
Medium	`GHSA-vh66-26gq-q6x8` source CVE-2026-101908	`axios` npm	`1.18.1`	1.20.0	✓	—	no	0.5%	`pnpm-lock.yaml`	Dispute
Medium	`GHSA-q2hr-2g5m-vwhr` source CVE-2026-102277	`brace-expansion` npm	`5.0.9`	5.0.12	✓	—	no	0.4%	`pnpm-lock.yaml`	Dispute
Medium	`CVE-2026-33481` source	`github.com/anchore/syft` golang	`v1.40.0`	1.42.3	✓	module in binary	no	0.4%	`go.mod`	Dispute
Medium	`GHSA-rjcw-vg7j-m9rc` source CVE-2026-33481	`github.com/anchore/syft` golang	`v1.40.0`	1.42.3	✓	module in binary	no	0.4%	`go.mod`	Dispute
Medium	`GHSA-7jxh-36q5-gcqv` source CVE-2026-53495	`github.com/containerd/containerd` golang	`v1.7.30`	1.7.35	✓	module in binary	no	0.2%	`go.mod`	Dispute
Medium	`GHSA-jpcc-p29g-p8mq` source CVE-2026-47262	`github.com/containerd/containerd` golang	`v1.7.30`	1.7.33	✓	module in binary	no	0.3%	`go.mod`	Dispute
Medium	`GHSA-pg57-6jwg-q645` source CVE-2026-53493	`github.com/containerd/containerd` golang	`v1.7.30`	1.7.36	✓	module in binary	no	0.4%	`go.mod`	Dispute
Medium	`GHSA-rp3h-jf77-q9p4` source CVE-2026-95838	`github.com/containerd/containerd` golang	`v1.7.30`	1.7.35	✓	module in binary	no	0.2%	`go.mod`	Dispute
Medium	`GO-2026-5622` source CVE-2026-53489, GHSA-rgh6-rfwx-v388	`github.com/containerd/containerd` golang	`v1.7.30`	no fix listed	✓	module in binary	no	0.2%	`go.mod`	Dispute
Medium	`GHSA-685w-q87j-wqw3` source CVE-2026-85747	`github.com/docker/distribution` golang	`v2.8.3+incompatible`	no fix listed	✓	vulnerable code not in binary	no	0.2%	`go.mod`	Dispute
Medium	`GHSA-pxq6-2prw-chj9` source CVE-2026-33997	`github.com/docker/docker` golang	`v28.5.2+incompatible`	no fix listed	✓	vulnerable code in binary	no	0.4%	`go.mod`	Dispute
Medium	`GHSA-vp62-88p7-qqf5` source CVE-2026-41568	`github.com/docker/docker` golang	`v28.5.2+incompatible`	no fix listed	✓	vulnerable code in binary	no	0.1%	`go.mod`	Dispute
Medium	`GHSA-4w3g-jfj2-cw2q` source CVE-2026-116585	`github.com/go-jose/go-jose/v4` golang	`v4.1.4`	4.1.5	✓	vulnerable code not in binary	no	0.3%	`go.mod`	Dispute
Medium	`GHSA-vvm8-gf78-28g4` source CVE-2026-116586	`github.com/go-jose/go-jose/v4` golang	`v4.1.4`	4.1.5	✓	vulnerable code not in binary	no	0.3%	`go.mod`	Dispute
Medium	`GHSA-gcjh-h69q-9w9g` source	`github.com/google/cel-go` golang	`v0.27.0`	0.29.0	✓	vulnerable code in binary	no	—	`go.mod`	Dispute
Medium	`GHSA-23wf-92cp-8pcj` source CVE-2026-118658	`github.com/labstack/echo/v4` golang	`v4.15.1`	4.15.2	✓	vulnerable code not in binary	no	0.2%	`go.mod`	Dispute
Medium	`GHSA-246p-cpwv-v3jq` source CVE-2026-118653	`github.com/labstack/echo/v4` golang	`v4.15.1`	no fix listed	✓	vulnerable code not in binary	no	0.4%	`go.mod`	Dispute
Medium	`GHSA-2ffq-g2xg-c22p` source CVE-2026-118657	`github.com/labstack/echo/v4` golang	`v4.15.1`	4.16.0	✓	vulnerable code not in binary	no	0.1%	`go.mod`	Dispute
Medium	`GHSA-3pmx-cf9f-34xr` source CVE-2026-118654	`github.com/labstack/echo/v4` golang	`v4.15.1`	4.16.0	✓	vulnerable code not in binary	no	0.3%	`go.mod`	Dispute
Medium	`GHSA-99jh-6h7p-pp36` source CVE-2026-118651	`github.com/labstack/echo/v4` golang	`v4.15.1`	no fix listed	✓	vulnerable code not in binary	no	0.2%	`go.mod`	Dispute
Medium	`GHSA-h9g5-28mm-hx3g` source CVE-2026-118652	`github.com/labstack/echo/v4` golang	`v4.15.1`	4.16.0	✓	vulnerable code not in binary	no	0.2%	`go.mod`	Dispute
Medium	`GHSA-r7w9-592q-9vg4` source CVE-2026-118266	`github.com/labstack/echo/v4` golang	`v4.15.1`	4.16.0	✓	vulnerable code not in binary	no	0.2%	`go.mod`	Dispute
Medium	`GHSA-v753-g4cw-jm48` source CVE-2026-118656	`github.com/labstack/echo/v4` golang	`v4.15.1`	4.16.0	✓	vulnerable code not in binary	no	0.2%	`go.mod`	Dispute
Medium	`GHSA-xwq5-6cqp-vx96` source CVE-2026-118655	`github.com/labstack/echo/v4` golang	`v4.15.1`	4.15.3	✓	vulnerable code not in binary	no	0.3%	`go.mod`	Dispute
Medium	`GHSA-7236-3392-c5c6` source CVE-2026-61711	`github.com/moby/buildkit` golang	`v0.26.3`	0.31.1	✓	vulnerable code in binary	no	0.4%	`go.mod`	Dispute
Medium	`GHSA-mjcv-p78q-w5fw` source CVE-2026-61801	`github.com/moby/sys/user` golang	`v0.4.0`	0.4.1	✓	vulnerable code in binary	no	0.1%	`go.mod`	Dispute
Medium	`GHSA-vvgj-x9jq-8cj9` source CVE-2026-40898	`github.com/quic-go/quic-go` golang	`v0.59.0`	0.59.1	✓	vulnerable code in binary	no	0.4%	`go.mod`	Dispute
Medium	`GO-2026-5320` source CVE-2026-5160, GHSA-c97m-vxhj-p7j6	`github.com/yuin/goldmark` golang	`v1.7.16`	1.7.17	✓	vulnerable code in binary	no	0.3%	`go.mod`	Dispute
Medium	`GHSA-g3hv-75wg-m249` source CVE-2026-118764	`minimatch` npm	`10.2.5`	11.0.1	✓	—	no	0.3%	`pnpm-lock.yaml`	Dispute
Medium	`GHSA-hrvq-x7jp-36xv` source CVE-2026-104853	`nx` npm	`23.1.1`	23.2.1	✓	—	no	0.2%	`pnpm-lock.yaml`	Dispute
Medium	`GHSA-r4xh-jqrq-34v2` source	`smol-toml` npm	`1.6.1`	1.9.0	✓	—	no	—	`pnpm-lock.yaml`	Dispute
Low	`GHSA-72x6-4j93-7w86` source CVE-2026-61712	`github.com/moby/buildkit` golang	`v0.26.3`	0.31.1	✓	vulnerable code in binary	no	0.4%	`go.mod`	Dispute
Unknown	`GO-2026-5932` source	`golang.org/x/crypto` golang	`v0.55.0`	no fix listed	✓	vulnerable code in binary	no	—	`go.mod`	Dispute
Unknown	`GO-2026-6860` source CVE-2026-78661	`golang.org/x/net` golang	`v0.58.0`	0.62.0	✓	vulnerable code in binary	no	0.2%	`go.mod`	Dispute
Unknown	`GO-2026-6866` source CVE-2026-97045	`golang.org/x/net` golang	`v0.58.0`	0.62.0	✓	vulnerable code in binary	no	0.2%	`go.mod`	Dispute

Second opinion: OSV-Scanner

OSV-Scanner found 83 advisories in the same files; 84 of Grype's matches are confirmed by it (marked ✓ above). 0 advisories were reported only by OSV-Scanner.

Vulnerable code in the released binary

govulncheck analyzed vet from vet_Linux_x86_64.tar.gz, built with go1.26.2. 58 advisories have vulnerable functions compiled into it: 34 in the Go standard library and 24 in dependencies.

Of the 61 Go advisories Grype matched in the source, 19 are in modules or code paths that are not in the shipped binary.

The Go linker removes unreachable functions, so a vulnerable function in the binary is likely reachable. Standard-library advisories are fixed by rebuilding with a newer Go release.

Advisory	Module	Version	Fixed in	Summary
`GO-2026-4918` CVE-2026-33814	`stdlib`	`v1.26.2`	v1.26.3	Infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in net/http/internal/http2 in golang.org/x/net
`GO-2026-4970` CVE-2026-39822	`stdlib`	`v1.26.2`	v1.26.5	Root escape via symlink plus trailing slash in os
`GO-2026-4971` CVE-2026-39836	`stdlib`	`v1.26.2`	v1.26.3	Panic in Dial and LookupPort when handling NUL byte on Windows in net
`GO-2026-4976` CVE-2026-39825	`stdlib`	`v1.26.2`	v1.26.3	ReverseProxy forwards queries with more than urlmaxqueryparams parameters in net/http/httputil
`GO-2026-4977` CVE-2026-42499	`stdlib`	`v1.26.2`	v1.26.3	Quadratic string concatenation in consumePhrase in net/mail
`GO-2026-4980` CVE-2026-39826	`stdlib`	`v1.26.2`	v1.26.3	Escaper bypass leads to XSS in html/template
`GO-2026-4981` CVE-2026-33811	`stdlib`	`v1.26.2`	v1.26.3	Crash when handling long CNAME response in net
`GO-2026-4982` CVE-2026-39823	`stdlib`	`v1.26.2`	v1.26.3	Bypass of meta content URL escaping causes XSS in html/template
`GO-2026-4986` CVE-2026-39820	`stdlib`	`v1.26.2`	v1.26.3	Quadratic string concatentation in consumeComment in net/mail
`GO-2026-5026` CVE-2026-39821	`stdlib`	`v1.26.2`	v1.26.6	Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna
`GO-2026-5037` CVE-2026-27145	`stdlib`	`v1.26.2`	v1.26.4	Inefficient candidate hostname parsing in crypto/x509
`GO-2026-5038` CVE-2026-42504	`stdlib`	`v1.26.2`	v1.26.4	Quadratic complexity in WordDecoder.DecodeHeader in mime
`GO-2026-5039` CVE-2026-42507	`stdlib`	`v1.26.2`	v1.26.4	Arbitrary inputs are included in errors without any escaping in net/textproto
`GO-2026-5856` CVE-2026-42505	`stdlib`	`v1.26.2`	v1.26.5	Invoking Encrypted Client Hello privacy leak in crypto/tls
`GO-2026-5942` CVE-2026-46600	`stdlib`	`v1.26.2`	v1.26.6	Parsing an invalid SVCB or HTTPS RR can panic in golang.org/x/net/dns/dnsmessage
`GO-2026-5972` CVE-2026-33818	`stdlib`	`v1.26.2`	v1.26.6	Enforce maximum recursion depth in encoding/asn1
`GO-2026-6088` CVE-2026-56859	`stdlib`	`v1.26.2`	v1.26.6	Add recursion depth guard during decode in encoding/xml
`GO-2026-6089` CVE-2026-56853	`stdlib`	`v1.26.2`	v1.26.6	Apply ReadHeaderTimeout when doing unencrypted HTTP/2 check in net/http
`GO-2026-6090` CVE-2026-56862	`stdlib`	`v1.26.2`	v1.26.6	Limit handshake messages we are willing to accept post-handshake in crypto/tls
`GO-2026-6091` CVE-2026-56858	`stdlib`	`v1.26.2`	v1.26.6	Fix Javascript regexp context tracking in html/template
`GO-2026-6218` CVE-2026-56860	`stdlib`	`v1.26.2`	v1.26.6	Avoid quadratic complexity in resolvePath in net/url
`GO-2026-6599` CVE-2026-94448	`stdlib`	`v1.26.2`	v1.26.9	Reset context tracking on consecutive template expressions in html/template
`GO-2026-6600` CVE-2026-97030	`stdlib`	`v1.26.2`	v1.26.9	Recognize yield as regexp preceder keyword in html/template
`GO-2026-6603` CVE-2026-78659	`stdlib`	`v1.26.2`	v1.26.9	HTTP/2 server memory exhaustion due to Trailer headers in net/http
`GO-2026-6605` CVE-2026-56866	`stdlib`	`v1.26.2`	v1.26.9	HTTP/1 client connection desynchronization after CONNECT rejection in net/http
`GO-2026-6607` CVE-2026-97031	`stdlib`	`v1.26.2`	v1.26.9	Reject malformed ECH outer extension references in crypto/tls
`GO-2026-6608` CVE-2026-94440	`stdlib`	`v1.26.2`	v1.26.9	Memory limit bypass when parsing MIME headers in net/textproto, mime/multipart
`GO-2026-6609` CVE-2026-78667	`stdlib`	`v1.26.2`	v1.26.9	Lack of limit on size of parsed Range headers in net/http
`GO-2026-6610` CVE-2026-78660	`stdlib`	`v1.26.2`	v1.26.9	HTTP/2 transport accepts malformed framing-related headers in net/http
`GO-2026-6611` CVE-2026-78669	`stdlib`	`v1.26.2`	v1.26.9	Excessive CPU consumption from repeated initial window changes in net/http
`GO-2026-6612` CVE-2026-78663	`stdlib`	`v1.26.2`	v1.26.9	Double flow control refund on HTTP/2 server streams in net/http
`GO-2026-6613` CVE-2026-94439	`stdlib`	`v1.26.2`	v1.26.9	HTTP/1 server connection desynchronization after 2xx CONNECT response in net/http
`GO-2026-6617` CVE-2026-97032	`stdlib`	`v1.26.2`	v1.26.9	HTTP/2 server crash due to HPACK encoder race in net/http
`GO-2026-6809` CVE-2026-111943	`stdlib`	`v1.26.2`	v1.26.10	Distrust compromised intermediate certificates in crypto/x509
`GO-2026-4514` CVE-2026-32285, GHSA-6g7g-w4f8-9c9x	`github.com/buger/jsonparser`	`v1.1.1`	v1.1.2	Denial of service in github.com/buger/jsonparser
`GO-2026-4883` CVE-2026-33997, GHSA-pxq6-2prw-chj9	`github.com/docker/docker`	`v28.5.2+incompatible`	—	Moby has an Off-by-one error in its plugin privilege validation in github.com/docker/docker
`GO-2026-4887` CVE-2026-34040, GHSA-x744-4wpc-v9h2	`github.com/docker/docker`	`v28.5.2+incompatible`	—	Moby has AuthZ plugin bypass when provided oversized request bodies in github.com/docker/docker
`GO-2026-5617` CVE-2026-42306, GHSA-rg2x-37c3-w2rh	`github.com/docker/docker`	`v28.5.2+incompatible`	—	Race condition in 'docker cp' in github.com/docker/docker allows bind mount redirection
`GO-2026-5668` CVE-2026-41568, GHSA-vp62-88p7-qqf5	`github.com/docker/docker`	`v28.5.2+incompatible`	—	Race condition in 'docker cp' in github.com/docker/docker allows creation of arbitrary files
`GO-2026-5746` CVE-2026-41567, GHSA-x86f-5xw2-fm2r	`github.com/docker/docker`	`v28.5.2+incompatible`	—	Docker: 'PUT /containers/{id}/archive' executes container binary on the host in github.com/docker/docker
`GO-2026-5208` CVE-2026-40890, GHSA-77fj-vx54-gvh7	`github.com/gomarkdown/markdown`	`v0.0.0-20260217112301-37c66b85d6ab`	v0.0.0-20260411013819-759bbc3e3207	Go Markdown has an out-of-bounds read in SmartypantsRenderer in github.com/gomarkdown/markdown
`GO-2026-6094` GHSA-gcjh-h69q-9w9g	`github.com/google/cel-go`	`v0.27.0`	v0.30.0	JSON private fields exposed via NativeTypes and ParseStructTag in github.com/google/cel-go
`GO-2026-5841` GHSA-259r-337f-4rfw	`github.com/klauspost/compress`	`v1.18.4`	v1.18.7	OOB read in github.com/klauspost/compress/s2
`GO-2026-6293` CVE-2026-55677, GHSA-vfp3-v2gw-7wfq	`github.com/labstack/echo/v4`	`v4.15.1`	v4.15.3	Encoded slash (%2F) bypasses route-level protection and exposes static files in github.com/labstack/echo/v4 and github.com/labstack/echo/v5
`GO-2026-4858` CVE-2026-33747, GHSA-4c29-8rgm-jvjj	`github.com/moby/buildkit`	`v0.26.3`	v0.28.1	BuildKit's Malicious frontend can cause file escape outside of storage root in github.com/moby/buildkit
`GO-2026-4859` CVE-2026-33748, GHSA-4vrq-3vrq-g6gg	`github.com/moby/buildkit`	`v0.26.3`	v0.28.1	BuildKit Git URL subdir component can cause access to restricted files in github.com/moby/buildkit
`GO-2026-6255` CVE-2026-61711, GHSA-7236-3392-c5c6	`github.com/moby/buildkit`	`v0.26.3`	v0.31.1	BuildKit: Custom frontend could bypass Seccomp/AppArmor in github.com/moby/buildkit
`GO-2026-6256` CVE-2026-61712, GHSA-72x6-4j93-7w86	`github.com/moby/buildkit`	`v0.26.3`	v0.31.1	BuildKit has a possible runtime DoS via unbounded group parsing in github.com/moby/buildkit
`GO-2026-6686` CVE-2026-61801, GHSA-mjcv-p78q-w5fw	`github.com/moby/sys/user`	`v0.4.0`	v0.4.1	Possible DoS via unbounded parsing of user and group database files in github.com/moby/sys/user
`GO-2026-5676` CVE-2026-40898, GHSA-vvgj-x9jq-8cj9	`github.com/quic-go/quic-go`	`v0.59.0`	v0.59.1	HTTP/3 QPACK Trailer Expansion Memory Exhaustion in github.com/quic-go/quic-go
`GO-2026-5320` CVE-2026-5160, GHSA-c97m-vxhj-p7j6	`github.com/yuin/goldmark`	`v1.7.16`	v1.7.17	Cross-site Scripting (XSS) in github.com/yuin/goldmark
`GO-2026-5932`	`golang.org/x/crypto`	`v0.55.0`	—	The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues
`GO-2026-6354` CVE-2026-78662	`golang.org/x/crypto`	`v0.55.0`	v0.56.0	Prevent DoS on deadlocked undecided channel in golang.org/x/crypto/ssh
`GO-2026-6355` CVE-2026-56855	`golang.org/x/crypto`	`v0.55.0`	v0.56.0	Prevent DoS on deadlocked established channel in golang.org/x/crypto/ssh
`GO-2026-6179` CVE-2026-56865	`golang.org/x/mod`	`v0.38.0`	v0.40.0	Fix transparency log tile verification bypass in golang.org/x/mod/sumdb/tlog
`GO-2026-6180` CVE-2026-56864	`golang.org/x/mod`	`v0.38.0`	v0.40.0	Ignore unrelated, unauthenticated hashes in Lookup in golang.org/x/mod/sumdb
`GO-2026-6860` CVE-2026-78661	`golang.org/x/net`	`v0.58.0`	v0.62.0	Avoid quadratic complexity when coalescing text nodes in html in golang.org/x/net
`GO-2026-6866` CVE-2026-97045	`golang.org/x/net`	`v0.58.0`	v0.62.0	Check all ancestor namespace transitions when rendering raw text in html in golang.org/x/net

Release integrity

Verdict: verified for vet_Linux_x86_64.tar.gz. The download matches GitHub's recorded digest.

Checksums file: yes
Signatures: no
SLSA provenance: no
SBOM published with the release: no

Check	Result	Detail
GitHub build attestation	verified	https://slsa.dev/provenance/v1
GitHub immutable release	verified	GitHub attests the file is unchanged since the release was published

Verified means a signature, provenance, or attestation was checked against an identity in safedep/vet's own GitHub Actions workflows.

Repository security (OpenSSF Scorecard)

Score 7.4/10, assessed 2026-11-01 (OpenSSF public dataset). Scorecard viewer

All checks

Check	Score	Reason
Code-Review	0	Found 2/26 approved changesets -- score normalized to 0
Signed-Releases	0	Project has not signed or included provenance with any releases.
Vulnerabilities	0	155 existing vulnerabilities detected
CII-Best-Practices	2	badge detected: InProgress
Branch-Protection	7	branch protection is not maximal on development and all release branches
Pinned-Dependencies	9	dependency not pinned by hash detected -- score normalized to 9
Security-Policy	9	security policy file detected
Binary-Artifacts	10	no binaries found in the repo
CI-Tests	10	26 out of 26 merged PRs checked by a CI test -- score normalized to 10
Contributors	10	project has 17 contributing companies or organizations
Dangerous-Workflow	10	no dangerous workflow patterns detected
Dependency-Update-Tool	10	update tool detected
Fuzzing	10	project is fuzzed
License	10	license file detected
Maintained	10	30 commit(s) and 5 issue activity found in the last 90 days -- score normalized to 10
Packaging	10	packaging workflow detected
SAST	10	SAST tool is run on all commits
Token-Permissions	10	GitHub workflow tokens follow principle of least privilege

GitHub Actions workflow audit (zizmor)

6 potential issues in 12 workflow files at this release: 5 high, 0 medium, 1 low severity (medium or high confidence only). Each is a pattern to review, not a confirmed vulnerability.

All findings

Severity	Rule	Location	Note
High	template-injection code injection via template expansion	`.github/workflows/container.yml:48`	this step
High	template-injection code injection via template expansion	`.github/workflows/container.yml:48`	this step
High	excessive-permissions overly broad permissions	`.github/workflows/gh-pages-deploy.yml:9`	pages: write is overly broad at the workflow level
High	excessive-permissions overly broad permissions	`.github/workflows/gh-pages-deploy.yml:10`	id-token: write is overly broad at the workflow level
High	bot-conditions spoofable bot actor check	`.github/workflows/vet-ci.yml:28`	this step
Low	adhoc-packages ad-hoc installation of packages	`.github/workflows/goreleaser.yml:157`	this step

Dependencies (712)

By ecosystem: golang 487, npm 200, github 25.

Licenses (as declared in the SBOM): unknown 641, MIT 50, BSD-3-Clause 16, Apache-2.0 5, BSD-2-Clause 2, sha256:b53dce8cb12bce0b96fc3e6cc59f9fb65f104dd0675c6a7102e19da89030b57c 1, ISC 1.

golang (487)

Name	Version	License	Declared in
`al.essio.dev/pkg/shellescape`	`v1.5.1`		`go.mod`
`ariga.io/atlas`	`v1.1.0`		`go.mod`
`bitbucket.org/creachadair/stringset`	`v0.0.14`		`go.mod`
`buf.build/gen/go/bufbuild/protovalidate/protocolbuffers/go`	`v1.36.12-20260415201107-50325440f8f2.1`		`go.mod`
`buf.build/gen/go/safedep/api/grpc/go`	`v1.6.2-20261001145028-14c0defb961c.1`		`go.mod`
`buf.build/gen/go/safedep/api/protocolbuffers/go`	`v1.36.12-20261001145028-14c0defb961c.2`		`go.mod`
`buf.build/go/protovalidate`	`v1.1.3`		`go.mod`
`cel.dev/expr`	`v0.25.2`		`go.mod`
`cloud.google.com/go`	`v0.123.0`		`go.mod`
`cloud.google.com/go/auth`	`v0.18.2`		`go.mod`
`cloud.google.com/go/auth/oauth2adapt`	`v0.2.8`		`go.mod`
`cloud.google.com/go/compute/metadata`	`v0.9.0`		`go.mod`
`cloud.google.com/go/iam`	`v1.5.3`		`go.mod`
`cloud.google.com/go/monitoring`	`v1.24.3`		`go.mod`
`cloud.google.com/go/storage`	`v1.60.0`		`go.mod`
`cyphar.com/go-pathrs`	`v0.2.4`		`go.mod`
`dario.cat/mergo`	`v1.0.2`		`go.mod`
`deps.dev/api/v3`	`v3.0.0-20260225225317-765e10b45d5b`		`go.mod`
`deps.dev/api/v3alpha`	`v0.0.0-20260225225317-765e10b45d5b`		`go.mod`
`deps.dev/util/maven`	`v0.0.0-20260225225317-765e10b45d5b`		`go.mod`
`deps.dev/util/pypi`	`v0.0.0-20260225225317-765e10b45d5b`		`go.mod`
`deps.dev/util/resolve`	`v0.0.0-20260225225317-765e10b45d5b`		`go.mod`
`deps.dev/util/semver`	`v0.0.0-20260225225317-765e10b45d5b`		`go.mod`
`entgo.io/ent`	`v0.14.6-0.20260218064135-ab0540611e15`		`go.mod`
`github.com/a-h/parse`	`v0.0.0-20250122154542-74294addb73e`	MIT	`go.mod`
`github.com/a-h/templ`	`v0.3.1001`	BSD-3-Clause, MIT	`go.mod`
`github.com/acobaugh/osrelease`	`v0.1.0`		`go.mod`
`github.com/AdaLogics/go-fuzz-headers`	`v0.0.0-20240806141605-e8a1dd7889d6`		`go.mod`
`github.com/AdamKorcz/go-118-fuzz-build`	`v0.0.0-20250520111509-a70c2aa677fa`		`go.mod`
`github.com/adrg/xdg`	`v0.5.3`		`go.mod`
`github.com/aead/serpent`	`v0.0.0-20160714141033-fba169763ea6`		`go.mod`
`github.com/afex/hystrix-go`	`v0.0.0-20180502004556-fa1af6a1f4f5`		`go.mod`
`github.com/agext/levenshtein`	`v1.2.3`		`go.mod`
`github.com/AlecAivazis/survey/v2`	`v2.3.7`		`go.mod`
`github.com/alecthomas/chroma/v2`	`v2.23.1`		`go.mod`
`github.com/alessio/shellescape`	`v1.4.1`	MIT	`go.mod`
`github.com/anchore/clio`	`v0.0.0-20260302164412-3ffbbe8c23a9`		`go.mod`
`github.com/anchore/fangs`	`v0.0.0-20260302165001-7b3d34e1cfff`		`go.mod`
`github.com/anchore/go-homedir`	`v0.0.0-20250319154043-c29668562e4d`		`go.mod`
`github.com/anchore/go-logger`	`v0.0.0-20260217144723-3bb369b8046c`		`go.mod`
`github.com/anchore/go-lzo`	`v0.1.0`		`go.mod`
`github.com/anchore/go-macholibre`	`v0.0.0-20260303191308-266b511890b2`		`go.mod`
`github.com/anchore/go-struct-converter`	`v0.1.0`		`go.mod`
`github.com/anchore/go-sync`	`v0.0.0-20260122203928-582959aeb913`		`go.mod`
`github.com/anchore/packageurl-go`	`v0.1.1-0.20250220190351-d62adb6e1115`		`go.mod`
`github.com/anchore/stereoscope`	`v0.1.17`		`go.mod`
`github.com/anchore/syft`	`v1.40.0`		`go.mod`
`github.com/andybalholm/brotli`	`v1.2.0`	MIT	`go.mod`
`github.com/anthropics/anthropic-sdk-go`	`v1.26.0`		`go.mod`
`github.com/antlr4-go/antlr/v4`	`v4.13.1`		`go.mod`
`github.com/apapsch/go-jsonmerge/v2`	`v2.0.0`		`go.mod`
`github.com/apparentlymart/go-textseg/v15`	`v15.0.0`		`go.mod`
`github.com/atotto/clipboard`	`v0.1.4`		`go.mod`
`github.com/aws/aws-sdk-go-v2`	`v1.41.5`		`go.mod`
`github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream`	`v1.7.8`		`go.mod`
`github.com/aws/aws-sdk-go-v2/config`	`v1.32.15`		`go.mod`
`github.com/aws/aws-sdk-go-v2/credentials`	`v1.19.14`		`go.mod`
`github.com/aws/aws-sdk-go-v2/feature/ec2/imds`	`v1.18.21`		`go.mod`
`github.com/aws/aws-sdk-go-v2/internal/configsources`	`v1.4.21`		`go.mod`
`github.com/aws/aws-sdk-go-v2/internal/endpoints/v2`	`v2.7.21`		`go.mod`
`github.com/aws/aws-sdk-go-v2/internal/v4a`	`v1.4.22`		`go.mod`
`github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding`	`v1.13.7`		`go.mod`
`github.com/aws/aws-sdk-go-v2/service/internal/checksum`	`v1.9.13`		`go.mod`
`github.com/aws/aws-sdk-go-v2/service/internal/presigned-url`	`v1.13.21`		`go.mod`
`github.com/aws/aws-sdk-go-v2/service/internal/s3shared`	`v1.19.21`		`go.mod`
`github.com/aws/aws-sdk-go-v2/service/s3`	`v1.99.0`		`go.mod`
`github.com/aws/aws-sdk-go-v2/service/signin`	`v1.0.9`		`go.mod`
`github.com/aws/aws-sdk-go-v2/service/sso`	`v1.30.15`		`go.mod`
`github.com/aws/aws-sdk-go-v2/service/ssooidc`	`v1.35.19`		`go.mod`
`github.com/aws/aws-sdk-go-v2/service/sts`	`v1.41.10`		`go.mod`
`github.com/aws/smithy-go`	`v1.24.2`		`go.mod`
`github.com/aymanbagabas/go-osc52/v2`	`v2.0.1`	MIT	`go.mod`
`github.com/aymerick/douceur`	`v0.2.0`		`go.mod`
`github.com/ayoubfaouzi/pkcs7`	`v0.2.2`		`go.mod`
`github.com/bahlo/generic-list-go`	`v0.2.0`		`go.mod`
`github.com/bazelbuild/buildtools`	`v0.0.0-20260211083412-859bfffeef82`		`go.mod`
`github.com/becheran/wildmatch-go`	`v1.0.0`		`go.mod`
`github.com/beorn7/perks`	`v1.0.1`		`go.mod`
`github.com/bgentry/go-netrc`	`v0.0.0-20140422174119-9fd32a8b3d3d`		`go.mod`
`github.com/bmatcuk/doublestar`	`v1.3.4`		`go.mod`
`github.com/bmatcuk/doublestar/v4`	`v4.10.0`		`go.mod`
`github.com/bodgit/plumbing`	`v1.3.0`		`go.mod`
`github.com/bodgit/sevenzip`	`v1.6.1`		`go.mod`
`github.com/bodgit/windows`	`v1.0.1`		`go.mod`
`github.com/boltdb/bolt`	`v1.3.1`		`go.mod`
`github.com/briandowns/spinner`	`v1.23.2`	Apache-2.0, sha256:b53dce8cb12bce0b96fc3e6cc59f9fb65f104dd0675c6a7102e19da89030b57c	`go.mod`
`github.com/buger/jsonparser`	`v1.1.1`		`go.mod`
`github.com/BurntSushi/toml`	`v1.6.0`		`go.mod`
`github.com/bytedance/gopkg`	`v0.1.3`		`go.mod`
`github.com/bytedance/sonic`	`v1.15.0`		`go.mod`
`github.com/bytedance/sonic/loader`	`v0.5.0`		`go.mod`
`github.com/caarlos0/env/v11`	`v11.4.0`		`go.mod`
`github.com/cactus/go-statsd-client/statsd`	`v0.0.0-20200423205355-cb0885a1018c`		`go.mod`
`github.com/cayleygraph/cayley`	`v0.7.7-0.20240706181042-81dcd7d73e45`		`go.mod`
`github.com/cayleygraph/quad`	`v1.3.0`		`go.mod`
`github.com/cenkalti/backoff/v4`	`v4.3.0`	MIT	`go.mod`
`github.com/cespare/xxhash/v2`	`v2.3.0`		`go.mod`
`github.com/chainguard-dev/git-urls`	`v1.0.2`		`go.mod`
`github.com/charmbracelet/bubbles`	`v1.0.0`		`go.mod`
`github.com/charmbracelet/bubbletea`	`v1.3.10`		`go.mod`
`github.com/charmbracelet/colorprofile`	`v0.4.2`	MIT	`go.mod`
`github.com/charmbracelet/glamour`	`v0.10.0`		`go.mod`
`github.com/charmbracelet/lipgloss`	`v1.1.1-0.20250404203927-76690c660834`	MIT	`go.mod`
`github.com/charmbracelet/x/ansi`	`v0.11.6`	MIT	`go.mod`
`github.com/charmbracelet/x/cellbuf`	`v0.0.15`	MIT	`go.mod`
`github.com/charmbracelet/x/exp/slice`	`v0.0.0-20260304084025-7dd5c0ab408e`		`go.mod`
`github.com/charmbracelet/x/term`	`v0.2.2`	MIT	`go.mod`
`github.com/chengxilo/virtualterm`	`v1.0.4`		`go.mod`
`github.com/cli/browser`	`v1.3.0`	BSD-2-Clause	`go.mod`
`github.com/cli/oauth`	`v1.2.2`		`go.mod`
`github.com/clipperhouse/displaywidth`	`v0.11.0`	MIT	`go.mod`
`github.com/clipperhouse/uax29/v2`	`v2.7.0`	MIT	`go.mod`
`github.com/cloudwego/base64x`	`v0.1.6`		`go.mod`
`github.com/cloudwego/eino`	`v0.7.37`		`go.mod`
`github.com/cloudwego/eino-ext/components/model/claude`	`v0.1.17`		`go.mod`
`github.com/cloudwego/eino-ext/components/model/gemini`	`v0.1.28`		`go.mod`
`github.com/cloudwego/eino-ext/components/model/openai`	`v0.1.8`		`go.mod`
`github.com/cloudwego/eino-ext/components/tool/mcp`	`v0.0.8`		`go.mod`
`github.com/cloudwego/eino-ext/libs/acl/openai`	`v0.1.13`		`go.mod`
`github.com/CloudyKit/fastprinter`	`v0.0.0-20251202014920-1725d2651bd4`		`go.mod`
`github.com/CloudyKit/jet/v6`	`v6.3.1`		`go.mod`
`github.com/cncf/xds/go`	`v0.0.0-20260202195803-dba9d589def2`		`go.mod`
`github.com/compose-spec/compose-go/v2`	`v2.10.1`		`go.mod`
`github.com/containerd/cgroups/v3`	`v3.1.0`		`go.mod`
`github.com/containerd/containerd`	`v1.7.30`		`go.mod`
`github.com/containerd/containerd/api`	`v1.10.0`		`go.mod`
`github.com/containerd/continuity`	`v0.4.5`		`go.mod`
`github.com/containerd/errdefs`	`v1.0.0`		`go.mod`
`github.com/containerd/errdefs/pkg`	`v0.3.0`		`go.mod`
`github.com/containerd/fifo`	`v1.1.0`		`go.mod`
`github.com/containerd/log`	`v0.1.0`		`go.mod`
`github.com/containerd/platforms`	`v1.0.0-rc.2`		`go.mod`
`github.com/containerd/stargz-snapshotter/estargz`	`v0.18.2`		`go.mod`
`github.com/containerd/ttrpc`	`v1.2.7`		`go.mod`
`github.com/containerd/typeurl/v2`	`v2.2.3`		`go.mod`
`github.com/cpuguy83/go-md2man/v2`	`v2.0.7`		`go.mod`
`github.com/creack/pty`	`v1.1.24`	MIT	`go.mod`
`github.com/CycloneDX/cyclonedx-go`	`v0.10.0`		`go.mod`
`github.com/cyphar/filepath-securejoin`	`v0.6.1`		`go.mod`
`github.com/danieljoos/wincred`	`v1.2.3`		`go.mod`
`github.com/DataDog/datadog-go`	`v4.8.3+incompatible`		`go.mod`
`github.com/davecgh/go-spew`	`v1.1.1`		`scripts/go.mod`
`github.com/davecgh/go-spew`	`v1.1.2-0.20180830191138-d8f796af33cc`	ISC	`go.mod`
`github.com/deepmap/oapi-codegen`	`v1.16.3`		`go.mod`
`github.com/deitch/magic`	`v0.0.0-20240306090643-c67ab88f10cb`		`go.mod`
`github.com/denisbrodbeck/machineid`	`v1.0.1`		`go.mod`
`github.com/diskfs/go-diskfs`	`v1.7.0`		`go.mod`
`github.com/distribution/reference`	`v0.6.0`		`go.mod`
`github.com/djherbis/times`	`v1.6.0`		`go.mod`
`github.com/dlclark/regexp2`	`v1.11.5`		`go.mod`
`github.com/docker/cli`	`v29.2.1+incompatible`		`go.mod`
`github.com/docker/distribution`	`v2.8.3+incompatible`		`go.mod`
`github.com/docker/docker`	`v28.5.2+incompatible`		`go.mod`
`github.com/docker/docker-credential-helpers`	`v0.9.5`		`go.mod`
`github.com/docker/go-connections`	`v0.6.0`		`go.mod`
`github.com/docker/go-events`	`v0.0.0-20250808211157-605354379745`		`go.mod`
`github.com/docker/go-units`	`v0.5.0`		`go.mod`
`github.com/dop251/goja`	`v0.0.0-20250114131315-46d383d606d3`		`go.mod`
`github.com/dsnet/compress`	`v0.0.2-0.20230904184137-39efe44ab707`		`go.mod`
`github.com/dsoprea/go-exfat`	`v0.0.0-20190906070738-5e932fbdb589`		`go.mod`
`github.com/dsoprea/go-logging`	`v0.0.0-20200710184922-b02d349568dd`		`go.mod`
`github.com/dustin/go-humanize`	`v1.0.1`		`go.mod`
`github.com/edsrzf/mmap-go`	`v1.2.0`		`go.mod`
`github.com/eino-contrib/jsonschema`	`v1.0.3`		`go.mod`
`github.com/elliotwutingfeng/asciiset`	`v0.0.0-20260129054604-cfde2086bc57`		`go.mod`
`github.com/envoyproxy/go-control-plane/envoy`	`v1.37.0`		`go.mod`
`github.com/envoyproxy/protoc-gen-validate`	`v1.3.3`		`go.mod`
`github.com/erikgeiser/coninput`	`v0.0.0-20211004153227-1c3628e74d0f`		`go.mod`
`github.com/erikvarga/go-rpmdb`	`v0.0.0-20250523120114-a15a62cd4593`		`go.mod`
`github.com/evanphx/json-patch`	`v0.5.2`		`go.mod`
`github.com/evilmartians/lefthook`	`v1.13.6`	MIT	`go.mod`
`github.com/facebookincubator/nvdtools`	`v0.1.5`		`go.mod`
`github.com/fatih/color`	`v1.18.0`	MIT	`go.mod`
`github.com/fatih/structs`	`v1.1.0`		`go.mod`
`github.com/felixge/fgprof`	`v0.9.5`		`go.mod`
`github.com/felixge/httpsnoop`	`v1.0.4`		`go.mod`
`github.com/flosch/pongo2/v4`	`v4.0.2`		`go.mod`
`github.com/fsnotify/fsnotify`	`v1.9.0`	BSD-3-Clause	`go.mod`
`github.com/gabriel-vasile/mimetype`	`v1.4.13`	MIT	`go.mod`
`github.com/GehirnInc/crypt`	`v0.0.0-20230320061759-8cc1b52080c5`		`go.mod`
`github.com/gin-contrib/sse`	`v1.1.0`		`go.mod`
`github.com/gin-gonic/gin`	`v1.12.0`		`go.mod`
`github.com/github/go-spdx/v2`	`v2.4.0`		`go.mod`
`github.com/go-errors/errors`	`v1.5.1`		`go.mod`
`github.com/go-git/gcfg`	`v1.5.1-0.20230307220236-3a3c6141e376`		`go.mod`
`github.com/go-git/go-billy/v5`	`v5.9.0`		`go.mod`
`github.com/go-git/go-git/v5`	`v5.19.2`		`go.mod`
`github.com/go-jose/go-jose/v4`	`v4.1.4`		`go.mod`
`github.com/go-json-experiment/json`	`v0.0.0-20250910080747-cc2cfa0554c3`	BSD-3-Clause	`go.mod`
`github.com/go-logr/logr`	`v1.4.4`		`go.mod`
`github.com/go-logr/stdr`	`v1.2.2`		`go.mod`
`github.com/go-ole/go-ole`	`v1.3.0`		`go.mod`
`github.com/go-openapi/inflect`	`v0.21.5`		`go.mod`
`github.com/go-playground/locales`	`v0.14.1`		`go.mod`
`github.com/go-playground/universal-translator`	`v0.18.1`		`go.mod`
`github.com/go-playground/validator/v10`	`v10.30.1`		`go.mod`
`github.com/go-restruct/restruct`	`v1.2.0-alpha`		`go.mod`
`github.com/go-resty/resty/v2`	`v2.17.2`		`go.mod`
`github.com/go-sourcemap/sourcemap`	`v2.1.4+incompatible`		`go.mod`
`github.com/go-viper/mapstructure/v2`	`v2.5.0`	MIT	`go.mod`
`github.com/gobwas/glob`	`v0.2.3`	MIT	`go.mod`
`github.com/goccy/go-json`	`v0.10.5`	MIT	`go.mod`
`github.com/goccy/go-yaml`	`v1.19.2`	MIT	`go.mod`
`github.com/godbus/dbus/v5`	`v5.1.0`		`go.mod`
`github.com/gofri/go-github-ratelimit`	`v1.1.1`		`go.mod`
`github.com/gogo/protobuf`	`v1.3.2`		`go.mod`
`github.com/gohugoio/hashstructure`	`v0.6.0`		`go.mod`
`github.com/gojek/heimdall`	`v5.0.2+incompatible`		`go.mod`
`github.com/gojek/heimdall/v7`	`v7.1.0`		`go.mod`
`github.com/gojek/valkyrie`	`v0.0.0-20190210220504-8f62c1e7ba45`		`go.mod`
`github.com/golang-jwt/jwt/v5`	`v5.3.1`		`go.mod`
`github.com/golang/groupcache`	`v0.0.0-20241129210726-2c02b8208cf8`		`go.mod`
`github.com/golang/protobuf`	`v1.5.4`		`go.mod`
`github.com/golang/snappy`	`v1.0.0`		`go.mod`
`github.com/gomarkdown/markdown`	`v0.0.0-20260217112301-37c66b85d6ab`		`go.mod`
`github.com/google/cel-go`	`v0.27.0`		`go.mod`
`github.com/google/go-cmp`	`v0.7.0`	BSD-3-Clause	`go.mod`
`github.com/google/go-containerregistry`	`v0.21.2`		`go.mod`
`github.com/google/go-github/v70`	`v70.0.0`		`go.mod`
`github.com/google/go-github/v74`	`v74.0.0`		`go.mod`
`github.com/google/go-querystring`	`v1.2.0`		`go.mod`
`github.com/google/licensecheck`	`v0.3.1`		`go.mod`
`github.com/google/osv-scalibr`	`v0.4.4`		`go.mod`
`github.com/google/osv-scanner`	`v1.9.2`		`go.mod`
`github.com/google/pprof`	`v0.0.0-20260302011040-a15ffb7f9dcc`		`go.mod`
`github.com/google/s2a-go`	`v0.1.9`		`go.mod`
`github.com/google/uuid`	`v1.6.0`		`go.mod`
`github.com/googleapis/enterprise-certificate-proxy`	`v0.3.13`		`go.mod`
`github.com/googleapis/gax-go/v2`	`v2.17.0`		`go.mod`
`github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp`	`v1.33.0`		`go.mod`
`github.com/GoogleCloudPlatform/opentelemetry-operations-go/exporter/metric`	`v0.55.0`		`go.mod`
`github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/resourcemapping`	`v0.55.0`		`go.mod`
`github.com/gookit/color`	`v1.6.0`		`go.mod`
`github.com/goph/emperror`	`v0.17.2`		`go.mod`
`github.com/gorilla/css`	`v1.0.1`		`go.mod`
`github.com/gorilla/websocket`	`v1.5.3`		`go.mod`
`github.com/grpc-ecosystem/go-grpc-middleware`	`v1.4.0`		`go.mod`
`github.com/hashicorp/aws-sdk-go-base/v2`	`v2.0.0-beta.71`		`go.mod`
`github.com/hashicorp/errwrap`	`v1.1.0`		`go.mod`
`github.com/hashicorp/go-cleanhttp`	`v0.5.2`		`go.mod`
`github.com/hashicorp/go-getter`	`v1.8.4`		`go.mod`
`github.com/hashicorp/go-multierror`	`v1.1.1`		`go.mod`
`github.com/hashicorp/go-version`	`v1.8.0`		`go.mod`
`github.com/hashicorp/golang-lru/v2`	`v2.0.7`		`go.mod`
`github.com/hashicorp/hcl/v2`	`v2.24.0`		`go.mod`
`github.com/hidal-go/hidalgo`	`v0.3.0`		`go.mod`
`github.com/iancoleman/strcase`	`v0.3.0`		`go.mod`
`github.com/ianlancetaylor/demangle`	`v0.0.0-20251118225945-96ee0021ea0f`		`go.mod`
`github.com/icholy/digest`	`v1.1.0`		`go.mod`
`github.com/inconshreveable/mousetrap`	`v1.1.0`		`go.mod`
`github.com/invopop/jsonschema`	`v0.13.0`		`go.mod`
`github.com/iris-contrib/schema`	`v0.0.6`		`go.mod`
`github.com/jbenet/go-context`	`v0.0.0-20150711004518-d14ea06fba99`		`go.mod`
`github.com/jedib0t/go-pretty/v6`	`v6.7.9`		`go.mod`
`github.com/jinzhu/copier`	`v0.4.0`		`go.mod`
`github.com/Joker/jade`	`v1.1.3`		`go.mod`
`github.com/josharian/intern`	`v1.0.0`		`go.mod`
`github.com/json-iterator/go`	`v1.1.12`		`go.mod`
`github.com/kaptinlin/go-i18n`	`v0.1.7`	MIT	`go.mod`
`github.com/kaptinlin/jsonschema`	`v0.4.14`	MIT	`go.mod`
`github.com/kaptinlin/messageformat-go`	`v0.4.0`	MIT	`go.mod`
`github.com/kataras/blocks`	`v0.0.12`		`go.mod`
`github.com/kataras/golog`	`v0.1.12`		`go.mod`
`github.com/kataras/iris/v12`	`v12.2.11`		`go.mod`
`github.com/kataras/pio`	`v0.0.13`		`go.mod`
`github.com/kataras/sitemap`	`v0.0.6`		`go.mod`
`github.com/kataras/tunnel`	`v0.0.4`		`go.mod`
`github.com/kballard/go-shellquote`	`v0.0.0-20180428030007-95032a82bc51`		`go.mod`
`github.com/klauspost/compress`	`v1.18.4`		`go.mod`
`github.com/klauspost/cpuid/v2`	`v2.3.0`		`go.mod`
`github.com/klauspost/pgzip`	`v1.2.6`		`go.mod`
`github.com/knadh/koanf/maps`	`v0.1.2`	MIT	`go.mod`
`github.com/knadh/koanf/parsers/json`	`v1.0.0`	MIT	`go.mod`
`github.com/knadh/koanf/parsers/toml/v2`	`v2.2.0`	MIT	`go.mod`
`github.com/knadh/koanf/parsers/yaml`	`v1.1.0`	MIT	`go.mod`
`github.com/knadh/koanf/providers/fs`	`v1.0.0`	MIT	`go.mod`
`github.com/knadh/koanf/v2`	`v2.3.0`	MIT	`go.mod`
`github.com/kr/pretty`	`v0.3.1`	MIT	`go.mod`
`github.com/kr/text`	`v0.2.0`	MIT	`go.mod`
`github.com/kubescape/go-git-url`	`v0.0.31`		`go.mod`
`github.com/labstack/echo/v4`	`v4.15.1`		`go.mod`
`github.com/labstack/gommon`	`v0.4.2`		`go.mod`
`github.com/leodido/go-urn`	`v1.4.0`		`go.mod`
`github.com/lucasb-eyer/go-colorful`	`v1.3.0`	MIT	`go.mod`
`github.com/lunixbochs/struc`	`v0.0.0-20241101090106-8d528fa2c543`		`go.mod`
`github.com/mailgun/raymond/v2`	`v2.0.48`		`go.mod`
`github.com/mailru/easyjson`	`v0.9.1`		`go.mod`
`github.com/MakeNowJust/heredoc`	`v1.0.0`	MIT	`go.mod`
`github.com/mark3labs/mcp-go`	`v0.44.1`		`go.mod`
`github.com/masahiro331/go-ext4-filesystem`	`v0.0.0-20240620024024-ca14e6327bbd`		`go.mod`
`github.com/Masterminds/semver/v3`	`v3.4.0`		`go.mod`
`github.com/mattn/go-colorable`	`v0.1.14`	MIT	`go.mod`
`github.com/mattn/go-isatty`	`v0.0.20`	MIT	`go.mod`
`github.com/mattn/go-localereader`	`v0.0.2-0.20220822084749-2491eb6c1c75`		`go.mod`
`github.com/mattn/go-runewidth`	`v0.0.20`	MIT	`go.mod`
`github.com/mattn/go-shellwords`	`v1.0.12`		`go.mod`
`github.com/mattn/go-sqlite3`	`v1.14.34`		`go.mod`
`github.com/mattn/go-tty`	`v0.0.7`		`go.mod`
`github.com/meguminnnnnnnnn/go-openai`	`v0.1.1`		`go.mod`
`github.com/mgutz/ansi`	`v0.0.0-20200706080929-d51e80ef957d`		`go.mod`
`github.com/mholt/archives`	`v0.1.5`		`go.mod`
`github.com/microcosm-cc/bluemonday`	`v1.0.27`		`go.mod`
`github.com/micromdm/plist`	`v0.2.2`		`go.mod`
`github.com/Microsoft/go-winio`	`v0.6.2`		`go.mod`
`github.com/Microsoft/hcsshim`	`v0.14.0-rc.1`		`go.mod`
`github.com/mikelolasagasti/xz`	`v1.0.1`		`go.mod`
`github.com/minio/minlz`	`v1.0.1`		`go.mod`
`github.com/mitchellh/colorstring`	`v0.0.0-20190213212951-d06e56a500db`	MIT	`go.mod`
`github.com/mitchellh/copystructure`	`v1.2.0`	MIT	`go.mod`
`github.com/mitchellh/go-homedir`	`v1.1.0`		`go.mod`
`github.com/mitchellh/go-wordwrap`	`v1.0.1`		`go.mod`
`github.com/mitchellh/mapstructure`	`v1.5.0`	MIT	`go.mod`
`github.com/mitchellh/reflectwalk`	`v1.0.2`	MIT	`go.mod`
`github.com/moby/buildkit`	`v0.26.3`		`go.mod`
`github.com/moby/docker-image-spec`	`v1.3.1`		`go.mod`
`github.com/moby/locker`	`v1.0.1`		`go.mod`
`github.com/moby/sys/mountinfo`	`v0.7.2`		`go.mod`
`github.com/moby/sys/sequential`	`v0.6.0`		`go.mod`
`github.com/moby/sys/signal`	`v0.7.1`		`go.mod`
`github.com/moby/sys/user`	`v0.4.0`		`go.mod`
`github.com/moby/sys/userns`	`v0.1.0`		`go.mod`
`github.com/modern-go/concurrent`	`v0.0.0-20180306012644-bacd9c7ef1dd`		`go.mod`
`github.com/modern-go/reflect2`	`v1.0.3-0.20250322232337-35a7c28c31ee`		`go.mod`
`github.com/muesli/ansi`	`v0.0.0-20230316100256-276c6243b2f6`		`go.mod`
`github.com/muesli/cancelreader`	`v0.2.2`		`go.mod`
`github.com/muesli/reflow`	`v0.3.0`		`go.mod`
`github.com/muesli/termenv`	`v0.16.0`	MIT	`go.mod`
`github.com/munnerz/goautoneg`	`v0.0.0-20191010083416-a7dc8b61c822`		`go.mod`
`github.com/natefinch/atomic`	`v1.0.1`	MIT	`go.mod`
`github.com/ncruces/go-strftime`	`v1.0.0`		`go.mod`
`github.com/nikolalohinski/gonja`	`v1.5.3`		`go.mod`
`github.com/nwaples/rardecode/v2`	`v2.2.2`		`go.mod`
`github.com/oklog/ulid/v2`	`v2.1.1`		`go.mod`
`github.com/opencontainers/go-digest`	`v1.0.0`		`go.mod`
`github.com/opencontainers/image-spec`	`v1.1.1`		`go.mod`
`github.com/opencontainers/runtime-spec`	`v1.2.1`		`go.mod`
`github.com/opencontainers/selinux`	`v1.13.1`		`go.mod`
`github.com/ossf/osv-schema/bindings/go`	`v0.0.0-20260304051245-ec3272c283e4`		`go.mod`
`github.com/owenrumney/go-sarif/v2`	`v2.3.3`		`go.mod`
`github.com/package-url/packageurl-go`	`v0.1.4`		`go.mod`
`github.com/pandatix/go-cvss`	`v0.6.2`		`go.mod`
`github.com/pborman/indent`	`v1.2.1`		`go.mod`
`github.com/pelletier/go-toml/v2`	`v2.2.4`	MIT	`go.mod`
`github.com/pierrec/lz4/v4`	`v4.1.25`		`go.mod`
`github.com/piprate/json-gold`	`v0.5.0`		`go.mod`
`github.com/pkg/errors`	`v0.9.1`		`go.mod`
`github.com/pkg/profile`	`v1.7.0`		`go.mod`
`github.com/pkg/xattr`	`v0.4.12`		`go.mod`
`github.com/planetscale/vtprotobuf`	`v0.6.1-0.20240319094008-0393e58bdf10`		`go.mod`
`github.com/pmezard/go-difflib`	`v1.0.0`		`scripts/go.mod`
`github.com/pmezard/go-difflib`	`v1.0.1-0.20181226105442-5d4384ee4fb2`	BSD-3-Clause	`go.mod`
`github.com/posthog/posthog-go`	`v1.10.0`		`go.mod`
`github.com/pquerna/cachecontrol`	`v0.2.0`		`go.mod`
`github.com/prometheus/client_golang`	`v1.23.2`		`go.mod`
`github.com/prometheus/client_model`	`v0.6.2`		`go.mod`
`github.com/prometheus/common`	`v0.66.1`		`go.mod`
`github.com/prometheus/procfs`	`v0.17.0`		`go.mod`
`github.com/quic-go/qpack`	`v0.6.0`		`go.mod`
`github.com/quic-go/quic-go`	`v0.59.0`		`go.mod`
`github.com/rcrowley/go-metrics`	`v0.0.0-20250401214520-65e299d6c5c9`		`go.mod`
`github.com/remyoudompheng/bigfft`	`v0.0.0-20230129092748-24d4a6f8daec`		`go.mod`
`github.com/rivo/uniseg`	`v0.4.7`	MIT	`go.mod`
`github.com/rogpeppe/go-internal`	`v1.14.1`	BSD-3-Clause	`go.mod`
`github.com/russross/blackfriday/v2`	`v2.1.0`		`go.mod`
`github.com/rust-secure-code/go-rustaudit`	`v0.0.0-20250226111315-e20ec32e963c`		`go.mod`
`github.com/safedep/code`	`v0.0.0-20260224174612-abe896956bc1`		`go.mod`
`github.com/safedep/dry`	`v0.0.0-20260430094716-037c59666d04`		`go.mod`
`github.com/saferwall/pe`	`v1.5.9`		`go.mod`
`github.com/sagikazarmark/locafero`	`v0.12.0`		`go.mod`
`github.com/saintfish/chardet`	`v0.0.0-20230101081208-5e3ef4b5456d`		`go.mod`
`github.com/santhosh-tekuri/jsonschema/v6`	`v6.0.2`		`go.mod`
`github.com/schollz/closestmatch`	`v2.1.0+incompatible`		`go.mod`
`github.com/schollz/progressbar/v3`	`v3.18.0`	MIT	`go.mod`
`github.com/scylladb/go-set`	`v1.0.3-0.20200225121959-cc7b2070d91e`		`go.mod`
`github.com/shirou/gopsutil`	`v3.21.11+incompatible`		`go.mod`
`github.com/Shopify/goreferrer`	`v0.0.0-20250617153402-88c1d9a79b05`		`go.mod`
`github.com/sirupsen/logrus`	`v1.9.4`		`go.mod`
`github.com/slongfield/pyfmt`	`v0.0.0-20220222012616-ea85ff4c361f`		`go.mod`
`github.com/smacker/go-tree-sitter`	`v0.0.0-20240827094217-dd81d9e9be82`		`go.mod`
`github.com/sony/gobreaker/v2`	`v2.4.0`		`go.mod`
`github.com/sorairolake/lzip-go`	`v0.3.8`		`go.mod`
`github.com/spdx/gordf`	`v0.0.0-20250128162952-000978ccd6fb`		`go.mod`
`github.com/spdx/tools-golang`	`v0.5.7`		`go.mod`
`github.com/spf13/afero`	`v1.15.0`	Apache-2.0	`go.mod`
`github.com/spf13/cast`	`v1.10.0`		`go.mod`
`github.com/spf13/cobra`	`v1.10.2`	Apache-2.0	`go.mod`
`github.com/spf13/pflag`	`v1.0.10`	BSD-3-Clause	`go.mod`
`github.com/spf13/viper`	`v1.21.0`		`go.mod`
`github.com/spiffe/go-spiffe/v2`	`v2.7.0`		`go.mod`
`github.com/STARRY-S/zip`	`v0.2.3`		`go.mod`
`github.com/stretchr/objx`	`v0.5.3`		`go.mod`
`github.com/stretchr/testify`	`v1.11.1`	MIT	`go.mod`
`github.com/subosito/gotenv`	`v1.6.0`		`go.mod`
`github.com/sylabs/squashfs`	`v1.0.6`		`go.mod`
`github.com/tdewolff/minify/v2`	`v2.24.10`		`go.mod`
`github.com/tdewolff/parse/v2`	`v2.8.10`		`go.mod`
`github.com/therootcompany/xz`	`v1.0.1`		`go.mod`
`github.com/thoas/go-funk`	`v0.9.3`		`go.mod`
`github.com/tidwall/gjson`	`v1.18.0`		`go.mod`
`github.com/tidwall/jsonc`	`v0.3.2`		`go.mod`
`github.com/tidwall/match`	`v1.2.0`		`go.mod`
`github.com/tidwall/pretty`	`v1.2.1`		`go.mod`
`github.com/tidwall/sjson`	`v1.2.5`		`go.mod`
`github.com/tink-crypto/tink-go/v2`	`v2.6.0`		`go.mod`
`github.com/tklauser/go-sysconf`	`v0.3.16`		`go.mod`
`github.com/tklauser/numcpus`	`v0.11.0`		`go.mod`
`github.com/tonistiigi/go-csvvalue`	`v0.0.0-20240814133006-030d3b2625d0`		`go.mod`
`github.com/twitchyliquid64/golang-asm`	`v0.15.1`		`go.mod`
`github.com/tylertreat/BoomFilters`	`v0.0.0-20210315201527-1a82519a3e43`		`go.mod`
`github.com/ugorji/go/codec`	`v1.3.1`		`go.mod`
`github.com/ulikunitz/xz`	`v0.5.15`		`go.mod`
`github.com/valyala/bytebufferpool`	`v1.0.0`		`go.mod`
`github.com/valyala/fasttemplate`	`v1.2.2`		`go.mod`
`github.com/vbatts/tar-split`	`v0.12.2`		`go.mod`
`github.com/vifraa/gopom`	`v1.0.0`		`go.mod`
`github.com/vmihailenco/msgpack/v5`	`v5.4.1`		`go.mod`
`github.com/vmihailenco/tagparser/v2`	`v2.0.0`		`go.mod`
`github.com/wagoodman/go-partybus`	`v0.0.0-20230516145632-8ccac152c651`		`go.mod`
`github.com/wagoodman/go-progress`	`v0.0.0-20260303201901-10176f79b2c0`		`go.mod`
`github.com/wk8/go-ordered-map/v2`	`v2.1.8`		`go.mod`
`github.com/xhit/go-str2duration/v2`	`v2.1.0`		`go.mod`
`github.com/xo/terminfo`	`v0.0.0-20220910002029-abceb7e1c41e`	MIT	`go.mod`
`github.com/xyproto/randomstring`	`v1.0.5`	BSD-3-Clause	`go.mod`
`github.com/yargevad/filepathx`	`v1.0.0`		`go.mod`
`github.com/yosida95/uritemplate/v3`	`v3.0.2`		`go.mod`
`github.com/yosssi/ace`	`v0.0.5`		`go.mod`
`github.com/yuin/goldmark`	`v1.7.16`		`go.mod`
`github.com/yuin/goldmark-emoji`	`v1.0.6`		`go.mod`
`github.com/yusufpapurcu/wmi`	`v1.2.4`		`go.mod`
`github.com/zalando/go-keyring`	`v0.2.6`		`go.mod`
`github.com/zclconf/go-cty`	`v1.18.0`		`go.mod`
`github.com/zclconf/go-cty-yaml`	`v1.2.0`		`go.mod`
`go.etcd.io/bbolt`	`v1.4.3`		`go.mod`
`go.mongodb.org/mongo-driver/v2`	`v2.5.0`		`go.mod`
`go.opencensus.io`	`v0.24.0`		`go.mod`
`go.opentelemetry.io/auto/sdk`	`v1.2.1`		`go.mod`
`go.opentelemetry.io/contrib/detectors/gcp`	`v1.44.0`		`go.mod`
`go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc`	`v0.66.0`		`go.mod`
`go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp`	`v0.66.0`		`go.mod`
`go.opentelemetry.io/otel`	`v1.45.0`		`go.mod`
`go.opentelemetry.io/otel/metric`	`v1.45.0`		`go.mod`
`go.opentelemetry.io/otel/sdk`	`v1.45.0`		`go.mod`
`go.opentelemetry.io/otel/sdk/metric`	`v1.45.0`		`go.mod`
`go.opentelemetry.io/otel/trace`	`v1.45.0`		`go.mod`
`go.uber.org/multierr`	`v1.11.0`		`go.mod`
`go.uber.org/zap`	`v1.27.1`		`go.mod`
`go.yaml.in/yaml/v2`	`v2.4.3`		`go.mod`
`go.yaml.in/yaml/v3`	`v3.0.4`	Apache-2.0, MIT	`go.mod`
`go.yaml.in/yaml/v4`	`v4.0.0-rc.4`		`go.mod`
`go4.org`	`v0.0.0-20260112195520-a5071408f32f`		`go.mod`
`golang.org/x/arch`	`v0.24.0`		`go.mod`
`golang.org/x/crypto`	`v0.55.0`		`go.mod`
`golang.org/x/exp`	`v0.0.0-20260410095643-746e56fc9e2f`	BSD-3-Clause	`go.mod`
`golang.org/x/mod`	`v0.38.0`	BSD-3-Clause	`go.mod`
`golang.org/x/net`	`v0.58.0`	BSD-3-Clause	`go.mod`
`golang.org/x/oauth2`	`v0.36.0`		`go.mod`
`golang.org/x/sync`	`v0.22.0`	BSD-3-Clause	`go.mod`
`golang.org/x/sys`	`v0.47.0`	BSD-3-Clause	`go.mod`
`golang.org/x/telemetry`	`v0.0.0-20260708182218-49f421fb7959`		`go.mod`
`golang.org/x/term`	`v0.45.0`	BSD-3-Clause	`go.mod`
`golang.org/x/text`	`v0.41.0`	BSD-3-Clause	`go.mod`
`golang.org/x/time`	`v0.14.0`		`go.mod`
`golang.org/x/tools`	`v0.48.0`	BSD-3-Clause	`go.mod`
`golang.org/x/vuln`	`v1.1.4`		`go.mod`
`golang.org/x/xerrors`	`v0.0.0-20240903120638-7835f813f4da`		`go.mod`
`google.golang.org/api`	`v0.269.0`		`go.mod`
`google.golang.org/genai`	`v1.48.0`		`go.mod`
`google.golang.org/genproto`	`v0.0.0-20260226221140-a57be14db171`		`go.mod`
`google.golang.org/genproto/googleapis/api`	`v0.0.0-20260526163538-3dc84a4a5aaa`		`go.mod`
`google.golang.org/genproto/googleapis/rpc`	`v0.0.0-20260526163538-3dc84a4a5aaa`		`go.mod`
`google.golang.org/grpc`	`v1.83.2`		`go.mod`
`google.golang.org/protobuf`	`v1.36.12`		`go.mod`
`gopkg.in/check.v1`	`v1.0.0-20201130134442-10cb98267c6c`	BSD-2-Clause	`go.mod`
`gopkg.in/ini.v1`	`v1.67.1`		`go.mod`
`gopkg.in/natefinch/lumberjack.v2`	`v2.2.1`		`go.mod`
`gopkg.in/warnings.v0`	`v0.1.2`		`go.mod`
`gopkg.in/yaml.v2`	`v2.4.0`		`go.mod`
`gopkg.in/yaml.v3`	`v3.0.1`	Apache-2.0, MIT	`go.mod`
`k8s.io/utils`	`v0.0.0-20260210185600-b8788abfbbc2`		`go.mod`
`modernc.org/libc`	`v1.70.0`		`go.mod`
`modernc.org/mathutil`	`v1.7.1`		`go.mod`
`modernc.org/memory`	`v1.11.0`		`go.mod`
`modernc.org/sqlite`	`v1.48.1`		`go.mod`
`osv.dev/bindings/go`	`v0.0.0-20260304060910-4fcedbd3c18b`		`go.mod`
`sigs.k8s.io/yaml`	`v1.6.0`		`go.mod`
`www.velocidex.com/golang/go-ntfs`	`v0.2.0`		`go.mod`
`www.velocidex.com/golang/regparser`	`v0.0.0-20250203141505-31e704a67ef7`		`go.mod`

npm (200)

Name	Version	Declared in
`@babel/generator`	`8.0.0-rc.5`	`pnpm-lock.yaml`
`@babel/helper-string-parser`	`8.0.0-rc.6`	`pnpm-lock.yaml`
`@babel/helper-validator-identifier`	`8.0.0-rc.5`	`pnpm-lock.yaml`
`@babel/helper-validator-identifier`	`8.0.0-rc.6`	`pnpm-lock.yaml`
`@babel/parser`	`8.0.0-rc.4`	`pnpm-lock.yaml`
`@babel/parser`	`8.0.0-rc.6`	`pnpm-lock.yaml`
`@babel/types`	`8.0.0-rc.6`	`pnpm-lock.yaml`
`@emnapi/core`	`1.10.0`	`pnpm-lock.yaml`
`@emnapi/core`	`1.4.5`	`pnpm-lock.yaml`
`@emnapi/runtime`	`1.10.0`	`pnpm-lock.yaml`
`@emnapi/runtime`	`1.4.5`	`pnpm-lock.yaml`
`@emnapi/wasi-threads`	`1.0.4`	`pnpm-lock.yaml`
`@emnapi/wasi-threads`	`1.2.1`	`pnpm-lock.yaml`
`@jest/diff-sequences`	`30.0.1`	`pnpm-lock.yaml`
`@jridgewell/gen-mapping`	`0.3.13`	`pnpm-lock.yaml`
`@jridgewell/resolve-uri`	`3.1.2`	`pnpm-lock.yaml`
`@jridgewell/sourcemap-codec`	`1.5.5`	`pnpm-lock.yaml`
`@jridgewell/trace-mapping`	`0.3.31`	`pnpm-lock.yaml`
`@napi-rs/wasm-runtime`	`0.2.4`	`pnpm-lock.yaml`
`@napi-rs/wasm-runtime`	`1.1.4`	`pnpm-lock.yaml`
`@nx/nx-darwin-arm64`	`23.1.1`	`pnpm-lock.yaml`
`@nx/nx-darwin-x64`	`23.1.1`	`pnpm-lock.yaml`
`@nx/nx-freebsd-x64`	`23.1.1`	`pnpm-lock.yaml`
`@nx/nx-linux-arm-gnueabihf`	`23.1.1`	`pnpm-lock.yaml`
`@nx/nx-linux-arm64-gnu`	`23.1.1`	`pnpm-lock.yaml`
`@nx/nx-linux-arm64-musl`	`23.1.1`	`pnpm-lock.yaml`
`@nx/nx-linux-x64-gnu`	`23.1.1`	`pnpm-lock.yaml`
`@nx/nx-linux-x64-musl`	`23.1.1`	`pnpm-lock.yaml`
`@nx/nx-win32-arm64-msvc`	`23.1.1`	`pnpm-lock.yaml`
`@nx/nx-win32-x64-msvc`	`23.1.1`	`pnpm-lock.yaml`
`@oxc-project/types`	`0.133.0`	`pnpm-lock.yaml`
`@quansync/fs`	`1.0.0`	`pnpm-lock.yaml`
`@rolldown/binding-android-arm64`	`1.0.3`	`pnpm-lock.yaml`
`@rolldown/binding-darwin-arm64`	`1.0.3`	`pnpm-lock.yaml`
`@rolldown/binding-darwin-x64`	`1.0.3`	`pnpm-lock.yaml`
`@rolldown/binding-freebsd-x64`	`1.0.3`	`pnpm-lock.yaml`
`@rolldown/binding-linux-arm-gnueabihf`	`1.0.3`	`pnpm-lock.yaml`
`@rolldown/binding-linux-arm64-gnu`	`1.0.3`	`pnpm-lock.yaml`
`@rolldown/binding-linux-arm64-musl`	`1.0.3`	`pnpm-lock.yaml`
`@rolldown/binding-linux-ppc64-gnu`	`1.0.3`	`pnpm-lock.yaml`
`@rolldown/binding-linux-s390x-gnu`	`1.0.3`	`pnpm-lock.yaml`
`@rolldown/binding-linux-x64-gnu`	`1.0.3`	`pnpm-lock.yaml`
`@rolldown/binding-linux-x64-musl`	`1.0.3`	`pnpm-lock.yaml`
`@rolldown/binding-openharmony-arm64`	`1.0.3`	`pnpm-lock.yaml`
`@rolldown/binding-wasm32-wasi`	`1.0.3`	`pnpm-lock.yaml`
`@rolldown/binding-win32-arm64-msvc`	`1.0.3`	`pnpm-lock.yaml`
`@rolldown/binding-win32-x64-msvc`	`1.0.3`	`pnpm-lock.yaml`
`@rolldown/pluginutils`	`1.0.1`	`pnpm-lock.yaml`
`@tybys/wasm-util`	`0.10.2`	`pnpm-lock.yaml`
`@tybys/wasm-util`	`0.9.0`	`pnpm-lock.yaml`
`@types/estree`	`1.0.9`	`pnpm-lock.yaml`
`@types/jsesc`	`2.5.1`	`pnpm-lock.yaml`
`@types/node`	`20.19.41`	`pnpm-lock.yaml`
`@types/node`	`25.9.1`	`pnpm-lock.yaml`
`@yarnpkg/lockfile`	`1.1.0`	`pnpm-lock.yaml`
`@zkochan/js-yaml`	`0.0.7`	`pnpm-lock.yaml`
`agent-base`	`6.0.2`	`pnpm-lock.yaml`
`ansi-colors`	`4.1.3`	`pnpm-lock.yaml`
`ansi-regex`	`5.0.1`	`pnpm-lock.yaml`
`ansi-styles`	`4.3.0`	`pnpm-lock.yaml`
`ansis`	`4.3.0`	`pnpm-lock.yaml`
`argparse`	`2.0.1`	`pnpm-lock.yaml`
`ast-kit`	`3.0.0-beta.1`	`pnpm-lock.yaml`
`asynckit`	`0.4.0`	`pnpm-lock.yaml`
`axios`	`1.18.1`	`pnpm-lock.yaml`
`balanced-match`	`4.0.3`	`pnpm-lock.yaml`
`base64-js`	`1.5.1`	`pnpm-lock.yaml`
`birpc`	`4.0.0`	`pnpm-lock.yaml`
`bl`	`4.1.0`	`pnpm-lock.yaml`
`brace-expansion`	`5.0.9`	`pnpm-lock.yaml`
`buffer`	`5.7.1`	`pnpm-lock.yaml`
`bundle-name`	`4.1.0`	`pnpm-lock.yaml`
`cac`	`7.0.0`	`pnpm-lock.yaml`
`call-bind-apply-helpers`	`1.0.2`	`pnpm-lock.yaml`
`chalk`	`4.1.2`	`pnpm-lock.yaml`
`cli-cursor`	`3.1.0`	`pnpm-lock.yaml`
`cli-spinners`	`2.6.1`	`pnpm-lock.yaml`
`cliui`	`8.0.1`	`pnpm-lock.yaml`
`clone`	`1.0.4`	`pnpm-lock.yaml`
`color-convert`	`2.0.1`	`pnpm-lock.yaml`
`color-name`	`1.1.4`	`pnpm-lock.yaml`
`combined-stream`	`1.0.8`	`pnpm-lock.yaml`
`debug`	`4.4.3`	`pnpm-lock.yaml`
`default-browser`	`5.2.1`	`pnpm-lock.yaml`
`default-browser-id`	`5.0.0`	`pnpm-lock.yaml`
`defaults`	`1.0.4`	`pnpm-lock.yaml`
`define-lazy-prop`	`3.0.0`	`pnpm-lock.yaml`
`defu`	`6.1.7`	`pnpm-lock.yaml`
`delayed-stream`	`1.0.0`	`pnpm-lock.yaml`
`dotenv`	`16.4.7`	`pnpm-lock.yaml`
`dotenv-expand`	`12.0.3`	`pnpm-lock.yaml`
`dts-resolver`	`3.0.0`	`pnpm-lock.yaml`
`dunder-proto`	`1.0.1`	`pnpm-lock.yaml`
`ejs`	`5.0.1`	`pnpm-lock.yaml`
`emoji-regex`	`8.0.0`	`pnpm-lock.yaml`
`empathic`	`2.0.1`	`pnpm-lock.yaml`
`end-of-stream`	`1.4.5`	`pnpm-lock.yaml`
`enquirer`	`2.3.6`	`pnpm-lock.yaml`
`es-define-property`	`1.0.1`	`pnpm-lock.yaml`
`es-errors`	`1.3.0`	`pnpm-lock.yaml`
`es-object-atoms`	`1.1.1`	`pnpm-lock.yaml`
`es-set-tostringtag`	`2.1.0`	`pnpm-lock.yaml`
`escalade`	`3.2.0`	`pnpm-lock.yaml`
`escape-string-regexp`	`1.0.5`	`pnpm-lock.yaml`
`estree-walker`	`3.0.3`	`pnpm-lock.yaml`
`fdir`	`6.5.0`	`pnpm-lock.yaml`
`figures`	`3.2.0`	`pnpm-lock.yaml`
`flat`	`5.0.2`	`pnpm-lock.yaml`
`follow-redirects`	`1.16.0`	`pnpm-lock.yaml`
`form-data`	`4.0.6`	`pnpm-lock.yaml`
`fs-constants`	`1.0.0`	`pnpm-lock.yaml`
`function-bind`	`1.1.2`	`pnpm-lock.yaml`
`get-caller-file`	`2.0.5`	`pnpm-lock.yaml`
`get-intrinsic`	`1.3.0`	`pnpm-lock.yaml`
`get-proto`	`1.0.1`	`pnpm-lock.yaml`
`get-tsconfig`	`5.0.0-beta.5`	`pnpm-lock.yaml`
`gopd`	`1.2.0`	`pnpm-lock.yaml`
`has-flag`	`4.0.0`	`pnpm-lock.yaml`
`has-symbols`	`1.1.0`	`pnpm-lock.yaml`
`has-tostringtag`	`1.0.2`	`pnpm-lock.yaml`
`hasown`	`2.0.2`	`pnpm-lock.yaml`
`hasown`	`2.0.4`	`pnpm-lock.yaml`
`hookable`	`6.1.1`	`pnpm-lock.yaml`
`https-proxy-agent`	`5.0.1`	`pnpm-lock.yaml`
`ieee754`	`1.2.1`	`pnpm-lock.yaml`
`ignore`	`7.0.5`	`pnpm-lock.yaml`
`import-without-cache`	`0.4.0`	`pnpm-lock.yaml`
`inherits`	`2.0.4`	`pnpm-lock.yaml`
`is-docker`	`3.0.0`	`pnpm-lock.yaml`
`is-fullwidth-code-point`	`3.0.0`	`pnpm-lock.yaml`
`is-inside-container`	`1.0.0`	`pnpm-lock.yaml`
`is-interactive`	`1.0.0`	`pnpm-lock.yaml`
`is-unicode-supported`	`0.1.0`	`pnpm-lock.yaml`
`is-wsl`	`3.1.0`	`pnpm-lock.yaml`
`isexe`	`2.0.0`	`pnpm-lock.yaml`
`jsesc`	`3.1.0`	`pnpm-lock.yaml`
`json5`	`2.2.3`	`pnpm-lock.yaml`
`jsonc-parser`	`3.3.1`	`pnpm-lock.yaml`
`lines-and-columns`	`2.0.3`	`pnpm-lock.yaml`
`log-symbols`	`4.1.0`	`pnpm-lock.yaml`
`math-intrinsics`	`1.1.0`	`pnpm-lock.yaml`
`mime-db`	`1.52.0`	`pnpm-lock.yaml`
`mime-types`	`2.1.35`	`pnpm-lock.yaml`
`mimic-fn`	`2.1.0`	`pnpm-lock.yaml`
`minimatch`	`10.2.5`	`pnpm-lock.yaml`
`minimist`	`1.2.8`	`pnpm-lock.yaml`
`ms`	`2.1.3`	`pnpm-lock.yaml`
`npm-run-path`	`4.0.1`	`pnpm-lock.yaml`
`nx`	`23.1.1`	`pnpm-lock.yaml`
`obug`	`2.1.1`	`pnpm-lock.yaml`
`once`	`1.4.0`	`pnpm-lock.yaml`
`onetime`	`5.1.2`	`pnpm-lock.yaml`
`open`	`10.1.0`	`pnpm-lock.yaml`
`ora`	`5.4.1`	`pnpm-lock.yaml`
`path-key`	`3.1.1`	`pnpm-lock.yaml`
`pathe`	`2.0.3`	`pnpm-lock.yaml`
`picocolors`	`1.1.1`	`pnpm-lock.yaml`
`picomatch`	`4.0.4`	`pnpm-lock.yaml`
`proxy-from-env`	`2.1.0`	`pnpm-lock.yaml`
`quansync`	`1.0.0`	`pnpm-lock.yaml`
`readable-stream`	`3.6.2`	`pnpm-lock.yaml`
`require-directory`	`2.1.1`	`pnpm-lock.yaml`
`resolve-pkg-maps`	`1.0.0`	`pnpm-lock.yaml`
`resolve.exports`	`2.0.3`	`pnpm-lock.yaml`
`restore-cursor`	`3.1.0`	`pnpm-lock.yaml`
`rolldown`	`1.0.3`	`pnpm-lock.yaml`
`rolldown-plugin-dts`	`0.25.1`	`pnpm-lock.yaml`
`run-applescript`	`7.0.0`	`pnpm-lock.yaml`
`safe-buffer`	`5.2.1`	`pnpm-lock.yaml`
`semver`	`7.8.1`	`pnpm-lock.yaml`
`semver`	`7.8.4`	`pnpm-lock.yaml`
`signal-exit`	`3.0.7`	`pnpm-lock.yaml`
`smol-toml`	`1.6.1`	`pnpm-lock.yaml`
`string-width`	`4.2.3`	`pnpm-lock.yaml`
`string_decoder`	`1.3.0`	`pnpm-lock.yaml`
`strip-ansi`	`6.0.1`	`pnpm-lock.yaml`
`strip-bom`	`3.0.0`	`pnpm-lock.yaml`
`supports-color`	`7.2.0`	`pnpm-lock.yaml`
`tar-stream`	`2.2.0`	`pnpm-lock.yaml`
`tinyexec`	`1.2.3`	`pnpm-lock.yaml`
`tinyglobby`	`0.2.16`	`pnpm-lock.yaml`
`tmp`	`0.2.7`	`pnpm-lock.yaml`
`tree-kill`	`1.2.2`	`pnpm-lock.yaml`
`tsconfig-paths`	`4.2.0`	`pnpm-lock.yaml`
`tsdown`	`0.22.0`	`pnpm-lock.yaml`
`tslib`	`2.8.1`	`pnpm-lock.yaml`
`typescript`	`6.0.3`	`pnpm-lock.yaml`
`unconfig-core`	`7.5.0`	`pnpm-lock.yaml`
`undici-types`	`6.21.0`	`pnpm-lock.yaml`
`undici-types`	`7.24.6`	`pnpm-lock.yaml`
`unrun`	`0.3.1`	`pnpm-lock.yaml`
`util-deprecate`	`1.0.2`	`pnpm-lock.yaml`
`wcwidth`	`1.0.1`	`pnpm-lock.yaml`
`which`	`3.0.1`	`pnpm-lock.yaml`
`wrap-ansi`	`7.0.0`	`pnpm-lock.yaml`
`wrappy`	`1.0.2`	`pnpm-lock.yaml`
`y18n`	`5.0.8`	`pnpm-lock.yaml`
`yaml`	`2.9.0`	`pnpm-lock.yaml`
`yargs`	`17.7.2`	`pnpm-lock.yaml`
`yargs-parser`	`21.1.1`	`pnpm-lock.yaml`

github (25)

Name	Version	Declared in
`actions/attest-build-provenance`	`v4.1.0`	`.github/workflows/goreleaser.yml`
`actions/cache`	`v5.0.5`	`.github/workflows/ci.yml`
`actions/checkout`	`v6.0.2`	`.github/workflows/ci.yml`
`actions/configure-pages`	`v5`	`.github/workflows/gh-pages-deploy.yml`
`actions/dependency-review-action`	`v3`	`.github/workflows/dependency-review.yml`
`actions/deploy-pages`	`v4`	`.github/workflows/gh-pages-deploy.yml`
`actions/download-artifact`	`v5.0.0`	`.github/workflows/goreleaser.yml`
`actions/jekyll-build-pages`	`v1`	`.github/workflows/gh-pages-deploy.yml`
`actions/setup-go`	`v6.4.0`	`.github/workflows/ci.yml`
`actions/setup-node`	`v6.4.0`	`.github/workflows/ci.yml`
`actions/upload-artifact`	`v4.6.0`	`.github/workflows/scorecard.yml`
`actions/upload-artifact`	`v4.6.2`	`.github/workflows/goreleaser.yml`
`actions/upload-pages-artifact`	`v3`	`.github/workflows/gh-pages-deploy.yml`
`codecov/codecov-action`	`v5`	`.github/workflows/ci.yml`
`docker/login-action`	`v4.2.0`	`.github/workflows/container.yml`
`docker/setup-buildx-action`	`v4.1.0`	`.github/workflows/ci.yml`
`docker/setup-qemu-action`	`v4.1.0`	`.github/workflows/ci.yml`
`github/codeql-action/analyze`	`v4`	`.github/workflows/codeql.yml`
`github/codeql-action/init`	`v4`	`.github/workflows/codeql.yml`
`github/codeql-action/upload-sarif`	`v4`	`.github/workflows/scorecard.yml`
`golangci/golangci-lint-action`	`v8`	`.github/workflows/golangci-lint.yml`
`goreleaser/goreleaser-action`	`v7.2.3`	`.github/workflows/ci.yml`
`ossf/scorecard-action`	`v2.3.1`	`.github/workflows/scorecard.yml`
`safedep/vet-action`	`01f547ee95dfd4f8f11fa64b399e5e00f22b0801`	`.github/workflows/vet-ci.yml`
`trufflesecurity/trufflehog`	`8b6f55b592e46ac44a42dc3e3dee0ebcc0f56df5`	`.github/workflows/secret_scan.yml`

History

Week	Version	Dependencies	Critical	High	Medium	Low	Unknown	Changes
2026-11-02	v1.20.0	712	4	41	35	1	3	—
2026-11-01	v1.20.0	712	4	41	35	1	3	—

SBOM minimum elements

Scored by sbomlyze on the generated source SBOM. A source SBOM usually lacks supplier and hash data, so these scores mostly reflect what the project's manifests declare.

Standard	Score	Checks passed	Failed checks
NTIA 2021	71	5/7	Supplier Name, Dependency Relationship
CISA 2025	50	5/10	Software Producer, Dependency Relationship, License Information, Component Hash, SBOM Author
BSI TR-03183	44	4/9	Component Creator, Distribution Licences, SHA-512 Hash, Dependency Relationship, SBOM Creator Contact

Evidence

Downloads for this week: CycloneDX SBOM · Grype report

Permanent copy of the raw SBOM, Grype, OSV-Scanner, and govulncheck output and release checks: release report-2026-11-02, folder supply-chain-shard-*/safedep__vet/.

25 manifests and lockfiles scanned

.github/workflows/ci.yml, .github/workflows/codeql.yml, .github/workflows/container.yml, .github/workflows/dependency-review.yml, .github/workflows/gh-pages-deploy.yml, .github/workflows/golangci-lint.yml, .github/workflows/goreleaser.yml, .github/workflows/mdm.yml, .github/workflows/scorecard.yml, .github/workflows/secret_scan.yml, .github/workflows/vet-ci.yml, .github/workflows/vet-container-scanning-e2e.yml, go.mod, go.sum, package.json, packages/smoke/package.json, packages/vet-darwin-arm64/package.json, packages/vet-darwin-x64/package.json, packages/vet-linux-arm64/package.json, packages/vet-linux-x64/package.json, packages/vet-win32-x64/package.json, packages/vet/package.json, pnpm-lock.yaml, scripts/go.mod, scripts/go.sum

Full JSON for this project · Atom feed of weekly changes

Badges

shields.io endpoints refreshed with each weekly scan. They report this week's result for the latest release, nothing more.

[![release verification](https://img.shields.io/endpoint?url=https%3A%2F%2Frezmoss.github.io%2Fawesome-security-pipeline%2Fbadges%2Fsafedep%2Fvet%2Frelease.json)](https://rezmoss.github.io/awesome-security-pipeline/projects/safedep/vet/index.html)
[![vulnerable code in binary](https://img.shields.io/endpoint?url=https%3A%2F%2Frezmoss.github.io%2Fawesome-security-pipeline%2Fbadges%2Fsafedep%2Fvet%2Fin-binary.json)](https://rezmoss.github.io/awesome-security-pipeline/projects/safedep/vet/index.html)

How this report is made

Every Sunday a GitHub Actions workflow resolves each catalog tool to its latest release and runs the checks below. Every tool is installed from its own latest release and verified against its published checksum or digest. Nothing from the scanned projects is built or executed; release binaries are analyzed as files.

Tool	What it does here	Version this week
Syft	Generates a CycloneDX SBOM from each release's manifests and lockfiles.	1.55.0
Grype	Matches the SBOM against known vulnerabilities.	0.121.0
OSV-Scanner	Checks the same files against the OSV database to confirm or add matches.	2.7.0
govulncheck	For Go tools, finds which advisories have vulnerable code compiled into the released Linux binary.	1.9.0
zizmor	Audits the project's GitHub Actions workflows for injection, unpinned actions, and excessive permissions.	1.31.1
OpenSSF Scorecard	Scores repository security practices such as code review, branch protection, and pinned dependencies.	5.6.0
Cosign	Verifies Sigstore signatures on the release binary or its checksums file.	3.1.4
slsa-verifier	Verifies SLSA build provenance published with the release.	2.7.1
GitHub CLI attestations	Verifies GitHub artifact attestations for the release binary.	—
sbomlyze	Diffs each SBOM against last week and scores NTIA, CISA, and BSI minimum elements. Maintained by this repository's maintainer.	0.6.0