chore(deps): update anchore dependencies (#3827 )

Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: wagoodman <590471+wagoodman@users.noreply.github.com>
fix: Make the fileresolver Support Prefix Match of Files (#3820 )
2026-10-25 03:22:22 +01:00 · 2025-04-24 16:03:09 -04:00 · 2025-04-24 17:38:05 +00:00 · 2025-04-24 17:11:01 +00:00 · 2025-04-24 13:08:32 -04:00 · 2025-04-24 12:22:36 -04:00
62 changed files with 1298 additions and 206 deletions
@@ -26,7 +26,7 @@ tools:
  # used for linting
  - name: golangci-lint
    version:
-      want: v2.0.2
+      want: v2.1.2
    method: github-release
    with:
      repo: golangci/golangci-lint
@@ -42,7 +42,7 @@ tools:
  # used for signing the checksums file at release
  - name: cosign
    version:
-      want: v2.4.3
+      want: v2.5.0
    method: github-release
    with:
      repo: sigstore/cosign
@@ -103,7 +103,7 @@ tools:
  # used for running all local and CI tasks
  - name: task
    version:
-      want: v3.42.1
+      want: v3.43.2
    method: github-release
    with:
      repo: go-task/task
@@ -111,7 +111,7 @@ tools:
  # used for triggering a release
  - name: gh
    version:
-      want: v2.69.0
+      want: v2.71.0
    method: github-release
    with:
      repo: cli/cli
@@ -45,7 +45,7 @@ jobs:
          path: test/results/**/*

      - name: Update PR benchmark results comment
-        uses: marocchino/sticky-pull-request-comment@52423e01640425a022ef5fd42c6fb5f633a02728 #v2.9.1
+        uses: marocchino/sticky-pull-request-comment@67d0dec7b07ed060a405f9b2a64b8ab319fdd7db #v2.9.2
        continue-on-error: true
        with:
          header: benchmark
@@ -45,7 +45,7 @@ jobs:

    # Initializes the CodeQL tools for scanning.
    - name: Initialize CodeQL
-      uses: github/codeql-action/init@1b549b9259bda1cb5ddde3b41741a82a2d15a841 #v3.28.13
+      uses: github/codeql-action/init@28deaeda66b76a05916b6923827895f2b14ab387 #v3.28.16
      with:
        languages: ${{ matrix.language }}
        # If you wish to specify custom queries, you can do so here or in a config file.
@@ -56,7 +56,7 @@ jobs:
    # Autobuild attempts to build any compiled languages  (C/C++, C#, or Java).
    # If this step fails, then you should remove it and run the build manually (see below)
    - name: Autobuild
-      uses: github/codeql-action/autobuild@1b549b9259bda1cb5ddde3b41741a82a2d15a841 #v3.28.13
+      uses: github/codeql-action/autobuild@28deaeda66b76a05916b6923827895f2b14ab387 #v3.28.16

    # ℹ️ Command-line programs to run using the OS shell.
    # 📚 https://git.io/JvXDl
@@ -70,4 +70,4 @@ jobs:
    #   make release

    - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@1b549b9259bda1cb5ddde3b41741a82a2d15a841 #v3.28.13
+      uses: github/codeql-action/analyze@28deaeda66b76a05916b6923827895f2b14ab387 #v3.28.16
@@ -40,7 +40,7 @@ jobs:

      - name: Delete existing comment
        if: ${{ hashFiles( env.CI_COMMENT_FILE ) == '' }}
-        uses: marocchino/sticky-pull-request-comment@52423e01640425a022ef5fd42c6fb5f633a02728 #v2.9.1
+        uses: marocchino/sticky-pull-request-comment@67d0dec7b07ed060a405f9b2a64b8ab319fdd7db #v2.9.2
        with:
          header: ${{ env.COMMENT_HEADER }}
          hide: true
@@ -48,7 +48,7 @@ jobs:

      - name: Add comment
        if: ${{ hashFiles( env.CI_COMMENT_FILE ) != '' }}
-        uses: marocchino/sticky-pull-request-comment@52423e01640425a022ef5fd42c6fb5f633a02728 #v2.9.1
+        uses: marocchino/sticky-pull-request-comment@67d0dec7b07ed060a405f9b2a64b8ab319fdd7db #v2.9.2
        with:
          header: ${{ env.COMMENT_HEADER }}
          path: ${{ env.CI_COMMENT_FILE }}
@@ -194,7 +194,7 @@ jobs:
    runs-on: macos-latest
    steps:
      - name: Install Cosign
-        uses: sigstore/cosign-installer@v3.8.1
+        uses: sigstore/cosign-installer@v3.8.2

      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 #v4.2.2

@@ -227,6 +227,16 @@ rough outline how that works:

 ## Testing

+### Testing commands
+
+* `make help` shows a list of available commands
+* `make unit`, `make integration`, `make cli`, and `make acceptance` run those test suites (see below)
+* `make test` runs all those tests (and is therefore pretty slow)
+* `make fixtures` clears and re-fetches all test fixtures.
+* `go test ./syft/pkg/` for example can test particular packages, assuming fixtures are already made
+* `make clean-cache` cleans all test cache. Note that subsequent test runs will be slower after this
+
+
 ### Levels of testing

 - `unit`: The default level of test which is distributed throughout the repo are unit tests. Any `_test.go` file that 
@@ -224,7 +224,7 @@ tasks:
      - "go run -race cmd/syft/main.go alpine:latest"

  validate-cyclonedx-schema:
-    desc: Run integration tests
+    desc: Validate that Syft produces valid CycloneDX documents
    cmds:
      - "cd schema/cyclonedx && make"

@@ -13,6 +13,7 @@ import (
 	"github.com/spf13/cobra"

 	"github.com/anchore/clio"
+	"github.com/anchore/syft/cmd/syft/internal/options"
 	"github.com/anchore/syft/internal/bus"
 	"github.com/anchore/syft/internal/task"
 	"github.com/anchore/syft/syft/cataloging"
@@ -86,11 +87,13 @@ func runCatalogerList(opts *catalogerListOptions) error {
 }

 func catalogerListReport(opts *catalogerListOptions, allTaskGroups [][]task.Task) (string, error) {
+	defaultCatalogers := options.Flatten(opts.DefaultCatalogers)
+	selectCatalogers := options.Flatten(opts.SelectCatalogers)
 	selectedTaskGroups, selectionEvidence, err := task.SelectInGroups(
 		allTaskGroups,
 		cataloging.NewSelectionRequest().
-			WithDefaults(opts.DefaultCatalogers...).
-			WithExpression(opts.SelectCatalogers...),
+			WithDefaults(defaultCatalogers...).
+			WithExpression(selectCatalogers...),
 	)
 	if err != nil {
 		return "", fmt.Errorf("unable to select catalogers: %w", err)
@@ -99,7 +102,7 @@ func catalogerListReport(opts *catalogerListOptions, allTaskGroups [][]task.Task

 	switch opts.Output {
 	case "json":
-		report, err = renderCatalogerListJSON(flattenTaskGroups(selectedTaskGroups), selectionEvidence, opts.DefaultCatalogers, opts.SelectCatalogers)
+		report, err = renderCatalogerListJSON(flattenTaskGroups(selectedTaskGroups), selectionEvidence, defaultCatalogers, selectCatalogers)
 	case "table", "":
 		if opts.ShowHidden {
 			report = renderCatalogerListTables(allTaskGroups, selectionEvidence)
@@ -184,11 +184,11 @@ Default selections: 1
  • 'image'
 Selection expressions: 6
  • 'b' (intersect)
-  • '-directory' (remove)
  • '-c' (remove)
+  • '-directory' (remove)
  • '-file' (remove)
-  • '+task3' (add)
  • '+file-task1' (add)
+  • '+task3' (add)
 ┌────────────────┬──────────────────┐
 │ FILE CATALOGER │ TAGS             │
 ├────────────────┼──────────────────┤
@@ -200,6 +200,43 @@ Selection expressions: 6
 │ task1             │ 1, a, b, image     │
 │ task3             │ 3, c, d, directory │
 └───────────────────┴────────────────────┘
+`,
+		},
+		{
+			name: "with comma separated expressions, table",
+			options: func() *catalogerListOptions {
+				c := defaultCatalogerListOptions()
+				c.Output = "table"
+				c.DefaultCatalogers = []string{
+					"image,task3,file-task1",
+				}
+				c.SelectCatalogers = []string{
+					"-task2,c,b",
+				}
+				return c
+			}(),
+			want: `
+Default selections: 4
+  • 'file-task1'
+  • 'image'
+  • 'task3'
+  • 'file'
+Selection expressions: 3
+  • 'b' (intersect)
+  • 'c' (intersect)
+  • '-task2' (remove)
+┌────────────────┬──────────────────┐
+│ FILE CATALOGER │ TAGS             │
+├────────────────┼──────────────────┤
+│ file-task1     │ file, ft, ft-1-b │
+│ file-task2     │ file, ft, ft-2-b │
+└────────────────┴──────────────────┘
+┌───────────────────┬────────────────────┐
+│ PACKAGE CATALOGER │ TAGS               │
+├───────────────────┼────────────────────┤
+│ task1             │ 1, a, b, image     │
+│ task3             │ 3, c, d, directory │
+└───────────────────┴────────────────────┘
 `,
 		},
 		{
@@ -219,7 +256,7 @@ Selection expressions: 6
 				return c
 			}(),
 			want: `
-{"default":["image"],"selection":["-directory","+task3","-c","b"],"catalogers":[{"name":"file-task1","tags":["file"]},{"name":"file-task2","tags":["file"]},{"name":"task1","tags":["b","image"]},{"name":"task3","tags":["task3"]}]}
+{"default":["image"],"selection":["+task3","-c","-directory","b"],"catalogers":[{"name":"file-task1","tags":["file"]},{"name":"file-task2","tags":["file"]},{"name":"task1","tags":["b","image"]},{"name":"task3","tags":["task3"]}]}
 `,
 		},
 	}
@@ -170,6 +170,7 @@ func (cfg Catalog) ToPackagesConfig() pkgcataloging.Config {
 		Dotnet: dotnet.DefaultCatalogerConfig().
 			WithDepPackagesMustHaveDLL(cfg.Dotnet.DepPackagesMustHaveDLL).
 			WithDepPackagesMustClaimDLL(cfg.Dotnet.DepPackagesMustClaimDLL).
+			WithPropagateDLLClaimsToParents(cfg.Dotnet.PropagateDLLClaimsToParents).
 			WithRelaxDLLClaimsWhenBundlingDetected(cfg.Dotnet.RelaxDLLClaimsWhenBundlingDetected),
 		Golang: golang.DefaultCatalogerConfig().
 			WithSearchLocalModCacheLicenses(*multiLevelOption(false, enrichmentEnabled(cfg.Enrich, task.Go, task.Golang), cfg.Golang.SearchLocalModCacheLicenses)).
@@ -272,12 +273,12 @@ func (cfg *Catalog) PostLoad() error {
 		return fmt.Errorf("cannot use both 'catalogers' and 'select-catalogers'/'default-catalogers' flags")
 	}

-	cfg.From = flatten(cfg.From)
+	cfg.From = Flatten(cfg.From)

-	cfg.Catalogers = flatten(cfg.Catalogers)
-	cfg.DefaultCatalogers = flatten(cfg.DefaultCatalogers)
-	cfg.SelectCatalogers = flatten(cfg.SelectCatalogers)
-	cfg.Enrich = flatten(cfg.Enrich)
+	cfg.Catalogers = Flatten(cfg.Catalogers)
+	cfg.DefaultCatalogers = Flatten(cfg.DefaultCatalogers)
+	cfg.SelectCatalogers = Flatten(cfg.SelectCatalogers)
+	cfg.Enrich = Flatten(cfg.Enrich)

 	// for backwards compatibility
 	cfg.DefaultCatalogers = append(cfg.DefaultCatalogers, cfg.Catalogers...)
@@ -295,7 +296,7 @@ func (cfg *Catalog) PostLoad() error {
 	return nil
 }

-func flatten(commaSeparatedEntries []string) []string {
+func Flatten(commaSeparatedEntries []string) []string {
 	var out []string
 	for _, v := range commaSeparatedEntries {
 		for _, s := range strings.Split(v, ",") {
@@ -139,7 +139,7 @@ func Test_enrichmentEnabled(t *testing.T) {

 	for _, test := range tests {
 		t.Run(test.directives, func(t *testing.T) {
-			got := enrichmentEnabled(flatten([]string{test.directives}), test.test)
+			got := enrichmentEnabled(Flatten([]string{test.directives}), test.test)
 			assert.Equal(t, test.expected, got)
 		})
 	}
@@ -10,6 +10,8 @@ type dotnetConfig struct {

 	DepPackagesMustClaimDLL bool `mapstructure:"dep-packages-must-claim-dll" json:"dep-packages-must-claim-dll" yaml:"dep-packages-must-claim-dll"`

+	PropagateDLLClaimsToParents bool `mapstructure:"propagate-dll-claims-to-parents" json:"propagate-dll-claims-to-parents" yaml:"propagate-dll-claims-to-parents"`
+
 	RelaxDLLClaimsWhenBundlingDetected bool `mapstructure:"relax-dll-claims-when-bundling-detected" json:"relax-dll-claims-when-bundling-detected" yaml:"relax-dll-claims-when-bundling-detected"`
 }

@@ -18,8 +20,9 @@ var _ interface {
 } = (*dotnetConfig)(nil)

 func (o *dotnetConfig) DescribeFields(descriptions clio.FieldDescriptionSet) {
-	descriptions.Add(&o.DepPackagesMustHaveDLL, `only keep dep.json packages which an executable on disk can be found for`)
-	descriptions.Add(&o.DepPackagesMustClaimDLL, `only keep dep.json packages which have a runtime/resource DLL claimed in the deps.json targets section (but not necessarily found on disk)`)
+	descriptions.Add(&o.DepPackagesMustHaveDLL, `only keep dep.json packages which an executable on disk is found. The package is also included if a DLL is found for any child package, even if the package itself does not have a DLL.`)
+	descriptions.Add(&o.DepPackagesMustClaimDLL, `only keep dep.json packages which have a runtime/resource DLL claimed in the deps.json targets section (but not necessarily found on disk). The package is also included if any child package claims a DLL, even if the package itself does not claim a DLL.`)
+	descriptions.Add(&o.PropagateDLLClaimsToParents, `treat DLL claims or on-disk evidence for child packages as DLL claims or on-disk evidence for any parent package`)
 	descriptions.Add(&o.RelaxDLLClaimsWhenBundlingDetected, `show all packages from the deps.json if bundling tooling is present as a dependency (e.g. ILRepack)`)
 }

@@ -28,6 +31,7 @@ func defaultDotnetConfig() dotnetConfig {
 	return dotnetConfig{
 		DepPackagesMustHaveDLL:             def.DepPackagesMustHaveDLL,
 		DepPackagesMustClaimDLL:            def.DepPackagesMustClaimDLL,
+		PropagateDLLClaimsToParents:        def.PropagateDLLClaimsToParents,
 		RelaxDLLClaimsWhenBundlingDetected: def.RelaxDLLClaimsWhenBundlingDetected,
 	}
 }
@@ -22,13 +22,13 @@ require (
 	github.com/anchore/go-testutils v0.0.0-20200925183923-d5f45b0d3c04
 	github.com/anchore/go-version v1.2.2-0.20200701162849-18adb9c92b9b
 	github.com/anchore/packageurl-go v0.1.1-0.20250220190351-d62adb6e1115
-	github.com/anchore/stereoscope v0.1.2
+	github.com/anchore/stereoscope v0.1.4
 	github.com/anmitsu/go-shlex v0.0.0-20200514113438-38f4b401e2be
 	github.com/aquasecurity/go-pep440-version v0.0.1
 	github.com/bitnami/go-version v0.0.0-20250131085805-b1f57a8634ef
 	github.com/blakesmith/ar v0.0.0-20190502131153-809d4375e1fb
 	github.com/bmatcuk/doublestar/v4 v4.8.1
-	github.com/charmbracelet/bubbles v0.20.0
+	github.com/charmbracelet/bubbles v0.21.0
 	github.com/charmbracelet/bubbletea v1.3.4
 	github.com/charmbracelet/lipgloss v1.1.0
 	github.com/dave/jennifer v1.7.1
@@ -40,7 +40,7 @@ require (
 	github.com/github/go-spdx/v2 v2.3.2
 	github.com/gkampitakis/go-snaps v0.5.11
 	github.com/go-git/go-billy/v5 v5.6.2
-	github.com/go-git/go-git/v5 v5.14.0
+	github.com/go-git/go-git/v5 v5.16.0
 	github.com/go-test/deep v1.1.1
 	github.com/go-viper/mapstructure/v2 v2.2.1
 	github.com/gohugoio/hashstructure v0.5.0
@@ -57,8 +57,8 @@ require (
 	github.com/jinzhu/copier v0.4.0
 	github.com/kastenhq/goversion v0.0.0-20230811215019-93b2f8823953
 	github.com/knqyf263/go-rpmdb v0.1.1
-	github.com/magiconair/properties v1.8.9
-	github.com/mholt/archives v0.1.0
+	github.com/magiconair/properties v1.8.10
+	github.com/mholt/archives v0.1.1
 	github.com/moby/sys/mountinfo v0.7.2
 	github.com/olekukonko/tablewriter v0.0.5
 	github.com/opencontainers/go-digest v1.0.0
@@ -85,7 +85,7 @@ require (
 	go.uber.org/goleak v1.3.0
 	golang.org/x/exp v0.0.0-20250305212735-054e65f0b394
 	golang.org/x/mod v0.24.0
-	golang.org/x/net v0.38.0
+	golang.org/x/net v0.39.0
 	gopkg.in/yaml.v3 v3.0.1
 	modernc.org/sqlite v1.37.0
 )
@@ -118,7 +118,7 @@ require (
 	github.com/charmbracelet/x/ansi v0.8.0 // indirect
 	github.com/charmbracelet/x/cellbuf v0.0.13-0.20250311204145-2c3ea96c31dd // indirect
 	github.com/charmbracelet/x/term v0.2.1 // indirect
-	github.com/cloudflare/circl v1.6.0 // indirect
+	github.com/cloudflare/circl v1.6.1 // indirect
 	github.com/containerd/cgroups v1.1.0 // indirect
 	github.com/containerd/containerd v1.7.27 // indirect
 	github.com/containerd/containerd/api v1.8.0 // indirect
@@ -132,9 +132,9 @@ require (
 	github.com/containerd/typeurl/v2 v2.1.1 // indirect
 	github.com/cyphar/filepath-securejoin v0.4.1 // indirect
 	github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
-	github.com/docker/cli v28.0.4+incompatible // indirect
+	github.com/docker/cli v28.1.1+incompatible // indirect
 	github.com/docker/distribution v2.8.3+incompatible // indirect
-	github.com/docker/docker v28.0.4+incompatible // indirect
+	github.com/docker/docker v28.1.1+incompatible // indirect
 	github.com/docker/docker-credential-helpers v0.8.2 // indirect
 	github.com/docker/go-connections v0.5.0 // indirect
 	github.com/docker/go-events v0.0.0-20190806004212-e31b211e4f1c // indirect
@@ -145,7 +145,7 @@ require (
 	github.com/felixge/fgprof v0.9.5 // indirect
 	github.com/felixge/httpsnoop v1.0.4 // indirect
 	github.com/fsnotify/fsnotify v1.8.0 // indirect
-	github.com/gabriel-vasile/mimetype v1.4.8 // indirect
+	github.com/gabriel-vasile/mimetype v1.4.9 // indirect
 	github.com/gkampitakis/ciinfo v0.3.1 // indirect
 	github.com/gkampitakis/go-diff v1.3.2 // indirect
 	github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376 // indirect
@@ -182,7 +182,7 @@ require (
 	github.com/mitchellh/reflectwalk v1.0.2 // indirect
 	github.com/moby/docker-image-spec v1.3.1 // indirect
 	github.com/moby/locker v1.0.1 // indirect
-	github.com/moby/sys/sequential v0.5.0 // indirect
+	github.com/moby/sys/sequential v0.6.0 // indirect
 	github.com/moby/sys/signal v0.7.0 // indirect
 	github.com/moby/sys/user v0.3.0 // indirect
 	github.com/moby/sys/userns v0.1.0 // indirect
@@ -191,7 +191,7 @@ require (
 	github.com/muesli/termenv v0.16.0 // indirect
 	github.com/ncruces/go-strftime v0.1.9 // indirect
 	github.com/nwaples/rardecode v1.1.3 // indirect
-	github.com/nwaples/rardecode/v2 v2.0.0-beta.4.0.20241112120701-034e449c6e78 // indirect
+	github.com/nwaples/rardecode/v2 v2.1.0 // indirect
 	github.com/opencontainers/image-spec v1.1.1 // indirect
 	github.com/opencontainers/runtime-spec v1.1.0 // indirect
 	github.com/opencontainers/selinux v1.11.0 // indirect
@@ -240,11 +240,11 @@ require (
 	go.uber.org/atomic v1.9.0 // indirect
 	go.uber.org/multierr v1.9.0 // indirect
 	go4.org v0.0.0-20230225012048-214862532bf5 // indirect
-	golang.org/x/crypto v0.36.0 // indirect
-	golang.org/x/sync v0.12.0 // indirect
-	golang.org/x/sys v0.31.0 // indirect
-	golang.org/x/term v0.30.0 // indirect
-	golang.org/x/text v0.23.0 // indirect
+	golang.org/x/crypto v0.37.0 // indirect
+	golang.org/x/sync v0.13.0 // indirect
+	golang.org/x/sys v0.32.0 // indirect
+	golang.org/x/term v0.31.0 // indirect
+	golang.org/x/text v0.24.0 // indirect
 	golang.org/x/tools v0.31.0 // indirect
 	golang.org/x/xerrors v0.0.0-20231012003039-104605ab7028 // indirect
 	google.golang.org/genproto v0.0.0-20241118233622-e639e219e697 // indirect
@@ -259,6 +259,8 @@ require (

 require github.com/anchore/go-sync v0.0.0-20250326131806-4eda43a485b6

+require github.com/minio/minlz v1.0.0 // indirect
+
 retract (
 	v0.53.2
 	v0.53.1 // Published accidentally with incorrect license in depdencies
@@ -122,8 +122,8 @@ github.com/anchore/go-version v1.2.2-0.20200701162849-18adb9c92b9b h1:e1bmaoJfZV
 github.com/anchore/go-version v1.2.2-0.20200701162849-18adb9c92b9b/go.mod h1:Bkc+JYWjMCF8OyZ340IMSIi2Ebf3uwByOk6ho4wne1E=
 github.com/anchore/packageurl-go v0.1.1-0.20250220190351-d62adb6e1115 h1:ZyRCmiEjnoGJZ1+Ah0ZZ/mKKqNhGcUZBl0s7PTTDzvY=
 github.com/anchore/packageurl-go v0.1.1-0.20250220190351-d62adb6e1115/go.mod h1:KoYIv7tdP5+CC9VGkeZV4/vGCKsY55VvoG+5dadg4YI=
-github.com/anchore/stereoscope v0.1.2 h1:0+Jcf7hoImYKfrH2XzN6vvbmbpm68A/woabC43gZ4eU=
-github.com/anchore/stereoscope v0.1.2/go.mod h1:kU4LkiocOimxuSnlmJgilHCfDMCR5t/UroKIpzI8jNw=
+github.com/anchore/stereoscope v0.1.4 h1:e+iT9UdUzLBabWGe84hn5sTHDRioY+4IHsVzJXuJlek=
+github.com/anchore/stereoscope v0.1.4/go.mod h1:omWgXDEp/XfqCJlZXIByEo1c3ArZg/qTJ5LBKVLAIdw=
 github.com/andreyvit/diff v0.0.0-20170406064948-c7f18ee00883/go.mod h1:rCTlJbsFo29Kk6CurOXKm700vrz8f0KW0JNfpkRJY/8=
 github.com/andybalholm/brotli v1.1.1 h1:PR2pgnyFznKEugtsUo0xLdDop5SKXd5Qf5ysW+7XdTA=
 github.com/andybalholm/brotli v1.1.1/go.mod h1:05ib4cKhjx3OQYUY22hTVd34Bc8upXjOLL2rKwwZBoA=
@@ -149,6 +149,8 @@ github.com/atotto/clipboard v0.1.4 h1:EH0zSVneZPSuFR11BlR9YppQTVDbh5+16AmcJi4g1z
 github.com/atotto/clipboard v0.1.4/go.mod h1:ZY9tmq7sm5xIbd9bOK4onWV4S6X0u6GY7Vn0Yu86PYI=
 github.com/aymanbagabas/go-osc52/v2 v2.0.1 h1:HwpRHbFMcZLEVr42D4p7XBqjyuxQH5SMiErDT4WkJ2k=
 github.com/aymanbagabas/go-osc52/v2 v2.0.1/go.mod h1:uYgXzlJ7ZpABp8OJ+exZzJJhRNQ2ASbcXHWsFqH8hp8=
+github.com/aymanbagabas/go-udiff v0.2.0 h1:TK0fH4MteXUDspT88n8CKzvK0X9O2xu9yQjWpi6yML8=
+github.com/aymanbagabas/go-udiff v0.2.0/go.mod h1:RE4Ex0qsGkTAJoQdQQCA0uG+nAzJO/pI/QwceO5fgrA=
 github.com/becheran/wildmatch-go v1.0.0 h1:mE3dGGkTmpKtT4Z+88t8RStG40yN9T+kFEGj2PZFSzA=
 github.com/becheran/wildmatch-go v1.0.0/go.mod h1:gbMvj0NtVdJ15Mg/mH9uxk2R1QCistMyU7d9KFzroX4=
 github.com/beorn7/perks v0.0.0-20180321164747-3a771d992973/go.mod h1:Dwedo/Wpr24TaqPxmxbtue+5NUziq4I4S80YR8gNf3Q=
@@ -179,8 +181,8 @@ github.com/cespare/xxhash/v2 v2.1.1/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XL
 github.com/cespare/xxhash/v2 v2.1.2/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
 github.com/cespare/xxhash/v2 v2.3.0 h1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UFvs=
 github.com/cespare/xxhash/v2 v2.3.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
-github.com/charmbracelet/bubbles v0.20.0 h1:jSZu6qD8cRQ6k9OMfR1WlM+ruM8fkPWkHvQWD9LIutE=
-github.com/charmbracelet/bubbles v0.20.0/go.mod h1:39slydyswPy+uVOHZ5x/GjwVAFkCsV8IIVy+4MhzwwU=
+github.com/charmbracelet/bubbles v0.21.0 h1:9TdC97SdRVg/1aaXNVWfFH3nnLAwOXr8Fn6u6mfQdFs=
+github.com/charmbracelet/bubbles v0.21.0/go.mod h1:HF+v6QUR4HkEpz62dx7ym2xc71/KBHg+zKwJtMw+qtg=
 github.com/charmbracelet/bubbletea v1.3.4 h1:kCg7B+jSCFPLYRA52SDZjr51kG/fMUEoPoZrkaDHyoI=
 github.com/charmbracelet/bubbletea v1.3.4/go.mod h1:dtcUCyCGEX3g9tosuYiut3MXgY/Jsv9nKVdibKKRRXo=
 github.com/charmbracelet/colorprofile v0.2.3-0.20250311203215-f60798e515dc h1:4pZI35227imm7yK2bGPcfpFEmuY1gc2YSTShr4iJBfs=
@@ -193,6 +195,8 @@ github.com/charmbracelet/x/ansi v0.8.0 h1:9GTq3xq9caJW8ZrBTe0LIe2fvfLR/bYXKTx2ll
 github.com/charmbracelet/x/ansi v0.8.0/go.mod h1:wdYl/ONOLHLIVmQaxbIYEC/cRKOQyjTkowiI4blgS9Q=
 github.com/charmbracelet/x/cellbuf v0.0.13-0.20250311204145-2c3ea96c31dd h1:vy0GVL4jeHEwG5YOXDmi86oYw2yuYUGqz6a8sLwg0X8=
 github.com/charmbracelet/x/cellbuf v0.0.13-0.20250311204145-2c3ea96c31dd/go.mod h1:xe0nKWGd3eJgtqZRaN9RjMtK7xUYchjzPr7q6kcvCCs=
+github.com/charmbracelet/x/exp/golden v0.0.0-20241011142426-46044092ad91 h1:payRxjMjKgx2PaCWLZ4p3ro9y97+TVLZNaRZgJwSVDQ=
+github.com/charmbracelet/x/exp/golden v0.0.0-20241011142426-46044092ad91/go.mod h1:wDlXFlCrmJ8J+swcL/MnGUuYnqgQdW9rhSD61oNMb6U=
 github.com/charmbracelet/x/term v0.2.1 h1:AQeHeLZ1OqSXhrAWpYUtZyX1T3zVxfpZuEQMIQaGIAQ=
 github.com/charmbracelet/x/term v0.2.1/go.mod h1:oQ4enTYFV7QN4m0i9mzHrViD7TQKvNEEkHUMCmsxdUg=
 github.com/chromedp/cdproto v0.0.0-20230802225258-3cf4e6d46a89/go.mod h1:GKljq0VrfU4D5yc+2qA6OVr8pmO/MBbPEWqWQ/oqGEs=
@@ -207,8 +211,8 @@ github.com/chzyer/test v1.0.0/go.mod h1:2JlltgoNkt4TW/z9V/IzDdFaMTM2JPIi26O1pF38
 github.com/circonus-labs/circonus-gometrics v2.3.1+incompatible/go.mod h1:nmEj6Dob7S7YxXgwXpfOuvO54S+tGdZdw9fuRZt25Ag=
 github.com/circonus-labs/circonusllhist v0.1.3/go.mod h1:kMXHVDlOchFAehlya5ePtbp5jckzBHf4XRpQvBOLI+I=
 github.com/client9/misspell v0.3.4/go.mod h1:qj6jICC3Q7zFZvVWo7KLAzC3yx5G7kyvSDkc90ppPyw=
-github.com/cloudflare/circl v1.6.0 h1:cr5JKic4HI+LkINy2lg3W2jF8sHCVTBncJr5gIIq7qk=
-github.com/cloudflare/circl v1.6.0/go.mod h1:uddAzsPgqdMAYatqJ0lsjX1oECcQLIlRpzZh3pJrofs=
+github.com/cloudflare/circl v1.6.1 h1:zqIqSPIndyBh1bjLVVDHMPpVKqp8Su/V+6MeDzzQBQ0=
+github.com/cloudflare/circl v1.6.1/go.mod h1:uddAzsPgqdMAYatqJ0lsjX1oECcQLIlRpzZh3pJrofs=
 github.com/cncf/udpa/go v0.0.0-20191209042840-269d4d468f6f/go.mod h1:M8M6+tZqaGXZJjfX53e64911xZQV5JYwmTeXPW+k8Sc=
 github.com/cncf/udpa/go v0.0.0-20200629203442-efcf912fb354/go.mod h1:WmhPx2Nbnhtbo57+VJT5O0JRkEi1Wbu0z5j0R8u5Hbk=
 github.com/cncf/udpa/go v0.0.0-20201120205902-5459f2c99403/go.mod h1:WmhPx2Nbnhtbo57+VJT5O0JRkEi1Wbu0z5j0R8u5Hbk=
@@ -260,12 +264,12 @@ github.com/deitch/magic v0.0.0-20230404182410-1ff89d7342da/go.mod h1:B3tI9iGHi4i
 github.com/dgrijalva/jwt-go/v4 v4.0.0-preview1/go.mod h1:+hnT3ywWDTAFrW5aE+u2Sa/wT555ZqwoCS+pk3p6ry4=
 github.com/distribution/reference v0.6.0 h1:0IXCQ5g4/QMHHkarYzh5l+u8T3t73zM5QvfrDyIgxBk=
 github.com/distribution/reference v0.6.0/go.mod h1:BbU0aIcezP1/5jX/8MP0YiH4SdvB5Y4f/wlDRiLyi3E=
-github.com/docker/cli v28.0.4+incompatible h1:pBJSJeNd9QeIWPjRcV91RVJihd/TXB77q1ef64XEu4A=
-github.com/docker/cli v28.0.4+incompatible/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8=
+github.com/docker/cli v28.1.1+incompatible h1:eyUemzeI45DY7eDPuwUcmDyDj1pM98oD5MdSpiItp8k=
+github.com/docker/cli v28.1.1+incompatible/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8=
 github.com/docker/distribution v2.8.3+incompatible h1:AtKxIZ36LoNK51+Z6RpzLpddBirtxJnzDrHLEKxTAYk=
 github.com/docker/distribution v2.8.3+incompatible/go.mod h1:J2gT2udsDAN96Uj4KfcMRqY0/ypR+oyYUYmja8H+y+w=
-github.com/docker/docker v28.0.4+incompatible h1:JNNkBctYKurkw6FrHfKqY0nKIDf5nrbxjVBtS+cdcok=
-github.com/docker/docker v28.0.4+incompatible/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk=
+github.com/docker/docker v28.1.1+incompatible h1:49M11BFLsVO1gxY9UX9p/zwkE/rswggs8AdFmXQw51I=
+github.com/docker/docker v28.1.1+incompatible/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk=
 github.com/docker/docker-credential-helpers v0.8.2 h1:bX3YxiGzFP5sOXWc3bTPEXdEaZSeVMrFgOr3T+zrFAo=
 github.com/docker/docker-credential-helpers v0.8.2/go.mod h1:P3ci7E3lwkZg6XiHdRKft1KckHiO9a2rNtyFbZ/ry9M=
 github.com/docker/go-connections v0.5.0 h1:USnMq7hx7gwdVZq1L49hLXaFtUdTADjXGp+uj1Br63c=
@@ -316,8 +320,8 @@ github.com/frankban/quicktest v1.14.6/go.mod h1:4ptaffx2x8+WTWXmUCuVU6aPUX1/Mz7z
 github.com/fsnotify/fsnotify v1.5.1/go.mod h1:T3375wBYaZdLLcVNkcVbzGHY7f1l/uK5T5Ai1i3InKU=
 github.com/fsnotify/fsnotify v1.8.0 h1:dAwr6QBTBZIkG8roQaJjGof0pp0EeF+tNV7YBP3F/8M=
 github.com/fsnotify/fsnotify v1.8.0/go.mod h1:8jBTzvmWwFyi3Pb8djgCCO5IBqzKJ/Jwo8TRcHyHii0=
-github.com/gabriel-vasile/mimetype v1.4.8 h1:FfZ3gj38NjllZIeJAmMhr+qKL8Wu+nOoI3GqacKw1NM=
-github.com/gabriel-vasile/mimetype v1.4.8/go.mod h1:ByKUIKGjh1ODkGM1asKUbQZOLGrPjydw3hYPU2YU9t8=
+github.com/gabriel-vasile/mimetype v1.4.9 h1:5k+WDwEsD9eTLL8Tz3L0VnmVh9QxGjRmjBvAG7U/oYY=
+github.com/gabriel-vasile/mimetype v1.4.9/go.mod h1:WnSQhFKJuBlRyLiKohA/2DtIlPFAbguNaG7QCHcyGok=
 github.com/ghodss/yaml v1.0.0/go.mod h1:4dBDuWmgqj2HViK6kFavaiC9ZROes6MMH2rRYeMEF04=
 github.com/github/go-spdx/v2 v2.3.2 h1:IfdyNHTqzs4zAJjXdVQfRnxt1XMfycXoHBE2Vsm1bjs=
 github.com/github/go-spdx/v2 v2.3.2/go.mod h1:2ZxKsOhvBp+OYBDlsGnUMcchLeo2mrpEBn2L1C+U3IQ=
@@ -337,8 +341,8 @@ github.com/go-git/go-billy/v5 v5.6.2 h1:6Q86EsPXMa7c3YZ3aLAQsMA0VlWmy43r6FHqa/UN
 github.com/go-git/go-billy/v5 v5.6.2/go.mod h1:rcFC2rAsp/erv7CMz9GczHcuD0D32fWzH+MJAU+jaUU=
 github.com/go-git/go-git-fixtures/v4 v4.3.2-0.20231010084843-55a94097c399 h1:eMje31YglSBqCdIqdhKBW8lokaMrL3uTkpGYlE2OOT4=
 github.com/go-git/go-git-fixtures/v4 v4.3.2-0.20231010084843-55a94097c399/go.mod h1:1OCfN199q1Jm3HZlxleg+Dw/mwps2Wbk9frAWm+4FII=
-github.com/go-git/go-git/v5 v5.14.0 h1:/MD3lCrGjCen5WfEAzKg00MJJffKhC8gzS80ycmCi60=
-github.com/go-git/go-git/v5 v5.14.0/go.mod h1:Z5Xhoia5PcWA3NF8vRLURn9E5FRhSl7dGj9ItW3Wk5k=
+github.com/go-git/go-git/v5 v5.16.0 h1:k3kuOEpkc0DeY7xlL6NaaNg39xdgQbtH5mwCafHO9AQ=
+github.com/go-git/go-git/v5 v5.16.0/go.mod h1:4Ge4alE/5gPs30F2H1esi2gPd69R0C39lolkucHBOp8=
 github.com/go-gl/glfw v0.0.0-20190409004039-e6da0acd62b1/go.mod h1:vR7hzQXu2zJy9AVAgeJqvqgH9Q5CA+iKCZ2gyEVpxRU=
 github.com/go-gl/glfw/v3.3/glfw v0.0.0-20191125211704-12ad95a8df72/go.mod h1:tQ2UAYgL5IevRw8kRxooKSPJfGvJ9fJQFa0TUsXzTg8=
 github.com/go-gl/glfw/v3.3/glfw v0.0.0-20200222043503-6f7a984d4dc4/go.mod h1:tQ2UAYgL5IevRw8kRxooKSPJfGvJ9fJQFa0TUsXzTg8=
@@ -569,8 +573,8 @@ github.com/lucasb-eyer/go-colorful v1.2.0 h1:1nnpGOrhyZZuNyfu1QjKiUICQ74+3FNCN69
 github.com/lucasb-eyer/go-colorful v1.2.0/go.mod h1:R4dSotOR9KMtayYi1e77YzuveK+i7ruzyGqttikkLy0=
 github.com/lyft/protoc-gen-star v0.5.3/go.mod h1:V0xaHgaf5oCCqmcxYcWiDfTiKsZsRc87/1qhoTACD8w=
 github.com/magiconair/properties v1.8.5/go.mod h1:y3VJvCyxH9uVvJTWEGAELF3aiYNyPKd5NZ3oSwXrF60=
-github.com/magiconair/properties v1.8.9 h1:nWcCbLq1N2v/cpNsy5WvQ37Fb+YElfq20WJ/a8RkpQM=
-github.com/magiconair/properties v1.8.9/go.mod h1:Dhd985XPs7jluiymwWYZ0G4Z61jb3vdS329zhj2hYo0=
+github.com/magiconair/properties v1.8.10 h1:s31yESBquKXCV9a/ScB3ESkOjUYYv+X0rg8SYxI99mE=
+github.com/magiconair/properties v1.8.10/go.mod h1:Dhd985XPs7jluiymwWYZ0G4Z61jb3vdS329zhj2hYo0=
 github.com/mailru/easyjson v0.7.7/go.mod h1:xzfreul335JAWq5oZzymOObrkdz5UnU4kGfJJLY9Nlc=
 github.com/maruel/natural v1.1.1 h1:Hja7XhhmvEFhcByqDoHz9QZbkWey+COd9xWfCfn1ioo=
 github.com/maruel/natural v1.1.1/go.mod h1:v+Rfd79xlw1AgVBjbO0BEQmptqb5HvL/k9GRHB7ZKEg=
@@ -598,11 +602,13 @@ github.com/mattn/go-runewidth v0.0.16/go.mod h1:Jdepj2loyihRzMpdS35Xk/zdY8IAYHsh
 github.com/matttproud/golang_protobuf_extensions v1.0.1/go.mod h1:D8He9yQNgCq6Z5Ld7szi9bcBfOoFv/3dc6xSMkL2PC0=
 github.com/mgutz/ansi v0.0.0-20200706080929-d51e80ef957d h1:5PJl274Y63IEHC+7izoQE9x6ikvDFZS2mDVS3drnohI=
 github.com/mgutz/ansi v0.0.0-20200706080929-d51e80ef957d/go.mod h1:01TrycV0kFyexm33Z7vhZRXopbI8J3TDReVlkTgMUxE=
-github.com/mholt/archives v0.1.0 h1:FacgJyrjiuyomTuNA92X5GyRBRZjE43Y/lrzKIlF35Q=
-github.com/mholt/archives v0.1.0/go.mod h1:j/Ire/jm42GN7h90F5kzj6hf6ZFzEH66de+hmjEKu+I=
+github.com/mholt/archives v0.1.1 h1:c7J3qXN1FB54y0qiUXiq9Bxk4eCUc8pdXWwOhZdRzeY=
+github.com/mholt/archives v0.1.1/go.mod h1:FQVz01Q2uXKB/35CXeW/QFO23xT+hSCGZHVtha78U4I=
 github.com/miekg/dns v1.0.14/go.mod h1:W1PPwlIAgtquWBMBEV9nkV9Cazfe8ScdGz/Lj7v3Nrg=
 github.com/miekg/dns v1.1.26/go.mod h1:bPDLeHnStXmXAq1m/Ch/hvfNHr14JKNPMBo3VZKjuso=
 github.com/miekg/dns v1.1.41/go.mod h1:p6aan82bvRIyn+zDIv9xYNUpwa73JcSh9BKwknJysuI=
+github.com/minio/minlz v1.0.0 h1:Kj7aJZ1//LlTP1DM8Jm7lNKvvJS2m74gyyXXn3+uJWQ=
+github.com/minio/minlz v1.0.0/go.mod h1:qT0aEB35q79LLornSzeDH75LBf3aH1MV+jB5w9Wasec=
 github.com/mitchellh/cli v1.1.0/go.mod h1:xcISNoH86gajksDmfB23e/pu+B+GeFRMYmoHXxx3xhI=
 github.com/mitchellh/copystructure v1.2.0 h1:vpKXTN4ewci03Vljg/q9QvCGUDttBOGBIa15WveJJGw=
 github.com/mitchellh/copystructure v1.2.0/go.mod h1:qLl+cE2AmVv+CoeAwDPye/v+N2HKCj9FbZEVFJRxO9s=
@@ -620,10 +626,12 @@ github.com/moby/docker-image-spec v1.3.1 h1:jMKff3w6PgbfSa69GfNg+zN/XLhfXJGnEx3N
 github.com/moby/docker-image-spec v1.3.1/go.mod h1:eKmb5VW8vQEh/BAr2yvVNvuiJuY6UIocYsFu/DxxRpo=
 github.com/moby/locker v1.0.1 h1:fOXqR41zeveg4fFODix+1Ch4mj/gT0NE1XJbp/epuBg=
 github.com/moby/locker v1.0.1/go.mod h1:S7SDdo5zpBK84bzzVlKr2V0hz+7x9hWbYC/kq7oQppc=
+github.com/moby/sys/atomicwriter v0.1.0 h1:kw5D/EqkBwsBFi0ss9v1VG3wIkVhzGvLklJ+w3A14Sw=
+github.com/moby/sys/atomicwriter v0.1.0/go.mod h1:Ul8oqv2ZMNHOceF643P6FKPXeCmYtlQMvpizfsSoaWs=
 github.com/moby/sys/mountinfo v0.7.2 h1:1shs6aH5s4o5H2zQLn796ADW1wMrIwHsyJ2v9KouLrg=
 github.com/moby/sys/mountinfo v0.7.2/go.mod h1:1YOa8w8Ih7uW0wALDUgT1dTTSBrZ+HiBLGws92L2RU4=
-github.com/moby/sys/sequential v0.5.0 h1:OPvI35Lzn9K04PBbCLW0g4LcFAJgHsvXsRyewg5lXtc=
-github.com/moby/sys/sequential v0.5.0/go.mod h1:tH2cOOs5V9MlPiXcQzRC+eEyab644PWKGRYaaV5ZZlo=
+github.com/moby/sys/sequential v0.6.0 h1:qrx7XFUd/5DxtqcoH1h438hF5TmOvzC/lspjy7zgvCU=
+github.com/moby/sys/sequential v0.6.0/go.mod h1:uyv8EUTrca5PnDsdMGXhZe6CCe8U/UiTWd+lL+7b/Ko=
 github.com/moby/sys/signal v0.7.0 h1:25RW3d5TnQEoKvRbEKUGay6DCQ46IxAVTT9CUMgmsSI=
 github.com/moby/sys/signal v0.7.0/go.mod h1:GQ6ObYZfqacOwTtlXvcmh9A26dVRul/hbOZn88Kg8Tg=
 github.com/moby/sys/user v0.3.0 h1:9ni5DlcW5an3SvRSx4MouotOygvzaXbaSrc/wGDFWPo=
@@ -650,8 +658,8 @@ github.com/ncruces/go-strftime v0.1.9 h1:bY0MQC28UADQmHmaF5dgpLmImcShSi2kHU9XLdh
 github.com/ncruces/go-strftime v0.1.9/go.mod h1:Fwc5htZGVVkseilnfgOVb9mKy6w1naJmn9CehxcKcls=
 github.com/nwaples/rardecode v1.1.3 h1:cWCaZwfM5H7nAD6PyEdcVnczzV8i/JtotnyW/dD9lEc=
 github.com/nwaples/rardecode v1.1.3/go.mod h1:5DzqNKiOdpKKBH87u8VlvAnPZMXcGRhxWkRpHbbfGS0=
-github.com/nwaples/rardecode/v2 v2.0.0-beta.4.0.20241112120701-034e449c6e78 h1:MYzLheyVx1tJVDqfu3YnN4jtnyALNzLvwl+f58TcvQY=
-github.com/nwaples/rardecode/v2 v2.0.0-beta.4.0.20241112120701-034e449c6e78/go.mod h1:yntwv/HfMc/Hbvtq9I19D1n58te3h6KsqCf3GxyfBGY=
+github.com/nwaples/rardecode/v2 v2.1.0 h1:JQl9ZoBPDy+nIZGb1mx8+anfHp/LV3NE2MjMiv0ct/U=
+github.com/nwaples/rardecode/v2 v2.1.0/go.mod h1:7uz379lSxPe6j9nvzxUZ+n7mnJNgjsRNb6IbvGVHRmw=
 github.com/olekukonko/tablewriter v0.0.5 h1:P2Ga83D34wi1o9J6Wh1mRuqd4mF/x/lgBS7N7AbDhec=
 github.com/olekukonko/tablewriter v0.0.5/go.mod h1:hPp6KlRPjbx+hW8ykQs1w3UBbZlj6HuIJcUGPhkA7kY=
 github.com/onsi/gomega v1.34.1 h1:EUMJIKUjM8sKjYbtxQI9A4z2o+rruxnzNvpknOXie6k=
@@ -915,8 +923,8 @@ golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPh
 golang.org/x/crypto v0.0.0-20210817164053-32db794688a5/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
 golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
 golang.org/x/crypto v0.0.0-20220622213112-05595931fe9d/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=
-golang.org/x/crypto v0.36.0 h1:AnAEvhDddvBdpY+uR+MyHmuZzzNqXSe/GvuDeob5L34=
-golang.org/x/crypto v0.36.0/go.mod h1:Y4J0ReaxCR1IMaabaSMugxJES1EpwhBHhv2bDHklZvc=
+golang.org/x/crypto v0.37.0 h1:kJNSjF/Xp7kU0iB2Z+9viTPMW4EqqsrywMXLJOOsXSE=
+golang.org/x/crypto v0.37.0/go.mod h1:vg+k43peMZ0pUMhYmVAWysMK35e6ioLh3wB8ZCAfbVc=
 golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
 golang.org/x/exp v0.0.0-20190306152737-a1d7652674e8/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
 golang.org/x/exp v0.0.0-20190510132918-efd6b22b2522/go.mod h1:ZjyILWgesfNpC6sMxTJOJm9Kp84zZh5NQWvqDGG3Qr8=
@@ -1002,8 +1010,8 @@ golang.org/x/net v0.0.0-20210813160813-60bc85c4be6d/go.mod h1:9nx3DQGgdP8bBQD5qx
 golang.org/x/net v0.0.0-20211112202133-69e39bad7dc2/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
 golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
 golang.org/x/net v0.7.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=
-golang.org/x/net v0.38.0 h1:vRMAPTMaeGqVhG5QyLJHqNDwecKTomGeqbnfZyKlBI8=
-golang.org/x/net v0.38.0/go.mod h1:ivrbrMbzFq5J41QOQh0siUuly180yBYtLp+CKbEaFx8=
+golang.org/x/net v0.39.0 h1:ZCu7HMWDxpXpaiKdhzIfaltL9Lp31x/3fCP11bc6/fY=
+golang.org/x/net v0.39.0/go.mod h1:X7NRbYVEA+ewNkCNyJ513WmMdQ3BineSwVtN2zD/d+E=
 golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
 golang.org/x/oauth2 v0.0.0-20190226205417-e64efc72b421/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
 golang.org/x/oauth2 v0.0.0-20190604053449-0f29369cfe45/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
@@ -1033,8 +1041,8 @@ golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJ
 golang.org/x/sync v0.0.0-20201207232520-09787c993a3a/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20210220032951-036812b2e83c/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.12.0 h1:MHc5BpPuC30uJk597Ri8TV3CNZcTLu6B6z4lJy+g6Jw=
-golang.org/x/sync v0.12.0/go.mod h1:1dzgHSNfp02xaA81J2MS99Qcpr2w7fw1gpm99rleRqA=
+golang.org/x/sync v0.13.0 h1:AauUjRAJ9OSnvULf/ARrrVywoJDy0YS2AwQ98I37610=
+golang.org/x/sync v0.13.0/go.mod h1:1dzgHSNfp02xaA81J2MS99Qcpr2w7fw1gpm99rleRqA=
 golang.org/x/sys v0.0.0-20180823144017-11551d06cbcc/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20180830151530-49385e6e1522/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20180905080454-ebe1bf3edb33/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
@@ -1110,13 +1118,13 @@ golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBc
 golang.org/x/sys v0.0.0-20220811171246-fbc7d0a398ab/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.31.0 h1:ioabZlmFYtWhL+TRYpcnNlLwhyxaM9kWTDEmfnprqik=
-golang.org/x/sys v0.31.0/go.mod h1:BJP2sWEmIv4KK5OTEluFJCKSidICx8ciO85XgH3Ak8k=
+golang.org/x/sys v0.32.0 h1:s77OFDvIQeibCmezSnk/q6iAfkdiQaJi4VzroCFrN20=
+golang.org/x/sys v0.32.0/go.mod h1:BJP2sWEmIv4KK5OTEluFJCKSidICx8ciO85XgH3Ak8k=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
 golang.org/x/term v0.5.0/go.mod h1:jMB1sMXY+tzblOD4FWmEbocvup2/aLOaQEp7JmGp78k=
-golang.org/x/term v0.30.0 h1:PQ39fJZ+mfadBm0y5WlL4vlM7Sx1Hgf13sMIY2+QS9Y=
-golang.org/x/term v0.30.0/go.mod h1:NYYFdzHoI5wRh/h5tDMdMqCqPJZEuNqVR5xJLd/n67g=
+golang.org/x/term v0.31.0 h1:erwDkOK1Msy6offm1mOgvspSkslFnIGsFnxOKoufg3o=
+golang.org/x/term v0.31.0/go.mod h1:R4BeIy7D95HzImkxGkTW1UQTtP54tio2RyHz7PwK0aw=
 golang.org/x/text v0.0.0-20170915032832-14c0d48ead0c/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.1-0.20180807135948-17ff2d5776d2/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
@@ -1127,8 +1135,8 @@ golang.org/x/text v0.3.5/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
 golang.org/x/text v0.7.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
-golang.org/x/text v0.23.0 h1:D71I7dUrlY+VX0gQShAThNGHFxZ13dGLBHQLVl1mJlY=
-golang.org/x/text v0.23.0/go.mod h1:/BLNzu4aZCJ1+kcD0DNRotWKage4q2rGVAg4o22unh4=
+golang.org/x/text v0.24.0 h1:dd5Bzh4yt5KYA8f9CJHCP4FB4D51c2c6JvN37xJJkJ0=
+golang.org/x/text v0.24.0/go.mod h1:L8rBsPeo2pSS+xqN0d5u2ikmjtmoJbDBT1b7nHvFCdU=
 golang.org/x/time v0.0.0-20181108054448-85acf8d2951c/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.0.0-20190308202827-9d24e82272b4/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.0.0-20191024005414-555d28b269f0/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
@@ -6,12 +6,19 @@ import (

 type licenseScannerKey struct{}

+var ctxKey = licenseScannerKey{}
+
 func SetContextLicenseScanner(ctx context.Context, s Scanner) context.Context {
-	return context.WithValue(ctx, licenseScannerKey{}, s)
+	return context.WithValue(ctx, ctxKey, s)
+}
+
+func IsContextLicenseScannerSet(ctx context.Context) bool {
+	_, ok := ctx.Value(ctxKey).(Scanner)
+	return ok
 }

 func ContextLicenseScanner(ctx context.Context) (Scanner, error) {
-	if s, ok := ctx.Value(licenseScannerKey{}).(Scanner); ok {
+	if s, ok := ctx.Value(ctxKey).(Scanner); ok {
 		return s, nil
 	}
 	return NewDefaultScanner()
@@ -0,0 +1,48 @@
+package licenses
+
+import (
+	"context"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestSetContextLicenseScanner(t *testing.T) {
+	scanner := testScanner(true)
+	ctx := context.Background()
+	ctx = SetContextLicenseScanner(ctx, scanner)
+
+	val := ctx.Value(ctxKey)
+	require.NotNil(t, val)
+	s, ok := val.(Scanner)
+	require.True(t, ok)
+	require.Equal(t, scanner, s)
+}
+
+func TestIsContextLicenseScannerSet(t *testing.T) {
+	scanner := testScanner(true)
+	ctx := context.Background()
+	require.False(t, IsContextLicenseScannerSet(ctx))
+
+	ctx = SetContextLicenseScanner(ctx, scanner)
+	require.True(t, IsContextLicenseScannerSet(ctx))
+}
+
+func TestContextLicenseScanner(t *testing.T) {
+	t.Run("with scanner", func(t *testing.T) {
+		scanner := testScanner(true)
+		ctx := SetContextLicenseScanner(context.Background(), scanner)
+		s, err := ContextLicenseScanner(ctx)
+		if err != nil || s != scanner {
+			t.Fatal("expected scanner from context")
+		}
+	})
+
+	t.Run("without scanner", func(t *testing.T) {
+		ctx := context.Background()
+		s, err := ContextLicenseScanner(ctx)
+		if err != nil || s == nil {
+			t.Fatal("expected default scanner")
+		}
+	})
+}
@@ -96,14 +96,21 @@ func setupContext(ctx context.Context, cfg *CreateSBOMConfig) (context.Context,
 	ctx = setContextExecutors(ctx, cfg)

 	// configure license scanner
-	return setContextLicenseScanner(ctx, cfg)
+	// skip injecting a license scanner if one already set on context
+	if licenses.IsContextLicenseScannerSet(ctx) {
+		return ctx, nil
+	}
+
+	return SetContextLicenseScanner(ctx, cfg.Licenses)
 }

-func setContextLicenseScanner(ctx context.Context, cfg *CreateSBOMConfig) (context.Context, error) {
+// SetContextLicenseScanner creates and sets a license scanner
+// on the provided context using the provided license config.
+func SetContextLicenseScanner(ctx context.Context, cfg cataloging.LicenseConfig) (context.Context, error) {
 	// inject a single license scanner and content config for all package cataloging tasks into context
 	licenseScanner, err := licenses.NewDefaultScanner(
-		licenses.WithIncludeLicenseContent(cfg.Licenses.IncludeUnkownLicenseContent),
-		licenses.WithCoverage(cfg.Licenses.Coverage),
+		licenses.WithIncludeLicenseContent(cfg.IncludeUnkownLicenseContent),
+		licenses.WithCoverage(cfg.Coverage),
 	)
 	if err != nil {
 		return nil, fmt.Errorf("could not build licenseScanner for cataloging: %w", err)
@@ -58,7 +58,8 @@ func (s *Source) UnmarshalJSON(b []byte) error {
 func unpackSrcMetadata(s *Source, unpacker sourceUnpacker) error {
 	rt := sourcemetadata.ReflectTypeFromJSONName(s.Type)
 	if rt == nil {
-		return fmt.Errorf("unable to find source metadata type=%q", s.Type)
+		// in cases where we are converting from an SBOM without any source information, we don't want this to be fatal
+		return nil
 	}

 	val := reflect.New(rt).Interface()
@@ -22,6 +22,15 @@ func TestSource_UnmarshalJSON(t *testing.T) {
 		expected *Source
 		wantErr  require.ErrorAssertionFunc
 	}{
+		{
+			name: "empty",
+			input: []byte(`{
+				"id": "",
+				"type": "",
+				"metadata": null
+			}`),
+			expected: &Source{},
+		},
 		{
 			name: "directory",
 			input: []byte(`{
@@ -169,7 +169,11 @@ func (r ChrootContext) ToNativeGlob(chrootPath string) (string, error) {
 		return "", err
 	}

-	parts[0] = strings.TrimRight(responsePath, "/") + "/"
+	hasSlash := strings.HasSuffix(parts[0], "/")
+	parts[0] = responsePath
+	if hasSlash {
+		parts[0] = strings.TrimRight(parts[0], "/") + "/"
+	}

 	return strings.Join(parts, "*"), nil
 }
@@ -558,6 +558,16 @@ func TestToNativeGlob(t *testing.T) {
 			expectedResult: "/cwd/relative/path/**/file*.txt",
 			expectedError:  nil,
 		},
+		{
+			name: "ending with glob",
+			chrootContext: ChrootContext{
+				root:              "/root",
+				cwdRelativeToRoot: "/cwd",
+			},
+			chrootPath:     "/var/lib/dpkg/info/name.*",
+			expectedResult: "/root/var/lib/dpkg/info/name.*",
+			expectedError:  nil,
+		},
 	}

 	for _, tt := range tests {
@@ -699,6 +699,17 @@ func Test_Cataloger_PositiveCases(t *testing.T) {
 				Metadata:  metadata("go-binary-hint"),
 			},
 		},
+		{
+			// note: this is for compatability with dev version of golang tip image, which resolves the issue #3681
+			logicalFixture: "go-version-hint/1.25/any",
+			expected: pkg.Package{
+				Name:      "go",
+				Version:   "1.25-d524e1e",
+				PURL:      "pkg:generic/go@1.25-d524e1e",
+				Locations: locations("VERSION.cache"),
+				Metadata:  metadata("go-binary-hint"),
+			},
+		},
 		{
 			// note: this is testing BUSYBOX which is typically through a link to "[" (in this case a symlink but in
 			// practice this is often a hard link).
@@ -1331,6 +1342,28 @@ func Test_Cataloger_PositiveCases(t *testing.T) {
 				Metadata:  metadata("jq-binary"),
 			},
 		},
+		{
+			logicalFixture: "chrome/126.0.6478.182/linux-amd64",
+			expected: pkg.Package{
+				Name:      "chrome",
+				Version:   "126.0.6478.182",
+				Type:      "binary",
+				PURL:      "pkg:generic/chrome@126.0.6478.182",
+				Locations: locations("chrome"),
+				Metadata:  metadata("chrome-binary"),
+			},
+		},
+		{
+			logicalFixture: "chrome/127.0.6533.119/linux-amd64",
+			expected: pkg.Package{
+				Name:      "chrome",
+				Version:   "127.0.6533.119",
+				Type:      "binary",
+				PURL:      "pkg:generic/chrome@127.0.6533.119",
+				Locations: locations("chrome"),
+				Metadata:  metadata("chrome-binary"),
+			},
+		},
 	}

 	for _, test := range tests {
@@ -171,9 +171,9 @@ func DefaultClassifiers() []Classifier {
 		},
 		{
 			Class:    "go-binary-hint",
-			FileGlob: "**/VERSION",
+			FileGlob: "**/VERSION*",
 			EvidenceMatcher: FileContentsVersionMatcher(
-				`(?m)go(?P<version>[0-9]+\.[0-9]+(\.[0-9]+|beta[0-9]+|alpha[0-9]+|rc[0-9]+)?)`),
+				`(?m)go(?P<version>[0-9]+\.[0-9]+(\.[0-9]+|beta[0-9]+|alpha[0-9]+|rc[0-9]+)?(-[0-9a-f]{7})?)`),
 			Package: "go",
 			PURL:    mustPURL("pkg:generic/go@version"),
 			CPEs:    singleCPE("cpe:2.3:a:golang:go:*:*:*:*:*:*:*:*", cpe.NVDDictionaryLookupSource),
@@ -670,6 +670,17 @@ func DefaultClassifiers() []Classifier {
 			PURL:    mustPURL("pkg:generic/jq@version"),
 			CPEs:    singleCPE("cpe:2.3:a:jqlang:jq:*:*:*:*:*:*:*:*", cpe.NVDDictionaryLookupSource),
 		},
+		{
+			Class:    "chrome-binary",
+			FileGlob: "**/chrome",
+			EvidenceMatcher: FileContentsVersionMatcher(
+				// [NUL]127.0.6533.119[NUL]Default
+				`\x00(?P<version>[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+)\x00Default`,
+			),
+			Package: "chrome",
+			PURL:    mustPURL("pkg:generic/chrome@version"),
+			CPEs:    singleCPE("cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*"),
+		},
 	}
 }

@@ -0,0 +1,2 @@
+devel go1.25-d524e1e Sun Feb 16 07:23:13 2025 -0800
+3devel go1.25-d524e1e Sun Feb 16 07:23:13 2025 -0800
@@ -130,6 +130,12 @@ from-images:
    paths:
      - /usr/local/go/bin/go

+  - version: 1.25
+    images:
+      - ref: golang:tip@sha256:319b219d4df413ef30123a7f69bdf00032d9841af58d7b0ef6971542b29875d5
+        platform: linux/amd64
+    paths:
+      - /usr/local/go/bin/go
  # TODO: this is no longer available from dockerhub! (the snippet is vital)
  - version: 1.5.14
    images:
@@ -47,14 +47,14 @@ func parseConanLock(_ context.Context, _ file.Resolver, _ *generic.Environment,
 	// in a second iteration
 	var indexToPkgMap = map[string]pkg.Package{}

-	v1Pkgs := handleConanLockV2(cl, reader, indexToPkgMap)
+	v2Pkgs := handleConanLockV2(cl, reader, indexToPkgMap)

 	// we do not want to store the index list requires in the conan metadata, because it is not useful to have it in
 	// the SBOM. Instead, we will store it in a map and then use it to build the relationships
 	// maps pkg.ID to a list of indices
 	var parsedPkgRequires = map[artifact.ID][]string{}

-	v2Pkgs := handleConanLockV1(cl, reader, parsedPkgRequires, indexToPkgMap)
+	v1Pkgs := handleConanLockV1(cl, reader, parsedPkgRequires, indexToPkgMap)

 	var relationships []artifact.Relationship
 	var pkgs []pkg.Package
@@ -288,7 +288,6 @@ func TestDpkgArchiveCataloger(t *testing.T) {
 		})
 	}
 }
-
 func TestCataloger_Globs(t *testing.T) {
 	tests := []struct {
 		name     string
@@ -305,6 +304,9 @@ func TestCataloger_Globs(t *testing.T) {
 				"var/lib/dpkg/status.d/pkg-1.0",
 				"usr/lib/opkg/info/pkg-1.0.control",
 				"usr/lib/opkg/status",
+				"usr/lib/dpkg/info/libpam-runtime.conffiles",
+				"usr/lib/dpkg/info/libpam-runtime.md5sums",
+				"usr/share/doc/libpam-runtime/copyright",
 			},
 		},
 	}
@@ -0,0 +1,2 @@
+/etc/pam.conf
+/etc/pam.d/other
@@ -0,0 +1,4 @@
+55f905631797551d4d936a34c7e73474  lib/x86_64-linux-gnu/libz.so.1.2.11
+cede84bda30d2380217f97753c8ccf3a  usr/share/doc/zlib1g/changelog.Debian.gz
+f3c9dafa6da7992c47328b4464f6d122  usr/share/doc/zlib1g/changelog.gz
+a4fae96070439a5209a62ae5b8017ab2  usr/share/doc/zlib1g/copyright
@@ -0,0 +1 @@
+# some shell script...
@@ -1 +1,23 @@
-bogus status
+Package:
+
+Package: libpam-runtime
+Status: install ok installed
+Priority: required
+Section: admin
+Installed-Size: 1016
+Maintainer: Steve Langasek <vorlon@debian.org>
+Architecture: all
+Multi-Arch: foreign
+Source: pam
+Version: 1.1.8-3.6
+Replaces: libpam0g-dev, libpam0g-util
+Depends: debconf (>= 0.5) | debconf-2.0, debconf (>= 1.5.19) | cdebconf, libpam-modules (>= 1.0.1-6)
+Conflicts: libpam0g-util
+Conffiles:
+ /etc/pam.conf 87fc76f18e98ee7d3848f6b81b3391e5
+ /etc/pam.d/other 31aa7f2181889ffb00b87df4126d1701
+Description: Runtime support for the PAM library
+ Contains configuration files and  directories required for
+ authentication  to work on Debian systems.  This package is required
+ on almost all installations.
+Homepage: http://www.linux-pam.org/
@@ -0,0 +1,43 @@
+Format: http://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
+Upstream-Name: auditd
+Source: https://people.redhat.com/sgrubb/audit/
+
+Files: *
+Copyright: 2012-2016 Steve Grubb <sgrubb@redhat.com>
+           2006-2012 Rik Faith
+License: GPL-2
+
+Files: src/libev/*
+Copyright: 2007-2009 Marc Alexamder Lehmann
+License: GPL-2
+
+Files: lib/*
+Copyright: 2005-2008 Steve Grubb <sgrubb@redhat.com>
+License: LGPL-2.1
+  The audit daemon's library libaudit.* is released under LGPL
+  so that it may be linked with 3rd party software.
+  .
+  On Debian systems, refer to /usr/share/common-licenses/LGPL-2.1
+  for the complete text of the GNU Lesser General Public License.
+
+Files: debian/*
+Copyright: 2007-2011 Philipp Matthias Hahn <pmhahn@debian.org>
+           2012-2016 Laurent Bigonville <bigon@debian.org>
+License: GPL-2
+
+License: GPL-2
+ This package is free software; you can redistribute it and/or modify
+ it under the terms of the GNU General Public License version 2,
+ as published by the Free Software Foundation.
+ .
+ This package is distributed in the hope that it will be useful,
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ GNU General Public License for more details.
+ .
+ You should have received a copy of the GNU General Public License
+ along with this package; if not, write to the Free Software
+ Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301 USA
+ .
+ On Debian systems, the complete text of the GNU General
+ Public License can be found in `/usr/share/common-licenses/GPL-1'.
@@ -1,9 +1,9 @@
 package dotnet

 import (
-	"strings"
 	"testing"

+	"github.com/scylladb/go-set/strset"
 	"github.com/stretchr/testify/assert"

 	"github.com/anchore/syft/syft/artifact"
@@ -119,6 +119,10 @@ func TestCataloger(t *testing.T) {
 	}
 	net8AppExpectedDepPkgs = append(net8AppExpectedDepPkgs, net8AppExpectedDepPkgsWithoutUnpairedDlls...)

+	var net8AppExpectedDepPkgsWithRuntime []string
+	net8AppExpectedDepPkgsWithRuntime = append(net8AppExpectedDepPkgsWithRuntime, net8AppExpectedDepPkgs...)
+	net8AppExpectedDepPkgsWithRuntime = append(net8AppExpectedDepPkgsWithRuntime, "Microsoft.NETCore.App.Runtime.linux-x64 @ 8.0.14 (/usr/share/dotnet/shared/Microsoft.NETCore.App/8.0.14/Microsoft.NETCore.App.deps.json)")
+
 	// app binaries (always dlls)
 	net8AppBinaryOnlyPkgs := []string{
 		"Humanizer @ 2.14.1.48190 (/app/Humanizer.dll)",
@@ -280,11 +284,17 @@ func TestCataloger(t *testing.T) {
 	net8AppDepOnlyRelationships = append(net8AppDepOnlyRelationships, net8AppDepOnlyRelationshipsWithoutHumanizer...)
 	net8AppDepOnlyRelationships = append(net8AppDepOnlyRelationships, humanizerToAppDepsRelationship)

+	var net8AppDepOnlyRelationshipsWithRuntime []string
+	net8AppDepOnlyRelationshipsWithRuntime = append(net8AppDepOnlyRelationshipsWithRuntime, net8AppDepOnlyRelationships...)
+	net8AppDepOnlyRelationshipsWithRuntime = append(net8AppDepOnlyRelationshipsWithRuntime,
+		"Microsoft.NETCore.App.Runtime.linux-x64 @ 8.0.14 (/usr/share/dotnet/shared/Microsoft.NETCore.App/8.0.14/Microsoft.NETCore.App.deps.json) [dependency-of] dotnetapp @ 1.0.0 (/app/dotnetapp.deps.json)",
+	)
+
 	var net8AppExpectedDepRelationships []string
 	net8AppExpectedDepRelationships = append(net8AppExpectedDepRelationships, net8AppDepOnlyRelationships...)

 	var net8AppExpectedDepSelfContainedPkgs []string
-	net8AppExpectedDepSelfContainedPkgs = append(net8AppExpectedDepSelfContainedPkgs, net8AppExpectedDepPkgsWithoutUnpairedDlls...)
+	net8AppExpectedDepSelfContainedPkgs = append(net8AppExpectedDepSelfContainedPkgs, net8AppExpectedDepPkgs...)
 	net8AppExpectedDepSelfContainedPkgs = append(net8AppExpectedDepSelfContainedPkgs,
 		// add the CLR runtime packages...
 		"runtimepack.Microsoft.NETCore.App.Runtime.win-x64 @ 8.0.14 (/app/dotnetapp.deps.json)",
@@ -298,7 +308,7 @@ func TestCataloger(t *testing.T) {
 	)

 	var net8AppExpectedDepSelfContainedRelationships []string
-	net8AppExpectedDepSelfContainedRelationships = append(net8AppExpectedDepSelfContainedRelationships, net8AppDepOnlyRelationshipsWithoutHumanizer...)
+	net8AppExpectedDepSelfContainedRelationships = append(net8AppExpectedDepSelfContainedRelationships, net8AppDepOnlyRelationships...)
 	net8AppExpectedDepSelfContainedRelationships = append(net8AppExpectedDepSelfContainedRelationships,
 		// add the CLR runtime relationships...
 		"runtimepack.Microsoft.NETCore.App.Runtime.win-x64 @ 8.0.14 (/app/dotnetapp.deps.json) [dependency-of] dotnetapp @ 1.0.0 (/app/dotnetapp.deps.json)",
@@ -706,36 +716,20 @@ func TestCataloger(t *testing.T) {
 			assertion:    assertAllDepEntriesWithoutExecutables,
 		},
 		{
-			name:      "combined cataloger",
-			fixture:   "image-net8-app",
-			cataloger: NewDotnetDepsBinaryCataloger(DefaultCatalogerConfig()),
-
-			// if we don't care about DLL claims in the deps.json, then this is right
-			//expectedPkgs: net8AppExpectedDepPkgs,
-			//expectedRels: net8AppExpectedDepRelationships,
-
-			// we care about DLL claims in the deps.json, so the main application inherits all relationships to/from humanizer
-			expectedPkgs: net8AppExpectedDepPkgsWithoutUnpairedDlls,
-			expectedRels: replaceAll(net8AppDepOnlyRelationshipsWithoutHumanizer, "Humanizer @ 2.14.1", "dotnetapp @ 1.0.0"),
-
-			assertion: assertAlmostAllDepEntriesWithExecutables, // important! this is what makes this case different from the previous one... dep entries have attached executables
+			name:         "combined cataloger",
+			fixture:      "image-net8-app",
+			cataloger:    NewDotnetDepsBinaryCataloger(DefaultCatalogerConfig()),
+			expectedPkgs: net8AppExpectedDepPkgs,
+			expectedRels: net8AppDepOnlyRelationships,
+			assertion:    assertAlmostAllDepEntriesWithExecutables, // important! this is what makes this case different from the previous one... dep entries have attached executables
 		},
 		{
-			name:      "combined cataloger (with runtime)",
-			fixture:   "image-net8-app-with-runtime",
-			cataloger: NewDotnetDepsBinaryCataloger(DefaultCatalogerConfig()),
-			expectedPkgs: func() []string {
-				pkgs := net8AppExpectedDepPkgsWithoutUnpairedDlls
-				pkgs = append(pkgs, "Microsoft.NETCore.App.Runtime.linux-x64 @ 8.0.14 (/usr/share/dotnet/shared/Microsoft.NETCore.App/8.0.14/Microsoft.NETCore.App.deps.json)")
-				return pkgs
-			}(),
-			expectedRels: func() []string {
-				x := replaceAll(net8AppDepOnlyRelationshipsWithoutHumanizer, "Humanizer @ 2.14.1", "dotnetapp @ 1.0.0")
-				// the main application should also have a relationship to the runtime package
-				x = append(x, "Microsoft.NETCore.App.Runtime.linux-x64 @ 8.0.14 (/usr/share/dotnet/shared/Microsoft.NETCore.App/8.0.14/Microsoft.NETCore.App.deps.json) [dependency-of] dotnetapp @ 1.0.0 (/app/dotnetapp.deps.json)")
-				return x
-			}(),
-			assertion: assertAccurateNetRuntimePackage,
+			name:         "combined cataloger (with runtime)",
+			fixture:      "image-net8-app-with-runtime",
+			cataloger:    NewDotnetDepsBinaryCataloger(DefaultCatalogerConfig()),
+			expectedPkgs: net8AppExpectedDepPkgsWithRuntime,
+			expectedRels: net8AppDepOnlyRelationshipsWithRuntime,
+			assertion:    assertAccurateNetRuntimePackage,
 		},
 		{
 			name:      "combined cataloger (with runtime, no deps.json anywhere)",
@@ -923,11 +917,7 @@ func TestCataloger(t *testing.T) {
 			fixture:      "image-net8-app-self-contained",
 			cataloger:    NewDotnetDepsCataloger(),
 			expectedPkgs: net8AppExpectedDepsSelfContainedPkgs,
-			expectedRels: func() []string {
-				x := net8AppExpectedDepSelfContainedRelationships
-				x = append(x, humanizerToAppDepsRelationship)
-				return x
-			}(),
+			expectedRels: net8AppExpectedDepSelfContainedRelationships,
 		},
 		{
 			name:      "combined cataloger (self-contained)",
@@ -935,13 +925,8 @@ func TestCataloger(t *testing.T) {
 			cataloger: NewDotnetDepsBinaryCataloger(DefaultCatalogerConfig()),
 			// we care about DLL claims in the deps.json, so the main application inherits all relationships to/from humarizer
 			expectedPkgs: net8AppExpectedDepSelfContainedPkgs,
-			expectedRels: func() []string {
-				x := replaceAll(net8AppExpectedDepSelfContainedRelationships, "Humanizer @ 2.14.1", "dotnetapp @ 1.0.0")
-				// the main application also has a dependency on the runtime package
-				x = append(x, "runtimepack.Microsoft.NETCore.App.Runtime.win-x64 @ 8.0.14 (/app/dotnetapp.deps.json) [dependency-of] dotnetapp @ 1.0.0 (/app/dotnetapp.deps.json)")
-				return x
-			}(),
-			assertion: assertAccurateNetRuntimePackage,
+			expectedRels: net8AppExpectedDepSelfContainedRelationships,
+			assertion:    assertAccurateNetRuntimePackage,
 		},
 		{
 			name:      "pe cataloger (self-contained)",
@@ -1004,19 +989,37 @@ func TestCataloger(t *testing.T) {
 			fixture:   "image-net2-app",
 			cataloger: NewDotnetDepsBinaryCataloger(DefaultCatalogerConfig()),
 			expectedPkgs: []string{
+				"Microsoft.NETCore.App @ 2.2.8 (/usr/share/dotnet/shared/Microsoft.NETCore.App/2.2.8/Microsoft.NETCore.App.deps.json)",
+				"Microsoft.NETCore.DotNetHostPolicy @ 2.2.8 (/usr/share/dotnet/shared/Microsoft.NETCore.App/2.2.8/Microsoft.NETCore.App.deps.json)",
 				"Serilog @ 2.10.0 (/app/helloworld.deps.json)",
 				"Serilog.Sinks.Console @ 4.0.1 (/app/helloworld.deps.json)",
 				"helloworld @ 1.0.0 (/app/helloworld.deps.json)",
 				"runtime.linux-x64.Microsoft.NETCore.App @ 2.2.8 (/usr/share/dotnet/shared/Microsoft.NETCore.App/2.2.8/Microsoft.NETCore.App.deps.json)",
+				"runtime.linux-x64.Microsoft.NETCore.DotNetHostPolicy @ 2.2.8 (/usr/share/dotnet/shared/Microsoft.NETCore.App/2.2.8/Microsoft.NETCore.App.deps.json)", // a compile target reference
 			},
 			expectedRels: []string{
+				"Microsoft.NETCore.DotNetHostPolicy @ 2.2.8 (/usr/share/dotnet/shared/Microsoft.NETCore.App/2.2.8/Microsoft.NETCore.App.deps.json) [dependency-of] Microsoft.NETCore.App @ 2.2.8 (/usr/share/dotnet/shared/Microsoft.NETCore.App/2.2.8/Microsoft.NETCore.App.deps.json)",
 				"Serilog @ 2.10.0 (/app/helloworld.deps.json) [dependency-of] Serilog.Sinks.Console @ 4.0.1 (/app/helloworld.deps.json)",
 				"Serilog @ 2.10.0 (/app/helloworld.deps.json) [dependency-of] helloworld @ 1.0.0 (/app/helloworld.deps.json)",
 				"Serilog.Sinks.Console @ 4.0.1 (/app/helloworld.deps.json) [dependency-of] helloworld @ 1.0.0 (/app/helloworld.deps.json)",
+				"runtime.linux-x64.Microsoft.NETCore.App @ 2.2.8 (/usr/share/dotnet/shared/Microsoft.NETCore.App/2.2.8/Microsoft.NETCore.App.deps.json) [dependency-of] Microsoft.NETCore.App @ 2.2.8 (/usr/share/dotnet/shared/Microsoft.NETCore.App/2.2.8/Microsoft.NETCore.App.deps.json)",
 				"runtime.linux-x64.Microsoft.NETCore.App @ 2.2.8 (/usr/share/dotnet/shared/Microsoft.NETCore.App/2.2.8/Microsoft.NETCore.App.deps.json) [dependency-of] helloworld @ 1.0.0 (/app/helloworld.deps.json)",
+				"runtime.linux-x64.Microsoft.NETCore.DotNetHostPolicy @ 2.2.8 (/usr/share/dotnet/shared/Microsoft.NETCore.App/2.2.8/Microsoft.NETCore.App.deps.json) [dependency-of] Microsoft.NETCore.DotNetHostPolicy @ 2.2.8 (/usr/share/dotnet/shared/Microsoft.NETCore.App/2.2.8/Microsoft.NETCore.App.deps.json)",
 			},
 			assertion: assertAccurateNetRuntimePackage,
 		},
+		{
+			name:      "libman support",
+			fixture:   "image-net6-asp-libman",
+			cataloger: NewDotnetDepsBinaryCataloger(DefaultCatalogerConfig()),
+			expectedPkgs: []string{
+				"LibManSample @ 1.0.0 (/app/LibManSample.deps.json)",
+				"jquery @ 3.3.1 (/app/libman.json)",
+			},
+			expectedRels: []string{
+				"jquery @ 3.3.1 (/app/libman.json) [dependency-of] LibManSample @ 1.0.0 (/app/LibManSample.deps.json)",
+			},
+		},
 	}

 	for _, tt := range cases {
@@ -1035,7 +1038,26 @@ func TestCataloger(t *testing.T) {
 	}
 }

-func TestDotnetDepsCataloger_problemCases(t *testing.T) {
+func TestDotnetDepsCataloger_regressions(t *testing.T) {
+
+	assertPackages := func(mustHave []string, mustNotHave []string) func(t *testing.T, pkgs []pkg.Package, relationships []artifact.Relationship) {
+		expected := strset.New(mustHave...)
+		notExpected := strset.New(mustNotHave...)
+		return func(t *testing.T, pkgs []pkg.Package, relationships []artifact.Relationship) {
+
+			for _, p := range pkgs {
+				expected.Remove(p.Name)
+				if notExpected.Has(p.Name) {
+					t.Errorf("unexpected package: %s", p.Name)
+				}
+			}
+			if expected.IsEmpty() {
+				return
+			}
+			t.Errorf("missing packages: %s", expected.List())
+		}
+	}
+
 	cases := []struct {
 		name      string
 		fixture   string
@@ -1072,6 +1094,72 @@ func TestDotnetDepsCataloger_problemCases(t *testing.T) {
 				pkgtest.AssertPackagesEqualIgnoreLayers(t, expected, actual)
 			},
 		},
+		{
+			name:      "indirect packages references",
+			fixture:   "image-net8-compile-target",
+			cataloger: NewDotnetDepsBinaryCataloger(DefaultCatalogerConfig()),
+			assertion: assertPackages(
+				[]string{
+					"DotNetNuke.Core", // uses a compile target reference in the deps.json
+					"Umbraco.Cms",     // this is the parent of other packages which do have DLLs included (even though it does not have any DLLs)
+				},
+				[]string{
+					"StyleCop.Analyzers",     // this is a development tool
+					"Microsoft.NET.Test.Sdk", // this is a development tool
+					"jQuery",                 // has no DLLs but has javascript assets
+				},
+			),
+		},
+		{
+			name:      "not propagating claims",
+			fixture:   "image-net8-compile-target",
+			cataloger: NewDotnetDepsBinaryCataloger(DefaultCatalogerConfig().WithPropagateDLLClaimsToParents(false)),
+			assertion: assertPackages(
+				[]string{
+					"DotNetNuke.Core", // uses a compile target reference in the deps.json
+
+				},
+				[]string{
+					"Umbraco.Cms",            // this is the parent of other packages which do have DLLs included (even though it does not have any DLLs)
+					"StyleCop.Analyzers",     // this is a development tool
+					"Microsoft.NET.Test.Sdk", // this is a development tool under the debug configuration (we build the release configuration)
+					"jQuery",                 // has no DLLs but has javascript assets -- this is bad behavior (as we want to detect this)
+				},
+			),
+		},
+		{
+			name:    "not requiring claims finds jquery",
+			fixture: "image-net8-compile-target",
+			cataloger: NewDotnetDepsBinaryCataloger(CatalogerConfig{
+				DepPackagesMustHaveDLL:             false,
+				DepPackagesMustClaimDLL:            false,
+				PropagateDLLClaimsToParents:        false,
+				RelaxDLLClaimsWhenBundlingDetected: false,
+			}),
+			assertion: assertPackages(
+				[]string{
+					"jQuery",             // has no DLLs but has javascript assets
+					"StyleCop.Analyzers", // this is a development tool -- this is bad behavior (since we should not detect this), but cannot be helped
+				},
+				[]string{
+					"Microsoft.NET.Test.Sdk", // this is a development tool under the debug configuration (we build the release configuration)
+				},
+			),
+		},
+		{
+			name:      "libman support",
+			fixture:   "image-net6-asp-libman",
+			cataloger: NewDotnetDepsBinaryCataloger(DefaultCatalogerConfig()),
+			assertion: assertPackages(
+				[]string{
+					"jquery", // a javascript package, not the nuget package
+				},
+				[]string{
+					"vendor", // this is the string reference for a filesystem provider
+					"lodash", // this is from a filesystem provider, which is not supported
+				},
+			),
+		},
 	}
 	for _, tt := range cases {
 		t.Run(tt.name, func(t *testing.T) {
@@ -1460,11 +1548,3 @@ func extractMatchingPackage(t *testing.T, name string, pkgs []pkg.Package) pkg.P
 	t.Fatalf("expected to find package %s", name)
 	return pkg.Package{}
 }
-
-func replaceAll(ss []string, find, replace string) []string {
-	var results []string
-	for _, s := range ss {
-		results = append(results, strings.ReplaceAll(s, find, replace))
-	}
-	return results
-}
@@ -8,6 +8,9 @@ type CatalogerConfig struct {
 	// This does not require such claimed DLLs to exist on disk. The behavior of this
 	DepPackagesMustClaimDLL bool `mapstructure:"dep-packages-must-claim-dll" json:"dep-packages-must-claim-dll" yaml:"dep-packages-must-claim-dll"`

+	// PropagateDLLClaimsToParents allows for deps.json packages to be included if any child (transitive) package claims a DLL. This applies to both the claims configuration and evidence-on-disk configurations.
+	PropagateDLLClaimsToParents bool `mapstructure:"propagate-dll-claims-to-parents" json:"propagate-dll-claims-to-parents" yaml:"propagate-dll-claims-to-parents"`
+
 	// RelaxDLLClaimsWhenBundlingDetected will look for indications of IL bundle tooling via deps.json package names
 	// and, if found (and this config option is enabled), will relax the DepPackagesMustClaimDLL value to `false` only in those cases.
 	RelaxDLLClaimsWhenBundlingDetected bool `mapstructure:"relax-dll-claims-when-bundling-detected" json:"relax-dll-claims-when-bundling-detected" yaml:"relax-dll-claims-when-bundling-detected"`
@@ -28,10 +31,16 @@ func (c CatalogerConfig) WithRelaxDLLClaimsWhenBundlingDetected(relax bool) Cata
 	return c
 }

+func (c CatalogerConfig) WithPropagateDLLClaimsToParents(propagate bool) CatalogerConfig {
+	c.PropagateDLLClaimsToParents = propagate
+	return c
+}
+
 func DefaultCatalogerConfig() CatalogerConfig {
 	return CatalogerConfig{
 		DepPackagesMustHaveDLL:             false,
 		DepPackagesMustClaimDLL:            true,
+		PropagateDLLClaimsToParents:        true,
 		RelaxDLLClaimsWhenBundlingDetected: true,
 	}
 }
@@ -78,6 +78,9 @@ func (c depsBinaryCataloger) Catalog(_ context.Context, resolver file.Resolver)
 	var runtimePkgs []*pkg.Package
 	for i := range pkgs {
 		p := &pkgs[i]
+		if p.Type != pkg.DotnetPkg {
+			continue
+		}
 		if isRuntime(p.Name) {
 			existingRuntimeVersions.Add(p.Version)
 			runtimePkgs = append(runtimePkgs, p)
@@ -111,7 +114,7 @@ func (c depsBinaryCataloger) Catalog(_ context.Context, resolver file.Resolver)
 		runtimePkgs = append(runtimePkgs, &rtp)
 	}

-	// create a relationship from every runtime package to every root package
+	// create a relationship from every runtime package to every root package...
 	for _, root := range roots {
 		for _, runtimePkg := range runtimePkgs {
 			relationships = append(relationships, artifact.Relationship{
@@ -122,7 +125,8 @@ func (c depsBinaryCataloger) Catalog(_ context.Context, resolver file.Resolver)
 		}
 	}

-	return pkgs, relationships, unknowns
+	// in the process of creating root-to-runtime relationships, we may have created duplicate relationships. Use the relationship index to deduplicate.
+	return pkgs, relationship.NewIndex(relationships...).All(), unknowns
 }

 var runtimeDLLPathPattern = regexp.MustCompile(`/Microsoft\.NETCore\.App/(?P<version>\d+\.\d+\.\d+)/[^/]+\.dll`)
@@ -204,6 +208,14 @@ func attachAssociatedExecutables(dep *logicalDepsJSON, pe logicalPE) bool {
 			continue
 		}

+		if targetPath, ok := p.CompilePathsByRelativeDLLPath[relativeDllPath]; ok {
+			pe.TargetPath = targetPath
+			p.Executables = append(p.Executables, pe)
+			dep.PackagesByNameVersion[key] = p // update the map with the modified package
+			found = true
+			continue
+		}
+
 		if p.NativePaths.Has(relativeDllPath) {
 			pe.TargetPath = relativeDllPath
 			p.Executables = append(p.Executables, pe)
@@ -259,15 +271,14 @@ func packagesFromLogicalDepsJSON(doc logicalDepsJSON, config CatalogerConfig) (*
 			continue
 		}
 		lp := doc.PackagesByNameVersion[nameVersion]
-		if config.DepPackagesMustHaveDLL && len(lp.Executables) == 0 {
+		if config.DepPackagesMustHaveDLL && !lp.FoundDLLs(config.PropagateDLLClaimsToParents) {
 			// could not find a paired DLL and the user required this...
 			skippedDepPkgs[nameVersion] = lp
 			continue
 		}

-		claimsDLLs := len(lp.RuntimePathsByRelativeDLLPath) > 0 || len(lp.ResourcePathsByRelativeDLLPath) > 0
-
-		if config.DepPackagesMustClaimDLL && !claimsDLLs {
+		// check to see if we should skip this package because it does not claim a DLL (or has not dependency that claims a DLL)
+		if config.DepPackagesMustClaimDLL && !lp.ClaimsDLLs(config.PropagateDLLClaimsToParents) {
 			if config.RelaxDLLClaimsWhenBundlingDetected && !doc.BundlingDetected || !config.RelaxDLLClaimsWhenBundlingDetected {
 				// could not find a runtime or resource path and the user required this...
 				// and there is no evidence of a bundler in the dependencies (e.g. ILRepack)
@@ -282,8 +293,22 @@ func packagesFromLogicalDepsJSON(doc logicalDepsJSON, config CatalogerConfig) (*
 			pkgMap[nameVersion] = *dotnetPkg
 		}
 	}
+	rels := relationshipsFromLogicalDepsJSON(doc, pkgMap, skippedDepPkgs)

-	return rootPkg, pkgs, relationshipsFromLogicalDepsJSON(doc, pkgMap, skippedDepPkgs)
+	// ensure that any libman packages are associated with the all root packages
+	for _, libmanPkg := range doc.LibmanPackages {
+		pkgs = append(pkgs, libmanPkg)
+		if rootPkg == nil {
+			continue
+		}
+		rels = append(rels, artifact.Relationship{
+			From: libmanPkg,
+			To:   *rootPkg,
+			Type: artifact.DependencyOfRelationship,
+		})
+	}
+
+	return rootPkg, pkgs, rels
 }

 // relationshipsFromLogicalDepsJSON creates relationships from a logicalDepsJSON document for only the given syft packages.
@@ -381,7 +406,13 @@ func findDepsJSON(resolver file.Resolver) ([]logicalDepsJSON, error, error) {
 			continue
 		}

-		depsJSONs = append(depsJSONs, getLogicalDepsJSON(*dj))
+		libman, err := findLibmanJSON(resolver, loc)
+		if err != nil {
+			unknownErr = unknown.Append(unknownErr, loc, err)
+			libman = nil
+		}
+
+		depsJSONs = append(depsJSONs, getLogicalDepsJSON(*dj, libman))
 	}

 	return depsJSONs, unknownErr, nil
@@ -9,6 +9,7 @@ import (
 	"github.com/scylladb/go-set/strset"

 	"github.com/anchore/syft/syft/file"
+	"github.com/anchore/syft/syft/pkg"
 )

 type depsJSON struct {
@@ -26,9 +27,50 @@ type depsTarget struct {
 	Dependencies map[string]string            `json:"dependencies"`
 	Runtime      map[string]map[string]string `json:"runtime"`
 	Resources    map[string]map[string]string `json:"resources"`
+	Compile      map[string]map[string]string `json:"compile"`
 	Native       map[string]map[string]string `json:"native"`
 }

+func (t depsTarget) nativePaths() *strset.Set {
+	results := strset.New()
+	for path := range t.Native {
+		results.Add(path)
+	}
+	return results
+}
+
+func (t depsTarget) compilePaths() map[string]string {
+	result := make(map[string]string)
+	for path := range t.Compile {
+		trimmedPath := trimLibPrefix(path)
+		if _, exists := result[trimmedPath]; exists {
+			continue
+		}
+		result[trimmedPath] = path
+	}
+	return result
+}
+
+func (t depsTarget) resourcePaths() map[string]string {
+	result := make(map[string]string)
+	for path := range t.Resources {
+		trimmedPath := trimLibPrefix(path)
+		if _, exists := result[trimmedPath]; exists {
+			continue
+		}
+		result[trimmedPath] = path
+	}
+	return result
+}
+
+func (t depsTarget) runtimePaths() map[string]string {
+	result := make(map[string]string)
+	for path := range t.Runtime {
+		result[trimLibPrefix(path)] = path
+	}
+	return result
+}
+
 type depsLibrary struct {
 	Type     string `json:"type"`
 	Path     string `json:"path"`
@@ -43,6 +85,12 @@ type logicalDepsJSONPackage struct {
 	Targets     *depsTarget
 	Library     *depsLibrary

+	// anyChildClaimsDLLs is a flag that indicates if any of the children of this package claim a DLL associated with them in the deps.json.
+	anyChildClaimsDLLs bool
+
+	// anyChildHasDLLs is a flag that indicates if any of the children of this package have a DLL associated with them (found on disk).
+	anyChildHasDLLs bool
+
 	// RuntimePathsByRelativeDLLPath is a map of the relative path to the DLL relative to the deps.json file
 	// to the target path as described in the deps.json target entry under "runtime".
 	RuntimePathsByRelativeDLLPath map[string]string
@@ -51,6 +99,10 @@ type logicalDepsJSONPackage struct {
 	// to the target path as described in the deps.json target entry under "resource".
 	ResourcePathsByRelativeDLLPath map[string]string

+	// CompilePathsByRelativeDLLPath is a map of the relative path to the DLL relative to the deps.json file
+	// to the target path as described in the deps.json target entry under "compile".
+	CompilePathsByRelativeDLLPath map[string]string
+
 	// NativePathsByRelativeDLLPath is a map of the relative path to the DLL relative to the deps.json file
 	// to the target path as described in the deps.json target entry under "native". These should not have
 	// any runtime references to trim from the front of the path.
@@ -62,12 +114,41 @@ type logicalDepsJSONPackage struct {
 	Executables []logicalPE
 }

+func (l *logicalDepsJSONPackage) dependencyNameVersions() []string {
+	if l.Targets == nil {
+		return nil
+	}
+	var results []string
+	for name, version := range l.Targets.Dependencies {
+		results = append(results, createNameAndVersion(name, version))
+	}
+	return results
+}
+
+// ClaimsDLLs indicates if this package has any DLLs associated with it (directly or indirectly with a dependency).
+func (l *logicalDepsJSONPackage) ClaimsDLLs(includeChildren bool) bool {
+	selfClaim := len(l.RuntimePathsByRelativeDLLPath) > 0 || len(l.ResourcePathsByRelativeDLLPath) > 0 || len(l.CompilePathsByRelativeDLLPath) > 0 || len(l.NativePaths.List()) > 0
+	if !includeChildren {
+		return selfClaim
+	}
+	return selfClaim || l.anyChildClaimsDLLs
+}
+
+func (l *logicalDepsJSONPackage) FoundDLLs(includeChildren bool) bool {
+	selfClaim := len(l.Executables) > 0
+	if !includeChildren {
+		return selfClaim
+	}
+	return selfClaim || l.anyChildHasDLLs
+}
+
 type logicalDepsJSON struct {
 	Location              file.Location
 	RuntimeTarget         runtimeTarget
 	PackagesByNameVersion map[string]logicalDepsJSONPackage
 	PackageNameVersions   *strset.Set
 	BundlingDetected      bool
+	LibmanPackages        []pkg.Package
 }

 func (l logicalDepsJSON) RootPackage() (logicalDepsJSONPackage, bool) {
@@ -117,7 +198,7 @@ var knownBundlers = strset.New(
 	"Fody",                       // IL weaving framework
 )

-func getLogicalDepsJSON(deps depsJSON) logicalDepsJSON {
+func getLogicalDepsJSON(deps depsJSON, lm *libmanJSON) logicalDepsJSON {
 	packageMap := make(map[string]*logicalDepsJSONPackage)
 	nameVersions := strset.New()

@@ -133,31 +214,15 @@ func getLogicalDepsJSON(deps depsJSON) logicalDepsJSON {
 			if ok {
 				lib = &l
 			}
-			runtimePaths := make(map[string]string)
-			for path := range target.Runtime {
-				runtimePaths[trimLibPrefix(path)] = path
-			}
-			resourcePaths := make(map[string]string)
-			for path := range target.Resources {
-				trimmedPath := trimLibPrefix(path)
-				if _, exists := resourcePaths[trimmedPath]; exists {
-					continue
-				}
-				resourcePaths[trimmedPath] = path
-			}
-
-			nativePaths := strset.New()
-			for path := range target.Native {
-				nativePaths.Add(path)
-			}

 			p := &logicalDepsJSONPackage{
 				NameVersion:                    libName,
 				Library:                        lib,
 				Targets:                        &target,
-				RuntimePathsByRelativeDLLPath:  runtimePaths,
-				ResourcePathsByRelativeDLLPath: resourcePaths,
-				NativePaths:                    nativePaths,
+				RuntimePathsByRelativeDLLPath:  target.runtimePaths(),
+				ResourcePathsByRelativeDLLPath: target.resourcePaths(),
+				CompilePathsByRelativeDLLPath:  target.compilePaths(),
+				NativePaths:                    target.nativePaths(),
 			}
 			packageMap[libName] = p
 			nameVersions.Add(libName)
@@ -170,6 +235,8 @@ func getLogicalDepsJSON(deps depsJSON) logicalDepsJSON {
 		if !bundlingDetected && knownBundlers.Has(name) {
 			bundlingDetected = true
 		}
+		p.anyChildClaimsDLLs = searchForDLLClaims(packageMap, p.dependencyNameVersions()...)
+		p.anyChildHasDLLs = searchForDLLEvidence(packageMap, p.dependencyNameVersions()...)
 		packages[p.NameVersion] = *p
 	}

@@ -179,9 +246,51 @@ func getLogicalDepsJSON(deps depsJSON) logicalDepsJSON {
 		PackagesByNameVersion: packages,
 		PackageNameVersions:   nameVersions,
 		BundlingDetected:      bundlingDetected,
+		LibmanPackages:        lm.packages(),
 	}
 }

+type visitorFunc func(p *logicalDepsJSONPackage) bool
+
+// searchForDLLEvidence recursively searches for executables found for any of the given nameVersions and children recursively.
+func searchForDLLEvidence(packageMap map[string]*logicalDepsJSONPackage, nameVersions ...string) bool {
+	return traverseDependencies(packageMap, func(p *logicalDepsJSONPackage) bool {
+		return p.FoundDLLs(true)
+	}, nameVersions...)
+}
+
+// searchForDLLClaims recursively searches for DLL claims in the deps.json for any of the given nameVersions and children recursively.
+func searchForDLLClaims(packageMap map[string]*logicalDepsJSONPackage, nameVersions ...string) bool {
+	return traverseDependencies(packageMap, func(p *logicalDepsJSONPackage) bool {
+		return p.ClaimsDLLs(true)
+	}, nameVersions...)
+}
+
+func traverseDependencies(packageMap map[string]*logicalDepsJSONPackage, visitor visitorFunc, nameVersions ...string) bool {
+	if len(nameVersions) == 0 {
+		return false
+	}
+
+	for _, nameVersion := range nameVersions {
+		if p, ok := packageMap[nameVersion]; ok {
+			if visitor(p) {
+				return true
+			}
+
+			var children []string
+			for name, version := range p.Targets.Dependencies {
+				children = append(children, createNameAndVersion(name, version))
+			}
+
+			if traverseDependencies(packageMap, visitor, children...) {
+				return true
+			}
+		}
+	}
+
+	return false
+}
+
 var libPathPattern = regexp.MustCompile(`^(?:runtimes/[^/]+/)?lib/net[^/]+/(?P<targetPath>.+)`)

 // trimLibPrefix removes prefixes like "lib/net6.0/" or "runtimes/linux-arm/lib/netcoreapp2.2/" from a path.
@@ -0,0 +1,109 @@
+package dotnet
+
+import (
+	"encoding/json"
+	"path"
+	"strings"
+
+	"github.com/anchore/packageurl-go"
+	"github.com/anchore/syft/internal"
+	"github.com/anchore/syft/syft/file"
+	"github.com/anchore/syft/syft/pkg"
+)
+
+// libmanJSON represents the libman.json file format in ASP.NET projects for describing javascript assets to be downloaded and bundled
+// see https://github.com/aspnet/LibraryManager/wiki/libman.json-reference
+type libmanJSON struct {
+	Location        file.Location `json:"-"`
+	Version         string        `json:"version"`
+	DefaultProvider string        `json:"defaultProvider"`
+	Libraries       []struct {
+		Library     string   `json:"library"`
+		Files       []string `json:"files"`
+		Destination string   `json:"destination"`
+		Provider    string   `json:"provider,omitempty"`
+	} `json:"libraries"`
+}
+
+func (l *libmanJSON) packages() []pkg.Package {
+	if l == nil {
+		return nil
+	}
+
+	var pkgs []pkg.Package
+	for _, lib := range l.Libraries {
+		if lib.Provider == "filesystem" {
+			// there is no name and version with filesystem providers
+			continue
+		}
+		fields := strings.Split(lib.Library, "@")
+		if len(fields) != 2 {
+			continue
+		}
+
+		name := fields[0]
+		version := fields[1]
+
+		p := pkg.Package{
+			Name:      name,
+			Version:   version,
+			Locations: file.NewLocationSet(l.Location),
+			Type:      pkg.NpmPkg,
+			PURL: packageurl.NewPackageURL(
+				packageurl.TypeNPM,
+				"",
+				name,
+				version,
+				nil,
+				"",
+			).ToString(),
+			Language: pkg.JavaScript,
+		}
+
+		p.SetID()
+		pkgs = append(pkgs, p)
+	}
+
+	return pkgs
+}
+
+func newLibmanJSON(reader file.LocationReadCloser) (*libmanJSON, error) {
+	var doc libmanJSON
+	dec := json.NewDecoder(reader)
+	if err := dec.Decode(&doc); err != nil {
+		return nil, err
+	}
+
+	for i := range doc.Libraries {
+		l := &doc.Libraries[i]
+		if l.Provider == "" {
+			l.Provider = doc.DefaultProvider
+		}
+	}
+
+	doc.Location = reader.Location
+
+	return &doc, nil
+}
+
+func findLibmanJSON(resolver file.Resolver, depsJSON file.Location) (*libmanJSON, error) {
+	parent := path.Dir(depsJSON.RealPath)
+	loc := resolver.RelativeFileByPath(depsJSON, path.Join(parent, "libman.json"))
+	if loc == nil {
+		return nil, nil
+	}
+
+	reader, err := resolver.FileContentsByLocation(*loc)
+	defer internal.CloseAndLogError(reader, loc.RealPath)
+	if err != nil {
+		return nil, err
+	}
+	internal.CloseAndLogError(reader, loc.RealPath)
+
+	lj, err := newLibmanJSON(file.NewLocationReadCloser(*loc, reader))
+	if err != nil {
+		return nil, err
+	}
+
+	return lj, nil
+}
@@ -196,9 +196,8 @@ func extractNameAndVersion(nameVersion string) (name, version string) {
 	return
 }

-func createNameAndVersion(name, version string) (nameVersion string) {
-	nameVersion = fmt.Sprintf("%s/%s", name, version)
-	return
+func createNameAndVersion(name, version string) string {
+	return fmt.Sprintf("%s/%s", name, version)
 }

 func packageURL(m pkg.DotnetDepsEntry) string {
@@ -0,0 +1,2 @@
+.gitignore
+Dockerfile
@@ -0,0 +1,2 @@
+/app
+/extract.sh
@@ -0,0 +1,13 @@
+FROM mcr.microsoft.com/dotnet/sdk:6.0 AS build
+ARG RUNTIME=win-x64
+
+COPY . .
+WORKDIR /src
+RUN dotnet restore -r $RUNTIME
+RUN dotnet publish -c Release --no-restore -o /app
+
+FROM busybox:latest
+WORKDIR /app
+COPY --from=build /app .
+
+
@@ -0,0 +1 @@
+wwwroot/lib/
@@ -0,0 +1,13 @@
+<Project Sdk="Microsoft.NET.Sdk.Web">
+
+  <PropertyGroup>
+    <TargetFramework>net6.0</TargetFramework>
+  </PropertyGroup>
+
+  <ItemGroup>
+    <!-- A PackageReference to Microsoft.AspNetCore.App is not necessary when targeting .NET Core 3.0 or higher. If Microsoft.NET.Sdk.Web is used, the shared framework will be referenced automatically (or override with FrameworkReference) -->
+    <!--  <PackageReference Include="Microsoft.AspNetCore.App" /> -->
+    <PackageReference Include="Microsoft.Web.LibraryManager.Build" Version="2.1.175" />
+  </ItemGroup>
+
+</Project>
@@ -0,0 +1,24 @@
+using System;
+using System.Collections.Generic;
+using System.IO;
+using System.Linq;
+using System.Threading.Tasks;
+using Microsoft.AspNetCore;
+using Microsoft.AspNetCore.Hosting;
+using Microsoft.Extensions.Configuration;
+using Microsoft.Extensions.Logging;
+
+namespace LibManSample
+{
+    public class Program
+    {
+        public static void Main(string[] args)
+        {
+            CreateWebHostBuilder(args).Build().Run();
+        }
+
+        public static IWebHostBuilder CreateWebHostBuilder(string[] args) =>
+            WebHost.CreateDefaultBuilder(args)
+                .UseStartup<Startup>();
+    }
+}
@@ -0,0 +1,34 @@
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Threading.Tasks;
+using Microsoft.AspNetCore.Builder;
+using Microsoft.AspNetCore.Hosting;
+using Microsoft.AspNetCore.Http;
+using Microsoft.Extensions.DependencyInjection;
+
+namespace LibManSample
+{
+    public class Startup
+    {
+        // This method gets called by the runtime. Use this method to add services to the container.
+        // For more information on how to configure your application, visit https://go.microsoft.com/fwlink/?LinkID=398940
+        public void ConfigureServices(IServiceCollection services)
+        {
+        }
+
+        // This method gets called by the runtime. Use this method to configure the HTTP request pipeline.
+        public void Configure(IApplicationBuilder app, IHostingEnvironment env)
+        {
+            if (env.IsDevelopment())
+            {
+                app.UseDeveloperExceptionPage();
+            }
+
+            app.Run(async (context) =>
+            {
+                await context.Response.WriteAsync("Hello World!");
+            });
+        }
+    }
+}
@@ -0,0 +1,24 @@
+{
+  "version": "1.0",
+  "defaultProvider": "cdnjs",
+  "libraries": [
+    {
+      "library": "jquery@3.3.1",
+      "files": [
+        "jquery.min.js",
+        "jquery.js",
+        "jquery.min.map"
+      ],
+      "destination": "wwwroot/lib/jquery/"
+    },
+    {
+      "provider": "filesystem",
+      "library": "vendor",
+      "files": [
+        "lodash.js",
+        "lodash.min.js"
+      ],
+      "destination": "wwwroot/lib/lodash/"
+    }
+  ]
+}
@@ -0,0 +1 @@
+// jk! nothing to see here!
@@ -0,0 +1 @@
+// still nothing here...
@@ -0,0 +1,2 @@
+/app
+/extract.sh
@@ -0,0 +1,17 @@
+FROM mcr.microsoft.com/dotnet/sdk:8.0-alpine@sha256:3f93439f47fea888d94e6e228d0d0de841f4122ef46f8bfd04f8bd78cbce7ddb AS build
+ARG RUNTIME=win-x64
+WORKDIR /src
+
+COPY src/helloworld.csproj .
+RUN dotnet restore -r $RUNTIME
+
+COPY src/*.cs .
+RUN dotnet publish -c Release -r $RUNTIME --self-contained false -o /app
+
+# note: we're not using a runtime here to make testing easier... so you cannot run this container and expect it to work
+# we do this to keep the test assertions small since the don't want to include the several other runtime packages
+FROM busybox:latest
+
+WORKDIR /app
+
+COPY --from=build /app .
@@ -0,0 +1,29 @@
+using System;
+using Microsoft.AspNetCore.Builder;
+using Microsoft.Extensions.Hosting;
+
+namespace HelloWorld
+{
+    public class Program
+    {
+        public static void Main(string[] args)
+        {
+            var builder = WebApplication.CreateBuilder(args);
+            var app = builder.Build();
+
+            // configure the HTTP request pipeline
+            if (!app.Environment.IsDevelopment())
+            {
+                app.UseExceptionHandler("/Error");
+            }
+
+            // enable serving static files (including jQuery)
+            app.UseStaticFiles();
+
+            app.MapGet("/", () => "Hello World!");
+
+            Console.WriteLine("Application starting...");
+            app.Run();
+        }
+    }
+}
@@ -0,0 +1,58 @@
+<Project Sdk="Microsoft.NET.Sdk" ToolsVersion="15.0">
+
+  <PropertyGroup>
+    <OutputType>Exe</OutputType>
+    <TargetFramework>net8.0</TargetFramework>
+    <Nullable>enable</Nullable>
+  </PropertyGroup>
+
+  <ItemGroup>
+    <PackageReference Include="DotNetNuke.Core" Version="9.9.1"/>
+
+    <!-- jQuery wraps the javascript library, so no DLLs -->
+    <PackageReference Include="jQuery" Version="3.4.1" />
+    <PackageReference Include="Microsoft.AspNetCore.Mvc.Razor" Version="2.2.0" />
+
+    <!-- ChakraCore is an open source Javascript engine with a C API -->
+    <PackageReference Include="Microsoft.ChakraCore" Version="1.11.24">
+      <IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
+      <PrivateAssets>all</PrivateAssets>
+    </PackageReference>
+
+    <!-- Nuget.CommandLine is a command line tool for managing NuGet packages -->
+    <PackageReference Include="Nuget.CommandLine" Version="6.3.1">
+      <IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
+      <PrivateAssets>all</PrivateAssets>
+    </PackageReference>
+
+    <!-- Umbraco.Cms has dependencies with software, but itself has no DLLs -->
+    <PackageReference Include="Umbraco.Cms" Version="11.3.0" />
+
+    <!-- For code analysis/style checking, only needed during development -->
+    <PackageReference Include="StyleCop.Analyzers" Version="1.2.0-beta.435" PrivateAssets="All" />
+
+    <!-- For unit testing, only needed during development -->
+    <PackageReference Include="Microsoft.NET.Test.Sdk" Version="17.8.0" Condition="'$(Configuration)' == 'Debug'" PrivateAssets="All" />
+
+  </ItemGroup>
+
+  <!-- create directories if they don't exist -->
+  <Target Name="CreateWwwroot" BeforeTargets="PrepareForPublish">
+    <MakeDir Directories="$(PublishDir)wwwroot\lib\jquery" />
+  </Target>
+
+  <!-- explicitly copy jQuery files during publish phase -->
+  <Target Name="CopyJQueryToPublishOutput" AfterTargets="CreateWwwroot" BeforeTargets="ComputeFilesToPublish">
+    <ItemGroup>
+      <!-- find jQuery files in the packages folder -->
+      <JQueryFiles Include="$(NuGetPackageRoot)\jquery\3.4.1\Content\Scripts\*.js" />
+
+      <!-- add these to the publish output -->
+      <ResolvedFileToPublish Include="@(JQueryFiles)">
+        <RelativePath>wwwroot\lib\jquery\%(Filename)%(Extension)</RelativePath>
+        <CopyToPublishDirectory>PreserveNewest</CopyToPublishDirectory>
+      </ResolvedFileToPublish>
+    </ItemGroup>
+  </Target>
+
+</Project>
@@ -77,18 +77,25 @@ func (c *goModCataloger) parseGoModFile(ctx context.Context, resolver file.Resol

 		// the old path and new path may be the same, in which case this is a noop,
 		// but if they're different we need to remove the old package.
-		delete(packages, m.Old.Path)
-
-		packages[m.New.Path] = pkg.Package{
-			Name:      m.New.Path,
+		// note that we may change the path but we should always reference the new version (since the old version
+		// cannot be trusted as a correct value).
+		var finalPath string
+		if !strings.HasPrefix(m.New.Path, ".") && !strings.HasPrefix(m.New.Path, "/") {
+			finalPath = m.New.Path
+			delete(packages, m.Old.Path)
+		} else {
+			finalPath = m.Old.Path
+		}
+		packages[finalPath] = pkg.Package{
+			Name:      finalPath,
 			Version:   m.New.Version,
 			Licenses:  pkg.NewLicenseSet(lics...),
 			Locations: file.NewLocationSet(reader.WithAnnotation(pkg.EvidenceAnnotationKey, pkg.PrimaryEvidenceAnnotation)),
-			PURL:      packageURL(m.New.Path, m.New.Version),
+			PURL:      packageURL(finalPath, m.New.Version),
 			Language:  pkg.Go,
 			Type:      pkg.GoModulePkg,
 			Metadata: pkg.GolangModuleEntry{
-				H1Digest: digests[fmt.Sprintf("%s %s", m.New.Path, m.New.Version)],
+				H1Digest: digests[fmt.Sprintf("%s %s", finalPath, m.New.Version)],
 			},
 		}
 	}
@@ -28,6 +28,20 @@ func TestParseGoMod(t *testing.T) {
 				},
 			},
 		},
+		{
+			fixture: "test-fixtures/relative-replace",
+			expected: []pkg.Package{
+				{
+					Name:      "github.com/aws/aws-sdk-go-v2",
+					Version:   "",
+					PURL:      "pkg:golang/github.com/aws/aws-sdk-go-v2",
+					Locations: file.NewLocationSet(file.NewLocation("test-fixtures/relative-replace")),
+					Language:  pkg.Go,
+					Type:      pkg.GoModulePkg,
+					Metadata:  pkg.GolangModuleEntry{},
+				},
+			},
+		},
 		{

 			fixture: "test-fixtures/many-packages",
@@ -0,0 +1,7 @@
+module github.com/aws/aws-sdk-go-v2/feature/ec2/imds
+
+go 1.22
+
+require github.com/aws/aws-sdk-go-v2 v1.36.3
+
+replace github.com/aws/aws-sdk-go-v2 => ../../../
@@ -121,6 +121,9 @@
      "github.com/whilp/git-urls": [
        "cpe:2.3:a:git-urls_project:git-urls:*:*:*:*:*:go:*:*"
      ],
+      "golang.org/x/crypto": [
+        "cpe:2.3:a:go:ssh:*:*:*:*:*:go:*:*"
+      ],
      "golang.org/x/crypto/ssh": [
        "cpe:2.3:a:golang:package_ssh:*:*:*:*:*:*:*:*",
        "cpe:2.3:a:golang:ssh:*:*:*:*:*:*:*:*"
@@ -144,6 +147,9 @@
      "golang.org/x/net/http2/hpack": [
        "cpe:2.3:a:golang:hpack:*:*:*:*:*:go:*:*"
      ],
+      "golang.org/x/oauth2/jws": [
+        "cpe:2.3:a:go:jws:*:*:*:*:*:go:*:*"
+      ],
      "golang.org/x/text": [
        "cpe:2.3:a:golang:text:*:*:*:*:*:*:*:*"
      ],
@@ -1665,6 +1671,9 @@
      "sidebar-link": [
        "cpe:2.3:a:jenkins:sidebar_link:*:*:*:*:*:jenkins:*:*"
      ],
+      "simple-queue": [
+        "cpe:2.3:a:jenkins:simple_queue:*:*:*:*:*:jenkins:*:*"
+      ],
      "simple-travis-runner": [
        "cpe:2.3:a:jenkins:simple_travis_pipeline_runner:*:*:*:*:*:jenkins:*:*"
      ],
@@ -1747,6 +1756,9 @@
      "ssh2easy": [
        "cpe:2.3:a:jenkins:ssh2_easy:*:*:*:*:*:jenkins:*:*"
      ],
+      "stackhammer": [
+        "cpe:2.3:a:jenkins:stack_hammer:*:*:*:*:*:jenkins:*:*"
+      ],
      "starteam": [
        "cpe:2.3:a:jenkins:starteam:*:*:*:*:*:jenkins:*:*"
      ],
@@ -2457,6 +2469,12 @@
      "bestzip": [
        "cpe:2.3:a:bestzip_project:bestzip:*:*:*:*:*:node.js:*:*"
      ],
+      "better-aut": [
+        "cpe:2.3:a:better-auth:better_auth:*:*:*:*:*:node.js:*:*"
+      ],
+      "better-auth": [
+        "cpe:2.3:a:better-auth:better_auth:*:*:*:*:*:node.js:*:*"
+      ],
      "bionode-sra": [
        "cpe:2.3:a:bionode:bionode-sra:*:*:*:*:*:node.js:*:*"
      ],
@@ -6340,6 +6358,9 @@
      "private_address_check": [
        "cpe:2.3:a:private_address_check_project:private_address_check:*:*:*:*:*:ruby:*:*"
      ],
+      "publify_core": [
+        "cpe:2.3:a:publify:publify_core:*:*:*:*:*:ruby:*:*"
+      ],
      "puma": [
        "cpe:2.3:a:puma:puma:*:*:*:*:*:ruby:*:*"
      ],
@@ -7080,6 +7101,9 @@
      "3d-flipbook-dflip-lite": [
        "cpe:2.3:a:dearhive:dearflip:*:*:*:*:*:wordpress:*:*"
      ],
+      "3d-photo-gallery": [
+        "cpe:2.3:a:webdevocean:3d_photo_gallery:*:*:*:*:*:wordpress:*:*"
+      ],
      "3d-presentation": [
        "cpe:2.3:a:lucapaggetti:3d_presentation:*:*:*:*:*:wordpress:*:*"
      ],
@@ -7271,6 +7295,9 @@
      "aco-product-labels-for-woocommerce": [
        "cpe:2.3:a:acowebs:product_labels_for_woocommerce_\\(sale_badges\\):*:*:*:*:*:wordpress:*:*"
      ],
+      "actionwear-products-sync": [
+        "cpe:2.3:a:marcoingraiti:actionwear_products_sync:*:*:*:*:*:wordpress:*:*"
+      ],
      "activecampaign-for-woocommerce": [
        "cpe:2.3:a:activecampaign:activecampaign_for_woocommerce:*:*:*:*:*:wordpress:*:*"
      ],
@@ -7593,6 +7620,9 @@
      "ai-engine": [
        "cpe:2.3:a:meowapps:ai_engine:*:*:*:*:*:wordpress:*:*"
      ],
+      "ai-image-alt-text-generator-for-wp": [
+        "cpe:2.3:a:wpmessiah:ai_image_alt_text_generator_for_wp:*:*:*:*:*:wordpress:*:*"
+      ],
      "ai-post-generator": [
        "cpe:2.3:a:autowriter:ai_post_generator_\\|_autowriter:*:*:*:*:*:wordpress:*:*"
      ],
@@ -7753,6 +7783,9 @@
      "amministrazione-trasparente": [
        "cpe:2.3:a:amministrazione_trasparente_project:amministrazione_trasparente:*:*:*:*:*:wordpress:*:*"
      ],
+      "amo-team-showcase": [
+        "cpe:2.3:a:amothemo:amo_team_showcase:*:*:*:*:*:wordpress:*:*"
+      ],
      "amp-img-shortcode": [
        "cpe:2.3:a:wpza:amp_img_shortcode:*:*:*:*:*:wordpress:*:*"
      ],
@@ -7795,6 +7828,9 @@
      "analytics-tracker": [
        "cpe:2.3:a:analytics_tracker_project:analytics_tracker:*:*:*:*:*:wordpress:*:*"
      ],
+      "analyticswp": [
+        "cpe:2.3:a:analyticswp:analyticswp:*:*:*:*:*:wordpress:*:*"
+      ],
      "anchor-episodes-index": [
        "cpe:2.3:a:jesweb:anchor_episodes_index:*:*:*:*:*:wordpress:*:*"
      ],
@@ -8337,6 +8373,9 @@
        "cpe:2.3:a:ithemes:security:*:*:*:*:*:wordpress:*:*",
        "cpe:2.3:a:solidwp:solid_security:*:*:*:*:*:wordpress:*:*"
      ],
+      "betterdocs": [
+        "cpe:2.3:a:wpdeveloper:betterdocs:*:*:*:*:*:wordpress:*:*"
+      ],
      "betterlinks": [
        "cpe:2.3:a:wpdeveloper:betterlinks:*:*:*:*:free:wordpress:*:*"
      ],
@@ -8364,6 +8403,9 @@
      "bigmart-elements": [
        "cpe:2.3:a:wpcirqle:bigmart_elements:*:*:*:*:*:wordpress:*:*"
      ],
+      "bilingual-linker": [
+        "cpe:2.3:a:ylefebvre:bilingual_linker:*:*:*:*:*:wordpress:*:*"
+      ],
      "billingo": [
        "cpe:2.3:a:official_integration_for_billingo_project:official_integration_for_billingo:*:*:*:*:*:wordpress:*:*"
      ],
@@ -8774,6 +8816,12 @@
      "byconsole-woo-order-delivery-time": [
        "cpe:2.3:a:byconsole:wooodt_lite:*:*:*:*:*:wordpress:*:*"
      ],
+      "c9-admin-dashboard": [
+        "cpe:2.3:a:covertnine:c9_admin_dashboard:*:*:*:*:*:wordpress:*:*"
+      ],
+      "c9-blocks": [
+        "cpe:2.3:a:covertnine:c9_blocks:*:*:*:*:*:wordpress:*:*"
+      ],
      "cab-fare-calculator": [
        "cpe:2.3:a:kanev:cab_fare_calculator:*:*:*:*:*:wordpress:*:*"
      ],
@@ -8882,6 +8930,9 @@
      "caret-country-access-limit": [
        "cpe:2.3:a:caret:country_access_limit:*:*:*:*:*:wordpress:*:*"
      ],
+      "carousel-anything": [
+        "cpe:2.3:a:webdevocean:carousel_anything:*:*:*:*:*:wordpress:*:*"
+      ],
      "carousel-ck": [
        "cpe:2.3:a:ceikay:carousel_ck:*:*:*:*:*:wordpress:*:*"
      ],
@@ -9068,6 +9119,9 @@
      "church-admin": [
        "cpe:2.3:a:church_admin_project:church_admin:*:*:*:*:*:wordpress:*:*"
      ],
+      "circle-image-slider-with-lightbox": [
+        "cpe:2.3:a:i13websolution:team_circle_image_slider_with_lightbox:*:*:*:*:*:wordpress:*:*"
+      ],
      "circles-gallery": [
        "cpe:2.3:a:greentreelabs:circles_gallery:*:*:*:*:*:wordpress:*:*"
      ],
@@ -10281,6 +10335,9 @@
      "drozd-addons-for-elementor": [
        "cpe:2.3:a:urchenko:drozd:*:*:*:*:*:wordpress:*:*"
      ],
+      "ds-cf7-math-captcha": [
+        "cpe:2.3:a:dotsquares:contact_form_7_math_captcha:*:*:*:*:*:wordpress:*:*"
+      ],
      "dsgvo-all-in-one-for-wp": [
        "cpe:2.3:a:dsgvo-for-wp:dsgvo_all_in_one_for_wp:*:*:*:*:*:wordpress:*:*"
      ],
@@ -10432,6 +10489,9 @@
      "easy-menu-manager-wpzest": [
        "cpe:2.3:a:wpzest:easy_menu_manager:*:*:*:*:*:wordpress:*:*"
      ],
+      "easy-mls-listings-import": [
+        "cpe:2.3:a:homeasap:easy_mls_listings_import:*:*:*:*:*:wordpress:*:*"
+      ],
      "easy-modal": [
        "cpe:2.3:a:easy_modal_project:easy_modal:*:*:*:*:*:wordpress:*:*",
        "cpe:2.3:a:easymodal_project:easy_modal:*:*:*:*:*:wordpress:*:*"
@@ -10469,6 +10529,9 @@
      "easy-social-icons": [
        "cpe:2.3:a:cybernetikz:easy_social_icons:*:*:*:*:*:wordpress:*:*"
      ],
+      "easy-social-share-buttons": [
+        "cpe:2.3:a:idiom:easy_social_share_buttons:*:*:*:*:*:wordpress:*:*"
+      ],
      "easy-student-results": [
        "cpe:2.3:a:easy_student_results_project:easy_student_results:*:*:*:*:*:wordpress:*:*"
      ],
@@ -10533,6 +10596,9 @@
      "ebook-download": [
        "cpe:2.3:a:zedna_ebook_download_project:zedna_ebook_download:*:*:*:*:*:wordpress:*:*"
      ],
+      "ebook-downloader": [
+        "cpe:2.3:a:infoway:ebook_downloader:*:*:*:*:*:wordpress:*:*"
+      ],
      "ebook-store": [
        "cpe:2.3:a:shopfiles:ebook_store:*:*:*:*:*:wordpress:*:*"
      ],
@@ -10598,6 +10664,9 @@
      "elegant-themes-icons": [
        "cpe:2.3:a:wpai:elegant_themes_icons:*:*:*:*:*:wordpress:*:*"
      ],
+      "elemenda": [
+        "cpe:2.3:a:dankedev:elemenda:*:*:*:*:*:wordpress:*:*"
+      ],
      "element-ready-lite": [
        "cpe:2.3:a:quomodosoft:elementsready:*:*:*:*:free:wordpress:*:*"
      ],
@@ -10670,6 +10739,9 @@
        "cpe:2.3:a:icegram:email_subscribers_\\\u0026_newsletters:*:*:*:*:*:wordpress:*:*",
        "cpe:2.3:a:icegram:icegram_express:*:*:*:*:*:wordpress:*:*"
      ],
+      "email-template-customizer-for-woo": [
+        "cpe:2.3:a:villatheme:woocommerce_email_template_customizer:*:*:*:*:*:wordpress:*:*"
+      ],
      "email-users": [
        "cpe:2.3:a:email_users_project:email_users:*:*:*:*:*:wordpress:*:*"
      ],
@@ -10749,6 +10821,9 @@
      "envato-elements": [
        "cpe:2.3:a:envato:envato_elements:*:*:*:*:*:wordpress:*:*"
      ],
+      "envialosimple-email-marketing-y-newsletters-gratis": [
+        "cpe:2.3:a:donweb:envialosimple:*:*:*:*:*:wordpress:*:*"
+      ],
      "envira-gallery-lite": [
        "cpe:2.3:a:enviragallery:envira_gallery:*:*:*:*:lite:wordpress:*:*"
      ],
@@ -10762,6 +10837,9 @@
      "eonet-manual-user-approve": [
        "cpe:2.3:a:xtendify:eonet_manual_user_approve:*:*:*:*:*:wordpress:*:*"
      ],
+      "epoll-wp-voting": [
+        "cpe:2.3:a:infotheme:wp_poll_maker:*:*:*:*:*:wordpress:*:*"
+      ],
      "eps-301-redirects": [
        "cpe:2.3:a:webfactoryltd:301_redirects:*:*:*:*:*:wordpress:*:*"
      ],
@@ -11020,6 +11098,9 @@
      "facebook-wall-and-social-integration": [
        "cpe:2.3:a:facebook-wall-and-social-integration_project:facebook-wall-and-social-integration:*:*:*:*:*:wordpress:*:*"
      ],
+      "falang": [
+        "cpe:2.3:a:faboba:falang:*:*:*:*:*:wordpress:*:*"
+      ],
      "fancier-author-box": [
        "cpe:2.3:a:thematosoup:fancier_author_box:*:*:*:*:*:wordpress:*:*"
      ],
@@ -11767,6 +11848,9 @@
      "google-language-translator": [
        "cpe:2.3:a:gtranslate:google_language_translator:*:*:*:*:*:wordpress:*:*"
      ],
+      "google-map-locations": [
+        "cpe:2.3:a:dotsquares:google_map_locations:*:*:*:*:*:wordpress:*:*"
+      ],
      "google-map-shortcode": [
        "cpe:2.3:a:web-argument:google-map-shortcode:*:*:*:*:*:wordpress:*:*"
      ],
@@ -11927,6 +12011,9 @@
      "guest-author-name": [
        "cpe:2.3:a:shooflysolutions:\\(simply\\)_guest_author_name:*:*:*:*:*:wordpress:*:*"
      ],
+      "gum-elementor-addon": [
+        "cpe:2.3:a:celomitan:gum_elementor_addon:*:*:*:*:*:wordpress:*:*"
+      ],
      "gumlet-video": [
        "cpe:2.3:a:gumlet:video:*:*:*:*:*:wordpress:*:*"
      ],
@@ -12001,6 +12088,9 @@
      "header-enhancement": [
        "cpe:2.3:a:catchplugins:header_enhancement:*:*:*:*:*:wordpress:*:*"
      ],
+      "header-footer-code": [
+        "cpe:2.3:a:ninjateam:header_footer_custom_code:*:*:*:*:*:wordpress:*:*"
+      ],
      "header-footer-code-manager": [
        "cpe:2.3:a:draftpress:header_footer_code_manager:*:*:*:*:*:wordpress:*:*"
      ],
@@ -12414,6 +12504,9 @@
      "inlinks": [
        "cpe:2.3:a:inlinks_project:inlinks:*:*:*:*:*:wordpress:*:*"
      ],
+      "inlocation": [
+        "cpe:2.3:a:gabrieldarezzo:inlocation:*:*:*:*:*:wordpress:*:*"
+      ],
      "innovs-hr-manager": [
        "cpe:2.3:a:theinnovs:innovs_hr:*:*:*:*:*:wordpress:*:*"
      ],
@@ -12957,6 +13050,9 @@
      "light-messages": [
        "cpe:2.3:a:light_messages_project:light_messages:*:*:*:*:*:wordpress:*:*"
      ],
+      "light-poll": [
+        "cpe:2.3:a:dmytropopov:light_poll:*:*:*:*:*:wordpress:*:*"
+      ],
      "lightbox-gallery": [
        "cpe:2.3:a:wpgogo:lightbox-gallery:*:*:*:*:*:wordpress:*:*"
      ],
@@ -13022,6 +13118,9 @@
      "list-category-posts": [
        "cpe:2.3:a:fernandobriano:list_category_posts:*:*:*:*:*:wordpress:*:*"
      ],
+      "listamester": [
+        "cpe:2.3:a:listamester:listamester:*:*:*:*:*:wordpress:*:*"
+      ],
      "litespeed-cache": [
        "cpe:2.3:a:litespeedtech:litespeed_cache:*:*:*:*:*:wordpress:*:*"
      ],
@@ -13244,6 +13343,9 @@
      "makestories-helper": [
        "cpe:2.3:a:makestories:makestories_\\(for_google_web_stories\\):*:*:*:*:*:wordpress:*:*"
      ],
+      "makewebbetter-hubspot-for-woocommerce": [
+        "cpe:2.3:a:makewebbetter:hubspot_for_woocommerce:*:*:*:*:*:wordpress:*:*"
+      ],
      "malinky-ajax-pagination": [
        "cpe:2.3:a:malinky:malinky-ajax-pagination:*:*:*:*:*:wordpress:*:*"
      ],
@@ -13274,6 +13376,9 @@
        "cpe:2.3:a:mappresspro:mappress:*:*:*:*:pro:wordpress:*:*",
        "cpe:2.3:a:mappresspro:mappress_maps_for_wordpress:*:*:*:*:*:wordpress:*:*"
      ],
+      "maps-for-wp": [
+        "cpe:2.3:a:icopydoc:maps_for_wp:*:*:*:*:*:wordpress:*:*"
+      ],
      "mapster-wp-maps": [
        "cpe:2.3:a:mapster:mapster_wp_maps:*:*:*:*:*:wordpress:*:*"
      ],
@@ -13995,6 +14100,9 @@
      "ninja-tables": [
        "cpe:2.3:a:wpmanageninja:ninja_tables:*:*:*:*:*:wordpress:*:*"
      ],
+      "ninjafirewall": [
+        "cpe:2.3:a:nintechnet:ninjafirewall:*:*:*:*:*:wordpress:*:*"
+      ],
      "nirweb-support": [
        "cpe:2.3:a:nirweb:nirweb_support:*:*:*:*:*:wordpress:*:*"
      ],
@@ -14354,6 +14462,9 @@
      "password-protected": [
        "cpe:2.3:a:wpexperts:password_protected:*:*:*:*:*:wordpress:*:*"
      ],
+      "passwords-manager": [
+        "cpe:2.3:a:hirewebxperts:passwords_manager:*:*:*:*:*:wordpress:*:*"
+      ],
      "patreon-connect": [
        "cpe:2.3:a:patreon:patreon_wordpress:*:*:*:*:*:wordpress:*:*"
      ],
@@ -14768,6 +14879,9 @@
      "post-list-designer": [
        "cpe:2.3:a:infornweb:posts_list_designer_by_category:*:*:*:*:*:wordpress:*:*"
      ],
+      "post-lockdown": [
+        "cpe:2.3:a:andypalmer:post_lockdown:*:*:*:*:*:wordpress:*:*"
+      ],
      "post-meta-data-manager": [
        "cpe:2.3:a:wpexpertplugins:post_meta_data_manager:*:*:*:*:*:wordpress:*:*"
      ],
@@ -14840,10 +14954,13 @@
        "cpe:2.3:a:posttabs_project:posttabs:*:*:*:*:*:wordpress:*:*"
      ],
      "powerpack-addon-for-beaver-builder": [
-        "cpe:2.3:a:wpbeaveraddons:powerpack_lite_for_beaver_builder:*:*:*:*:*:wordpress:*:*"
+        "cpe:2.3:a:ideabox:powerpack_for_beaver_builder:*:*:*:*:lite:wordpress:*:*"
+      ],
+      "powerpack-elements": [
+        "cpe:2.3:a:ideabox:powerpack_addons_for_elementor:*:*:*:*:pro:wordpress:*:*"
      ],
      "powerpack-lite-for-elementor": [
-        "cpe:2.3:a:ideabox:powerpack_addons_for_elementor:*:*:*:*:*:wordpress:*:*"
+        "cpe:2.3:a:ideabox:powerpack_addons_for_elementor:*:*:*:*:free:wordpress:*:*"
      ],
      "powerpress": [
        "cpe:2.3:a:blubrry:powerpress:*:*:*:*:*:wordpress:*:*"
@@ -15622,6 +15739,9 @@
      "saan-world-clock": [
        "cpe:2.3:a:saan:world_clock:*:*:*:*:*:wordpress:*:*"
      ],
+      "safe-ai-malware-protection-for-wp": [
+        "cpe:2.3:a:wpmessiah:safe_ai_malware_protection_for_wp:*:*:*:*:*:wordpress:*:*"
+      ],
      "safe-editor": [
        "cpe:2.3:a:kodebyraaet:safe_editor:*:*:*:*:*:wordpress:*:*"
      ],
@@ -15683,6 +15803,9 @@
      "scoutnet-kalender": [
        "cpe:2.3:a:scoutnet:kalender:*:*:*:*:*:wordpress:*:*"
      ],
+      "scratch-win-giveaways-for-website-facebook": [
+        "cpe:2.3:a:akashmalik:scratch_\\\u0026_win:*:*:*:*:*:wordpress:*:*"
+      ],
      "scribble-maps": [
        "cpe:2.3:a:scribblemaps:scribble_maps:*:*:*:*:*:wordpress:*:*"
      ],
@@ -16167,12 +16290,18 @@
      "simple-posts-ticker": [
        "cpe:2.3:a:sayandatta:simple_posts_ticker:*:*:*:*:*:wordpress:*:*"
      ],
+      "simple-pricing-tables-vc-extension": [
+        "cpe:2.3:a:webdevocean:pricing_tables:*:*:*:*:*:wordpress:*:*"
+      ],
      "simple-quotation": [
        "cpe:2.3:a:sedlex:simple_quotation:*:*:*:*:*:wordpress:*:*"
      ],
      "simple-real-estate-pack-4": [
        "cpe:2.3:a:simple_real_estate_pack_project:simple_real_estate_pack:*:*:*:*:*:wordpress:*:*"
      ],
+      "simple-responsive-slider": [
+        "cpe:2.3:a:marcelotorres:simple_responsive_slider:*:*:*:*:*:wordpress:*:*"
+      ],
      "simple-revisions-delete": [
        "cpe:2.3:a:b-website:simple_revisions_delete:*:*:*:*:*:wordpress:*:*"
      ],
@@ -16907,6 +17036,9 @@
      "svgmagic": [
        "cpe:2.3:a:andibauer:svgmagic:*:*:*:*:*:wordpress:*:*"
      ],
+      "svs-pricing-tables": [
+        "cpe:2.3:a:svs-websoft:svs_pricing_tables:*:*:*:*:*:wordpress:*:*"
+      ],
      "swatchly": [
        "cpe:2.3:a:hasthemes:swatchly:*:*:*:*:*:wordpress:*:*"
      ],
@@ -17096,7 +17228,6 @@
        "cpe:2.3:a:posimyth:the_plus_addons_for_elementor_page_builder_lite:*:*:*:*:*:wordpress:*:*"
      ],
      "the-post-grid": [
-        "cpe:2.3:a:radiustheme:post_grid:*:*:*:*:*:wordpress:*:*",
        "cpe:2.3:a:radiustheme:the_post_grid:*:*:*:*:*:wordpress:*:*"
      ],
      "the-sorter": [
@@ -17157,8 +17288,7 @@
        "cpe:2.3:a:brandevolutionco:themeshark_templates_\\\u0026_widgets_for_elementor:*:*:*:*:*:wordpress:*:*"
      ],
      "themify-builder": [
-        "cpe:2.3:a:themify:builder:*:*:*:*:-:wordpress:*:*",
-        "cpe:2.3:a:themify:themify_builder:*:*:*:*:*:wordpress:*:*"
+        "cpe:2.3:a:themify:builder:*:*:*:*:-:wordpress:*:*"
      ],
      "themify-portfolio-post": [
        "cpe:2.3:a:themify:portfolio_post:*:*:*:*:*:wordpress:*:*"
@@ -17472,6 +17602,9 @@
      "ultimate-category-excluder": [
        "cpe:2.3:a:infolific:ultimate_category_excluder:*:*:*:*:*:wordpress:*:*"
      ],
+      "ultimate-classified-listings": [
+        "cpe:2.3:a:webcodingplace:ultimate_classified_listings:*:*:*:*:*:wordpress:*:*"
+      ],
      "ultimate-dashboard": [
        "cpe:2.3:a:davidvongries:ultimate_dashboard:*:*:*:*:*:wordpress:*:*"
      ],
@@ -17866,6 +17999,9 @@
      "w-dalil": [
        "cpe:2.3:a:w-dalil_project:w-dalil:*:*:*:*:*:wordpress:*:*"
      ],
+      "w2s-migrate-woo-to-shopify": [
+        "cpe:2.3:a:villatheme:w2s:*:*:*:*:*:wordpress:*:*"
+      ],
      "w3-total-cache": [
        "cpe:2.3:a:boldgrid:w3_total_cache:*:*:*:*:*:wordpress:*:*"
      ],
@@ -17899,6 +18035,9 @@
      "watu": [
        "cpe:2.3:a:kibokolabs:watu_quiz:*:*:*:*:*:wordpress:*:*"
      ],
+      "wc-affiliate": [
+        "cpe:2.3:a:codexpert:wc_affiliate:*:*:*:*:*:wordpress:*:*"
+      ],
      "wc-dynamic-pricing-and-discounts": [
        "cpe:2.3:a:rightpress:woocommerce_dynamic_pricing_\\\u0026_discounts:*:*:*:*:*:wordpress:*:*"
      ],
@@ -17984,6 +18123,9 @@
      "web-stories": [
        "cpe:2.3:a:google:web_stories:*:*:*:*:*:wordpress:*:*"
      ],
+      "web-stories-enhancer": [
+        "cpe:2.3:a:magazine3:web_stories_enhancer:*:*:*:*:*:wordpress:*:*"
+      ],
      "web3-authentication": [
        "cpe:2.3:a:miniorange:web3_-_crypto_wallet_login_\\\u0026_nft_token_gating:*:*:*:*:*:wordpress:*:*"
      ],
@@ -18446,6 +18588,9 @@
      "woocommerce-store-toolkit": [
        "cpe:2.3:a:visser:store_toolkit_for_woocommerce:*:*:*:*:*:wordpress:*:*"
      ],
+      "woocommerce-superfaktura": [
+        "cpe:2.3:a:superfaktura:superfaktura_woocommerce:*:*:*:*:*:wordpress:*:*"
+      ],
      "woocommerce-wholesale-prices": [
        "cpe:2.3:a:rymera:wholesale_suite:*:*:*:*:*:wordpress:*:*"
      ],
@@ -18565,9 +18710,15 @@
      "wordpress-users": [
        "cpe:2.3:a:jonathonkemp:wordpress_users:*:*:*:*:*:wordpress:*:*"
      ],
+      "workreap": [
+        "cpe:2.3:a:amentotech:workreap:*:*:*:*:*:wordpress:*:*"
+      ],
      "wow-moodboard-lite": [
        "cpe:2.3:a:wownmedia:wow_moodboard:*:*:*:*:lite:wordpress:*:*"
      ],
+      "wowpth": [
+        "cpe:2.3:a:andreafarracani:wowpth:*:*:*:*:*:wordpress:*:*"
+      ],
      "wp-2fa": [
        "cpe:2.3:a:melapress:wp_2fa:*:*:*:*:*:wordpress:*:*",
        "cpe:2.3:a:wpwhitesecurity:wp_2fa:*:*:*:*:*:wordpress:*:*"
@@ -19078,6 +19229,9 @@
      "wp-gmappity-easy-google-maps": [
        "cpe:2.3:a:matthewschwartz:google_maps_made_simple:*:*:*:*:*:wordpress:*:*"
      ],
+      "wp-google-analytics-events": [
+        "cpe:2.3:a:wpgoaltracker:wp_google_analytics_events:*:*:*:*:*:wordpress:*:*"
+      ],
      "wp-google-fonts": [
        "cpe:2.3:a:wp_google_fonts_project:wp_google_fonts:*:*:*:*:*:*:*:*"
      ],
@@ -19517,6 +19671,9 @@
      "wp-reset": [
        "cpe:2.3:a:webfactoryltd:wp_reset:*:*:*:*:*:wordpress:*:*"
      ],
+      "wp-responsive-photo-gallery": [
+        "cpe:2.3:a:i13websolution:photo_gallery_slideshow_\\\u0026_masonry_tiled_gallery:*:*:*:*:*:wordpress:*:*"
+      ],
      "wp-responsive-slider-with-lightbox": [
        "cpe:2.3:a:i13websolution:thumbnail_slider_with_lightbox:*:*:*:*:*:wordpress:*:*"
      ],
@@ -20184,6 +20341,9 @@
      "xllentech-english-islamic-calendar": [
        "cpe:2.3:a:xllentech:english_islamic_calendar:*:*:*:*:*:wordpress:*:*"
      ],
+      "xml-for-google-merchant-center": [
+        "cpe:2.3:a:icopydoc:xml_for_google_merchant_center:*:*:*:*:*:wordpress:*:*"
+      ],
      "xml-sitemap-generator-for-google": [
        "cpe:2.3:a:wpgrim:dynamic_xml_sitemaps_generator_for_google:*:*:*:*:*:wordpress:*:*"
      ],
@@ -20342,6 +20502,9 @@
      "yuzo-related-post": [
        "cpe:2.3:a:yuzopro:yuzo:*:*:*:*:*:wordpress:*:*"
      ],
+      "z-companion": [
+        "cpe:2.3:a:wpzita:z_companion:*:*:*:*:*:wordpress:*:*"
+      ],
      "z-url-preview": [
        "cpe:2.3:a:z-url_preview_project:z-url_preview:*:*:*:*:*:wordpress:*:*"
      ],
@@ -20395,6 +20558,9 @@
      "zm-gallery": [
        "cpe:2.3:a:zm-gallery_project:zm-gallery:*:*:*:*:*:wordpress:*:*"
      ],
+      "zoho-campaigns": [
+        "cpe:2.3:a:zoho:zoho_campaigns:*:*:*:*:*:*:*:*"
+      ],
      "zoho-crm-forms": [
        "cpe:2.3:a:zoho:lead_magnet:*:*:*:*:*:wordpress:*:*",
        "cpe:2.3:a:zohocorp:zoho_crm_lead_magnet:*:*:*:*:*:wordpress:*:*"
@@ -20412,6 +20578,9 @@
        "cpe:2.3:a:katieseaborn:zotpress:*:*:*:*:*:wordpress:*:*",
        "cpe:2.3:a:zotpress_project:zotpress:*:*:*:*:*:wordpress:*:*"
      ],
+      "zstore-manager-basic": [
+        "cpe:2.3:a:ikjweb:zstore_manager_basic:*:*:*:*:*:wordpress:*:*"
+      ],
      "zx-csv-upload": [
        "cpe:2.3:a:zx-csv-upload_project:zx-csv-upload:*:*:*:*:*:wordpress:*:*"
      ],
@@ -20508,6 +20677,9 @@
      "carspot": [
        "cpe:2.3:a:scriptsbundle:carspot:*:*:*:*:*:wordpress:*:*"
      ],
+      "click-mag": [
+        "cpe:2.3:a:mvpthemes:click_mag:*:*:*:*:*:wordpress:*:*"
+      ],
      "colibri-wp": [
        "cpe:2.3:a:colibriwp:colibri:*:*:*:*:*:wordpress:*:*"
      ],
@@ -20597,6 +20769,9 @@
      "hueman": [
        "cpe:2.3:a:presscustomizr:hueman:*:*:*:*:*:wordpress:*:*"
      ],
+      "idyllic": [
+        "cpe:2.3:a:themefreesia:idyllic:*:*:*:*:*:wordpress:*:*"
+      ],
      "illdy": [
        "cpe:2.3:a:colorlib:illdy:*:*:*:*:*:wordpress:*:*"
      ],
@@ -20680,6 +20855,9 @@
      "pinzolo": [
        "cpe:2.3:a:thriveweb:pinzolo:*:*:*:*:*:wordpress:*:*"
      ],
+      "pixgraphy": [
+        "cpe:2.3:a:themefreesia:pixgraphy:*:*:*:*:*:wordpress:*:*"
+      ],
      "pixova-lite": [
        "cpe:2.3:a:colorlib:pixova_lite:*:*:*:*:*:wordpress:*:*"
      ],
@@ -20767,6 +20945,12 @@
      ],
      "zigcy-lite": [
        "cpe:2.3:a:accesspressthemes:zigcy_lite:*:*:*:*:*:wordpress:*:*"
+      ],
+      "zox-news": [
+        "cpe:2.3:a:mvpthemes:zox_news:*:*:*:*:*:wordpress:*:*"
+      ],
+      "zoxpress": [
+        "cpe:2.3:a:mvpthemes:zoxpress:*:*:*:*:*:wordpress:*:*"
      ]
    }
  }
@@ -201,7 +201,11 @@ func (c *Collection) deleteNameFromIndex(p Package) {

 	nameIndex := c.idsByName[p.Name]
 	nameIndex.delete(p.id)
-	c.idsByName[p.Name] = nameIndex
+	if len(nameIndex.slice) == 0 {
+		delete(c.idsByName, p.Name)
+	} else {
+		c.idsByName[p.Name] = nameIndex
+	}
 }

 func (c *Collection) deleteTypeFromIndex(p Package) {
@@ -209,7 +213,11 @@ func (c *Collection) deleteTypeFromIndex(p Package) {

 	typeIndex := c.idsByType[p.Type]
 	typeIndex.delete(p.id)
-	c.idsByType[p.Type] = typeIndex
+	if len(typeIndex.slice) == 0 {
+		delete(c.idsByType, p.Type)
+	} else {
+		c.idsByType[p.Type] = typeIndex
+	}
 }

 func (c *Collection) deletePathsFromIndex(p Package) {
@@ -184,6 +184,24 @@ func TestCatalogDeleteRemovesPackages(t *testing.T) {
 				},
 			},
 		},
+		{
+			name: "delete idsBy key entries when all deleted",
+			pkgs: []Package{
+				{
+					id:      artifact.ID("pkg:deb/debian/1"),
+					Name:    "debian",
+					Version: "1",
+					Type:    DebPkg,
+					Locations: file.NewLocationSet(
+						file.NewVirtualLocation("/c/path", "/another/path1"),
+					),
+				},
+			},
+			deleteIDs: []artifact.ID{
+				artifact.ID("pkg:deb/debian/1"),
+			},
+			expectedIndexes: expectedIndexes{},
+		},
 	}

 	for _, test := range tests {
@@ -26,10 +26,11 @@ import (
 var _ source.Source = (*fileSource)(nil)

 type Config struct {
-	Path             string
-	Exclude          source.ExcludeConfig
-	DigestAlgorithms []crypto.Hash
-	Alias            source.Alias
+	Path               string
+	Exclude            source.ExcludeConfig
+	DigestAlgorithms   []crypto.Hash
+	Alias              source.Alias
+	SkipExtractArchive bool
 }

 type fileSource struct {
@@ -58,7 +59,7 @@ func New(cfg Config) (source.Source, error) {
 		return nil, fmt.Errorf("given path is a directory: %q", cfg.Path)
 	}

-	analysisPath, cleanupFn := fileAnalysisPath(cfg.Path)
+	analysisPath, cleanupFn := fileAnalysisPath(cfg.Path, cfg.SkipExtractArchive)

 	var digests []file.Digest
 	if len(cfg.DigestAlgorithms) > 0 {
@@ -206,9 +207,15 @@ func (s *fileSource) Close() error {

 // fileAnalysisPath returns the path given, or in the case the path is an archive, the location where the archive
 // contents have been made available. A cleanup function is provided for any temp files created (if any).
-func fileAnalysisPath(path string) (string, func() error) {
-	var analysisPath = path
+// Users can disable unpacking archives, allowing individual cataloguers to extract them instead (where
+// supported)
+func fileAnalysisPath(path string, skipExtractArchive bool) (string, func() error) {
 	var cleanupFn = func() error { return nil }
+	var analysisPath = path
+
+	if skipExtractArchive {
+		return analysisPath, cleanupFn
+	}

 	// if the given file is an archive (as indicated by the file extension and not MIME type) then unarchive it and
 	// use the contents as the source. Note: this does NOT recursively unarchive contents, only the given path is
@@ -99,13 +99,14 @@ func TestNewFromFile_WithArchive(t *testing.T) {
 	testutil.Chdir(t, "..") // run with source/test-fixtures

 	testCases := []struct {
-		desc       string
-		input      string
-		expString  string
-		inputPaths []string
-		expRefs    int
-		layer2     bool
-		contents   string
+		desc               string
+		input              string
+		expString          string
+		inputPaths         []string
+		expRefs            int
+		layer2             bool
+		contents           string
+		skipExtractArchive bool
 	}{
 		{
 			desc:       "path detected",
@@ -121,14 +122,25 @@ func TestNewFromFile_WithArchive(t *testing.T) {
 			layer2:     true,
 			contents:   "Another .vimrc file",
 		},
+		{
+			desc:               "skip extract archive",
+			input:              "test-fixtures/path-detected",
+			inputPaths:         []string{"/.vimrc"},
+			expRefs:            0,
+			layer2:             false,
+			skipExtractArchive: true,
+		},
 	}
 	for _, test := range testCases {
 		t.Run(test.desc, func(t *testing.T) {
 			archivePath := setupArchiveTest(t, test.input, test.layer2)

-			src, err := New(Config{
-				Path: archivePath,
-			})
+			cfg := Config{
+				Path:               archivePath,
+				SkipExtractArchive: test.skipExtractArchive,
+			}
+
+			src, err := New(cfg)
 			require.NoError(t, err)
 			t.Cleanup(func() {
 				require.NoError(t, src.Close())
Author	SHA1	Message	Date
anchore-actions-token-generator[bot]andwagoodman	4211d79667	chore(deps): update anchore dependencies (#3827 ) Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: wagoodman <590471+wagoodman@users.noreply.github.com>	2025-04-24 16:03:09 -04:00
VictorHuuandAlex Goodman	9af087d213	fix: Make the fileresolver Support Prefix Match of Files (#3820 ) * fix the dpkg files pattern detection Signed-off-by: Yuntao Hu <victorhu493@gmail.com> * consider slash before the path is concatenated Signed-off-by: Yuntao Hu <victorhu493@gmail.com> * add test Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> --------- Signed-off-by: Yuntao Hu <victorhu493@gmail.com> Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com>	2025-04-24 17:38:05 +00:00
Alex Goodman	5c6c6aa123	Add support for detecting javascript assets in .NET projects using libman (#3825 ) * add support for .NET libman files Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * fix when no libman detected Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * add libman.json docs Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> --------- Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>	2025-04-24 17:11:01 +00:00
anchore-actions-token-generator[bot]andspiffcs	43a85dfb85	chore(deps): update tools to latest versions (#3823 ) Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: spiffcs <32073428+spiffcs@users.noreply.github.com>	2025-04-24 13:08:32 -04:00
Adam McClenaghan	61a3d1784a	(feat): support skipping archive extraction with file source (#3795 ) Signed-off-by: Adam McClenaghan <adam@mcclenaghan.co.uk>	2025-04-24 12:22:36 -04:00
Alex Goodman	df18edf905	Consider DLL claims for dependencies of .NET packages from deps.json (#3822 ) * consider child dll claims for .NET packages from deps.json Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * make dll claim propagation configurable Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> --------- Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>	2025-04-24 11:59:16 -04:00
Alex Goodman	2dd9d583af	PE cataloger should consider compile target paths from deps.json (#3821 ) * fix PE compile path processing Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * fix tests Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * adjust fixture comment Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> --------- Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>	2025-04-24 14:01:53 +01:00
Adam McClenaghan	f6d4a7d27a	Perf: skip license scanner injection (#3796 ) * (perf): allow library users to skip default scanner injection Signed-off-by: Adam McClenaghan <adam@mcclenaghan.co.uk> * (perf): remove prints Signed-off-by: Adam McClenaghan <adam@mcclenaghan.co.uk> * perf: move to cataloging licenses.go Signed-off-by: adammcclenaghan <adam.mcclenaghan@upwind.io> * perf: Simplify to expose a SetContextLicenseScanner func Signed-off-by: adammcclenaghan <adam.mcclenaghan@upwind.io> --------- Signed-off-by: Adam McClenaghan <adam@mcclenaghan.co.uk> Signed-off-by: adammcclenaghan <adam.mcclenaghan@upwind.io>	2025-04-23 16:01:10 -04:00
dependabot[bot]	273d414b6b	chore(deps): bump sigstore/cosign-installer from 3.8.1 to 3.8.2 (#3818 ) Bumps [sigstore/cosign-installer](https://github.com/sigstore/cosign-installer) from 3.8.1 to 3.8.2. - [Release notes](https://github.com/sigstore/cosign-installer/releases) - [Commits](https://github.com/sigstore/cosign-installer/compare/v3.8.1...v3.8.2) --- updated-dependencies: - dependency-name: sigstore/cosign-installer dependency-version: 3.8.2 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2025-04-23 11:27:08 -04:00
dependabot[bot]	0a0c2963f4	chore(deps): bump github/codeql-action from 3.28.15 to 3.28.16 (#3819 ) Bumps [github/codeql-action](https://github.com/github/codeql-action) from 3.28.15 to 3.28.16. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/45775bd8235c68ba998cffa5171334d58593da47...28deaeda66b76a05916b6923827895f2b14ab387) --- updated-dependencies: - dependency-name: github/codeql-action dependency-version: 3.28.16 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2025-04-23 11:25:42 -04:00
anchore-actions-token-generator[bot]andspiffcs	1d7529d01f	chore(deps): update tools to latest versions (#3815 ) Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: spiffcs <32073428+spiffcs@users.noreply.github.com>	2025-04-22 13:10:35 -04:00
Will Murphy	a69f6aec90	docs: document test commands (#3816 ) So that contributors can quickly figure out how to run tests. Signed-off-by: Will Murphy <willmurphyscode@users.noreply.github.com>	2025-04-22 10:23:52 -04:00
Stijn Taelemans	df11561929	Support detection of Chrome binaries (#3136 ) * test: add test cases Signed-off-by: Stijn Taelemans <taelemansst@gmail.com> * feat: add classifier for chrome Signed-off-by: Stijn Taelemans <taelemansst@gmail.com> --------- Signed-off-by: Stijn Taelemans <taelemansst@gmail.com>	2025-04-21 16:37:15 -04:00
VictorHuu	ab570497b0	fix:allow golang tip image detection regex pattern (#3757 ) * Modify the Regex version matcher for golang in the binary classifiers to make it compatible with golang tip images Signed-off-by: Victor Hu <victorhu493@gmail.com> Signed-off-by: Yuntao Hu <victorhu493@gmail.com> * Preliminary fix the regex matching for golang tip image and add the corresponding unit tests Signed-off-by: Yuntao Hu <victorhu493@gmail.com> * consider VERSION.cache when it comes to golang tip images Signed-off-by: Yuntao Hu <victorhu493@gmail.com> * consider VERSION.cache when it comes to golang tip images Signed-off-by: Yuntao Hu <victorhu493@gmail.com> --------- Signed-off-by: Victor Hu <victorhu493@gmail.com> Signed-off-by: Yuntao Hu <victorhu493@gmail.com>	2025-04-21 14:06:52 -04:00
VictorHuuandAlex Goodman	ea7e9e696b	fix:Make the parse of the replace part in ```go.mod``` more compliant and traceable (#3812 ) * We only need to replace the name of a GoLang package when the name is a web link Signed-off-by: Yuntao Hu <victorhu493@gmail.com> * make the detection of a localfile path pattern more easy Signed-off-by: Yuntao Hu <victorhu493@gmail.com> * consider the m.New.Version so the granularity is narrowed Signed-off-by: Yuntao Hu <victorhu493@gmail.com> * to pass the static-analysis Signed-off-by: Yuntao Hu <victorhu493@gmail.com> * to pass the static-analysis Signed-off-by: Yuntao Hu <victorhu493@gmail.com> * add test Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> --------- Signed-off-by: Yuntao Hu <victorhu493@gmail.com> Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com>	2025-04-21 17:58:54 +00:00
Adam McClenaghan	1f15361ecf	(fix): delete collection name/type key entries when empty (#3797 ) Signed-off-by: Adam McClenaghan <adam@mcclenaghan.co.uk>	2025-04-21 13:41:39 -04:00
anchore-actions-token-generator[bot]andwagoodman	0bcf2881c4	chore(deps): update CPE dictionary index (#3813 ) Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: wagoodman <590471+wagoodman@users.noreply.github.com>	2025-04-21 09:59:06 -04:00
anchore-actions-token-generator[bot]andspiffcs	b9ae936731	chore(deps): update tools to latest versions (#3806 ) Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: spiffcs <32073428+spiffcs@users.noreply.github.com>	2025-04-17 12:26:29 -04:00
dependabot[bot]	e452cc7623	chore(deps): bump github.com/go-git/go-git/v5 from 5.15.0 to 5.16.0 (#3807 ) Bumps [github.com/go-git/go-git/v5](https://github.com/go-git/go-git) from 5.15.0 to 5.16.0. - [Release notes](https://github.com/go-git/go-git/releases) - [Commits](https://github.com/go-git/go-git/compare/v5.15.0...v5.16.0) --- updated-dependencies: - dependency-name: github.com/go-git/go-git/v5 dependency-version: 5.16.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2025-04-17 12:26:18 -04:00
Keith Zantow	b13ffdd304	fix: comma separated selectors in cataloger list command (#3804 ) Signed-off-by: Keith Zantow <kzantow@gmail.com>	2025-04-16 10:41:48 -04:00
dependabot[bot]	a5da154327	chore(deps): bump github.com/anchore/stereoscope from 0.1.2 to 0.1.3 (#3803 )	2025-04-15 19:31:45 +00:00
Musang Kim	1866e25f9a	chore: fix conan parser typos (#3802 ) Signed-off-by: Musang <s.musang.kim@gmail.com>	2025-04-15 10:51:02 -04:00
anchore-actions-token-generator[bot]andspiffcs	1e336e3f07	chore(deps): update tools to latest versions (#3798 ) Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: spiffcs <32073428+spiffcs@users.noreply.github.com>	2025-04-14 14:43:53 -04:00
anchore-actions-token-generator[bot]andwagoodman	eee9d0a41e	chore(deps): update CPE dictionary index (#3799 ) Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: wagoodman <590471+wagoodman@users.noreply.github.com>	2025-04-14 14:43:25 -04:00
dependabot[bot]	a5632c0044	chore(deps): bump github.com/mholt/archives from 0.1.0 to 0.1.1 (#3778 ) Bumps [github.com/mholt/archives](https://github.com/mholt/archives) from 0.1.0 to 0.1.1. - [Release notes](https://github.com/mholt/archives/releases) - [Commits](https://github.com/mholt/archives/compare/v0.1.0...v0.1.1) --- updated-dependencies: - dependency-name: github.com/mholt/archives dependency-version: 0.1.1 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2025-04-11 14:50:51 -04:00
dependabot[bot]	2a409488a0	chore(deps): bump marocchino/sticky-pull-request-comment (#3788 ) Bumps [marocchino/sticky-pull-request-comment](https://github.com/marocchino/sticky-pull-request-comment) from 2.9.1 to 2.9.2. - [Release notes](https://github.com/marocchino/sticky-pull-request-comment/releases) - [Commits](https://github.com/marocchino/sticky-pull-request-comment/compare/52423e01640425a022ef5fd42c6fb5f633a02728...67d0dec7b07ed060a405f9b2a64b8ab319fdd7db) --- updated-dependencies: - dependency-name: marocchino/sticky-pull-request-comment dependency-version: 2.9.2 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2025-04-11 12:43:11 -04:00
dependabot[bot]	d145e80c20	chore(deps): bump github.com/magiconair/properties from 1.8.9 to 1.8.10 (#3789 ) Bumps [github.com/magiconair/properties](https://github.com/magiconair/properties) from 1.8.9 to 1.8.10. - [Release notes](https://github.com/magiconair/properties/releases) - [Commits](https://github.com/magiconair/properties/compare/v1.8.9...v1.8.10) --- updated-dependencies: - dependency-name: github.com/magiconair/properties dependency-version: 1.8.10 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2025-04-11 12:42:57 -04:00
dependabot[bot]	05de0d2a1b	chore(deps): bump github.com/charmbracelet/bubbles from 0.20.0 to 0.21.0 (#3790 ) Bumps [github.com/charmbracelet/bubbles](https://github.com/charmbracelet/bubbles) from 0.20.0 to 0.21.0. - [Release notes](https://github.com/charmbracelet/bubbles/releases) - [Changelog](https://github.com/charmbracelet/bubbles/blob/master/.goreleaser.yml) - [Commits](https://github.com/charmbracelet/bubbles/compare/v0.20.0...v0.21.0) --- updated-dependencies: - dependency-name: github.com/charmbracelet/bubbles dependency-version: 0.21.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2025-04-11 12:42:46 -04:00
Alex Goodman	24df095a5e	empty source during decoding should not be fatal (#3791 ) Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>	2025-04-11 10:12:29 -04:00
dependabot[bot]	e7f0a602c2	chore(deps): bump github.com/go-git/go-git/v5 from 5.14.0 to 5.15.0 (#3792 ) Bumps [github.com/go-git/go-git/v5](https://github.com/go-git/go-git) from 5.14.0 to 5.15.0. - [Release notes](https://github.com/go-git/go-git/releases) - [Commits](https://github.com/go-git/go-git/compare/v5.14.0...v5.15.0) --- updated-dependencies: - dependency-name: github.com/go-git/go-git/v5 dependency-version: 5.15.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2025-04-11 10:12:05 -04:00
anchore-actions-token-generator[bot]andspiffcs	e73293cd45	chore(deps): update tools to latest versions (#3785 ) Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: spiffcs <32073428+spiffcs@users.noreply.github.com>	2025-04-08 14:03:29 -04:00
dependabot[bot]	3b3943d2d6	chore(deps): bump github/codeql-action from 3.28.13 to 3.28.15 (#3786 ) Bumps [github/codeql-action](https://github.com/github/codeql-action) from 3.28.13 to 3.28.15. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/1b549b9259bda1cb5ddde3b41741a82a2d15a841...45775bd8235c68ba998cffa5171334d58593da47) --- updated-dependencies: - dependency-name: github/codeql-action dependency-version: 3.28.15 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2025-04-08 14:03:06 -04:00
dependabot[bot]	97228af539	chore(deps): bump golang.org/x/net from 0.38.0 to 0.39.0 (#3787 ) Bumps [golang.org/x/net](https://github.com/golang/net) from 0.38.0 to 0.39.0. - [Commits](https://github.com/golang/net/compare/v0.38.0...v0.39.0) --- updated-dependencies: - dependency-name: golang.org/x/net dependency-version: 0.39.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2025-04-08 14:02:48 -04:00