From 28e38c29f30e8c424d9c31d3d6c4f1a06adef7dc Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Fri, 9 Oct 2026 13:27:40 +0000 Subject: [PATCH 01/10] chore(deps): bump anchore/go-make/.github/actions/setup (#5396) Bumps [anchore/go-make/.github/actions/setup](https://github.com/anchore/go-make) from 0.8.1 to 0.9.1. - [Release notes](https://github.com/anchore/go-make/releases) - [Commits](https://github.com/anchore/go-make/compare/fa5421b3bf24c9d18f11a736c5eb4172f2b7d683...27a9f35f41b5fe86d68815844efd2ba816e9ba6b) --- updated-dependencies: - dependency-name: anchore/go-make/.github/actions/setup dependency-version: 0.9.1 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- .github/actions/bootstrap/action.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/actions/bootstrap/action.yaml b/.github/actions/bootstrap/action.yaml index 51304dbec..a0d15846d 100644 --- a/.github/actions/bootstrap/action.yaml +++ b/.github/actions/bootstrap/action.yaml @@ -30,7 +30,7 @@ runs: using: "composite" steps: - name: Setup go + go-make tooling - uses: anchore/go-make/.github/actions/setup@fa5421b3bf24c9d18f11a736c5eb4172f2b7d683 # v0.8.1 + uses: anchore/go-make/.github/actions/setup@27a9f35f41b5fe86d68815844efd2ba816e9ba6b # v0.9.1 with: go-version: ${{ inputs.go-version }} cache-key-prefix: ${{ inputs.cache-key-prefix }} From 1f5ac479904678b129f72fa24559e8cb5f30d7d9 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Fri, 9 Oct 2026 13:29:42 +0000 Subject: [PATCH 02/10] chore(deps): bump anchore/go-make/.github/actions/setup (#5397) Bumps [anchore/go-make/.github/actions/setup](https://github.com/anchore/go-make) from 0.8.1 to 0.9.1. - [Release notes](https://github.com/anchore/go-make/releases) - [Commits](https://github.com/anchore/go-make/compare/fa5421b3bf24c9d18f11a736c5eb4172f2b7d683...27a9f35f41b5fe86d68815844efd2ba816e9ba6b) --- updated-dependencies: - dependency-name: anchore/go-make/.github/actions/setup dependency-version: 0.9.1 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- .github/workflows/validations.yaml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/workflows/validations.yaml b/.github/workflows/validations.yaml index 998ba78ef..d576ae792 100644 --- a/.github/workflows/validations.yaml +++ b/.github/workflows/validations.yaml @@ -99,7 +99,7 @@ jobs: # go-make's setup only (not ./.github/actions/bootstrap): binny ships no windows release, so binny tools # are unavailable here (`make unit` skips the fixture refresh on windows) - name: Setup go + go-make tooling - uses: anchore/go-make/.github/actions/setup@fa5421b3bf24c9d18f11a736c5eb4172f2b7d683 # v0.8.1 + uses: anchore/go-make/.github/actions/setup@27a9f35f41b5fe86d68815844efd2ba816e9ba6b # v0.9.1 with: # keep in sync with the go-version default in ./.github/actions/bootstrap go-version: "1.26.2" @@ -195,7 +195,7 @@ jobs: # go-make's setup only (not ./.github/actions/bootstrap): the test only needs make + the snapshot binary - name: Setup go + go-make tooling - uses: anchore/go-make/.github/actions/setup@fa5421b3bf24c9d18f11a736c5eb4172f2b7d683 # v0.8.1 + uses: anchore/go-make/.github/actions/setup@27a9f35f41b5fe86d68815844efd2ba816e9ba6b # v0.9.1 with: # keep in sync with the go-version default in ./.github/actions/bootstrap go-version: "1.26.2" @@ -228,7 +228,7 @@ jobs: # go-make's setup only (not ./.github/actions/bootstrap): the test only needs make + the snapshot binary - name: Setup go + go-make tooling - uses: anchore/go-make/.github/actions/setup@fa5421b3bf24c9d18f11a736c5eb4172f2b7d683 # v0.8.1 + uses: anchore/go-make/.github/actions/setup@27a9f35f41b5fe86d68815844efd2ba816e9ba6b # v0.9.1 with: # keep in sync with the go-version default in ./.github/actions/bootstrap go-version: "1.26.2" From 7e713d106e7a13c667fe7a62172ff40260569c5a Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Fri, 9 Oct 2026 13:29:55 +0000 Subject: [PATCH 03/10] chore(deps): bump modernc.org/sqlite from 1.59.0 to 1.60.1 (#5398) Bumps [modernc.org/sqlite](https://gitlab.com/cznic/sqlite) from 1.59.0 to 1.60.1. - [Changelog](https://gitlab.com/cznic/sqlite/blob/master/CHANGELOG.md) - [Commits](https://gitlab.com/cznic/sqlite/compare/v1.59.0...v1.60.1) --- updated-dependencies: - dependency-name: modernc.org/sqlite dependency-version: 1.60.1 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- go.mod | 4 ++-- go.sum | 16 ++++++++-------- 2 files changed, 10 insertions(+), 10 deletions(-) diff --git a/go.mod b/go.mod index 02ae7c253..857c64e40 100644 --- a/go.mod +++ b/go.mod @@ -97,7 +97,7 @@ require ( golang.org/x/net v0.59.0 golang.org/x/time v0.16.0 golang.org/x/tools v0.50.0 - modernc.org/sqlite v1.59.0 + modernc.org/sqlite v1.60.1 ) require ( @@ -345,7 +345,7 @@ require ( google.golang.org/grpc v1.83.2 // indirect google.golang.org/protobuf v1.36.12 // indirect gopkg.in/warnings.v0 v0.1.2 // indirect - modernc.org/libc v1.75.7 // indirect + modernc.org/libc v1.77.1 // indirect modernc.org/mathutil v1.7.1 // indirect modernc.org/memory v1.12.1 // indirect ) diff --git a/go.sum b/go.sum index 904138143..2dd682867 100644 --- a/go.sum +++ b/go.sum @@ -1610,10 +1610,10 @@ honnef.co/go/tools v0.0.1-2020.1.3/go.mod h1:X/FiERA/W4tHapMX5mGpAtMSVEeEUOyHaw9 honnef.co/go/tools v0.0.1-2020.1.4/go.mod h1:X/FiERA/W4tHapMX5mGpAtMSVEeEUOyHaw9vFzvIQ3k= howett.net/plist v1.0.1 h1:37GdZ8tP09Q35o9ych3ehygcsL+HqKSwzctveSlarvM= howett.net/plist v1.0.1/go.mod h1:lqaXoTrLY4hg8tnEzNru53gicrbv7rrk+2xJA/7hw9g= -modernc.org/cc/v4 v4.29.2 h1:h6+9ciCnPKutf4I03CvheAvDLX7+IHlqR6Iy6J+cgd8= -modernc.org/cc/v4 v4.29.2/go.mod h1:OnovgIhbbMXMu1aISnJ0wvVD1KnW+cAUJkIrAWh+kVI= -modernc.org/ccgo/v4 v4.35.0 h1:F+TUsmw09QxLzmi3aeYYGxjAXarmZaKgj3mKQHNaA8w= -modernc.org/ccgo/v4 v4.35.0/go.mod h1:qrVGs9S3Sr2Ztcg9ve+kTAYMp5a3YvWjo+SoN06kJ5I= +modernc.org/cc/v4 v4.29.7 h1:q+NXGJ0bK3b4TXFYQQVr9pYETGnmwFWkrUzJnMya/Tg= +modernc.org/cc/v4 v4.29.7/go.mod h1:OnovgIhbbMXMu1aISnJ0wvVD1KnW+cAUJkIrAWh+kVI= +modernc.org/ccgo/v4 v4.36.1 h1:ZNIUZAryN0UgnJwtyxrdEzcFc3yD4Cu4AzjfPXsLsIE= +modernc.org/ccgo/v4 v4.36.1/go.mod h1:rrtGc2QkS239nYb/mQNuBMyjq3/y3ZXWbBjPoV3wqzA= modernc.org/fileutil v1.4.0 h1:j6ZzNTftVS054gi281TyLjHPp6CPHr2KCxEXjEbD6SM= modernc.org/fileutil v1.4.0/go.mod h1:EqdKFDxiByqxLk8ozOxObDSfcVOv/54xDs/DUHdvCUU= modernc.org/gc/v2 v2.6.5 h1:nyqdV8q46KvTpZlsw66kWqwXRHdjIlJOhG6kxiV/9xI= @@ -1622,8 +1622,8 @@ modernc.org/gc/v3 v3.1.5 h1:21ldfPfRYE31Tb7B3mwAK8gy1AxP4+dKjrOQPfqakoc= modernc.org/gc/v3 v3.1.5/go.mod h1:HFK/6AGESC7Ex+EZJhJ2Gni6cTaYpSMmU/cT9RmlfYY= modernc.org/goabi0 v0.2.0 h1:HvEowk7LxcPd0eq6mVOAEMai46V+i7Jrj13t4AzuNks= modernc.org/goabi0 v0.2.0/go.mod h1:CEFRnnJhKvWT1c1JTI3Avm+tgOWbkOu5oPA8eH8LnMI= -modernc.org/libc v1.75.7 h1:o3DTP9/0p9pKmY2WCKQaySW6wIiZhNM7wc2lUoyhfew= -modernc.org/libc v1.75.7/go.mod h1:bO5o2ztHxBb2rjz0PgdHN0sSMw57CgxGFLZ3Qd/QpVQ= +modernc.org/libc v1.77.1 h1:Ct8j47QtiZ1Enj2DtFXQtUqrPCAjdCmPjtCuvrYQ0Hs= +modernc.org/libc v1.77.1/go.mod h1:87/pZ4L6nD1zqW4nItuS12YO7hN1igAah34xjnQo/W0= modernc.org/mathutil v1.7.1 h1:GCZVGXdaN8gTqB1Mf/usp1Y/hSqgI2vAGGP4jZMCxOU= modernc.org/mathutil v1.7.1/go.mod h1:4p5IwJITfppl0G4sUEDtCr4DthTaT47/N3aT6MhfgJg= modernc.org/memory v1.12.1 h1:nFMiWrpStgZczNl6XI9GnIk/rWhYIyHGUaR04pGbp9g= @@ -1632,8 +1632,8 @@ modernc.org/opt v0.2.0 h1:tGyef5ApycA7FSEOMraay9SaTk5zmbx7Tu+cJs4QKZg= modernc.org/opt v0.2.0/go.mod h1:03fq9lsNfvkYSfxrfUhZCWPk1lm4cq4N+Bh//bEtgns= modernc.org/sortutil v1.2.1 h1:+xyoGf15mM3NMlPDnFqrteY07klSFxLElE2PVuWIJ7w= modernc.org/sortutil v1.2.1/go.mod h1:7ZI3a3REbai7gzCLcotuw9AC4VZVpYMjDzETGsSMqJE= -modernc.org/sqlite v1.59.0 h1:X1es1GpqBlS/5T+vbM4HLUdaa8OtQx468DF2vrx+38A= -modernc.org/sqlite v1.59.0/go.mod h1:+paeT2A3iPRHkQDwG7oA6Tk0zQd5woMEI8q7orfry8k= +modernc.org/sqlite v1.60.1 h1:/blz53O951KWFOso4QQvEs/Fq6cDBKLtMVrYNSeJVKw= +modernc.org/sqlite v1.60.1/go.mod h1:1dIoEagfDE72QytD5scH1lxARtaUgKgHC/NuApA27r0= modernc.org/strutil v1.2.1 h1:UneZBkQA+DX2Rp35KcM69cSsNES9ly8mQWD71HKlOA0= modernc.org/strutil v1.2.1/go.mod h1:EHkiggD70koQxjVdSBM3JKM7k6L0FbGE5eymy9i3B9A= modernc.org/token v1.1.0 h1:Xl7Ap9dKaEs5kLoOQeQmPWevfnk/DM5qcLcYlA8ys6Y= From fc8bd6c9d826c5aaabfa323a5f59d62134c03ad7 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Fri, 9 Oct 2026 13:31:27 +0000 Subject: [PATCH 04/10] chore(deps): bump anchore/sbom-action from 0.24.2 to 0.24.3 (#5395) Bumps [anchore/sbom-action](https://github.com/anchore/sbom-action) from 0.24.2 to 0.24.3. - [Release notes](https://github.com/anchore/sbom-action/releases) - [Changelog](https://github.com/anchore/sbom-action/blob/main/RELEASE.md) - [Commits](https://github.com/anchore/sbom-action/compare/3ad7283483fc7af8ff2b4ea19663c2d5ca935e26...66cbf4bc1f1c0d2edc94016e65bc221b6bb0ad6c) --- updated-dependencies: - dependency-name: anchore/sbom-action dependency-version: 0.24.3 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- .github/workflows/release.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml index d1cad71b8..704e444c3 100644 --- a/.github/workflows/release.yaml +++ b/.github/workflows/release.yaml @@ -118,7 +118,7 @@ jobs: # for updating brew formula in anchore/homebrew-syft GITHUB_BREW_TOKEN: ${{ secrets.ANCHOREOPS_GITHUB_OSS_WRITE_TOKEN }} - - uses: anchore/sbom-action@3ad7283483fc7af8ff2b4ea19663c2d5ca935e26 #v0.24.2 + - uses: anchore/sbom-action@66cbf4bc1f1c0d2edc94016e65bc221b6bb0ad6c #v0.24.3 continue-on-error: true with: file: go.mod From 0a050b0e275b195329f9cf4469d77f6d46a8fef3 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Fri, 9 Oct 2026 13:35:03 +0000 Subject: [PATCH 05/10] chore(deps): bump github.com/gpustack/gguf-parser-go (#5401) Bumps [github.com/gpustack/gguf-parser-go](https://github.com/gpustack/gguf-parser-go) from 0.26.3 to 0.26.4. - [Release notes](https://github.com/gpustack/gguf-parser-go/releases) - [Commits](https://github.com/gpustack/gguf-parser-go/compare/v0.26.3...v0.26.4) --- updated-dependencies: - dependency-name: github.com/gpustack/gguf-parser-go dependency-version: 0.26.4 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- go.mod | 2 +- go.sum | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/go.mod b/go.mod index 857c64e40..43c81c659 100644 --- a/go.mod +++ b/go.mod @@ -52,7 +52,7 @@ require ( github.com/google/licensecheck v0.3.1 github.com/google/uuid v1.6.0 github.com/gookit/color v1.6.1 - github.com/gpustack/gguf-parser-go v0.26.3 + github.com/gpustack/gguf-parser-go v0.26.4 github.com/hashicorp/go-cleanhttp v0.5.2 github.com/hashicorp/go-getter v1.8.9 github.com/hashicorp/go-multierror v1.1.1 diff --git a/go.sum b/go.sum index 2dd682867..6c7b3572f 100644 --- a/go.sum +++ b/go.sum @@ -579,8 +579,8 @@ github.com/gookit/color v1.6.1 h1:KoTnDxJPRgrL0SoX0f8rCFg2zI0t4E3GZZBMo2nN8LU= github.com/gookit/color v1.6.1/go.mod h1:9ACFc7/1IpHGBW8RwuDm/0YEnhg3dwwXpoMsmtyHfjs= github.com/gorilla/mux v1.8.1 h1:TuBL49tXwgrFYWhqrNgrUNEY92u81SPhu7sTdzQEiWY= github.com/gorilla/mux v1.8.1/go.mod h1:AKf9I4AEqPTmMytcMc0KkNouC66V3BtZ4qD5fmWSiMQ= -github.com/gpustack/gguf-parser-go v0.26.3 h1:F63PlUPIW56HGU5k4Crv0JAG9ojtz/TuwzgMYlb82Ec= -github.com/gpustack/gguf-parser-go v0.26.3/go.mod h1:y4TwTtDqFWTK+xvprOjRUh+dowgU2TKCX37vRKvGiZ0= +github.com/gpustack/gguf-parser-go v0.26.4 h1:B9CRrQBcIB7I/MJFZvzPZ+e+cbc1xBzQJcmpi9l/mKU= +github.com/gpustack/gguf-parser-go v0.26.4/go.mod h1:y4TwTtDqFWTK+xvprOjRUh+dowgU2TKCX37vRKvGiZ0= github.com/grpc-ecosystem/grpc-gateway v1.16.0/go.mod h1:BDjrQk3hbvj6Nolgz8mAMFbcEtjT1g+wF4CSlocrBnw= github.com/hashicorp/aws-sdk-go-base/v2 v2.0.0-beta.74 h1:mymLUKThnV9wFvogOK8NnsMP9/vlhnjXY98gr2QIGW8= github.com/hashicorp/aws-sdk-go-base/v2 v2.0.0-beta.74/go.mod h1:Bh9qYL8ehmDxSg14Tk8oxFCP90XHfs6NxV1D84884xA= From 3e41abadc4316b5a8e56f97b56a3771566db932a Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Fri, 9 Oct 2026 13:35:51 +0000 Subject: [PATCH 06/10] chore(deps): bump github.com/go-git/go-billy/v5 from 5.9.1 to 5.9.2 (#5399) Bumps [github.com/go-git/go-billy/v5](https://github.com/go-git/go-billy) from 5.9.1 to 5.9.2. - [Release notes](https://github.com/go-git/go-billy/releases) - [Commits](https://github.com/go-git/go-billy/compare/v5.9.1...v5.9.2) --- updated-dependencies: - dependency-name: github.com/go-git/go-billy/v5 dependency-version: 5.9.2 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- go.mod | 2 +- go.sum | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/go.mod b/go.mod index 43c81c659..24159766c 100644 --- a/go.mod +++ b/go.mod @@ -41,7 +41,7 @@ require ( github.com/facebookincubator/nvdtools v0.1.5 github.com/github/go-spdx/v2 v2.7.0 github.com/gkampitakis/go-snaps v0.5.23 - github.com/go-git/go-billy/v5 v5.9.1 + github.com/go-git/go-billy/v5 v5.9.2 github.com/go-git/go-git/v5 v5.19.2 github.com/go-test/deep v1.1.1 github.com/go-viper/mapstructure/v2 v2.5.0 diff --git a/go.sum b/go.sum index 6c7b3572f..e96b61a0e 100644 --- a/go.sum +++ b/go.sum @@ -434,8 +434,8 @@ github.com/gliderlabs/ssh v0.3.8 h1:a4YXD1V7xMF9g5nTkdfnja3Sxy1PVDCj1Zg4Wb8vY6c= github.com/gliderlabs/ssh v0.3.8/go.mod h1:xYoytBv1sV0aL3CavoDuJIQNURXkkfPA/wxQ1pL1fAU= github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376 h1:+zs/tPmkDkHx3U66DAb0lQFJrpS6731Oaa12ikc+DiI= github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376/go.mod h1:an3vInlBmSxCcxctByoQdvwPiA7DTK7jaaFDBTtu0ic= -github.com/go-git/go-billy/v5 v5.9.1 h1:8U73XiOTfINdItHVa6z4Gv7ToObcZ6grkqQbLryLCdA= -github.com/go-git/go-billy/v5 v5.9.1/go.mod h1:ExsU+jcGwXTBOnyilvAnEM1wug1IxHr4yP2ZXsNRtV0= +github.com/go-git/go-billy/v5 v5.9.2 h1:OXFSRyz4g20upsGDJgQG9Bak1l/ZEv8GHVYB52O71sE= +github.com/go-git/go-billy/v5 v5.9.2/go.mod h1:ExsU+jcGwXTBOnyilvAnEM1wug1IxHr4yP2ZXsNRtV0= github.com/go-git/go-git-fixtures/v4 v4.3.2-0.20231010084843-55a94097c399 h1:eMje31YglSBqCdIqdhKBW8lokaMrL3uTkpGYlE2OOT4= github.com/go-git/go-git-fixtures/v4 v4.3.2-0.20231010084843-55a94097c399/go.mod h1:1OCfN199q1Jm3HZlxleg+Dw/mwps2Wbk9frAWm+4FII= github.com/go-git/go-git/v5 v5.19.2 h1:wkfn7vOlUBu8ivAWKBWisTiwJK4jYHzTF8Ndv1LyGqY= From 740beb6dc4c2044418585a1571ef12ed889feee6 Mon Sep 17 00:00:00 2001 From: Peter McConnell Date: Fri, 9 Oct 2026 14:36:52 +0100 Subject: [PATCH 07/10] fix: search for the .NET bundle marker without holding the file (#5393) Signed-off-by: Peter McConnell --- .../internal/dotnet/bundle/bundle.go | 98 ++++++++++--- .../internal/dotnet/bundle/bundle_test.go | 137 +++++++++++++++++- 2 files changed, 211 insertions(+), 24 deletions(-) diff --git a/syft/pkg/cataloger/internal/dotnet/bundle/bundle.go b/syft/pkg/cataloger/internal/dotnet/bundle/bundle.go index 434b1d2ac..b74569c86 100644 --- a/syft/pkg/cataloger/internal/dotnet/bundle/bundle.go +++ b/syft/pkg/cataloger/internal/dotnet/bundle/bundle.go @@ -12,18 +12,25 @@ import ( ) const ( - // maxBundleSearchSize bounds the bytes findSignatureOffset will hold at once while looking for the - // bundle marker. + // maxBundleSearchSize bounds how far into a file findSignatureOffset looks for the bundle marker. // // The marker sits inside the executable structure, so the search legitimately covers a whole // single-file bundle, which routinely runs past 100MB and can reach a few hundred for an app that // embeds sizable assets. Clamping to the file length alone is not enough: a mostly empty file costs - // almost nothing inside a compressed layer, so a small artifact can still authorize a multi-gigabyte - // allocation. The trade-off is that a bundle larger than this loses its deps.json rather than being - // cataloged, which is the correct direction to fail when the alternative is OOM-killing the scan. - // This mirrors maxDeclaredSectionSize in syft/internal/elfutil. + // almost nothing inside a compressed layer, so a small artifact can still authorize an unbounded + // amount of reading. The trade-off is that a bundle larger than this loses its deps.json rather than + // being cataloged, which is the correct direction to fail. This mirrors maxDeclaredSectionSize in + // syft/internal/elfutil. What the search holds in memory is bounded separately, by + // markerSearchWindowSize, so raising this costs time rather than resident bytes. maxBundleSearchSize = 512 * intFile.MB + // markerSearchWindowSize is how much of a file findSignatureOffset holds at once. + markerSearchWindowSize = 256 * intFile.KB + + // bundleHeaderOffsetSize is the width of the little-endian header offset stored immediately before + // the marker. + bundleHeaderOffsetSize = 8 + // maxDepsJSONSize bounds an embedded deps.json. These are dependency manifests, so real ones are // measured in KB even for large applications. maxDepsJSONSize = 3 * intFile.MB @@ -37,13 +44,26 @@ const ( ) // dotNetBundleSignature is the SHA-256 hash of ".net core bundle" used to identify single-file bundles. -var dotNetBundleSignature = []byte{ +var dotNetBundleSignature = [32]byte{ 0x8b, 0x12, 0x02, 0xb9, 0x6a, 0x61, 0x20, 0x38, 0x72, 0x7b, 0x93, 0x02, 0x14, 0xd7, 0xa0, 0x32, 0x13, 0xf5, 0xb9, 0xe6, 0xef, 0xae, 0x33, 0x18, 0xee, 0x3b, 0x2d, 0xce, 0x24, 0xb3, 0x6a, 0xae, } +// markerSearchOverlap is how much of each search window carries over into the next: the bytes a marker +// could straddle the boundary with, plus the offset that precedes it. Retaining both is what lets a +// windowed search give the same answer as reading the file whole - a marker split across two reads is +// still matched, and the offset in front of it is always in the same window as the match. +const markerSearchOverlap = bundleHeaderOffsetSize + len(dotNetBundleSignature) - 1 + +// the slide at the end of findSignatureOffset carries markerSearchOverlap bytes into the next window and +// advances by the rest, so a window no wider than the overlap would take a negative slice index and never +// move. The window is five orders of magnitude clear of that today; this is what refuses to compile if +// anyone shrinks it to the marker's own scale, which is the tempting thing to do to make a test cheaper. +// The -1 is what makes equality fail too: the window has to exceed the overlap, not merely match it. +const _ = uint(markerSearchWindowSize - markerSearchOverlap - 1) + // ExtractDepsJSON returns the deps.json embedded in the .NET single-file bundle in r, or "" if r carries no // bundle marker. // @@ -94,29 +114,17 @@ func findBundleHeaderOffset(r unionreader.UnionReader, searchLimit int64) (int64 clamped = true } - // this scans a whole executable, routinely over 100MB for a single-file bundle, so the buffer is sized - // exactly once. An append-growing read holds both arrays at its final growth and would cost well over - // twice the file's own size for the same result. - searchData := make([]byte, limit) - - // a short read is not fatal here: the marker may well be in what we did get, so search the bytes we - // actually hold. ReadAt reports a short read as io.EOF, and may report a full one that way too, so the - // count is what says how much there is to search. - n, err := r.ReadAt(searchData, 0) - if err != nil && !errors.Is(err, io.EOF) { + headerOffset, found, err := findSignatureOffset(r, limit) + if err != nil { return 0, err } - - idx := bytes.Index(searchData[:n], dotNetBundleSignature) - if idx == -1 || idx < 8 { + if !found { if clamped { return 0, fmt.Errorf("no bundle marker in the first %d bytes and the rest of the %d byte file was not searched", maxBundleSearchSize, size) } return 0, nil } - headerOffset := int64(binary.LittleEndian.Uint64(searchData[idx-8 : idx])) - if headerOffset == 0 { // the marker is compiled into every apphost; only publishing as a single file fills in the offset return 0, nil @@ -131,6 +139,52 @@ func findBundleHeaderOffset(r unionreader.UnionReader, searchLimit int64) (int64 return headerOffset, nil } +// findSignatureOffset searches the first limit bytes of r for the bundle marker and returns the header +// offset stored in the 8 bytes immediately before it, or false if the marker is not there. +func findSignatureOffset(r unionreader.UnionReader, limit int64) (int64, bool, error) { + // nothing shorter than the marker plus the offset in front of it can hold a usable match + if limit < int64(bundleHeaderOffsetSize+len(dotNetBundleSignature)) { + return 0, false, nil + } + + buf := make([]byte, min(int64(markerSearchWindowSize), limit)) + + var ( + windowStart int64 // offset in the file that buf[0] holds + filled int // bytes of buf that hold file content + ) + + for { + // a short read is not fatal: the marker may well be in what we did get. ReadAt reports a short + // read as io.EOF, and may report a full one that way too, so the count is what says how much + // there is to search. + want := min(int64(len(buf)-filled), limit-windowStart-int64(filled)) + n, err := r.ReadAt(buf[filled:int64(filled)+want], windowStart+int64(filled)) + filled += n + if err != nil && !errors.Is(err, io.EOF) { + return 0, false, err + } + + if idx := bytes.Index(buf[:filled], dotNetBundleSignature[:]); idx >= 0 { + // only reachable in the first window: after a slide the overlap guarantees that a match not + // already seen begins at least bundleHeaderOffsetSize into the buffer + if idx < bundleHeaderOffsetSize { + return 0, false, nil + } + return int64(binary.LittleEndian.Uint64(buf[idx-bundleHeaderOffsetSize : idx])), true, nil + } + + // a buffer the read could not fill means the reader ran out before the limit did + if filled < len(buf) || windowStart+int64(filled) >= limit { + return 0, false, nil + } + + copy(buf, buf[filled-markerSearchOverlap:filled]) + windowStart += int64(filled - markerSearchOverlap) + filled = markerSearchOverlap + } +} + // dotNetBundleHeader represents the fixed portion of the bundle header (version 1+) type dotNetBundleHeader struct { MajorVersion uint32 diff --git a/syft/pkg/cataloger/internal/dotnet/bundle/bundle_test.go b/syft/pkg/cataloger/internal/dotnet/bundle/bundle_test.go index a3146d218..4c990d1f5 100644 --- a/syft/pkg/cataloger/internal/dotnet/bundle/bundle_test.go +++ b/syft/pkg/cataloger/internal/dotnet/bundle/bundle_test.go @@ -16,7 +16,7 @@ import ( func fileWithSignatureAt(size, sigStart int, headerOffset uint64) []byte { data := make([]byte, size) binary.LittleEndian.PutUint64(data[sigStart-8:sigStart], headerOffset) - copy(data[sigStart:], dotNetBundleSignature) + copy(data[sigStart:], dotNetBundleSignature[:]) return data } @@ -74,7 +74,7 @@ func TestFindBundleHeaderOffset(t *testing.T) { { // there is no room for the 8-byte header offset before the signature name: "signature too close to the start to carry an offset", - data: append(append([]byte{0, 0}, dotNetBundleSignature...), make([]byte, 32)...), + data: append(append([]byte{0, 0}, dotNetBundleSignature[:]...), make([]byte, 32)...), searchLimit: 128, }, { @@ -295,3 +295,136 @@ func TestFindDepsJSONInManifest_PlausibleEntryCountIsWalked(t *testing.T) { require.NoError(t, err) assert.Empty(t, got, "no deps.json entry in this manifest") } + +// A windowed search only gives the same answer as reading the file whole if a marker lying across a +// window boundary - or one whose header offset lies across it - is still matched. These are the offsets +// where an overlap that is absent, too small, or applied to the wrong end of the buffer goes wrong. +func TestFindBundleHeaderOffset_MarkerAcrossWindowBoundary(t *testing.T) { + const window = markerSearchWindowSize + const headerOffset = 0x1234 + size := window + 4096 + + for _, tt := range []struct { + name string + sigStart int + }{ + {"whole marker inside the first window", window - 4096}, + {"header offset split across the boundary", window - 4}, + {"header offset ends exactly at the boundary", window}, + {"signature split one byte into the second window", window - len(dotNetBundleSignature) + 1}, + {"signature split down the middle", window - len(dotNetBundleSignature)/2}, + {"signature starts one byte before the boundary", window - 1}, + {"whole marker inside the second window", window + 2048}, + } { + t.Run(tt.name, func(t *testing.T) { + data := fileWithSignatureAt(size, tt.sigStart, headerOffset) + + got, err := findBundleHeaderOffset(readSeekCloser{bytes.NewReader(data)}, int64(size)) + + require.NoError(t, err) + assert.Equal(t, int64(headerOffset), got) + }) + } +} + +// recordingReader records the largest single read it is asked for. The search buffer is what bounds +// that length, so this is what fails if the implementation ever sizes a buffer against the file again. +type recordingReader struct { + *bytes.Reader + largestRead int +} + +func (r *recordingReader) ReadAt(p []byte, off int64) (int, error) { + if len(p) > r.largestRead { + r.largestRead = len(p) + } + return r.Reader.ReadAt(p, off) +} + +func (*recordingReader) Close() error { return nil } + +// Holding an executable at its full size to look for 32 bytes is what made this the largest single +// consumer of memory in a scan of a Windows volume, so the bound matters more than the result here. +func TestFindBundleHeaderOffset_ReadsAreBoundedByTheWindow(t *testing.T) { + size := 5 * markerSearchWindowSize + data := fileWithSignatureAt(size, size-1024, 0x1234) + r := &recordingReader{Reader: bytes.NewReader(data)} + + got, err := findBundleHeaderOffset(r, int64(size)) + + require.NoError(t, err) + require.Equal(t, int64(0x1234), got, "the marker must still be found at the far end of the file") + assert.LessOrEqual(t, r.largestRead, markerSearchWindowSize, + "no single read may exceed the search window, whatever the file's size") +} + +// Every window after the first begins with bytes already searched. Re-reporting a match from that +// overlap would be harmless, but failing to advance past it would spin forever. +func TestFindBundleHeaderOffset_UnmarkedFileTerminates(t *testing.T) { + for _, size := range []int{ + markerSearchWindowSize - 1, + markerSearchWindowSize, + markerSearchWindowSize + 1, + markerSearchWindowSize + markerSearchOverlap, + 3 * markerSearchWindowSize, + } { + got, err := findBundleHeaderOffset(readSeekCloser{bytes.NewReader(make([]byte, size))}, int64(size)) + + require.NoError(t, err) + assert.Zero(t, got) + } +} + +// lateShortReader reads cleanly until shortFrom and only then hands back fewer bytes than were asked for. +// shortReader above comes up short on its very first read, which the search answers before it has slid at +// all; the reader running out partway through a windowed search is a different branch. +type lateShortReader struct { + *bytes.Reader + shortFrom int64 // a read starting here or beyond stops after shortLen bytes + shortLen int +} + +func (r *lateShortReader) ReadAt(p []byte, off int64) (int, error) { + if off < r.shortFrom || len(p) <= r.shortLen { + return r.Reader.ReadAt(p, off) + } + + n, _ := r.Reader.ReadAt(p[:r.shortLen], off) + return n, io.EOF +} + +func (*lateShortReader) Close() error { return nil } + +// A squashfs block that decompresses short makes unionreader return fewer bytes than were asked for, and +// nothing says that lands in the first window. Whatever the search did get still has to be searched, and the +// bytes the reader never produced have to end it rather than being read as a file with no bundle in it. +func TestFindBundleHeaderOffset_ShortReadAfterASlideSearchesWhatWasRead(t *testing.T) { + const window = markerSearchWindowSize + const shortLen = 4096 // what the second window gets before the reader gives up + const headerOffset = 0x1234 + size := 2*window + 8192 + + for _, tt := range []struct { + name string + sigStart int + want int64 + }{ + {"marker inside the bytes the second window did get", window + 1024, headerOffset}, + {"marker straddling the boundary into those bytes", window - 4, headerOffset}, + {"marker beyond where the reader gave up", window + shortLen + 1024, 0}, + } { + t.Run(tt.name, func(t *testing.T) { + // honest about its length: only the read past the first window comes up short + r := &lateShortReader{ + Reader: bytes.NewReader(fileWithSignatureAt(size, tt.sigStart, headerOffset)), + shortFrom: window, + shortLen: shortLen, + } + + got, err := findBundleHeaderOffset(r, int64(size)) + + require.NoError(t, err, "a reader that runs out is not a parse failure") + assert.Equal(t, tt.want, got) + }) + } +} From 679027251852f07dd80f2bde260f321cb637548b Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Fri, 9 Oct 2026 13:37:22 +0000 Subject: [PATCH 08/10] chore(deps): bump github.com/anchore/go-make in /.make (#5402) Bumps [github.com/anchore/go-make](https://github.com/anchore/go-make) from 0.8.1 to 0.9.1. - [Release notes](https://github.com/anchore/go-make/releases) - [Commits](https://github.com/anchore/go-make/compare/v0.8.1...v0.9.1) --- updated-dependencies: - dependency-name: github.com/anchore/go-make dependency-version: 0.9.1 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- .make/go.mod | 8 ++++---- .make/go.sum | 12 ++++++------ 2 files changed, 10 insertions(+), 10 deletions(-) diff --git a/.make/go.mod b/.make/go.mod index b67a4d3a0..47b40e8de 100644 --- a/.make/go.mod +++ b/.make/go.mod @@ -1,12 +1,12 @@ module github.com/anchore/syft/.make -go 1.25.8 +go 1.26.0 -require github.com/anchore/go-make v0.8.1 +require github.com/anchore/go-make v0.9.1 require ( github.com/bmatcuk/doublestar/v4 v4.10.0 // indirect github.com/goccy/go-yaml v1.19.2 // indirect - golang.org/x/mod v0.40.0 // indirect - golang.org/x/sys v0.47.0 // indirect + golang.org/x/mod v0.41.0 // indirect + golang.org/x/sys v0.48.0 // indirect ) diff --git a/.make/go.sum b/.make/go.sum index f8fd03437..1c623844b 100644 --- a/.make/go.sum +++ b/.make/go.sum @@ -1,10 +1,10 @@ -github.com/anchore/go-make v0.8.1 h1:GAhPXR+9qVQhFB1pfVlHFOzxAt3dTDTUIA7Tp7nx9tg= -github.com/anchore/go-make v0.8.1/go.mod h1:xALbVsPsDoJnJxdkjPlxOLZV7GbAdT5Pv3gd0kP1Lz0= +github.com/anchore/go-make v0.9.1 h1:OnC830XJEhdHUPhR8jLpnjmLTco9UThNZfHpLefqd94= +github.com/anchore/go-make v0.9.1/go.mod h1:1KhqPt0STAHLVEngwrXxYsuFftD62Nx497rNujwo8IY= github.com/bmatcuk/doublestar/v4 v4.10.0 h1:zU9WiOla1YA122oLM6i4EXvGW62DvKZVxIe6TYWexEs= github.com/bmatcuk/doublestar/v4 v4.10.0/go.mod h1:xBQ8jztBU6kakFMg+8WGxn0c6z1fTSPVIjEY1Wr7jzc= github.com/goccy/go-yaml v1.19.2 h1:PmFC1S6h8ljIz6gMRBopkjP1TVT7xuwrButHID66PoM= github.com/goccy/go-yaml v1.19.2/go.mod h1:XBurs7gK8ATbW4ZPGKgcbrY1Br56PdM69F7LkFRi1kA= -golang.org/x/mod v0.40.0 h1:hUv+3cXcdRHz08UmSiOob7sadHig73uo5bkXxQ/tvUs= -golang.org/x/mod v0.40.0/go.mod h1:0/weTWkPWGBikyTWAX3dkjVztMmBA5hM0DH6BElSupE= -golang.org/x/sys v0.47.0 h1:o7XGOvZQCADBQQ4Y7VNq2dRWQR7JmOUW8Kxx4ZsNgWs= -golang.org/x/sys v0.47.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw= +golang.org/x/mod v0.41.0 h1:qJmnOUb4YB+FsEuM3HcWucdZASCPGhsX6uljO6pog0c= +golang.org/x/mod v0.41.0/go.mod h1:Ek9pY8RKWXwsWvd3rQiHYtMqkjSUV+s1Rj7j4H5Ur6o= +golang.org/x/sys v0.48.0 h1:bbX/i/6MgT9BVLM9RT1thmxL04yeTAhbEz4SyadbXoo= +golang.org/x/sys v0.48.0/go.mod h1:hNLxWAXmnKAxqDtdwIYC4bM9oQPEecfsnNMuSxOs3og= From 33419c8f397e8e3ec1df9570c10c320a67fd2bc5 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Fri, 9 Oct 2026 13:42:52 +0000 Subject: [PATCH 09/10] chore(deps): bump github.com/pb33f/ordered-map/v2 from 2.3.1 to 2.3.2 (#5400) Bumps [github.com/pb33f/ordered-map/v2](https://github.com/pb33f/ordered-map) from 2.3.1 to 2.3.2. - [Changelog](https://github.com/pb33f/ordered-map/blob/master/CHANGELOG.md) - [Commits](https://github.com/pb33f/ordered-map/compare/v2.3.1...v2.3.2) --- updated-dependencies: - dependency-name: github.com/pb33f/ordered-map/v2 dependency-version: 2.3.2 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- go.mod | 4 ++-- go.sum | 8 ++++---- 2 files changed, 6 insertions(+), 6 deletions(-) diff --git a/go.mod b/go.mod index 24159766c..ea067a62b 100644 --- a/go.mod +++ b/go.mod @@ -101,7 +101,7 @@ require ( ) require ( - github.com/pb33f/ordered-map/v2 v2.3.1 + github.com/pb33f/ordered-map/v2 v2.3.2 github.com/tailscale/hujson v0.0.0-20260302212456-ecc657c15afd howett.net/plist v1.0.1 ) @@ -265,6 +265,7 @@ require ( github.com/opencontainers/image-spec v1.1.1 // indirect github.com/opencontainers/runtime-spec v1.3.0 // indirect github.com/opencontainers/selinux v1.15.1 // indirect + github.com/pb33f/go-yaml v0.1.0 // indirect github.com/pborman/indent v1.2.1 // indirect github.com/pelletier/go-toml/v2 v2.4.3 // indirect github.com/pierrec/lz4/v4 v4.1.26 // indirect @@ -328,7 +329,6 @@ require ( go.opentelemetry.io/otel/trace v1.46.0 // indirect go.podman.io/image/v5 v5.41.2 // indirect go.podman.io/storage v1.64.1 // indirect - go.yaml.in/yaml/v4 v4.0.0-rc.2 // indirect go4.org v0.0.0-20230225012048-214862532bf5 // indirect golang.org/x/crypto v0.57.0 // indirect golang.org/x/oauth2 v0.36.0 // indirect diff --git a/go.sum b/go.sum index e96b61a0e..bc204bb81 100644 --- a/go.sum +++ b/go.sum @@ -808,8 +808,10 @@ github.com/opencontainers/selinux v1.15.1/go.mod h1:LenyElirjUHszfxrjuFqC85HIeXZ github.com/orisano/pixelmatch v0.0.0-20220722002657-fb0b55479cde/go.mod h1:nZgzbfBr3hhjoZnS66nKrHmduYNpc34ny7RK4z5/HM0= github.com/pascaldekloe/goe v0.0.0-20180627143212-57f6aae5913c/go.mod h1:lzWF7FIEvWOWxwDKqyGYQf6ZUaNfKdP144TG7ZOy1lc= github.com/pascaldekloe/goe v0.1.0/go.mod h1:lzWF7FIEvWOWxwDKqyGYQf6ZUaNfKdP144TG7ZOy1lc= -github.com/pb33f/ordered-map/v2 v2.3.1 h1:5319HDO0aw4DA4gzi+zv4FXU9UlSs3xGZ40wcP1nBjY= -github.com/pb33f/ordered-map/v2 v2.3.1/go.mod h1:qxFQgd0PkVUtOMCkTapqotNgzRhMPL7VvaHKbd1HnmQ= +github.com/pb33f/go-yaml v0.1.0 h1:zZ6Gg+ATbumXlXZNLMHIe7+zTkVqe20lx+TSYRrXEuY= +github.com/pb33f/go-yaml v0.1.0/go.mod h1:QvWdkHP5VjFYAeHMQUkaPQqREaQnBNOXmWzAjNrnSdo= +github.com/pb33f/ordered-map/v2 v2.3.2 h1:wDyaZ2Pv9QLh64X4utCeD5Zoi9nIv2aW3lwv172O5PQ= +github.com/pb33f/ordered-map/v2 v2.3.2/go.mod h1:1OhFrXu3OYw3kM+FXF+Ug3ugmmZ9LE8z0JfQMLvtV0w= github.com/pborman/indent v1.2.1 h1:lFiviAbISHv3Rf0jcuh489bi06hj98JsVMtIDZQb9yM= github.com/pborman/indent v1.2.1/go.mod h1:FitS+t35kIYtB5xWTZAPhnmrxcciEEOdbyrrpz5K6Vw= github.com/pelletier/go-toml v1.9.4/go.mod h1:u1nR/EPcESfeI/szUZKdtJ0xRNbUoANCkoOuaOx1Y+c= @@ -1084,8 +1086,6 @@ go.uber.org/zap v1.17.0/go.mod h1:MXVU+bhUf/A7Xi2HNOnopQOrmycQ5Ih87HtOu4q5SSo= go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg= go.yaml.in/yaml/v3 v3.0.5 h1:N6y/pJk8buWs9NY5ERU2HSMfm+IuD/OtfdAnq6kESPw= go.yaml.in/yaml/v3 v3.0.5/go.mod h1:HVTZu1O7/Vkt2N+BFy8Zza+lnLsABggaTM2ZpNIGuKg= -go.yaml.in/yaml/v4 v4.0.0-rc.2 h1:/FrI8D64VSr4HtGIlUtlFMGsm7H7pWTbj6vOLVZcA6s= -go.yaml.in/yaml/v4 v4.0.0-rc.2/go.mod h1:aZqd9kCMsGL7AuUv/m/PvWLdg5sjJsZ4oHDEnfPPfY0= go4.org v0.0.0-20230225012048-214862532bf5 h1:nifaUDeh+rPaBCMPMQHZmvJf+QdpLFnuQPwx+LxVmtc= go4.org v0.0.0-20230225012048-214862532bf5/go.mod h1:F57wTi5Lrj6WLyswp5EYV1ncrEbFGHD4hhz6S1ZYeaU= golang.org/x/crypto v0.0.0-20180904163835-0709b304e793/go.mod h1:6SG95UA2DQfeDnfUPMdvaQW0Q7yPrPDi9nlGo2tz2b4= From c0109a7ad19cc5444f9840464a37a87abe169f56 Mon Sep 17 00:00:00 2001 From: anchore-oss-update-bot Date: Sun, 11 Oct 2026 21:56:57 -0400 Subject: [PATCH 10/10] chore(deps): update CPE dictionary index (#5409) Signed-off-by: anchore-oss-update-bot Co-authored-by: anchore-oss-update-bot --- .../internal/cpegenerate/dictionary/data/cpe-index.json | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/syft/pkg/cataloger/internal/cpegenerate/dictionary/data/cpe-index.json b/syft/pkg/cataloger/internal/cpegenerate/dictionary/data/cpe-index.json index 5361f9932..d3f07b37b 100644 --- a/syft/pkg/cataloger/internal/cpegenerate/dictionary/data/cpe-index.json +++ b/syft/pkg/cataloger/internal/cpegenerate/dictionary/data/cpe-index.json @@ -2439,12 +2439,18 @@ "@backstage/plugin-catalog-backend": [ "cpe:2.3:a:linuxfoundation:backstage\\/plugin-catalog-backend-module-unprocessed:*:*:*:*:*:node.js:*:*" ], + "@backstage/plugin-catalog-unprocessed-entities": [ + "cpe:2.3:a:linuxfoundation:backstage\\/plugin-catalog-unprocessed-entities:*:*:*:*:*:node.js:*:*" + ], "@backstage/plugin-catalog-unprocessed-entities-common": [ "cpe:2.3:a:linuxfoundation:backstage\\/plugin-catalog-unprocessed-entities-common:*:*:*:*:*:node.js:*:*" ], "@backstage/plugin-scaffolder-backend": [ "cpe:2.3:a:linuxfoundation:backstage\\/plugin-scaffolder-backend:*:*:*:*:*:*:*:*" ], + "@backstage/plugin-scaffolder-backend-module-sentry": [ + "cpe:2.3:a:linuxfoundation:backstage\\/plugin-scaffolder-backend-module-sentry:*:*:*:*:*:node.js:*:*" + ], "@backstage/plugin-techdocs": [ "cpe:2.3:a:linuxfoundation:\\@backstage\\/plugin-techdocs:*:*:*:*:*:node.js:*:*" ],