fix: resolve yarn lock aliases to source package (#4836)

Signed-off-by: cyphercodes <cyphercodes@users.noreply.github.com>

.binny.yaml

@@ -1,8 +1,13 @@
+# only pull in version updates that were released more than a week ago (low-pass filter for quickly-retracted releases)
+cooldown: 7d
+
 tools:
+  ## internal tools ############################################################################
+
   # we want to use a pinned version of binny to manage the toolchain (so binny manages itself!)
   - name: binny
     version:
-      want: v0.11.3
+      want: v0.13.0
     method: github-release
     with:
       repo: anchore/binny
@@ -10,7 +15,7 @@ tools:
   # used to produce SBOMs during release
   - name: syft
     version:
-      want: latest
+      want: v1.42.3
     method: github-release
     with:
       repo: anchore/syft
@@ -18,15 +23,25 @@ tools:
   # used to sign mac binaries at release
   - name: quill
     version:
-      want: v0.5.1
+      want: v0.7.1
     method: github-release
     with:
       repo: anchore/quill
 
+  # used at release to generate the changelog
+  - name: chronicle
+    version:
+      want: v0.8.0
+    method: github-release
+    with:
+      repo: anchore/chronicle
+
+  ## external tools ############################################################################
+
   # used for linting
   - name: golangci-lint
     version:
-      want: v2.11.2
+      want: v2.11.4
     method: github-release
     with:
       repo: golangci/golangci-lint
@@ -58,7 +73,7 @@ tools:
   # used to release all artifacts
   - name: goreleaser
     version:
-      want: v2.14.2
+      want: v2.15.2
     method: github-release
     with:
       repo: goreleaser/goreleaser
@@ -71,14 +86,6 @@ tools:
     with:
       repo: rinchsan/gosimports
 
-  # used at release to generate the changelog
-  - name: chronicle
-    version:
-      want: v0.8.0
-    method: github-release
-    with:
-      repo: anchore/chronicle
-
   # used during static analysis for license compliance
   - name: bouncer
     version:
@@ -98,7 +105,7 @@ tools:
   # used for triggering a release
   - name: gh
     version:
-      want: v2.87.3
+      want: v2.89.0
     method: github-release
     with:
       repo: cli/cli
@@ -106,7 +113,7 @@ tools:
   # used to upload test fixture cache
   - name: oras
     version:
-      want: v1.3.0
+      want: v1.3.1
     method: github-release
     with:
       repo: oras-project/oras
@@ -114,7 +121,7 @@ tools:
   # used to upload test fixture cache
   - name: yq
     version:
-      want: v4.52.4
+      want: v4.52.5
     method: github-release
     with:
       repo: mikefarah/yq

.github/actions/bootstrap/action.yaml

@@ -1,11 +1,10 @@
 name: "Bootstrap"
-
 description: "Bootstrap all tools and dependencies"
 inputs:
   go-version:
     description: "Go version to install"
     required: true
-    default: "1.26.x"
+    default: "1.26.2"
   go-dependencies:
     description: "Download go dependencies"
     required: true
@@ -24,25 +23,22 @@ inputs:
   bootstrap-apt-packages:
     description: "Space delimited list of tools to install via apt"
     default: "libxml2-utils"
-
 runs:
   using: "composite"
   steps:
     # note: go mod and build is automatically cached on default with v4+
-    - uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0
+    - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
       if: inputs.go-version != ''
       with:
         go-version: ${{ inputs.go-version }}
         check-latest: true
-
     - name: Restore tool cache
       if: inputs.tools == 'true'
       id: tool-cache
-      uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
+      uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
       with:
         path: ${{ github.workspace }}/.tool
         key: ${{ inputs.cache-key-prefix }}-${{ runner.os }}-tool-${{ hashFiles('.binny.yaml') }}
-
     - name: Install project tools
       shell: bash
       if: inputs.tools == 'true'
@@ -50,12 +46,10 @@ runs:
         make tools
         .tool/binny list
         .tool/binny check
-
     - name: Install go dependencies
       if: inputs.go-dependencies == 'true'
       shell: bash
       run: make ci-bootstrap-go
-
     - name: Install apt packages
       if: inputs.bootstrap-apt-packages != ''
       shell: bash
@@ -64,14 +58,12 @@ runs:
       run: |
         IFS=' ' read -ra packages <<< "$APT_PACKAGES"
         DEBIAN_FRONTEND=noninteractive sudo apt update && sudo -E apt install -y "${packages[@]}"
-
     - name: Restore ORAS cache from github actions
       if: inputs.download-test-fixture-cache == 'true'
-      uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
+      uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
       with:
         path: ${{ github.workspace }}/.tmp/oras-cache
         key: ${{ inputs.cache-key-prefix }}-oras-cache
-
     - name: Download test fixture cache
       if: inputs.download-test-fixture-cache == 'true'
       shell: bash

.github/dependabot.yml

@@ -23,6 +23,11 @@ updates:
     open-pull-requests-limit: 10
     labels:
       - "dependencies"
+    ignore:
+      - dependency-name: "github.com/aquasecurity/go-pep440-version"
+      - dependency-name: "github.com/aquasecurity/go-version"
+      - dependency-name: "github.com/knqyf263/go-apk-version"
+      - dependency-name: "github.com/knqyf263/go-deb-version"
     groups:
       go-minor-patch:
         applies-to: version-updates  # security updates get individual PRs
@@ -35,7 +40,7 @@ updates:
   - package-ecosystem: "github-actions"
     directories:
       - "/"
-      - "/.github/actions/bootstrap"
+      - "/.github/actions/*"
     cooldown:
       default-days: 7
     schedule:

.github/workflows/codeql-analysis.yml

@@ -1,76 +0,0 @@
-# For most projects, this workflow file will not need changing; you simply need
-# to commit it to your repository.
-#
-# You may wish to alter this file to override the set of languages analyzed,
-# or to provide custom queries or build logic.
-name: "CodeQL Security Scan"
-
-on:
-  push:
-    branches:
-      # only run when there are pushes to the main branch (not on PRs)
-      - main
-
-  schedule:
-    - cron: '0 0 * * 3'
-
-permissions:
-  contents: read
-
-jobs:
-  analyze:
-    name: Analyze
-    runs-on: ubuntu-22.04-4core-16gb
-    if: github.repository == 'anchore/syft' # only run for main repo
-    permissions:
-      security-events: write
-
-    strategy:
-      fail-fast: false
-      matrix:
-        # Override automatic language detection by changing the below list
-        # Supported options are ['csharp', 'cpp', 'go', 'java', 'javascript', 'python']
-        language: ['go', 'python']
-        # Learn more...
-        # https://docs.github.com/en/github/finding-security-vulnerabilities-and-errors-in-your-code/configuring-code-scanning#overriding-automatic-language-detection
-
-    steps:
-    - name: Checkout repository
-      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd #v6.0.2
-      with:
-        persist-credentials: false
-
-    - name: Install Go
-      uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 #v6.3.0
-      with:
-        go-version-file: go.mod
-        check-latest: true
-
-    # Initializes the CodeQL tools for scanning.
-    - name: Initialize CodeQL
-      uses: github/codeql-action/init@9e907b5e64f6b83e7804b09294d44122997950d6 # v4.32.3
-      with:
-        languages: ${{ matrix.language }}
-        # If you wish to specify custom queries, you can do so here or in a config file.
-        # By default, queries listed here will override any specified in a config file. 
-        # Prefix the list here with "+" to use these queries and those in the config file.
-        # queries: ./path/to/local/query, your-org/your-repo/queries@main
-
-    # Autobuild attempts to build any compiled languages  (C/C++, C#, or Java).
-    # If this step fails, then you should remove it and run the build manually (see below)
-    - name: Autobuild
-      uses: github/codeql-action/autobuild@9e907b5e64f6b83e7804b09294d44122997950d6 # v4.32.3
-
-    # ℹ️ Command-line programs to run using the OS shell.
-    # 📚 https://git.io/JvXDl
-
-    # ✏️ If the Autobuild fails above, remove it and uncomment the following three lines
-    #    and modify them (or add more) to build your code if your project
-    #    uses a compiled language
-
-    #- run: |
-    #   make bootstrap
-    #   make release
-
-    - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@9e907b5e64f6b83e7804b09294d44122997950d6 # v4.32.3

.github/workflows/codeql.yaml

@@ -0,0 +1,81 @@
+# CodeQL scans for security vulnerabilities and coding errors across all
+# languages in this repo. Results appear in the "Security" tab under
+# "Code scanning alerts" and are enforced by branch protection rules.
+name: "CodeQL"
+
+on:
+  push:
+    branches: [ "main" ]
+  pull_request:
+    branches: [ "main" ]
+  # Weekly scheduled scan catches newly disclosed vulnerabilities in
+  # existing code, not just changes introduced by PRs.
+  schedule:
+    - cron: '38 11 * * 3'
+
+jobs:
+  analyze:
+    name: Analyze (${{ matrix.language }})
+    runs-on: ubuntu-latest
+    permissions:
+      # Required to upload SARIF results to the "Security" tab.
+      security-events: write
+      # Required to fetch internal or private CodeQL packs.
+      packages: read
+      # Only required for workflows in private repositories.
+      actions: read
+      contents: read
+
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          # GitHub Actions workflow linting — no build needed.
+          - language: actions
+            build-mode: none
+
+          # Go uses "manual" build mode so we control exactly what gets
+          # compiled. The default "autobuild" finds the Makefile and runs
+          # the full CI pipeline (lint, test, snapshot release, etc.),
+          # which is far more work than CodeQL needs. All it requires is
+          # compiled Go source so it can build a type-resolved code graph
+          # for analysis.
+          - language: go
+            build-mode: manual
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+
+        with:
+          persist-credentials: false
+
+      # Pin the Go toolchain to whatever go.mod declares so CodeQL
+      # analyzes with the same version the project actually uses.
+      # Only runs for the Go matrix entry.
+      - name: Setup Go
+        if: matrix.language == 'go'
+        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
+        with:
+          go-version-file: go.mod
+
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@c10b8064de6f491fea524254123dbe5e09572f13 # v4.35.1
+        with:
+          languages: ${{ matrix.language }}
+          build-mode: ${{ matrix.build-mode }}
+
+      # Minimal build for Go: compile all packages so CodeQL gets a full
+      # type-resolved code graph for analysis.
+      - name: Build (Go)
+        if: matrix.build-mode == 'manual'
+        shell: bash
+        run: go build ./...
+
+      - name: Perform CodeQL Analysis
+        uses: github/codeql-action/analyze@c10b8064de6f491fea524254123dbe5e09572f13 # v4.35.1
+        with:
+          # The category tag lets GitHub associate SARIF results with the
+          # correct language when branch protection checks for required
+          # code scanning results.
+          category: "/language:${{matrix.language}}"

.github/workflows/detect-schema-changes.yaml

@@ -1,3 +1,5 @@
+# Note: this workflow has been disabled manually in the UI and will be replaced in short order
+
 name: "Detect schema changes"
 
 on:
@@ -37,6 +39,8 @@ jobs:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd #v6.0.2
         with:
           persist-credentials: false
+          repository: anchore/syft # IMPORTANT! An additional protection that this is checking out code from the expected repository 
+          ref: main # IMPORTANT!  It is CRITICAL that this only ever considers the code from main and NEVER EVER from a fork.
 
       - run: python .github/scripts/labeler.py
         env:
@@ -46,7 +50,7 @@ jobs:
 
       - name: Delete existing comment
         if: ${{ hashFiles( env.CI_COMMENT_FILE ) == '' }}
-        uses: marocchino/sticky-pull-request-comment@773744901bac0e8cbb5a0dc842800d45e9b2b405 #v2.9.4
+        uses: marocchino/sticky-pull-request-comment@d4d6b0936434b21bc8345ad45a440c5f7d2c40ff #v3.0.3
         with:
           header: ${{ env.COMMENT_HEADER }}
           hide: true
@@ -54,7 +58,7 @@ jobs:
 
       - name: Add comment
         if: ${{ hashFiles( env.CI_COMMENT_FILE ) != '' }}
-        uses: marocchino/sticky-pull-request-comment@773744901bac0e8cbb5a0dc842800d45e9b2b405 #v2.9.4
+        uses: marocchino/sticky-pull-request-comment@d4d6b0936434b21bc8345ad45a440c5f7d2c40ff #v3.0.3
         with:
           header: ${{ env.COMMENT_HEADER }}
           path: ${{ env.CI_COMMENT_FILE }}

.github/workflows/release.yaml

@@ -150,13 +150,13 @@ jobs:
         uses: ./.github/actions/bootstrap
 
       - name: Login to Docker Hub
-        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9  #v3.7.0
+        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121  #v4.1.0
         with:
           username: ${{ secrets.ANCHOREOSSWRITE_DH_USERNAME }}
           password: ${{ secrets.ANCHOREOSSWRITE_DH_PAT }}
 
       - name: Login to GitHub Container Registry
-        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9  #v3.7.0
+        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121  #v4.1.0
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
@@ -186,14 +186,14 @@ jobs:
           # for updating brew formula in anchore/homebrew-syft
           GITHUB_BREW_TOKEN: ${{ secrets.ANCHOREOPS_GITHUB_OSS_WRITE_TOKEN }}
 
-      - uses: anchore/sbom-action@17ae1740179002c89186b61233e0f892c3118b11 #v0.23.0
+      - uses: anchore/sbom-action@e22c389904149dbc22b58101806040fa8d37a610 #v0.24.0
         continue-on-error: true
         with:
           file: go.mod
           artifact-name: sbom.spdx.json
 
       - name: Notify Slack of new release
-        uses: slackapi/slack-github-action@91efab103c0de0a537f72a35f6b8cda0ee76bf0a #v2.1.1
+        uses: slackapi/slack-github-action@af78098f536edbc4de71162a307590698245be95 #v3.0.1
         continue-on-error: true
         with:
           webhook: ${{ secrets.SLACK_TOOLBOX_WEBHOOK_URL }}

.github/workflows/test-fixture-cache-publish.yaml

@@ -1,48 +0,0 @@
-name: "Test fixture cache: publish"
-
-on:
-  workflow_dispatch:
-  schedule:
-    # run nightly at 4AM UTC
-    - cron: "0 4 * * *"
-
-permissions:
-  contents: read
-
-jobs:
-
-  Publish:
-    name: "Publish test fixture image cache"
-    # runs-on.com: general purpose instances for building test fixture cache
-    #   spot disabled: can run up to an hour, avoid interruptions
-    #   s3-cache: faster actions cache
-    #   family: note that m*d instances have local nvme storage which is beneficial for building large test fixture images
-    runs-on: "runs-on=${{ github.run_id }}/cpu=8+16/ram=32+64/family=m5d+m5ad+m5dn+m6gd+m6id+m6idn+m7gd+m8gd/spot=false/extras=s3-cache"
-    if: github.repository == 'anchore/syft' # only run for main repo
-    permissions:
-      packages: write
-    steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd #v6.0.2
-        with:
-          persist-credentials: false
-
-      - name: Bootstrap environment
-        uses: ./.github/actions/bootstrap
-        with:
-          # we want to rebuild the cache with no previous state
-          download-test-fixture-cache: false
-
-      - name: Run all tests
-        run: |
-          make test
-        env:
-          # we want to rebuild the cache with no previous state
-          DOWNLOAD_TEST_FIXTURE_CACHE: "false"
-
-      - name: Login to GitHub Container Registry (ORAS)
-        run: echo "${{ secrets.GITHUB_TOKEN }}" | .tool/oras login ghcr.io -u "$ACTOR" --password-stdin
-        env:
-          ACTOR: ${{ github.actor }}
-
-      - name: Publish test fixture cache
-        run: make upload-test-fixture-cache

.github/workflows/update-anchore-dependencies.yml

@@ -1,51 +0,0 @@
-name: PR to update Anchore dependencies
-on:
-  workflow_dispatch:
-    inputs:
-      repos:
-        description: "List of dependencies to update"
-        required: true
-        type: string
-
-permissions:
-  contents: read
-
-jobs:
-  update:
-    runs-on: ubuntu-latest
-    if: github.repository_owner == 'anchore' # only run for main repo (not forks)
-    steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd #v6.0.2
-        with:
-          persist-credentials: false
-
-      - name: Bootstrap environment
-        uses: ./.github/actions/bootstrap
-        with:
-          tools: false
-          bootstrap-apt-packages: ""
-
-      - name: Update dependencies
-        id: update
-        uses: anchore/workflows/.github/actions/update-go-dependencies@main
-        with:
-          repos: ${{ github.event.inputs.repos }}
-
-      - uses: actions/create-github-app-token@29824e69f54612133e76f7eaac726eef6c875baf #v2.2.1
-        id: generate-token
-        with:
-          app-id: ${{ secrets.TOKEN_APP_ID }}
-          private-key: ${{ secrets.TOKEN_APP_PRIVATE_KEY }}
-
-      - uses: peter-evans/create-pull-request@c0f553fe549906ede9cf27b5156039d195d2ece0 #v8.1.0
-        with:
-          signoff: true
-          delete-branch: true
-          draft: ${{ steps.update.outputs.draft }}
-          # do not change this branch, as other workflows depend on it
-          branch: auto/integration
-          labels: dependencies,pre-release
-          commit-message: "chore(deps): update anchore dependencies"
-          title: "chore(deps): update anchore dependencies"
-          body: ${{ steps.update.outputs.summary }}
-          token: ${{ steps.generate-token.outputs.token }}

.github/workflows/update-bootstrap-tools.yml

@@ -1,67 +0,0 @@
-name: PR for latest versions of tools
-on:
-  schedule:
-    - cron: "0 8 * * *" # 3 AM EST
-
-  workflow_dispatch:
-
-permissions:
-  contents: read
-
-jobs:
-  update-bootstrap-tools:
-    runs-on: ubuntu-latest
-    if: github.repository == 'anchore/syft' # only run for main repo
-    steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd #v6.0.2
-        with:
-          persist-credentials: false
-
-      - name: Bootstrap environment
-        uses: ./.github/actions/bootstrap
-        with:
-          bootstrap-apt-packages: ""
-          go-dependencies: false
-
-      - name: "Update tool versions"
-        id: latest-versions
-        run: |
-          make update-tools
-          make list-tools
-          
-          export NO_COLOR=1
-          delimiter="$(openssl rand -hex 8)"
-          
-          {
-            echo "status<<${delimiter}"
-            make list-tool-updates
-            echo "${delimiter}"
-          } >> $GITHUB_OUTPUT
-          
-          {
-            echo "### Tool version status"
-            echo "\`\`\`"
-            make list-tool-updates
-            echo "\`\`\`"
-          } >> $GITHUB_STEP_SUMMARY
-
-      - uses: actions/create-github-app-token@29824e69f54612133e76f7eaac726eef6c875baf #v2.2.1
-        id: generate-token
-        with:
-          app-id: ${{ secrets.TOKEN_APP_ID }}
-          private-key: ${{ secrets.TOKEN_APP_PRIVATE_KEY }}
-
-      - uses: peter-evans/create-pull-request@c0f553fe549906ede9cf27b5156039d195d2ece0 #v8.1.0
-        with:
-          signoff: true
-          delete-branch: true
-          branch: auto/latest-tools
-          labels: dependencies
-          commit-message: 'chore(deps): update tools to latest versions'
-          title: 'chore(deps): update tools to latest versions'
-          body: |
-            ```
-            ${{ steps.latest-versions.outputs.status }}
-            ```
-            This is an auto-generated pull request to update all of the tools to the latest versions.
-          token: ${{ steps.generate-token.outputs.token }}

.github/workflows/update-cpe-dictionary-index.yml

@@ -1,84 +0,0 @@
-name: PR to update CPE dictionary index
-on:
-  schedule:
-    - cron: "0 1 * * 1" # every monday at 1 AM
-
-  workflow_dispatch:
-
-permissions:
-  contents: read
-
-env:
-  SLACK_NOTIFICATIONS: true
-
-jobs:
-  upgrade-cpe-dictionary-index:
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-      packages: write
-    if: github.repository == 'anchore/syft' # only run for main repo
-    steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd #v6.0.2
-        with:
-          persist-credentials: false
-
-      - name: Bootstrap environment
-        uses: ./.github/actions/bootstrap
-        id: bootstrap
-
-      - name: Login to GitHub Container Registry
-        run: echo "${{ secrets.GITHUB_TOKEN }}" | .tool/oras login ghcr.io -u "$ACTOR" --password-stdin
-        env:
-          ACTOR: ${{ github.actor }}
-
-      - name: Pull CPE cache from registry
-        run: make generate:cpe-index:cache:pull
-
-      - name: Update CPE cache from NVD API
-        run: make generate:cpe-index:cache:update
-        env:
-          NVD_API_KEY: ${{ secrets.NVD_API_KEY }}
-
-      - name: Generate CPE dictionary index
-        run: make generate:cpe-index:build
-
-      - name: Push updated CPE cache to registry
-        run: make generate:cpe-index:cache:push
-
-      - uses: actions/create-github-app-token@29824e69f54612133e76f7eaac726eef6c875baf #v2.2.1
-        id: generate-token
-        with:
-          app-id: ${{ secrets.TOKEN_APP_ID }}
-          private-key: ${{ secrets.TOKEN_APP_PRIVATE_KEY }}
-
-      - uses: peter-evans/create-pull-request@c0f553fe549906ede9cf27b5156039d195d2ece0 #v8.1.0
-        with:
-          signoff: true
-          delete-branch: true
-          branch: auto/latest-cpe-dictionary-index
-          labels: dependencies
-          commit-message: "chore(deps): update CPE dictionary index"
-          title: "chore(deps): update CPE dictionary index"
-          body: |
-            Update CPE dictionary index based on the latest available CPE dictionary
-          token: ${{ steps.generate-token.outputs.token }}
-
-      - name: Notify Slack on failure
-        uses: slackapi/slack-github-action@91efab103c0de0a537f72a35f6b8cda0ee76bf0a #v2.1.1
-        with:
-          webhook: ${{ secrets.SLACK_TOOLBOX_WEBHOOK_URL }}
-          webhook-type: incoming-webhook
-          payload: |
-            text: "Syft CPE dictionary index update failed"
-            blocks:
-              - type: section
-                text:
-                  type: mrkdwn
-                  text: |
-                    *Syft CPE dictionary index update failed*
-                    • Workflow: `${{ github.workflow }}`
-                    • Event: `${{ github.event_name }}`
-                    • Job Status: `${{ job.status }}`
-                    • <${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}|View Run>
-        if: ${{ failure() && env.SLACK_NOTIFICATIONS == 'true' }}

.github/workflows/update-spdx-license-list.yaml

@@ -1,64 +0,0 @@
-name: PR to update SPDX license list
-on:
-  schedule:
-    - cron: "0 6 * * 1" # every monday at 6 AM UTC
-
-  workflow_dispatch:
-
-permissions:
-  contents: read
-
-env:
-  SLACK_NOTIFICATIONS: true
-
-jobs:
-  upgrade-spdx-license-list:
-    runs-on: ubuntu-latest
-    if: github.repository == 'anchore/syft' # only run for main repo
-    steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd #v6.0.2
-        with:
-          persist-credentials: false
-
-      - name: Bootstrap environment
-        uses: ./.github/actions/bootstrap
-
-      - run: |
-          make generate-license-list
-
-      - uses: tibdex/github-app-token@3beb63f4bd073e61482598c45c71c1019b59b73a #v2.1.0
-        id: generate-token
-        with:
-          app_id: ${{ secrets.TOKEN_APP_ID }}
-          private_key: ${{ secrets.TOKEN_APP_PRIVATE_KEY }}
-
-      - uses: peter-evans/create-pull-request@c0f553fe549906ede9cf27b5156039d195d2ece0 #v8.1.0
-        with:
-          signoff: true
-          delete-branch: true
-          branch: auto/latest-spdx-license-list
-          labels: dependencies
-          commit-message: "chore(deps): update SPDX license list"
-          title: "chore(deps): update SPDX license list"
-          body: |
-            Update SPDX license list based on the latest available list from spdx.org
-          token: ${{ steps.generate-token.outputs.token }}
-
-      - name: Notify Slack on failure
-        uses: slackapi/slack-github-action@91efab103c0de0a537f72a35f6b8cda0ee76bf0a #v2.1.1
-        with:
-          webhook: ${{ secrets.SLACK_TOOLBOX_WEBHOOK_URL }}
-          webhook-type: incoming-webhook
-          payload: |
-            text: "Syft SPDX license list update failed"
-            blocks:
-              - type: section
-                text:
-                  type: mrkdwn
-                  text: |
-                    *Syft SPDX license list update failed*
-                    • Workflow: `${{ github.workflow }}`
-                    • Event: `${{ github.event_name }}`
-                    • Job Status: `${{ job.status }}`
-                    • <${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}|View Run>
-        if: ${{ failure() && env.SLACK_NOTIFICATIONS == 'true' }}

.github/workflows/validate-github-actions.yaml

@@ -1,10 +1,8 @@
 name: "Validate GitHub Actions"
 
 on:
+  workflow_dispatch:
   pull_request:
-    paths:
-      - '.github/workflows/**'
-      - '.github/actions/**'
   push:
     branches:
       - main
@@ -28,9 +26,8 @@ jobs:
           persist-credentials: false
 
       - name: "Run zizmor"
-        uses: zizmorcore/zizmor-action@0dce2577a4760a2749d8cfb7a84b7d5585ebcb7d # v0.5.0
+        uses: zizmorcore/zizmor-action@71321a20a9ded102f6e9ce5718a2fcec2c4f70d8 # v0.5.2
         with:
-          config: .github/zizmor.yml
-          # Disable SARIF upload so the step is a simple pass/fail gate
-          advanced-security: false
+          # there is a pass/fail gate as a repo ruleset (if there is no ruleset configured then the action will pass by default)
+          advanced-security: true
           inputs: .github

.github/workflows/validations.yaml

@@ -91,7 +91,7 @@ jobs:
     runs-on: "runs-on=${{ github.run_id }}/cpu=16+32/ram=32+128/family=c5+c6+c7+c8/spot=false/extras=s3-cache+tmpfs"
     steps:
       # required for magic-cache from runs-on to function with artifact upload/download (see https://runs-on.com/caching/magic-cache/#actionsupload-artifact-compatibility)
-      - uses: runs-on/action@cd2b598b0515d39d78c38a02d529db87d2196d1e  # v2.0.3
+      - uses: runs-on/action@742bf56072eb4845a0f94b3394673e4903c90ff0  # v2.1.0
 
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd #v6.0.2
         with:
@@ -109,7 +109,7 @@ jobs:
         run: make snapshot-smoke-test
 
       - name: Upload snapshot artifacts
-        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f #v7.0.0
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a #v7.0.1
         with:
           name: snapshot
           path: snapshot/
@@ -122,7 +122,7 @@ jobs:
     runs-on: *test-runner
     steps:
       # required for magic-cache from runs-on to function with artifact upload/download (see https://runs-on.com/caching/magic-cache/#actionsupload-artifact-compatibility)
-      - uses: runs-on/action@cd2b598b0515d39d78c38a02d529db87d2196d1e  # v2.0.3
+      - uses: runs-on/action@742bf56072eb4845a0f94b3394673e4903c90ff0  # v2.1.0
 
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd #v6.0.2
         with:
@@ -134,7 +134,7 @@ jobs:
           download-test-fixture-cache: true
 
       - name: Download snapshot artifacts
-        uses: actions/download-artifact@70fc10c6e5e1ce46ad2ea6f2b72d43f7d47b13c3 #v8.0.0
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c #v8.0.1
         with:
           name: snapshot
           path: snapshot
@@ -164,7 +164,7 @@ jobs:
     runs-on: macos-latest
     steps:
       - name: Install Cosign
-        uses: sigstore/cosign-installer@faadad0cce49287aee09b3a48701e75088a2c6ad # v4.0.0
+        uses: sigstore/cosign-installer@cad07c2e89fa2edd6e2d7bab4c1aa38e53f76003 # v4.1.1
 
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd #v6.0.2
         with:
@@ -178,7 +178,7 @@ jobs:
           download-test-fixture-cache: true
 
       - name: Download snapshot artifacts
-        uses: actions/download-artifact@70fc10c6e5e1ce46ad2ea6f2b72d43f7d47b13c3 #v8.0.0
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c #v8.0.1
         with:
           name: snapshot
           path: snapshot
@@ -199,7 +199,7 @@ jobs:
     runs-on: *test-runner
     steps:
       # required for magic-cache from runs-on to function with artifact upload/download (see https://runs-on.com/caching/magic-cache/#actionsupload-artifact-compatibility)
-      - uses: runs-on/action@cd2b598b0515d39d78c38a02d529db87d2196d1e  # v2.0.3
+      - uses: runs-on/action@742bf56072eb4845a0f94b3394673e4903c90ff0  # v2.1.0
 
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd #v6.0.2
         with:
@@ -211,7 +211,7 @@ jobs:
           download-test-fixture-cache: true
 
       - name: Download snapshot artifacts
-        uses: actions/download-artifact@70fc10c6e5e1ce46ad2ea6f2b72d43f7d47b13c3 #v8.0.0
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c #v8.0.1
         with:
           name: snapshot
           path: snapshot

.goreleaser.yaml

@@ -14,7 +14,7 @@ builds:
     dir: ./cmd/syft
     binary: syft
     goos: [linux]
-    goarch: [amd64, arm64, ppc64le, s390x]
+    goarch: [amd64, arm64, ppc64le, riscv64, s390x]
     mod_timestamp: &build-timestamp '{{ .CommitTimestamp }}'
     ldflags: &build-ldflags |
       -w
@@ -114,6 +114,20 @@ dockers:
       - "--build-arg=VCS_REF={{.FullCommit}}"
       - "--build-arg=VCS_URL={{.GitURL}}"
 
+  - image_templates:
+      - anchore/syft:{{.Tag}}-riscv64
+      - ghcr.io/anchore/syft:{{.Tag}}-riscv64
+    goarch: riscv64
+    dockerfile: Dockerfile
+    use: buildx
+    build_flag_templates:
+      - "--platform=linux/riscv64"
+      - "--build-arg=DEBIAN_VERSION=13"
+      - "--build-arg=BUILD_DATE={{.Date}}"
+      - "--build-arg=BUILD_VERSION={{.Version}}"
+      - "--build-arg=VCS_REF={{.FullCommit}}"
+      - "--build-arg=VCS_URL={{.GitURL}}"
+
   - image_templates:
       - anchore/syft:{{.Tag}}-s390x
       - ghcr.io/anchore/syft:{{.Tag}}-s390x
@@ -167,6 +181,20 @@ dockers:
       - "--build-arg=VCS_REF={{.FullCommit}}"
       - "--build-arg=VCS_URL={{.GitURL}}"
 
+  - image_templates:
+      - anchore/syft:{{.Tag}}-nonroot-riscv64
+      - ghcr.io/anchore/syft:{{.Tag}}-nonroot-riscv64
+    goarch: riscv64
+    dockerfile: Dockerfile.nonroot
+    use: buildx
+    build_flag_templates:
+      - "--platform=linux/riscv64"
+      - "--build-arg=DEBIAN_VERSION=13"
+      - "--build-arg=BUILD_DATE={{.Date}}"
+      - "--build-arg=BUILD_VERSION={{.Version}}"
+      - "--build-arg=VCS_REF={{.FullCommit}}"
+      - "--build-arg=VCS_URL={{.GitURL}}"
+
   - image_templates:
       - anchore/syft:{{.Tag}}-nonroot-s390x
       - ghcr.io/anchore/syft:{{.Tag}}-nonroot-s390x
@@ -220,6 +248,20 @@ dockers:
       - "--build-arg=VCS_REF={{.FullCommit}}"
       - "--build-arg=VCS_URL={{.GitURL}}"
 
+  - image_templates:
+      - anchore/syft:{{.Tag}}-debug-riscv64
+      - ghcr.io/anchore/syft:{{.Tag}}-debug-riscv64
+    goarch: riscv64
+    dockerfile: Dockerfile.debug
+    use: buildx
+    build_flag_templates:
+      - "--platform=linux/riscv64"
+      - "--build-arg=DEBIAN_VERSION=13"
+      - "--build-arg=BUILD_DATE={{.Date}}"
+      - "--build-arg=BUILD_VERSION={{.Version}}"
+      - "--build-arg=VCS_REF={{.FullCommit}}"
+      - "--build-arg=VCS_URL={{.GitURL}}"
+
   - image_templates:
       - anchore/syft:{{.Tag}}-debug-s390x
       - ghcr.io/anchore/syft:{{.Tag}}-debug-s390x
@@ -239,6 +281,7 @@ docker_manifests:
       - anchore/syft:{{.Tag}}-amd64
       - anchore/syft:{{.Tag}}-arm64v8
       - anchore/syft:{{.Tag}}-ppc64le
+      - anchore/syft:{{.Tag}}-riscv64
       - anchore/syft:{{.Tag}}-s390x
 
   - name_template: ghcr.io/anchore/syft:latest
@@ -246,6 +289,7 @@ docker_manifests:
       - ghcr.io/anchore/syft:{{.Tag}}-amd64
       - ghcr.io/anchore/syft:{{.Tag}}-arm64v8
       - ghcr.io/anchore/syft:{{.Tag}}-ppc64le
+      - ghcr.io/anchore/syft:{{.Tag}}-riscv64
       - ghcr.io/anchore/syft:{{.Tag}}-s390x
 
   - name_template: anchore/syft:{{.Tag}}
@@ -253,6 +297,7 @@ docker_manifests:
       - anchore/syft:{{.Tag}}-amd64
       - anchore/syft:{{.Tag}}-arm64v8
       - anchore/syft:{{.Tag}}-ppc64le
+      - anchore/syft:{{.Tag}}-riscv64
       - anchore/syft:{{.Tag}}-s390x
 
   - name_template: ghcr.io/anchore/syft:{{.Tag}}
@@ -260,6 +305,7 @@ docker_manifests:
       - ghcr.io/anchore/syft:{{.Tag}}-amd64
       - ghcr.io/anchore/syft:{{.Tag}}-arm64v8
       - ghcr.io/anchore/syft:{{.Tag}}-ppc64le
+      - ghcr.io/anchore/syft:{{.Tag}}-riscv64
       - ghcr.io/anchore/syft:{{.Tag}}-s390x
 
   # nonroot images...
@@ -268,6 +314,7 @@ docker_manifests:
       - anchore/syft:{{.Tag}}-nonroot-amd64
       - anchore/syft:{{.Tag}}-nonroot-arm64v8
       - anchore/syft:{{.Tag}}-nonroot-ppc64le
+      - anchore/syft:{{.Tag}}-nonroot-riscv64
       - anchore/syft:{{.Tag}}-nonroot-s390x
 
   - name_template: ghcr.io/anchore/syft:nonroot
@@ -275,6 +322,7 @@ docker_manifests:
       - ghcr.io/anchore/syft:{{.Tag}}-nonroot-amd64
       - ghcr.io/anchore/syft:{{.Tag}}-nonroot-arm64v8
       - ghcr.io/anchore/syft:{{.Tag}}-nonroot-ppc64le
+      - ghcr.io/anchore/syft:{{.Tag}}-nonroot-riscv64
       - ghcr.io/anchore/syft:{{.Tag}}-nonroot-s390x
 
   - name_template: anchore/syft:{{.Tag}}-nonroot
@@ -282,6 +330,7 @@ docker_manifests:
       - anchore/syft:{{.Tag}}-nonroot-amd64
       - anchore/syft:{{.Tag}}-nonroot-arm64v8
       - anchore/syft:{{.Tag}}-nonroot-ppc64le
+      - anchore/syft:{{.Tag}}-nonroot-riscv64
       - anchore/syft:{{.Tag}}-nonroot-s390x
 
   - name_template: ghcr.io/anchore/syft:{{.Tag}}-nonroot
@@ -289,6 +338,7 @@ docker_manifests:
       - ghcr.io/anchore/syft:{{.Tag}}-nonroot-amd64
       - ghcr.io/anchore/syft:{{.Tag}}-nonroot-arm64v8
       - ghcr.io/anchore/syft:{{.Tag}}-nonroot-ppc64le
+      - ghcr.io/anchore/syft:{{.Tag}}-nonroot-riscv64
       - ghcr.io/anchore/syft:{{.Tag}}-nonroot-s390x
 
   # debug images...
@@ -297,6 +347,7 @@ docker_manifests:
       - anchore/syft:{{.Tag}}-debug-amd64
       - anchore/syft:{{.Tag}}-debug-arm64v8
       - anchore/syft:{{.Tag}}-debug-ppc64le
+      - anchore/syft:{{.Tag}}-debug-riscv64
       - anchore/syft:{{.Tag}}-debug-s390x
 
   - name_template: ghcr.io/anchore/syft:debug
@@ -304,6 +355,7 @@ docker_manifests:
       - ghcr.io/anchore/syft:{{.Tag}}-debug-amd64
       - ghcr.io/anchore/syft:{{.Tag}}-debug-arm64v8
       - ghcr.io/anchore/syft:{{.Tag}}-debug-ppc64le
+      - ghcr.io/anchore/syft:{{.Tag}}-debug-riscv64
       - ghcr.io/anchore/syft:{{.Tag}}-debug-s390x
 
   - name_template: anchore/syft:{{.Tag}}-debug
@@ -311,6 +363,7 @@ docker_manifests:
       - anchore/syft:{{.Tag}}-debug-amd64
       - anchore/syft:{{.Tag}}-debug-arm64v8
       - anchore/syft:{{.Tag}}-debug-ppc64le
+      - anchore/syft:{{.Tag}}-debug-riscv64
       - anchore/syft:{{.Tag}}-debug-s390x
 
   - name_template: ghcr.io/anchore/syft:{{.Tag}}-debug
@@ -318,6 +371,7 @@ docker_manifests:
       - ghcr.io/anchore/syft:{{.Tag}}-debug-amd64
       - ghcr.io/anchore/syft:{{.Tag}}-debug-arm64v8
       - ghcr.io/anchore/syft:{{.Tag}}-debug-ppc64le
+      - ghcr.io/anchore/syft:{{.Tag}}-debug-riscv64
       - ghcr.io/anchore/syft:{{.Tag}}-debug-s390x
 
 sboms:

Dockerfile

@@ -1,4 +1,5 @@
-FROM gcr.io/distroless/static-debian12:latest AS build
+ARG DEBIAN_VERSION=12
+FROM gcr.io/distroless/static-debian${DEBIAN_VERSION}:latest AS build
 
 FROM scratch
 # needed for version check HTTPS request

Dockerfile.debug

@@ -1,4 +1,5 @@
-FROM gcr.io/distroless/static-debian12:debug-nonroot
+ARG DEBIAN_VERSION=12
+FROM gcr.io/distroless/static-debian${DEBIAN_VERSION}:debug-nonroot
 
 # create the /tmp dir, which is needed for image content cache
 WORKDIR /tmp

Dockerfile.nonroot

@@ -1,4 +1,5 @@
-FROM gcr.io/distroless/static-debian12:nonroot
+ARG DEBIAN_VERSION=12
+FROM gcr.io/distroless/static-debian${DEBIAN_VERSION}:nonroot
 
 # create the /tmp dir, which is needed for image content cache
 WORKDIR /tmp

SECURITY.md

@@ -14,3 +14,23 @@ affected versions, and, if known, mitigations for the issue.
 All support will be made on a best effort basis, so please indicate the "urgency level" of the vulnerability as Critical, High, Medium or Low.
 
 For more details, see our [security policy documentation](https://oss.anchore.com/docs/contributing/security/).
+
+## Trust Boundary
+
+Syft is a tool to scan content and product an SBOM. Syft is not a tool designed to scan malicious content. Detecting and properly reporting on purposely malicious artifacts is outside the scope of Syft's expected operating environment.
+
+There are many possible ways for malicious content to cause Syft to become confused or fail to include results in an SBOM. We do not consider this to be a security vulnerability.
+
+**Examples**
+- Removing or altering a package lock file
+- Removing or altering an RPM or DEB database
+- A malicious archive that Syft will skip but the runtime may not
+- Self modifying systems that change state when running
+
+We consider the security trust boundary for Syft to be anything that causes problems for the overall system running Syft, or Syft operating in a way that is dangerous to itself, the system, or the operator.
+
+**Examples**
+- Filling up temp space permanently
+- Syft executing arbitrary code when scanning an artifact
+- Syft leaking secrets from the environment or configuration files into logs or SBOMs
+- Syft operating outside of the expected artifact or directory (directory traversal)

Taskfile.yaml

@@ -10,7 +10,8 @@ vars:
 
   # v1: when fixtures were located at test-fixtures dirs
   # v2: migration to testdata dirs
-  CACHE_IMAGE: ghcr.io/{{ .OWNER }}/{{ .PROJECT }}/test-fixture-cache:v2
+  CACHE_REPO: oss-cache
+  CACHE_IMAGE: ghcr.io/{{ .OWNER }}/{{ .CACHE_REPO }}/syft-test-fixture-cache:v2
 
   # static file dirs
   TOOL_DIR: .tool
@@ -424,7 +425,7 @@ tasks:
       done
       oras_command+=" {{ .CACHE_PATHS_FILE }}"
 
-      oras_command+=" --annotation org.opencontainers.image.source=https://github.com/{{ .OWNER }}/{{ .PROJECT }}"
+      oras_command+=" --annotation org.opencontainers.image.source=https://github.com/{{ .OWNER }}/{{ .CACHE_REPO }}"
       oras_command+=" --annotation fingerprint=$(cat {{ .CACHE_PATHS_FILE }} | {{ .YQ }} -r '.digest')"
 
       echo "Executing: $oras_command"

cmd/syft/internal/commands/attest.go

@@ -59,7 +59,7 @@ func Attest(app clio.Application) *cobra.Command {
 		Use:   "attest --output [FORMAT] <IMAGE>",
 		Short: "Generate an SBOM as an attestation for the given [SOURCE] container image",
 		Long:  "Generate a packaged-based Software Bill Of Materials (SBOM) from a container image as the predicate of an in-toto attestation that will be uploaded to the image registry",
-		Example: internal.Tprintf(attestHelp, map[string]interface{}{
+		Example: internal.Tprintf(attestHelp, map[string]any{
 			"appName": id.Name,
 			"command": "attest",
 		}),

cmd/syft/internal/commands/cataloger_info.go

@@ -5,6 +5,7 @@ import (
 	"encoding/json"
 	"fmt"
 	"os"
+	"slices"
 	"sort"
 	"strings"
 
@@ -248,12 +249,7 @@ func renderCatalogerInfoJSON(doc *capabilities.Document, catalogers []capabiliti
 
 // isDeprecatedCataloger checks if a cataloger is deprecated based on its selectors
 func isDeprecatedCataloger(selectors []string) bool {
-	for _, selector := range selectors {
-		if selector == "deprecated" {
-			return true
-		}
-	}
-	return false
+	return slices.Contains(selectors, "deprecated")
 }
 
 // convertDetectorPackages converts detector package info to the JSON output format
@@ -452,7 +448,7 @@ func extractArrayCapability(caps capabilities.CapabilitySet, name string) string
 				if len(v) > 0 {
 					return strings.Join(v, ", ")
 				}
-			case []interface{}:
+			case []any:
 				if len(v) > 0 {
 					strs := make([]string, 0, len(v))
 					for _, item := range v {
@@ -475,7 +471,7 @@ func extractNodesCapability(caps capabilities.CapabilitySet) string {
 			switch v := cap.Default.(type) {
 			case []string:
 				return formatDepthStringArray(v)
-			case []interface{}:
+			case []any:
 				return formatDepthInterfaceArray(v)
 			}
 			return noStyle.Render("·")
@@ -496,7 +492,7 @@ func formatDepthStringArray(v []string) string {
 }
 
 // formatDepthInterfaceArray formats a []interface{} dependency depth value
-func formatDepthInterfaceArray(v []interface{}) string {
+func formatDepthInterfaceArray(v []any) string {
 	if len(v) == 0 {
 		return noStyle.Render("·")
 	}

cmd/syft/internal/commands/convert.go

@@ -40,7 +40,7 @@ func Convert(app clio.Application) *cobra.Command {
 		Use:   "convert [SOURCE-SBOM] -o [FORMAT]",
 		Short: "Convert between SBOM formats",
 		Long:  "[Experimental] Convert SBOM files to, and from, SPDX, CycloneDX and Syft's format. For more info about data loss between formats see https://github.com/anchore/syft/wiki/format-conversion",
-		Example: internal.Tprintf(convertExample, map[string]interface{}{
+		Example: internal.Tprintf(convertExample, map[string]any{
 			"appName": id.Name,
 			"command": "convert",
 		}),

cmd/syft/internal/commands/packages.go

@@ -18,7 +18,7 @@ func Packages(app clio.Application, scanCmd *cobra.Command) *cobra.Command {
 		Short: scanCmd.Short,
 		Long:  scanCmd.Long,
 		Args:  scanCmd.Args,
-		Example: internal.Tprintf(scanHelp, map[string]interface{}{
+		Example: internal.Tprintf(scanHelp, map[string]any{
 			"appName": id.Name,
 			"command": "packages",
 		}),

cmd/syft/internal/commands/packages_test.go

@@ -29,7 +29,7 @@ func Test_filterExpressionErrors_expressionErrorsHelp(t *testing.T) {
 		{
 			name: "single non-expression error is retained",
 			err:  errors.New("foo"),
-			wantErr: func(t assert.TestingT, err error, i ...interface{}) bool {
+			wantErr: func(t assert.TestingT, err error, i ...any) bool {
 				return assert.Equal(t, "foo", err.Error())
 			},
 			wantHelp: "",
@@ -42,7 +42,7 @@ func Test_filterExpressionErrors_expressionErrorsHelp(t *testing.T) {
 				err = multierror.Append(err, errors.New("bar"))
 				return err
 			}(),
-			wantErr: func(t assert.TestingT, err error, i ...interface{}) bool {
+			wantErr: func(t assert.TestingT, err error, i ...any) bool {
 				// note: this is the default formatting from the hashicorp multierror object
 				expected := `2 errors occurred:
 	* foo
@@ -64,7 +64,7 @@ func Test_filterExpressionErrors_expressionErrorsHelp(t *testing.T) {
 				err = multierror.Append(err, errors.New("last"))
 				return err
 			}(),
-			wantErr: func(t assert.TestingT, err error, i ...interface{}) bool {
+			wantErr: func(t assert.TestingT, err error, i ...any) bool {
 				expected := `5 errors occurred:
 	* foo
 	* invalid expression: "foo": tags are not allowed with this operation (must use exact names)
@@ -103,7 +103,7 @@ func Test_filterExpressionErrors_expressionErrorsHelp(t *testing.T) {
 
 				return fmt.Errorf("top: %w", fmt.Errorf("middle: %w", err))
 			}(),
-			wantErr: func(t assert.TestingT, err error, i ...interface{}) bool {
+			wantErr: func(t assert.TestingT, err error, i ...any) bool {
 				expected := `top: middle: 4 errors occurred:
 	* foo: bar: last
 	* invalid expression: "foo": tags are not allowed with this operation (must use exact names)
@@ -142,7 +142,7 @@ func Test_filterExpressionErrors_expressionErrorsHelp(t *testing.T) {
 				// note we wrap the top error in a chain
 				return fmt.Errorf("top: %w", fmt.Errorf("middle: %w", err))
 			}(),
-			wantErr: func(t assert.TestingT, err error, i ...interface{}) bool {
+			wantErr: func(t assert.TestingT, err error, i ...any) bool {
 				expected := `top: middle: 4 errors occurred:
 	* foo: bar: last
 	* invalid expression: "foo": tags are not allowed with this operation (must use exact names)
@@ -178,7 +178,7 @@ func Test_filterExpressionErrors_expressionErrorsHelp(t *testing.T) {
 
 				return err
 			}(),
-			wantErr: func(t assert.TestingT, err error, i ...interface{}) bool {
+			wantErr: func(t assert.TestingT, err error, i ...any) bool {
 				// note: the errors are removed and the help text shows the enriched error help
 				expected := `2 errors occurred:
 	* invalid expression: "foo": tags are not allowed with this operation (must use exact names)

cmd/syft/internal/commands/scan.go

@@ -92,7 +92,7 @@ func Scan(app clio.Application) *cobra.Command {
 		Use:   "scan [SOURCE]",
 		Short: "Generate an SBOM",
 		Long:  "Generate a packaged-based Software Bill Of Materials (SBOM) from container images and filesystems",
-		Example: internal.Tprintf(scanHelp, map[string]interface{}{
+		Example: internal.Tprintf(scanHelp, map[string]any{
 			"appName": id.Name,
 			"command": "scan",
 		}),

cmd/syft/internal/commands/scan_test.go

@@ -60,7 +60,7 @@ func Test_scanOptions_validateLegacyOptionsNotUsed(t *testing.T) {
 }
 
 func assertErrorContains(contains string) assert.ErrorAssertionFunc {
-	return func(t assert.TestingT, err error, i ...interface{}) bool {
+	return func(t assert.TestingT, err error, i ...any) bool {
 		return assert.ErrorContains(t, err, contains, i...)
 	}
 }

cmd/syft/internal/commands/update.go

@@ -107,7 +107,7 @@ func fetchLatestApplicationVersion(id clio.Identification) (*hashiVersion.Versio
 		return nil, fmt.Errorf("HTTP %d on fetching latest version: %s", resp.StatusCode, resp.Status)
 	}
 
-	versionBytes, err := io.ReadAll(resp.Body)
+	versionBytes, err := io.ReadAll(io.LimitReader(resp.Body, 500))
 	if err != nil {
 		return nil, fmt.Errorf("failed to read latest version: %w", err)
 	}

cmd/syft/internal/options/catalog.go

@@ -2,6 +2,7 @@ package options
 
 import (
 	"fmt"
+	"slices"
 	"sort"
 	"strings"
 
@@ -313,10 +314,8 @@ func enrichmentEnabled(enrichDirectives []string, features ...string) *bool {
 				directive = directive[1:]
 				enable = false
 			}
-			for _, feature := range features {
-				if directive == feature {
-					return &enable
-				}
+			if slices.Contains(features, directive) {
+				return &enable
 			}
 		}
 		return nil

cmd/syft/internal/options/writer_test.go

@@ -32,7 +32,7 @@ func Test_MakeSBOMWriter(t *testing.T) {
 		{
 			name:    "unknown format",
 			outputs: []string{"unknown"},
-			wantErr: func(t assert.TestingT, err error, bla ...interface{}) bool {
+			wantErr: func(t assert.TestingT, err error, bla ...any) bool {
 				return assert.ErrorContains(t, err, `unsupported output format "unknown", supported formats are:`)
 			},
 		},

cmd/syft/internal/test/integration/catalog_packages_test.go

@@ -2,6 +2,7 @@ package integration
 
 import (
 	"context"
+	"slices"
 	"strings"
 	"testing"
 
@@ -194,11 +195,8 @@ func assertPackages(t *testing.T, sbom sbom.SBOM, test testCase, observedLanguag
 		}
 
 		var foundLang bool
-		for _, lang := range strings.Split(test.pkgLanguage.String(), ",") {
-			if actualPkg.Language.String() == lang {
-				foundLang = true
-				break
-			}
+		if slices.Contains(strings.Split(test.pkgLanguage.String(), ","), actualPkg.Language.String()) {
+			foundLang = true
 		}
 		if !foundLang {
 			t.Errorf("bad language (pkg=%+v): %+v", actualPkg.Name, actualPkg.Language)

cmd/syft/internal/test/integration/package_cataloger_convention_test.go

@@ -329,7 +329,7 @@ func packageCatalogerExports(t *testing.T) map[string]exportTokenSet {
 					}
 					exportsPerPackage[pkg].Add(exportToken{
 						Name:            decl.Name.Name,
-						Type:            reflect.TypeOf(decl.Type).String(),
+						Type:            reflect.TypeFor[*ast.FuncType]().String(),
 						SignatureSize:   len(decl.Type.Params.List),
 						ReturnTypeNames: returnTypes,
 					})

cmd/syft/internal/ui/log_writer_test.go

@@ -36,33 +36,33 @@ func Test_logWriter(t *testing.T) {
 
 type bufferLogger struct{ values []any }
 
-func (l *bufferLogger) Tracef(_ string, _ ...interface{}) {}
+func (l *bufferLogger) Tracef(_ string, _ ...any) {}
 
-func (l *bufferLogger) Debugf(_ string, _ ...interface{}) {}
+func (l *bufferLogger) Debugf(_ string, _ ...any) {}
 
-func (l *bufferLogger) Infof(_ string, _ ...interface{}) {}
+func (l *bufferLogger) Infof(_ string, _ ...any) {}
 
-func (l *bufferLogger) Warnf(_ string, _ ...interface{}) {}
+func (l *bufferLogger) Warnf(_ string, _ ...any) {}
 
-func (l *bufferLogger) Errorf(_ string, _ ...interface{}) {}
+func (l *bufferLogger) Errorf(_ string, _ ...any) {}
 
-func (l *bufferLogger) Trace(vals ...interface{}) {
+func (l *bufferLogger) Trace(vals ...any) {
 	l.values = append(l.values, vals...)
 }
 
-func (l *bufferLogger) Debug(_ ...interface{}) {}
+func (l *bufferLogger) Debug(_ ...any) {}
 
-func (l *bufferLogger) Info(_ ...interface{}) {}
+func (l *bufferLogger) Info(_ ...any) {}
 
-func (l *bufferLogger) Warn(vals ...interface{}) {
+func (l *bufferLogger) Warn(vals ...any) {
 	l.values = append(l.values, vals...)
 }
 
-func (l *bufferLogger) Error(_ ...interface{}) {}
+func (l *bufferLogger) Error(_ ...any) {}
 
-func (l *bufferLogger) WithFields(_ ...interface{}) logger.MessageLogger { return l }
+func (l *bufferLogger) WithFields(_ ...any) logger.MessageLogger { return l }
 
-func (l *bufferLogger) Nested(_ ...interface{}) logger.Logger { return l }
+func (l *bufferLogger) Nested(_ ...any) logger.Logger { return l }
 
 func (l *bufferLogger) SetOutput(_ io.Writer) {}
 

examples/create_custom_sbom/alpine_configuration_cataloger.go

@@ -94,7 +94,7 @@ func getVersion(resolver file.Resolver) (string, []file.Location, error) {
 	}
 	defer internal.CloseAndLogError(reader, locations[0].RealPath)
 
-	version, err := io.ReadAll(reader)
+	version, err := io.ReadAll(reader) //nolint:gocritic // example code
 	if err != nil {
 		return "", nil, fmt.Errorf("unable to read alpine version: %w", err)
 	}
@@ -117,7 +117,7 @@ func getAPKKeys(resolver file.Resolver) (map[string]string, []file.Location, err
 		if err != nil {
 			return nil, nil, fmt.Errorf("unable to resolve file contents by location at %s: %w", location.RealPath, err)
 		}
-		content, err := io.ReadAll(reader)
+		content, err := io.ReadAll(reader) //nolint:gocritic // example code
 		if err != nil {
 			return nil, nil, fmt.Errorf("unable to read apk key content at %s: %w", location.RealPath, err)
 		}

go.mod

@@ -1,6 +1,6 @@
 module github.com/anchore/syft
 
-go 1.25.6
+go 1.25.8
 
 require (
 	github.com/BurntSushi/toml v1.6.0
@@ -11,22 +11,24 @@ require (
 	github.com/acarl005/stripansi v0.0.0-20180116102854-5a71ef0e047d
 	github.com/acobaugh/osrelease v0.1.0
 	github.com/adrg/xdg v0.5.3
-	github.com/anchore/bubbly v0.0.0-20231115134915-def0aba654a9
-	github.com/anchore/clio v0.0.0-20250319180342-2cfe4b0cb716
-	github.com/anchore/fangs v0.0.0-20250319222917-446a1e748ec2
-	github.com/anchore/go-collections v0.0.0-20251016125210-a3c352120e8c
-	github.com/anchore/go-homedir v0.0.0-20250319154043-c29668562e4d
-	github.com/anchore/go-logger v0.0.0-20250318195838-07ae343dd722
-	github.com/anchore/go-macholibre v0.0.0-20220308212642-53e6d0aaf6fb
-	github.com/anchore/go-rpmdb v0.0.0-20250516171929-f77691e1faec
-	github.com/anchore/go-sync v0.0.0-20250326131806-4eda43a485b6
+	github.com/anchore/bubbly v0.2.0
+	github.com/anchore/clio v0.1.0
+	github.com/anchore/fangs v0.1.0
+	github.com/anchore/go-collections v0.1.0
+	github.com/anchore/go-homedir v0.1.0
+	github.com/anchore/go-logger v0.1.0
+	github.com/anchore/go-macholibre v0.1.0
+	github.com/anchore/go-rpmdb v0.1.0
+	github.com/anchore/go-sync v0.1.0
 	github.com/anchore/go-version v1.2.2-0.20200701162849-18adb9c92b9b
-	github.com/anchore/packageurl-go v0.1.1-0.20250220190351-d62adb6e1115
-	github.com/anchore/stereoscope v0.1.21
+	github.com/anchore/packageurl-go v0.2.0
+	github.com/anchore/stereoscope v0.1.23
+	github.com/anmitsu/go-shlex v0.0.0-20200514113438-38f4b401e2be
 	github.com/aquasecurity/go-pep440-version v0.0.1
 	github.com/bitnami/go-version v0.0.0-20250131085805-b1f57a8634ef
 	github.com/blakesmith/ar v0.0.0-20190502131153-809d4375e1fb
 	github.com/bmatcuk/doublestar/v4 v4.10.0
+	github.com/cespare/xxhash/v2 v2.3.0
 	github.com/charmbracelet/bubbles v1.0.0
 	github.com/charmbracelet/bubbletea v1.3.10
 	github.com/charmbracelet/lipgloss v1.1.0
@@ -38,19 +40,21 @@ require (
 	github.com/elliotchance/phpserialize v1.4.0
 	github.com/facebookincubator/nvdtools v0.1.5
 	github.com/github/go-spdx/v2 v2.4.0
-	github.com/gkampitakis/go-snaps v0.5.20
+	github.com/gkampitakis/go-snaps v0.5.21
 	github.com/go-git/go-billy/v5 v5.8.0
-	github.com/go-git/go-git/v5 v5.17.0
+	github.com/go-git/go-git/v5 v5.18.0
 	github.com/go-test/deep v1.1.1
 	github.com/go-viper/mapstructure/v2 v2.5.0
+	github.com/goccy/go-yaml v1.19.2
 	github.com/gohugoio/hashstructure v0.6.0
 	github.com/google/go-cmp v0.7.0
-	github.com/google/go-containerregistry v0.21.1
+	github.com/google/go-containerregistry v0.21.5
 	github.com/google/licensecheck v0.3.1
 	github.com/google/uuid v1.6.0
 	github.com/gookit/color v1.6.0
+	github.com/gpustack/gguf-parser-go v0.24.0
 	github.com/hashicorp/go-cleanhttp v0.5.2
-	github.com/hashicorp/go-getter v1.8.4
+	github.com/hashicorp/go-getter v1.8.6
 	github.com/hashicorp/go-multierror v1.1.1
 	github.com/hashicorp/hcl/v2 v2.24.0
 	github.com/iancoleman/strcase v0.3.0
@@ -62,7 +66,7 @@ require (
 	github.com/mholt/archives v0.1.5
 	github.com/moby/sys/mountinfo v0.7.2
 	github.com/nix-community/go-nix v0.0.0-20250101154619-4bdde671e0a1
-	github.com/olekukonko/tablewriter v1.1.3
+	github.com/olekukonko/tablewriter v1.1.4
 	github.com/opencontainers/go-digest v1.0.0
 	github.com/pelletier/go-toml v1.9.5
 	github.com/quasilyte/go-ruleguard/dsl v0.3.23
@@ -78,72 +82,111 @@ require (
 	github.com/spf13/afero v1.15.0
 	github.com/spf13/cobra v1.10.2
 	github.com/stretchr/testify v1.11.1
+	github.com/ulikunitz/xz v0.5.15
 	github.com/vbatts/go-mtree v0.7.0
 	github.com/vifraa/gopom v1.0.0
 	github.com/wagoodman/go-partybus v0.0.0-20230516145632-8ccac152c651
 	github.com/wagoodman/go-progress v0.0.0-20260303201901-10176f79b2c0
+	github.com/wk8/go-ordered-map/v2 v2.1.8
 	github.com/xeipuuv/gojsonschema v1.2.0
 	github.com/zyedidia/generic v1.2.2-0.20230320175451-4410d2372cb1
 	go.uber.org/goleak v1.3.0
 	go.yaml.in/yaml/v3 v3.0.4
 	golang.org/x/exp v0.0.0-20251023183803-a4bb9ffd2546
-	golang.org/x/mod v0.33.0
-	golang.org/x/net v0.51.0
-	modernc.org/sqlite v1.46.1
+	golang.org/x/mod v0.35.0
+	golang.org/x/net v0.53.0
+	golang.org/x/time v0.15.0
+	golang.org/x/tools v0.44.0
+	gopkg.in/yaml.v3 v3.0.1
+	modernc.org/sqlite v1.46.2
 )
 
 require (
+	cel.dev/expr v0.25.1 // indirect
 	cloud.google.com/go v0.123.0 // indirect
-	cloud.google.com/go/auth v0.17.0 // indirect
+	cloud.google.com/go/auth v0.18.2 // indirect
 	cloud.google.com/go/auth/oauth2adapt v0.2.8 // indirect
 	cloud.google.com/go/compute/metadata v0.9.0 // indirect
 	cloud.google.com/go/iam v1.5.3 // indirect
-	cloud.google.com/go/storage v1.58.0 // indirect
+	cloud.google.com/go/monitoring v1.24.3 // indirect
+	cloud.google.com/go/storage v1.61.3 // indirect
+	cyphar.com/go-pathrs v0.2.1 // indirect
 	dario.cat/mergo v1.0.2 // indirect
 	github.com/DataDog/zstd v1.5.5 // indirect
+	github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp v1.30.0 // indirect
+	github.com/GoogleCloudPlatform/opentelemetry-operations-go/exporter/metric v0.55.0 // indirect
+	github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/resourcemapping v0.55.0 // indirect
 	github.com/Masterminds/goutils v1.1.1 // indirect
 	github.com/Microsoft/go-winio v0.6.2 // indirect
 	github.com/Microsoft/hcsshim v0.14.0-rc.1 // indirect
-	github.com/ProtonMail/go-crypto v1.3.0 // indirect
+	github.com/ProtonMail/go-crypto v1.4.0 // indirect
 	github.com/STARRY-S/zip v0.2.3 // indirect
-	github.com/agext/levenshtein v1.2.1 // indirect; indirectt
+	github.com/agext/levenshtein v1.2.1 // indirect
 	github.com/anchore/go-lzo v0.1.0 // indirect
 	github.com/anchore/go-struct-converter v0.1.0 // indirect
 	github.com/andybalholm/brotli v1.2.0 // indirect
 	github.com/apparentlymart/go-textseg/v15 v15.0.0 // indirect
 	github.com/aquasecurity/go-version v0.0.1 // indirect
 	github.com/atotto/clipboard v0.1.4 // indirect
+	github.com/aws/aws-sdk-go-v2 v1.41.5 // indirect
+	github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.8 // indirect
+	github.com/aws/aws-sdk-go-v2/config v1.32.12 // indirect
+	github.com/aws/aws-sdk-go-v2/credentials v1.19.12 // indirect
+	github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.20 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.21 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.21 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/ini v1.8.6 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.22 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.7 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.9.13 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.21 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.19.21 // indirect
+	github.com/aws/aws-sdk-go-v2/service/s3 v1.97.3 // indirect
+	github.com/aws/aws-sdk-go-v2/service/signin v1.0.8 // indirect
+	github.com/aws/aws-sdk-go-v2/service/sso v1.30.13 // indirect
+	github.com/aws/aws-sdk-go-v2/service/ssooidc v1.35.17 // indirect
+	github.com/aws/aws-sdk-go-v2/service/sts v1.41.9 // indirect
+	github.com/aws/smithy-go v1.24.2 // indirect
 	github.com/aymanbagabas/go-osc52/v2 v2.0.1 // indirect
+	github.com/bahlo/generic-list-go v0.2.0 // indirect
 	github.com/becheran/wildmatch-go v1.0.0 // indirect
 	github.com/bgentry/go-netrc v0.0.0-20140422174119-9fd32a8b3d3d // indirect
 	github.com/bodgit/plumbing v1.3.0 // indirect
 	github.com/bodgit/sevenzip v1.6.1 // indirect
 	github.com/bodgit/windows v1.0.1 // indirect
+	github.com/buger/jsonparser v1.1.2 // indirect
 	github.com/charmbracelet/colorprofile v0.4.1 // indirect
 	github.com/charmbracelet/harmonica v0.2.0 // indirect
 	github.com/charmbracelet/x/ansi v0.11.6 // indirect
 	github.com/charmbracelet/x/cellbuf v0.0.15 // indirect
 	github.com/charmbracelet/x/term v0.2.2 // indirect
+	github.com/clipperhouse/displaywidth v0.10.0 // indirect
+	github.com/clipperhouse/uax29/v2 v2.6.0 // indirect
 	github.com/cloudflare/circl v1.6.3 // indirect
+	github.com/cncf/xds/go v0.0.0-20251210132809-ee656c7534f5 // indirect
+	github.com/containerd/cgroups/v3 v3.1.2 // indirect
 	github.com/containerd/containerd/api v1.10.0 // indirect
+	github.com/containerd/containerd/v2 v2.2.2 // indirect
 	github.com/containerd/continuity v0.4.5 // indirect
 	github.com/containerd/errdefs v1.0.0 // indirect
 	github.com/containerd/errdefs/pkg v0.3.0 // indirect
 	github.com/containerd/fifo v1.1.0 // indirect
 	github.com/containerd/log v0.1.0 // indirect
-	github.com/containerd/platforms v1.0.0-rc.2 // indirect
+	github.com/containerd/platforms v1.0.0-rc.4 // indirect
+	github.com/containerd/plugin v1.0.0 // indirect
 	github.com/containerd/stargz-snapshotter/estargz v0.18.2 // indirect
 	github.com/containerd/ttrpc v1.2.7 // indirect
 	github.com/containerd/typeurl/v2 v2.2.3 // indirect
 	github.com/cyphar/filepath-securejoin v0.6.0 // indirect
 	github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
-	github.com/docker/cli v29.2.1+incompatible // indirect
-	github.com/docker/distribution v2.8.3+incompatible // indirect
+	github.com/docker/cli v29.4.0+incompatible // indirect
 	github.com/docker/docker-credential-helpers v0.9.5 // indirect
 	github.com/docker/go-connections v0.6.0 // indirect
 	github.com/docker/go-units v0.5.0 // indirect
 	github.com/dsnet/compress v0.0.2-0.20230904184137-39efe44ab707 // indirect
 	github.com/emirpasic/gods v1.18.1 // indirect
+	github.com/envoyproxy/go-control-plane/envoy v1.36.0 // indirect
+	github.com/envoyproxy/protoc-gen-validate v1.3.0 // indirect
 	github.com/erikgeiser/coninput v0.0.0-20211004153227-1c3628e74d0f // indirect
 	github.com/fatih/color v1.18.0 // indirect
 	github.com/felixge/fgprof v0.9.5 // indirect
@@ -152,28 +195,32 @@ require (
 	github.com/gabriel-vasile/mimetype v1.4.13 // indirect
 	github.com/gkampitakis/ciinfo v0.3.2 // indirect
 	github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376 // indirect
+	github.com/go-jose/go-jose/v4 v4.1.4 // indirect
 	github.com/go-logr/logr v1.4.3 // indirect
 	github.com/go-logr/stdr v1.2.2 // indirect
 	github.com/go-restruct/restruct v1.2.0-alpha // indirect
-	github.com/goccy/go-yaml v1.19.2
 	github.com/gogo/protobuf v1.3.2 // indirect
 	github.com/golang/groupcache v0.0.0-20241129210726-2c02b8208cf8 // indirect
 	github.com/google/pprof v0.0.0-20250317173921-a4b03ec1a45e // indirect
 	github.com/google/s2a-go v0.1.9 // indirect
-	github.com/googleapis/enterprise-certificate-proxy v0.3.7 // indirect
-	github.com/googleapis/gax-go/v2 v2.15.0 // indirect
+	github.com/googleapis/enterprise-certificate-proxy v0.3.14 // indirect
+	github.com/googleapis/gax-go/v2 v2.17.0 // indirect
+	github.com/hashicorp/aws-sdk-go-base/v2 v2.0.0-beta.72 // indirect
 	github.com/hashicorp/errwrap v1.1.0 // indirect
 	github.com/hashicorp/go-version v1.8.0 // indirect
 	github.com/hashicorp/golang-lru/v2 v2.0.7 // indirect
+	github.com/henvic/httpretty v0.1.4 // indirect
 	github.com/huandu/xstrings v1.5.0 // indirect
 	github.com/inconshreveable/mousetrap v1.1.0 // indirect
 	github.com/jbenet/go-context v0.0.0-20150711004518-d14ea06fba99 // indirect
+	github.com/json-iterator/go v1.1.12 // indirect
 	github.com/kevinburke/ssh_config v1.2.0 // indirect
-	github.com/klauspost/compress v1.18.4 // indirect
+	github.com/klauspost/compress v1.18.5 // indirect
 	github.com/klauspost/pgzip v1.2.6 // indirect
 	github.com/kr/pretty v0.3.1 // indirect
 	github.com/kr/text v0.2.0 // indirect
 	github.com/lucasb-eyer/go-colorful v1.3.0 // indirect
+	github.com/mailru/easyjson v0.7.7 // indirect
 	github.com/maruel/natural v1.1.1 // indirect
 	github.com/mattn/go-colorable v0.1.14 // indirect
 	github.com/mattn/go-isatty v0.0.20 // indirect
@@ -188,14 +235,22 @@ require (
 	github.com/mitchellh/reflectwalk v1.0.2 // indirect
 	github.com/moby/docker-image-spec v1.3.1 // indirect
 	github.com/moby/locker v1.0.1 // indirect
+	github.com/moby/moby/api v1.54.1 // indirect
+	github.com/moby/moby/client v0.4.0 // indirect
 	github.com/moby/sys/sequential v0.6.0 // indirect
 	github.com/moby/sys/signal v0.7.1 // indirect
 	github.com/moby/sys/user v0.4.0 // indirect
 	github.com/moby/sys/userns v0.1.0 // indirect
+	github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
+	github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee // indirect
 	github.com/muesli/ansi v0.0.0-20230316100256-276c6243b2f6 // indirect
 	github.com/muesli/cancelreader v0.2.2 // indirect
 	github.com/muesli/termenv v0.16.0 // indirect
 	github.com/ncruces/go-strftime v1.0.0 // indirect
+	github.com/nwaples/rardecode/v2 v2.2.0 // indirect
+	github.com/olekukonko/cat v0.0.0-20250911104152-50322a0618f6 // indirect
+	github.com/olekukonko/errors v1.2.0 // indirect
+	github.com/olekukonko/ll v0.1.6 // indirect
 	github.com/opencontainers/image-spec v1.1.1 // indirect
 	github.com/opencontainers/runtime-spec v1.3.0 // indirect
 	github.com/opencontainers/selinux v1.13.1 // indirect
@@ -206,30 +261,32 @@ require (
 	github.com/pkg/errors v0.9.1 // indirect
 	github.com/pkg/profile v1.7.0 // indirect
 	github.com/pkg/xattr v0.4.9 // indirect
+	github.com/planetscale/vtprotobuf v0.6.1-0.20240319094008-0393e58bdf10 // indirect
 	github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
 	github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec // indirect
 	github.com/rivo/uniseg v0.4.7 // indirect
 	github.com/rogpeppe/go-internal v1.14.1 // indirect
-	github.com/sagikazarmark/locafero v0.7.0 // indirect
+	github.com/sagikazarmark/locafero v0.11.0 // indirect
 	github.com/sahilm/fuzzy v0.1.1 // indirect
 	github.com/shopspring/decimal v1.4.0 // indirect
 	github.com/sirupsen/logrus v1.9.4 // indirect
 	github.com/skeema/knownhosts v1.3.1 // indirect
+	github.com/smallnest/ringbuffer v0.0.0-20241116012123-461381446e3d // indirect
 	github.com/sorairolake/lzip-go v0.3.8 // indirect
-	github.com/sourcegraph/conc v0.3.0 // indirect
-	github.com/spf13/cast v1.7.1 // indirect
+	github.com/sourcegraph/conc v0.3.1-0.20240121214520-5f936abd7ae8 // indirect
+	github.com/spf13/cast v1.10.0 // indirect
 	github.com/spf13/pflag v1.0.10 // indirect
-	github.com/spf13/viper v1.20.0 // indirect
+	github.com/spf13/viper v1.21.0 // indirect
+	github.com/spiffe/go-spiffe/v2 v2.6.0 // indirect
 	github.com/stretchr/objx v0.5.2 // indirect
 	github.com/subosito/gotenv v1.6.0 // indirect
-	github.com/sylabs/sif/v2 v2.23.0 // indirect
+	github.com/sylabs/sif/v2 v2.24.0 // indirect
 	github.com/sylabs/squashfs v1.0.6 // indirect
 	github.com/therootcompany/xz v1.0.1 // indirect
 	github.com/tidwall/gjson v1.18.0 // indirect
 	github.com/tidwall/match v1.1.1 // indirect
 	github.com/tidwall/pretty v1.2.1 // indirect
 	github.com/tidwall/sjson v1.2.5 // indirect
-	github.com/ulikunitz/xz v0.5.15
 	github.com/vbatts/tar-split v0.12.2 // indirect
 	github.com/xanzy/ssh-agent v0.3.3 // indirect
 	github.com/xeipuuv/gojsonpointer v0.0.0-20190905194746-02993c407bfb // indirect
@@ -239,103 +296,35 @@ require (
 	github.com/zclconf/go-cty v1.16.3 // indirect
 	go.opencensus.io v0.24.0 // indirect
 	go.opentelemetry.io/auto/sdk v1.2.1 // indirect
+	go.opentelemetry.io/contrib/detectors/gcp v1.39.0 // indirect
 	go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.63.0 // indirect
 	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.61.0 // indirect
-	go.opentelemetry.io/otel v1.40.0 // indirect
-	go.opentelemetry.io/otel/metric v1.40.0 // indirect
-	go.opentelemetry.io/otel/trace v1.40.0 // indirect
-	go.uber.org/atomic v1.9.0 // indirect
-	go.uber.org/multierr v1.9.0 // indirect
+	go.opentelemetry.io/otel v1.43.0 // indirect
+	go.opentelemetry.io/otel/metric v1.43.0 // indirect
+	go.opentelemetry.io/otel/sdk v1.43.0 // indirect
+	go.opentelemetry.io/otel/sdk/metric v1.43.0 // indirect
+	go.opentelemetry.io/otel/trace v1.43.0 // indirect
 	go4.org v0.0.0-20230225012048-214862532bf5 // indirect
-	golang.org/x/crypto v0.48.0 // indirect
-	golang.org/x/oauth2 v0.35.0 // indirect
-	golang.org/x/sync v0.19.0 // indirect
-	golang.org/x/sys v0.41.0 // indirect
-	golang.org/x/term v0.40.0 // indirect
-	golang.org/x/text v0.34.0 // indirect
-	golang.org/x/time v0.14.0
-	golang.org/x/tools v0.42.0
+	golang.org/x/crypto v0.50.0 // indirect
+	golang.org/x/oauth2 v0.36.0 // indirect
+	golang.org/x/sync v0.20.0 // indirect
+	golang.org/x/sys v0.43.0 // indirect
+	golang.org/x/term v0.42.0 // indirect
+	golang.org/x/text v0.36.0 // indirect
 	golang.org/x/xerrors v0.0.0-20231012003039-104605ab7028 // indirect
-	google.golang.org/api v0.256.0 // indirect
-	google.golang.org/genproto v0.0.0-20250922171735-9219d122eba9 // indirect
-	google.golang.org/genproto/googleapis/api v0.0.0-20251111163417-95abcf5c77ba // indirect
-	google.golang.org/genproto/googleapis/rpc v0.0.0-20251111163417-95abcf5c77ba // indirect
-	google.golang.org/grpc v1.76.0 // indirect
+	gonum.org/v1/gonum v0.16.0 // indirect
+	google.golang.org/api v0.271.0 // indirect
+	google.golang.org/genproto v0.0.0-20260128011058-8636f8732409 // indirect
+	google.golang.org/genproto/googleapis/api v0.0.0-20260203192932-546029d2fa20 // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20260226221140-a57be14db171 // indirect
+	google.golang.org/grpc v1.79.3 // indirect
 	google.golang.org/protobuf v1.36.11 // indirect
 	gopkg.in/warnings.v0 v0.1.2 // indirect
-	gopkg.in/yaml.v3 v3.0.1
-	modernc.org/libc v1.67.6 // indirect
+	modernc.org/libc v1.70.0 // indirect
 	modernc.org/mathutil v1.7.1 // indirect
 	modernc.org/memory v1.11.0 // indirect
 )
 
-require (
-	github.com/anmitsu/go-shlex v0.0.0-20200514113438-38f4b401e2be
-	github.com/cespare/xxhash/v2 v2.3.0
-	github.com/gpustack/gguf-parser-go v0.24.0
-	github.com/wk8/go-ordered-map/v2 v2.1.8
-)
-
-require (
-	cel.dev/expr v0.24.0 // indirect
-	cloud.google.com/go/monitoring v1.24.2 // indirect
-	cyphar.com/go-pathrs v0.2.1 // indirect
-	github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp v1.29.0 // indirect
-	github.com/GoogleCloudPlatform/opentelemetry-operations-go/exporter/metric v0.54.0 // indirect
-	github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/resourcemapping v0.54.0 // indirect
-	github.com/aws/aws-sdk-go-v2 v1.41.2 // indirect
-	github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.4 // indirect
-	github.com/aws/aws-sdk-go-v2/config v1.32.10 // indirect
-	github.com/aws/aws-sdk-go-v2/credentials v1.19.10 // indirect
-	github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.18 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.18 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.18 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/ini v1.8.4 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.16 // indirect
-	github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.5 // indirect
-	github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.9.7 // indirect
-	github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.18 // indirect
-	github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.19.16 // indirect
-	github.com/aws/aws-sdk-go-v2/service/s3 v1.95.0 // indirect
-	github.com/aws/aws-sdk-go-v2/service/signin v1.0.6 // indirect
-	github.com/aws/aws-sdk-go-v2/service/sso v1.30.11 // indirect
-	github.com/aws/aws-sdk-go-v2/service/ssooidc v1.35.15 // indirect
-	github.com/aws/aws-sdk-go-v2/service/sts v1.41.7 // indirect
-	github.com/aws/smithy-go v1.24.1 // indirect
-	github.com/bahlo/generic-list-go v0.2.0 // indirect
-	github.com/buger/jsonparser v1.1.1 // indirect
-	github.com/clipperhouse/displaywidth v0.9.0 // indirect
-	github.com/clipperhouse/stringish v0.1.1 // indirect
-	github.com/clipperhouse/uax29/v2 v2.5.0 // indirect
-	github.com/cncf/xds/go v0.0.0-20250501225837-2ac532fd4443 // indirect
-	github.com/containerd/cgroups/v3 v3.1.2 // indirect
-	github.com/containerd/containerd/v2 v2.2.1 // indirect
-	github.com/containerd/plugin v1.0.0 // indirect
-	github.com/envoyproxy/go-control-plane/envoy v1.32.4 // indirect
-	github.com/envoyproxy/protoc-gen-validate v1.2.1 // indirect
-	github.com/go-jose/go-jose/v4 v4.1.2 // indirect
-	github.com/hashicorp/aws-sdk-go-base/v2 v2.0.0-beta.70 // indirect
-	github.com/henvic/httpretty v0.1.4 // indirect
-	github.com/json-iterator/go v1.1.12 // indirect
-	github.com/mailru/easyjson v0.7.7 // indirect
-	github.com/moby/moby/api v1.53.0 // indirect
-	github.com/moby/moby/client v0.2.2 // indirect
-	github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
-	github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee // indirect
-	github.com/nwaples/rardecode/v2 v2.2.0 // indirect
-	github.com/olekukonko/cat v0.0.0-20250911104152-50322a0618f6 // indirect
-	github.com/olekukonko/errors v1.1.0 // indirect
-	github.com/olekukonko/ll v0.1.4-0.20260115111900-9e59c2286df0 // indirect
-	github.com/planetscale/vtprotobuf v0.6.1-0.20240319094008-0393e58bdf10 // indirect
-	github.com/smallnest/ringbuffer v0.0.0-20241116012123-461381446e3d // indirect
-	github.com/spiffe/go-spiffe/v2 v2.5.0 // indirect
-	github.com/zeebo/errs v1.4.0 // indirect
-	go.opentelemetry.io/contrib/detectors/gcp v1.36.0 // indirect
-	go.opentelemetry.io/otel/sdk v1.40.0 // indirect
-	go.opentelemetry.io/otel/sdk/metric v1.40.0 // indirect
-	gonum.org/v1/gonum v0.16.0 // indirect
-)
-
 retract (
 	v1.25.0 // published with a replace directive (confusing for API users)
 	v0.53.2

go.sum

@@ -1,5 +1,5 @@
-cel.dev/expr v0.24.0 h1:56OvJKSH3hDGL0ml5uSxZmz3/3Pq4tJ+fb1unVLAFcY=
-cel.dev/expr v0.24.0/go.mod h1:hLPLo1W4QUmuYdA72RBX06QTs6MXw941piREPl3Yfiw=
+cel.dev/expr v0.25.1 h1:1KrZg61W6TWSxuNZ37Xy49ps13NUovb66QLprthtwi4=
+cel.dev/expr v0.25.1/go.mod h1:hrXvqGP6G6gyx8UAHSHJ5RGk//1Oj5nXQ2NI02Nrsg4=
 cloud.google.com/go v0.26.0/go.mod h1:aQUYkXzVsufM+DwF1aE+0xfcU+56JwCaLick0ClmMTw=
 cloud.google.com/go v0.34.0/go.mod h1:aQUYkXzVsufM+DwF1aE+0xfcU+56JwCaLick0ClmMTw=
 cloud.google.com/go v0.38.0/go.mod h1:990N+gfupTy94rShfmMCWGDn0LpTmnzTp2qbd1dvSRU=
@@ -31,8 +31,8 @@ cloud.google.com/go v0.98.0/go.mod h1:ua6Ush4NALrHk5QXDWnjvZHN93OuF0HfuEPq9I1X0c
 cloud.google.com/go v0.99.0/go.mod h1:w0Xx2nLzqWJPuozYQX+hFfCSI8WioryfRDzkoI/Y2ZA=
 cloud.google.com/go v0.123.0 h1:2NAUJwPR47q+E35uaJeYoNhuNEM9kM8SjgRgdeOJUSE=
 cloud.google.com/go v0.123.0/go.mod h1:xBoMV08QcqUGuPW65Qfm1o9Y4zKZBpGS+7bImXLTAZU=
-cloud.google.com/go/auth v0.17.0 h1:74yCm7hCj2rUyyAocqnFzsAYXgJhrG26XCFimrc/Kz4=
-cloud.google.com/go/auth v0.17.0/go.mod h1:6wv/t5/6rOPAX4fJiRjKkJCvswLwdet7G8+UGXt7nCQ=
+cloud.google.com/go/auth v0.18.2 h1:+Nbt5Ev0xEqxlNjd6c+yYUeosQ5TtEUaNcN/3FozlaM=
+cloud.google.com/go/auth v0.18.2/go.mod h1:xD+oY7gcahcu7G2SG2DsBerfFxgPAJz17zz2joOFF3M=
 cloud.google.com/go/auth/oauth2adapt v0.2.8 h1:keo8NaayQZ6wimpNSmW5OPc283g65QNIiLpZnkHRbnc=
 cloud.google.com/go/auth/oauth2adapt v0.2.8/go.mod h1:XQ9y31RkqZCcwJWNSx2Xvric3RrU88hAYYbjDWYDL+c=
 cloud.google.com/go/bigquery v1.0.1/go.mod h1:i/xbL2UlR5RvWAURpBYZTtm/cXjCha9lbfbpx4poX+o=
@@ -48,12 +48,12 @@ cloud.google.com/go/datastore v1.1.0/go.mod h1:umbIZjpQpHh4hmRpGhH4tLFup+FVzqBi1
 cloud.google.com/go/firestore v1.6.1/go.mod h1:asNXNOzBdyVQmEU+ggO8UPodTkEVFW5Qx+rwHnAz+EY=
 cloud.google.com/go/iam v1.5.3 h1:+vMINPiDF2ognBJ97ABAYYwRgsaqxPbQDlMnbHMjolc=
 cloud.google.com/go/iam v1.5.3/go.mod h1:MR3v9oLkZCTlaqljW6Eb2d3HGDGK5/bDv93jhfISFvU=
-cloud.google.com/go/logging v1.13.0 h1:7j0HgAp0B94o1YRDqiqm26w4q1rDMH7XNRU34lJXHYc=
-cloud.google.com/go/logging v1.13.0/go.mod h1:36CoKh6KA/M0PbhPKMq6/qety2DCAErbhXT62TuXALA=
-cloud.google.com/go/longrunning v0.7.0 h1:FV0+SYF1RIj59gyoWDRi45GiYUMM3K1qO51qoboQT1E=
-cloud.google.com/go/longrunning v0.7.0/go.mod h1:ySn2yXmjbK9Ba0zsQqunhDkYi0+9rlXIwnoAf+h+TPY=
-cloud.google.com/go/monitoring v1.24.2 h1:5OTsoJ1dXYIiMiuL+sYscLc9BumrL3CarVLL7dd7lHM=
-cloud.google.com/go/monitoring v1.24.2/go.mod h1:x7yzPWcgDRnPEv3sI+jJGBkwl5qINf+6qY4eq0I9B4U=
+cloud.google.com/go/logging v1.13.1 h1:O7LvmO0kGLaHY/gq8cV7T0dyp6zJhYAOtZPX4TF3QtY=
+cloud.google.com/go/logging v1.13.1/go.mod h1:XAQkfkMBxQRjQek96WLPNze7vsOmay9H5PqfsNYDqvw=
+cloud.google.com/go/longrunning v0.8.0 h1:LiKK77J3bx5gDLi4SMViHixjD2ohlkwBi+mKA7EhfW8=
+cloud.google.com/go/longrunning v0.8.0/go.mod h1:UmErU2Onzi+fKDg2gR7dusz11Pe26aknR4kHmJJqIfk=
+cloud.google.com/go/monitoring v1.24.3 h1:dde+gMNc0UhPZD1Azu6at2e79bfdztVDS5lvhOdsgaE=
+cloud.google.com/go/monitoring v1.24.3/go.mod h1:nYP6W0tm3N9H/bOw8am7t62YTzZY+zUeQ+Bi6+2eonI=
 cloud.google.com/go/pubsub v1.0.1/go.mod h1:R0Gpsv3s54REJCy4fxDixWD93lHJMoZTyQ2kNxGRt3I=
 cloud.google.com/go/pubsub v1.1.0/go.mod h1:EwwdRX2sKPjnvnqCa270oGRyludottCI76h+R3AArQw=
 cloud.google.com/go/pubsub v1.2.0/go.mod h1:jhfEVHT8odbXTkndysNHCcx0awwzvfOlguIAii9o8iA=
@@ -63,10 +63,10 @@ cloud.google.com/go/storage v1.5.0/go.mod h1:tpKbwo567HUNpVclU5sGELwQWBDZ8gh0Zeo
 cloud.google.com/go/storage v1.6.0/go.mod h1:N7U0C8pVQ/+NIKOBQyamJIeKQKkZ+mxpohlUTyfDhBk=
 cloud.google.com/go/storage v1.8.0/go.mod h1:Wv1Oy7z6Yz3DshWRJFhqM/UCfaWIRTdp0RXyy7KQOVs=
 cloud.google.com/go/storage v1.10.0/go.mod h1:FLPqc6j+Ki4BU591ie1oL6qBQGu2Bl/tZ9ullr3+Kg0=
-cloud.google.com/go/storage v1.58.0 h1:PflFXlmFJjG/nBeR9B7pKddLQWaFaRWx4uUi/LyNxxo=
-cloud.google.com/go/storage v1.58.0/go.mod h1:cMWbtM+anpC74gn6qjLh+exqYcfmB9Hqe5z6adx+CLI=
-cloud.google.com/go/trace v1.11.6 h1:2O2zjPzqPYAHrn3OKl029qlqG6W8ZdYaOWRyr8NgMT4=
-cloud.google.com/go/trace v1.11.6/go.mod h1:GA855OeDEBiBMzcckLPE2kDunIpC72N+Pq8WFieFjnI=
+cloud.google.com/go/storage v1.61.3 h1:VS//ZfBuPGDvakfD9xyPW1RGF1Vy3BWUoVZXgW1KMOg=
+cloud.google.com/go/storage v1.61.3/go.mod h1:JtqK8BBB7TWv0HVGHubtUdzYYrakOQIsMLffZ2Z/HWk=
+cloud.google.com/go/trace v1.11.7 h1:kDNDX8JkaAG3R2nq1lIdkb7FCSi1rCmsEtKVsty7p+U=
+cloud.google.com/go/trace v1.11.7/go.mod h1:TNn9d5V3fQVf6s4SCveVMIBS2LJUqo73GACmq/Tky0s=
 cyphar.com/go-pathrs v0.2.1 h1:9nx1vOgwVvX1mNBWDu93+vaceedpbsDqo+XuBGL40b8=
 cyphar.com/go-pathrs v0.2.1/go.mod h1:y8f1EMG7r+hCuFf/rXsKqMJrJAUoADZGNh5/vZPKcGc=
 dario.cat/mergo v1.0.2 h1:85+piFYR1tMbRrLcDwR18y4UKJ3aH1Tbzi24VRW1TK8=
@@ -84,14 +84,14 @@ github.com/CycloneDX/cyclonedx-go v0.10.0/go.mod h1:vUvbCXQsEm48OI6oOlanxstwNByX
 github.com/DataDog/datadog-go v3.2.0+incompatible/go.mod h1:LButxg5PwREeZtORoXG3tL4fMGNddJ+vMq1mwgfaqoQ=
 github.com/DataDog/zstd v1.5.5 h1:oWf5W7GtOLgp6bciQYDmhHHjdhYkALu6S/5Ni9ZgSvQ=
 github.com/DataDog/zstd v1.5.5/go.mod h1:g4AWEaM3yOg3HYfnJ3YIawPnVdXJh9QME85blwSAmyw=
-github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp v1.29.0 h1:UQUsRi8WTzhZntp5313l+CHIAT95ojUI2lpP/ExlZa4=
-github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp v1.29.0/go.mod h1:Cz6ft6Dkn3Et6l2v2a9/RpN7epQ1GtDlO6lj8bEcOvw=
-github.com/GoogleCloudPlatform/opentelemetry-operations-go/exporter/metric v0.54.0 h1:lhhYARPUu3LmHysQ/igznQphfzynnqI3D75oUyw1HXk=
-github.com/GoogleCloudPlatform/opentelemetry-operations-go/exporter/metric v0.54.0/go.mod h1:l9rva3ApbBpEJxSNYnwT9N4CDLrWgtq3u8736C5hyJw=
-github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/cloudmock v0.54.0 h1:xfK3bbi6F2RDtaZFtUdKO3osOBIhNb+xTs8lFW6yx9o=
-github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/cloudmock v0.54.0/go.mod h1:vB2GH9GAYYJTO3mEn8oYwzEdhlayZIdQz6zdzgUIRvA=
-github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/resourcemapping v0.54.0 h1:s0WlVbf9qpvkh1c/uDAPElam0WrL7fHRIidgZJ7UqZI=
-github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/resourcemapping v0.54.0/go.mod h1:Mf6O40IAyB9zR/1J8nGDDPirZQQPbYJni8Yisy7NTMc=
+github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp v1.30.0 h1:sBEjpZlNHzK1voKq9695PJSX2o5NEXl7/OL3coiIY0c=
+github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp v1.30.0/go.mod h1:P4WPRUkOhJC13W//jWpyfJNDAIpvRbAUIYLX/4jtlE0=
+github.com/GoogleCloudPlatform/opentelemetry-operations-go/exporter/metric v0.55.0 h1:UnDZ/zFfG1JhH/DqxIZYU/1CUAlTUScoXD/LcM2Ykk8=
+github.com/GoogleCloudPlatform/opentelemetry-operations-go/exporter/metric v0.55.0/go.mod h1:IA1C1U7jO/ENqm/vhi7V9YYpBsp+IMyqNrEN94N7tVc=
+github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/cloudmock v0.55.0 h1:7t/qx5Ost0s0wbA/VDrByOooURhp+ikYwv20i9Y07TQ=
+github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/cloudmock v0.55.0/go.mod h1:vB2GH9GAYYJTO3mEn8oYwzEdhlayZIdQz6zdzgUIRvA=
+github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/resourcemapping v0.55.0 h1:0s6TxfCu2KHkkZPnBfsQ2y5qia0jl3MMrmBhu3nCOYk=
+github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/resourcemapping v0.55.0/go.mod h1:Mf6O40IAyB9zR/1J8nGDDPirZQQPbYJni8Yisy7NTMc=
 github.com/Masterminds/goutils v1.1.1 h1:5nUrii3FMTL5diU80unEVvNevw1nH4+ZV4DSLVJLSYI=
 github.com/Masterminds/goutils v1.1.1/go.mod h1:8cTjp+g8YejhMuvIA5y2vz3BpJxksy863GQaJW2MFNU=
 github.com/Masterminds/semver/v3 v3.4.0 h1:Zog+i5UMtVoCU8oKka5P7i9q9HgrJeGzI9SA1Xbatp0=
@@ -106,8 +106,8 @@ github.com/Microsoft/hcsshim v0.14.0-rc.1/go.mod h1:hTKFGbnDtQb1wHiOWv4v0eN+7boS
 github.com/OneOfOne/xxhash v1.2.2/go.mod h1:HSdplMjZKSmBqAxg5vPj2TmRDmfkzw+cTzAElWljhcU=
 github.com/OneOfOne/xxhash v1.2.8 h1:31czK/TI9sNkxIKfaUfGlU47BAxQ0ztGgd9vPyqimf8=
 github.com/OneOfOne/xxhash v1.2.8/go.mod h1:eZbhyaAYD41SGSSsnmcpxVoRiQ/MPUTjUdIIOT9Um7Q=
-github.com/ProtonMail/go-crypto v1.3.0 h1:ILq8+Sf5If5DCpHQp4PbZdS1J7HDFRXz/+xKBiRGFrw=
-github.com/ProtonMail/go-crypto v1.3.0/go.mod h1:9whxjD8Rbs29b4XWbB8irEcE8KHMqaR2e7GWU1R+/PE=
+github.com/ProtonMail/go-crypto v1.4.0 h1:Zq/pbM3F5DFgJiMouxEdSVY44MVoQNEKp5d5QxIQceQ=
+github.com/ProtonMail/go-crypto v1.4.0/go.mod h1:e1OaTyu5SYVrO9gKOEhTc+5UcXtTUa+P3uLudwcgPqo=
 github.com/STARRY-S/zip v0.2.3 h1:luE4dMvRPDOWQdeDdUxUoZkzUIpTccdKdhHHsQJ1fm4=
 github.com/STARRY-S/zip v0.2.3/go.mod h1:lqJ9JdeRipyOQJrYSOtpNAiaesFO6zVDsE8GIGFaoSk=
 github.com/acarl005/stripansi v0.0.0-20180116102854-5a71ef0e047d h1:licZJFw2RwpHMqeKTCYkitsPqHNxTmd4SNR5r94FGM8=
@@ -122,34 +122,34 @@ github.com/alecthomas/template v0.0.0-20160405071501-a0175ee3bccc/go.mod h1:LOuy
 github.com/alecthomas/template v0.0.0-20190718012654-fb15b899a751/go.mod h1:LOuyumcjzFXgccqObfd/Ljyb9UuFJ6TxHnclSeseNhc=
 github.com/alecthomas/units v0.0.0-20151022065526-2efee857e7cf/go.mod h1:ybxpYRFXyAe+OPACYpWeL0wqObRcbAqCMya13uyzqw0=
 github.com/alecthomas/units v0.0.0-20190717042225-c3de453c63f4/go.mod h1:ybxpYRFXyAe+OPACYpWeL0wqObRcbAqCMya13uyzqw0=
-github.com/anchore/bubbly v0.0.0-20231115134915-def0aba654a9 h1:p0ZIe0htYOX284Y4axJaGBvXHU0VCCzLN5Wf5XbKStU=
-github.com/anchore/bubbly v0.0.0-20231115134915-def0aba654a9/go.mod h1:3ZsFB9tzW3vl4gEiUeuSOMDnwroWxIxJelOOHUp8dSw=
-github.com/anchore/clio v0.0.0-20250319180342-2cfe4b0cb716 h1:2sIdYJlQESEnyk3Y0WD2vXWW5eD2iMz9Ev8fj1Z8LNA=
-github.com/anchore/clio v0.0.0-20250319180342-2cfe4b0cb716/go.mod h1:Utb9i4kwiCWvqAIxZaJeMIXFO9uOgQXlvH2BfbfO/zI=
-github.com/anchore/fangs v0.0.0-20250319222917-446a1e748ec2 h1:GC2QaO0YsmjpsZ4rtVKv9DnproIxqqn+qkskpc+i8MA=
-github.com/anchore/fangs v0.0.0-20250319222917-446a1e748ec2/go.mod h1:XUbUECwVKuD3qYRUj+QZIOHjyyXua2gFmVjKA40iHXA=
-github.com/anchore/go-collections v0.0.0-20251016125210-a3c352120e8c h1:eoJXyC0n7DZ4YvySG/ETdYkTar2Due7eH+UmLK6FbrA=
-github.com/anchore/go-collections v0.0.0-20251016125210-a3c352120e8c/go.mod h1:1aiktV46ATCkuVg0O573ZrH56BUawTECPETbZyBcqT8=
-github.com/anchore/go-homedir v0.0.0-20250319154043-c29668562e4d h1:gT69osH9AsdpOfqxbRwtxcNnSZ1zg4aKy2BevO3ZBdc=
-github.com/anchore/go-homedir v0.0.0-20250319154043-c29668562e4d/go.mod h1:PhSnuFYknwPZkOWKB1jXBNToChBA+l0FjwOxtViIc50=
-github.com/anchore/go-logger v0.0.0-20250318195838-07ae343dd722 h1:2SqmFgE7h+Ql4VyBzhjLkRF/3gDrcpUBj8LjvvO6OOM=
-github.com/anchore/go-logger v0.0.0-20250318195838-07ae343dd722/go.mod h1:oFuE8YuTCM+spgMXhePGzk3asS94yO9biUfDzVTFqNw=
+github.com/anchore/bubbly v0.2.0 h1:VE6nLlWsYV+bTOqqCzS46NirrVmvHah3UQDtFcjzgHU=
+github.com/anchore/bubbly v0.2.0/go.mod h1:zRg1mfRCCe4vq1t9Ibu24YurErmnp9LAVCbpnpsb1pQ=
+github.com/anchore/clio v0.1.0 h1:lrlSgD38V0T6TLjOG5Kn3miEXCQyYr6ZlwTSnW1WIJg=
+github.com/anchore/clio v0.1.0/go.mod h1:z4l6oHaU8x/yQ3BnES4Ekh4eLqFSYlj1jQpk7waPkJs=
+github.com/anchore/fangs v0.1.0 h1:EidxQN2XDRWn8q2n9pCVZXrOEnvpV1CuPLiWMyWG/vE=
+github.com/anchore/fangs v0.1.0/go.mod h1:5YocMj6a0MC+KiBXBP0/ocOfc54DvlsOcpkAxmPWgx0=
+github.com/anchore/go-collections v0.1.0 h1:vh2LE/j6HLKC27pENkas+J+h4BK4nOte9b7pDjlhY9w=
+github.com/anchore/go-collections v0.1.0/go.mod h1:1aiktV46ATCkuVg0O573ZrH56BUawTECPETbZyBcqT8=
+github.com/anchore/go-homedir v0.1.0 h1:WP+lNLOz2og8hzCkY7IccyFNInVKsrjogzV19G5G8p0=
+github.com/anchore/go-homedir v0.1.0/go.mod h1:9B0DGhbmMAJVGGEbrlb+PkORM5eDFCEOtZ3xQ22qaLA=
+github.com/anchore/go-logger v0.1.0 h1:3pE9Sli4SE1I/mtV+2pZXzim+aWj83BRaneVXeMgD3A=
+github.com/anchore/go-logger v0.1.0/go.mod h1:0l63X5VyHqfWQwsNaTmkgXErsfohze3NAFCXFdhSjdQ=
 github.com/anchore/go-lzo v0.1.0 h1:NgAacnzqPeGH49Ky19QKLBZEuFRqtTG9cdaucc3Vncs=
 github.com/anchore/go-lzo v0.1.0/go.mod h1:3kLx0bve2oN1iDwgM1U5zGku1Tfbdb0No5qp1eL1fIk=
-github.com/anchore/go-macholibre v0.0.0-20220308212642-53e6d0aaf6fb h1:iDMnx6LIjtjZ46C0akqveX83WFzhpTD3eqOthawb5vU=
-github.com/anchore/go-macholibre v0.0.0-20220308212642-53e6d0aaf6fb/go.mod h1:DmTY2Mfcv38hsHbG78xMiTDdxFtkHpgYNVDPsF2TgHk=
-github.com/anchore/go-rpmdb v0.0.0-20250516171929-f77691e1faec h1:SjjPMOXTzpuU1ZME4XeoHyek+dry3/C7I8gzaCo02eg=
-github.com/anchore/go-rpmdb v0.0.0-20250516171929-f77691e1faec/go.mod h1:eQVa6QFGzKy0qMcnW2pez0XBczvgwSjw9vA23qifEyU=
+github.com/anchore/go-macholibre v0.1.0 h1:qHbdusBZNcZM/uuKf1Psa9xxAFSoyRTps8GW9gpJgsg=
+github.com/anchore/go-macholibre v0.1.0/go.mod h1:eu0gbwaZ+ocVFJLePdmPPDKU8MboV1MKsUCr36Ckd5s=
+github.com/anchore/go-rpmdb v0.1.0 h1:Q8dc208/HYzCqhx0L1zurfm1UPil24hlo9NjkdFmLdE=
+github.com/anchore/go-rpmdb v0.1.0/go.mod h1:eQVa6QFGzKy0qMcnW2pez0XBczvgwSjw9vA23qifEyU=
 github.com/anchore/go-struct-converter v0.1.0 h1:2rDRssAl6mgKBSLNiVCMADgZRhoqtw9dedlWa0OhD30=
 github.com/anchore/go-struct-converter v0.1.0/go.mod h1:rYqSE9HbjzpHTI74vwPvae4ZVYZd1lue2ta6xHPdblA=
-github.com/anchore/go-sync v0.0.0-20250326131806-4eda43a485b6 h1:Ha+LSCVuXYSYGi7wIkJK6G8g6jI3LH7y6LbyEVyp4Io=
-github.com/anchore/go-sync v0.0.0-20250326131806-4eda43a485b6/go.mod h1:+9oM3XUy8iea/vWj9FhZ9bQGUBN8JpPxxJm5Wbcx9XM=
+github.com/anchore/go-sync v0.1.0 h1:1TEZM7jISrvtoBMOF79xP0caQKASAtgW1yKqc0EjyZg=
+github.com/anchore/go-sync v0.1.0/go.mod h1:Iposeub0kHipoTei1icj4Tys0SJN+cCdxEnkS7bZUFs=
 github.com/anchore/go-version v1.2.2-0.20200701162849-18adb9c92b9b h1:e1bmaoJfZVsCYMrIZBpFxwV26CbsuoEh5muXD5I1Ods=
 github.com/anchore/go-version v1.2.2-0.20200701162849-18adb9c92b9b/go.mod h1:Bkc+JYWjMCF8OyZ340IMSIi2Ebf3uwByOk6ho4wne1E=
-github.com/anchore/packageurl-go v0.1.1-0.20250220190351-d62adb6e1115 h1:ZyRCmiEjnoGJZ1+Ah0ZZ/mKKqNhGcUZBl0s7PTTDzvY=
-github.com/anchore/packageurl-go v0.1.1-0.20250220190351-d62adb6e1115/go.mod h1:KoYIv7tdP5+CC9VGkeZV4/vGCKsY55VvoG+5dadg4YI=
-github.com/anchore/stereoscope v0.1.21 h1:rIwPDjJQdOdIvMrkNyZFkUS5dSyQPDjAwUqU0XjVF74=
-github.com/anchore/stereoscope v0.1.21/go.mod h1:8652axKmO8itOcGX8gzAvHW3cVWvbxpJ4woLNMEO4a0=
+github.com/anchore/packageurl-go v0.2.0 h1:CkrM4RMUwrEGAiE1OVlxaZNzWj0TuHRey7o4T/EAErk=
+github.com/anchore/packageurl-go v0.2.0/go.mod h1:2JCgOQMIsqZ7TmliXG4PnUthPJAKE3mWQbsW2XHjAOE=
+github.com/anchore/stereoscope v0.1.23 h1:q9i3CtbicTuSlcCnA+5pfoT9WDCEoSqvXDfHMH1hyWo=
+github.com/anchore/stereoscope v0.1.23/go.mod h1:JLnun49fkLkuv3ebU0ROvFl/0JiRmNmUtCzc6y4ollo=
 github.com/andreyvit/diff v0.0.0-20170406064948-c7f18ee00883/go.mod h1:rCTlJbsFo29Kk6CurOXKm700vrz8f0KW0JNfpkRJY/8=
 github.com/andybalholm/brotli v1.2.0 h1:ukwgCxwYrmACq68yiUqwIWnGY0cTPox/M94sVwToPjQ=
 github.com/andybalholm/brotli v1.2.0/go.mod h1:rzTDkvFWvIrjDXZHkuS16NPggd91W3kUSvPlQ1pLaKY=
@@ -171,44 +171,44 @@ github.com/armon/go-socks5 v0.0.0-20160902184237-e75332964ef5 h1:0CwZNZbxp69SHPd
 github.com/armon/go-socks5 v0.0.0-20160902184237-e75332964ef5/go.mod h1:wHh0iHkYZB8zMSxRWpUBQtwG5a7fFgvEO+odwuTv2gs=
 github.com/atotto/clipboard v0.1.4 h1:EH0zSVneZPSuFR11BlR9YppQTVDbh5+16AmcJi4g1z4=
 github.com/atotto/clipboard v0.1.4/go.mod h1:ZY9tmq7sm5xIbd9bOK4onWV4S6X0u6GY7Vn0Yu86PYI=
-github.com/aws/aws-sdk-go-v2 v1.41.2 h1:LuT2rzqNQsauaGkPK/7813XxcZ3o3yePY0Iy891T2ls=
-github.com/aws/aws-sdk-go-v2 v1.41.2/go.mod h1:IvvlAZQXvTXznUPfRVfryiG1fbzE2NGK6m9u39YQ+S4=
-github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.4 h1:489krEF9xIGkOaaX3CE/Be2uWjiXrkCH6gUX+bZA/BU=
-github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.4/go.mod h1:IOAPF6oT9KCsceNTvvYMNHy0+kMF8akOjeDvPENWxp4=
-github.com/aws/aws-sdk-go-v2/config v1.32.10 h1:9DMthfO6XWZYLfzZglAgW5Fyou2nRI5CuV44sTedKBI=
-github.com/aws/aws-sdk-go-v2/config v1.32.10/go.mod h1:2rUIOnA2JaiqYmSKYmRJlcMWy6qTj1vuRFscppSBMcw=
-github.com/aws/aws-sdk-go-v2/credentials v1.19.10 h1:EEhmEUFCE1Yhl7vDhNOI5OCL/iKMdkkYFTRpZXNw7m8=
-github.com/aws/aws-sdk-go-v2/credentials v1.19.10/go.mod h1:RnnlFCAlxQCkN2Q379B67USkBMu1PipEEiibzYN5UTE=
-github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.18 h1:Ii4s+Sq3yDfaMLpjrJsqD6SmG/Wq/P5L/hw2qa78UAY=
-github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.18/go.mod h1:6x81qnY++ovptLE6nWQeWrpXxbnlIex+4H4eYYGcqfc=
-github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.18 h1:F43zk1vemYIqPAwhjTjYIz0irU2EY7sOb/F5eJ3HuyM=
-github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.18/go.mod h1:w1jdlZXrGKaJcNoL+Nnrj+k5wlpGXqnNrKoP22HvAug=
-github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.18 h1:xCeWVjj0ki0l3nruoyP2slHsGArMxeiiaoPN5QZH6YQ=
-github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.18/go.mod h1:r/eLGuGCBw6l36ZRWiw6PaZwPXb6YOj+i/7MizNl5/k=
-github.com/aws/aws-sdk-go-v2/internal/ini v1.8.4 h1:WKuaxf++XKWlHWu9ECbMlha8WOEGm0OUEZqm4K/Gcfk=
-github.com/aws/aws-sdk-go-v2/internal/ini v1.8.4/go.mod h1:ZWy7j6v1vWGmPReu0iSGvRiise4YI5SkR3OHKTZ6Wuc=
-github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.16 h1:CjMzUs78RDDv4ROu3JnJn/Ig1r6ZD7/T2DXLLRpejic=
-github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.16/go.mod h1:uVW4OLBqbJXSHJYA9svT9BluSvvwbzLQ2Crf6UPzR3c=
-github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.5 h1:CeY9LUdur+Dxoeldqoun6y4WtJ3RQtzk0JMP2gfUay0=
-github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.5/go.mod h1:AZLZf2fMaahW5s/wMRciu1sYbdsikT/UHwbUjOdEVTc=
-github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.9.7 h1:DIBqIrJ7hv+e4CmIk2z3pyKT+3B6qVMgRsawHiR3qso=
-github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.9.7/go.mod h1:vLm00xmBke75UmpNvOcZQ/Q30ZFjbczeLFqGx5urmGo=
-github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.18 h1:LTRCYFlnnKFlKsyIQxKhJuDuA3ZkrDQMRYm6rXiHlLY=
-github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.18/go.mod h1:XhwkgGG6bHSd00nO/mexWTcTjgd6PjuvWQMqSn2UaEk=
-github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.19.16 h1:NSbvS17MlI2lurYgXnCOLvCFX38sBW4eiVER7+kkgsU=
-github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.19.16/go.mod h1:SwT8Tmqd4sA6G1qaGdzWCJN99bUmPGHfRwwq3G5Qb+A=
-github.com/aws/aws-sdk-go-v2/service/s3 v1.95.0 h1:MIWra+MSq53CFaXXAywB2qg9YvVZifkk6vEGl/1Qor0=
-github.com/aws/aws-sdk-go-v2/service/s3 v1.95.0/go.mod h1:79S2BdqCJpScXZA2y+cpZuocWsjGjJINyXnOsf5DTz8=
-github.com/aws/aws-sdk-go-v2/service/signin v1.0.6 h1:MzORe+J94I+hYu2a6XmV5yC9huoTv8NRcCrUNedDypQ=
-github.com/aws/aws-sdk-go-v2/service/signin v1.0.6/go.mod h1:hXzcHLARD7GeWnifd8j9RWqtfIgxj4/cAtIVIK7hg8g=
-github.com/aws/aws-sdk-go-v2/service/sso v1.30.11 h1:7oGD8KPfBOJGXiCoRKrrrQkbvCp8N++u36hrLMPey6o=
-github.com/aws/aws-sdk-go-v2/service/sso v1.30.11/go.mod h1:0DO9B5EUJQlIDif+XJRWCljZRKsAFKh3gpFz7UnDtOo=
-github.com/aws/aws-sdk-go-v2/service/ssooidc v1.35.15 h1:edCcNp9eGIUDUCrzoCu1jWAXLGFIizeqkdkKgRlJwWc=
-github.com/aws/aws-sdk-go-v2/service/ssooidc v1.35.15/go.mod h1:lyRQKED9xWfgkYC/wmmYfv7iVIM68Z5OQ88ZdcV1QbU=
-github.com/aws/aws-sdk-go-v2/service/sts v1.41.7 h1:NITQpgo9A5NrDZ57uOWj+abvXSb83BbyggcUBVksN7c=
-github.com/aws/aws-sdk-go-v2/service/sts v1.41.7/go.mod h1:sks5UWBhEuWYDPdwlnRFn1w7xWdH29Jcpe+/PJQefEs=
-github.com/aws/smithy-go v1.24.1 h1:VbyeNfmYkWoxMVpGUAbQumkODcYmfMRfZ8yQiH30SK0=
-github.com/aws/smithy-go v1.24.1/go.mod h1:LEj2LM3rBRQJxPZTB4KuzZkaZYnZPnvgIhb4pu07mx0=
+github.com/aws/aws-sdk-go-v2 v1.41.5 h1:dj5kopbwUsVUVFgO4Fi5BIT3t4WyqIDjGKCangnV/yY=
+github.com/aws/aws-sdk-go-v2 v1.41.5/go.mod h1:mwsPRE8ceUUpiTgF7QmQIJ7lgsKUPQOUl3o72QBrE1o=
+github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.8 h1:eBMB84YGghSocM7PsjmmPffTa+1FBUeNvGvFou6V/4o=
+github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.8/go.mod h1:lyw7GFp3qENLh7kwzf7iMzAxDn+NzjXEAGjKS2UOKqI=
+github.com/aws/aws-sdk-go-v2/config v1.32.12 h1:O3csC7HUGn2895eNrLytOJQdoL2xyJy0iYXhoZ1OmP0=
+github.com/aws/aws-sdk-go-v2/config v1.32.12/go.mod h1:96zTvoOFR4FURjI+/5wY1vc1ABceROO4lWgWJuxgy0g=
+github.com/aws/aws-sdk-go-v2/credentials v1.19.12 h1:oqtA6v+y5fZg//tcTWahyN9PEn5eDU/Wpvc2+kJ4aY8=
+github.com/aws/aws-sdk-go-v2/credentials v1.19.12/go.mod h1:U3R1RtSHx6NB0DvEQFGyf/0sbrpJrluENHdPy1j/3TE=
+github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.20 h1:zOgq3uezl5nznfoK3ODuqbhVg1JzAGDUhXOsU0IDCAo=
+github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.20/go.mod h1:z/MVwUARehy6GAg/yQ1GO2IMl0k++cu1ohP9zo887wE=
+github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.21 h1:Rgg6wvjjtX8bNHcvi9OnXWwcE0a2vGpbwmtICOsvcf4=
+github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.21/go.mod h1:A/kJFst/nm//cyqonihbdpQZwiUhhzpqTsdbhDdRF9c=
+github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.21 h1:PEgGVtPoB6NTpPrBgqSE5hE/o47Ij9qk/SEZFbUOe9A=
+github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.21/go.mod h1:p+hz+PRAYlY3zcpJhPwXlLC4C+kqn70WIHwnzAfs6ps=
+github.com/aws/aws-sdk-go-v2/internal/ini v1.8.6 h1:qYQ4pzQ2Oz6WpQ8T3HvGHnZydA72MnLuFK9tJwmrbHw=
+github.com/aws/aws-sdk-go-v2/internal/ini v1.8.6/go.mod h1:O3h0IK87yXci+kg6flUKzJnWeziQUKciKrLjcatSNcY=
+github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.22 h1:rWyie/PxDRIdhNf4DzRk0lvjVOqFJuNnO8WwaIRVxzQ=
+github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.22/go.mod h1:zd/JsJ4P7oGfUhXn1VyLqaRZwPmZwg44Jf2dS84Dm3Y=
+github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.7 h1:5EniKhLZe4xzL7a+fU3C2tfUN4nWIqlLesfrjkuPFTY=
+github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.7/go.mod h1:x0nZssQ3qZSnIcePWLvcoFisRXJzcTVvYpAAdYX8+GI=
+github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.9.13 h1:JRaIgADQS/U6uXDqlPiefP32yXTda7Kqfx+LgspooZM=
+github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.9.13/go.mod h1:CEuVn5WqOMilYl+tbccq8+N2ieCy0gVn3OtRb0vBNNM=
+github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.21 h1:c31//R3xgIJMSC8S6hEVq+38DcvUlgFY0FM6mSI5oto=
+github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.21/go.mod h1:r6+pf23ouCB718FUxaqzZdbpYFyDtehyZcmP5KL9FkA=
+github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.19.21 h1:ZlvrNcHSFFWURB8avufQq9gFsheUgjVD9536obIknfM=
+github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.19.21/go.mod h1:cv3TNhVrssKR0O/xxLJVRfd2oazSnZnkUeTf6ctUwfQ=
+github.com/aws/aws-sdk-go-v2/service/s3 v1.97.3 h1:HwxWTbTrIHm5qY+CAEur0s/figc3qwvLWsNkF4RPToo=
+github.com/aws/aws-sdk-go-v2/service/s3 v1.97.3/go.mod h1:uoA43SdFwacedBfSgfFSjjCvYe8aYBS7EnU5GZ/YKMM=
+github.com/aws/aws-sdk-go-v2/service/signin v1.0.8 h1:0GFOLzEbOyZABS3PhYfBIx2rNBACYcKty+XGkTgw1ow=
+github.com/aws/aws-sdk-go-v2/service/signin v1.0.8/go.mod h1:LXypKvk85AROkKhOG6/YEcHFPoX+prKTowKnVdcaIxE=
+github.com/aws/aws-sdk-go-v2/service/sso v1.30.13 h1:kiIDLZ005EcKomYYITtfsjn7dtOwHDOFy7IbPXKek2o=
+github.com/aws/aws-sdk-go-v2/service/sso v1.30.13/go.mod h1:2h/xGEowcW/g38g06g3KpRWDlT+OTfxxI0o1KqayAB8=
+github.com/aws/aws-sdk-go-v2/service/ssooidc v1.35.17 h1:jzKAXIlhZhJbnYwHbvUQZEB8KfgAEuG0dc08Bkda7NU=
+github.com/aws/aws-sdk-go-v2/service/ssooidc v1.35.17/go.mod h1:Al9fFsXjv4KfbzQHGe6V4NZSZQXecFcvaIF4e70FoRA=
+github.com/aws/aws-sdk-go-v2/service/sts v1.41.9 h1:Cng+OOwCHmFljXIxpEVXAGMnBia8MSU6Ch5i9PgBkcU=
+github.com/aws/aws-sdk-go-v2/service/sts v1.41.9/go.mod h1:LrlIndBDdjA/EeXeyNBle+gyCwTlizzW5ycgWnvIxkk=
+github.com/aws/smithy-go v1.24.2 h1:FzA3bu/nt/vDvmnkg+R8Xl46gmzEDam6mZ1hzmwXFng=
+github.com/aws/smithy-go v1.24.2/go.mod h1:YE2RhdIuDbA5E5bTdciG9KrW3+TiEONeUWCqxX9i1Fc=
 github.com/aymanbagabas/go-osc52/v2 v2.0.1 h1:HwpRHbFMcZLEVr42D4p7XBqjyuxQH5SMiErDT4WkJ2k=
 github.com/aymanbagabas/go-osc52/v2 v2.0.1/go.mod h1:uYgXzlJ7ZpABp8OJ+exZzJJhRNQ2ASbcXHWsFqH8hp8=
 github.com/aymanbagabas/go-udiff v0.3.1 h1:LV+qyBQ2pqe0u42ZsUEtPiCaUoqgA9gYRDs3vj1nolY=
@@ -237,8 +237,8 @@ github.com/bodgit/windows v1.0.1 h1:tF7K6KOluPYygXa3Z2594zxlkbKPAOvqr97etrGNIz4=
 github.com/bodgit/windows v1.0.1/go.mod h1:a6JLwrB4KrTR5hBpp8FI9/9W9jJfeQ2h4XDXU74ZCdM=
 github.com/bradleyjkemp/cupaloy/v2 v2.8.0 h1:any4BmKE+jGIaMpnU8YgH/I2LPiLBufr6oMMlVBbn9M=
 github.com/bradleyjkemp/cupaloy/v2 v2.8.0/go.mod h1:bm7JXdkRd4BHJk9HpwqAI8BoAY1lps46Enkdqw6aRX0=
-github.com/buger/jsonparser v1.1.1 h1:2PnMjfWD7wBILjqQbt530v576A/cAbQvEW9gGIpYMUs=
-github.com/buger/jsonparser v1.1.1/go.mod h1:6RYKKt7H4d4+iWqouImQ9R2FZql3VbhNgx27UK13J/0=
+github.com/buger/jsonparser v1.1.2 h1:frqHqw7otoVbk5M8LlE/L7HTnIq2v9RX6EJ48i9AxJk=
+github.com/buger/jsonparser v1.1.2/go.mod h1:6RYKKt7H4d4+iWqouImQ9R2FZql3VbhNgx27UK13J/0=
 github.com/census-instrumentation/opencensus-proto v0.2.1/go.mod h1:f6KPmirojxKA12rnyqOA5BBL4O983OfeGPqjHWSTneU=
 github.com/census-instrumentation/opencensus-proto v0.3.0/go.mod h1:f6KPmirojxKA12rnyqOA5BBL4O983OfeGPqjHWSTneU=
 github.com/cespare/xxhash v1.1.0/go.mod h1:XrSqR1VqqWfGrhpAt58auRo0WTKS1nRRg3ghfAqPWnc=
@@ -276,12 +276,10 @@ github.com/chzyer/test v1.0.0/go.mod h1:2JlltgoNkt4TW/z9V/IzDdFaMTM2JPIi26O1pF38
 github.com/circonus-labs/circonus-gometrics v2.3.1+incompatible/go.mod h1:nmEj6Dob7S7YxXgwXpfOuvO54S+tGdZdw9fuRZt25Ag=
 github.com/circonus-labs/circonusllhist v0.1.3/go.mod h1:kMXHVDlOchFAehlya5ePtbp5jckzBHf4XRpQvBOLI+I=
 github.com/client9/misspell v0.3.4/go.mod h1:qj6jICC3Q7zFZvVWo7KLAzC3yx5G7kyvSDkc90ppPyw=
-github.com/clipperhouse/displaywidth v0.9.0 h1:Qb4KOhYwRiN3viMv1v/3cTBlz3AcAZX3+y9OLhMtAtA=
-github.com/clipperhouse/displaywidth v0.9.0/go.mod h1:aCAAqTlh4GIVkhQnJpbL0T/WfcrJXHcj8C0yjYcjOZA=
-github.com/clipperhouse/stringish v0.1.1 h1:+NSqMOr3GR6k1FdRhhnXrLfztGzuG+VuFDfatpWHKCs=
-github.com/clipperhouse/stringish v0.1.1/go.mod h1:v/WhFtE1q0ovMta2+m+UbpZ+2/HEXNWYXQgCt4hdOzA=
-github.com/clipperhouse/uax29/v2 v2.5.0 h1:x7T0T4eTHDONxFJsL94uKNKPHrclyFI0lm7+w94cO8U=
-github.com/clipperhouse/uax29/v2 v2.5.0/go.mod h1:Wn1g7MK6OoeDT0vL+Q0SQLDz/KpfsVRgg6W7ihQeh4g=
+github.com/clipperhouse/displaywidth v0.10.0 h1:GhBG8WuerxjFQQYeuZAeVTuyxuX+UraiZGD4HJQ3Y8g=
+github.com/clipperhouse/displaywidth v0.10.0/go.mod h1:XqJajYsaiEwkxOj4bowCTMcT1SgvHo9flfF3jQasdbs=
+github.com/clipperhouse/uax29/v2 v2.6.0 h1:z0cDbUV+aPASdFb2/ndFnS9ts/WNXgTNNGFoKXuhpos=
+github.com/clipperhouse/uax29/v2 v2.6.0/go.mod h1:Wn1g7MK6OoeDT0vL+Q0SQLDz/KpfsVRgg6W7ihQeh4g=
 github.com/cloudflare/circl v1.6.3 h1:9GPOhQGF9MCYUeXyMYlqTR6a5gTrgR/fBLXvUgtVcg8=
 github.com/cloudflare/circl v1.6.3/go.mod h1:2eXP6Qfat4O/Yhh8BznvKnJ+uzEoTQ6jVKJRn81BiS4=
 github.com/cncf/udpa/go v0.0.0-20191209042840-269d4d468f6f/go.mod h1:M8M6+tZqaGXZJjfX53e64911xZQV5JYwmTeXPW+k8Sc=
@@ -294,14 +292,14 @@ github.com/cncf/xds/go v0.0.0-20210922020428-25de7278fc84/go.mod h1:eXthEFrGJvWH
 github.com/cncf/xds/go v0.0.0-20211001041855-01bcc9b48dfe/go.mod h1:eXthEFrGJvWHgFFCl3hGmgk+/aYT6PnTQLykKQRLhEs=
 github.com/cncf/xds/go v0.0.0-20211011173535-cb28da3451f1/go.mod h1:eXthEFrGJvWHgFFCl3hGmgk+/aYT6PnTQLykKQRLhEs=
 github.com/cncf/xds/go v0.0.0-20211130200136-a8f946100490/go.mod h1:eXthEFrGJvWHgFFCl3hGmgk+/aYT6PnTQLykKQRLhEs=
-github.com/cncf/xds/go v0.0.0-20250501225837-2ac532fd4443 h1:aQ3y1lwWyqYPiWZThqv1aFbZMiM9vblcSArJRf2Irls=
-github.com/cncf/xds/go v0.0.0-20250501225837-2ac532fd4443/go.mod h1:W+zGtBO5Y1IgJhy4+A9GOqVhqLpfZi+vwmdNXUehLA8=
+github.com/cncf/xds/go v0.0.0-20251210132809-ee656c7534f5 h1:6xNmx7iTtyBRev0+D/Tv1FZd4SCg8axKApyNyRsAt/w=
+github.com/cncf/xds/go v0.0.0-20251210132809-ee656c7534f5/go.mod h1:KdCmV+x/BuvyMxRnYBlmVaq4OLiKW6iRQfvC62cvdkI=
 github.com/containerd/cgroups/v3 v3.1.2 h1:OSosXMtkhI6Qove637tg1XgK4q+DhR0mX8Wi8EhrHa4=
 github.com/containerd/cgroups/v3 v3.1.2/go.mod h1:PKZ2AcWmSBsY/tJUVhtS/rluX0b1uq1GmPO1ElCmbOw=
 github.com/containerd/containerd/api v1.10.0 h1:5n0oHYVBwN4VhoX9fFykCV9dF1/BvAXeg2F8W6UYq1o=
 github.com/containerd/containerd/api v1.10.0/go.mod h1:NBm1OAk8ZL+LG8R0ceObGxT5hbUYj7CzTmR3xh0DlMM=
-github.com/containerd/containerd/v2 v2.2.1 h1:TpyxcY4AL5A+07dxETevunVS5zxqzuq7ZqJXknM11yk=
-github.com/containerd/containerd/v2 v2.2.1/go.mod h1:NR70yW1iDxe84F2iFWbR9xfAN0N2F0NcjTi1OVth4nU=
+github.com/containerd/containerd/v2 v2.2.2 h1:mjVQdtfryzT7lOqs5EYUFZm8ioPVjOpkSoG1GJPxEMY=
+github.com/containerd/containerd/v2 v2.2.2/go.mod h1:5Jhevmv6/2J+Iu/A2xXAdUIdI5Ah/hfyO7okJ4AFIdY=
 github.com/containerd/continuity v0.4.5 h1:ZRoN1sXq9u7V6QoHMcVWGhOwDFqZ4B9i5H6un1Wh0x4=
 github.com/containerd/continuity v0.4.5/go.mod h1:/lNJvtJKUQStBzpVQ1+rasXO1LAWtUQssk28EZvJ3nE=
 github.com/containerd/errdefs v1.0.0 h1:tg5yIfIlQIrxYtu9ajqY42W3lpS19XqdxRQeEwYG8PI=
@@ -312,8 +310,8 @@ github.com/containerd/fifo v1.1.0 h1:4I2mbh5stb1u6ycIABlBw9zgtlK8viPI9QkQNRQEEmY
 github.com/containerd/fifo v1.1.0/go.mod h1:bmC4NWMbXlt2EZ0Hc7Fx7QzTFxgPID13eH0Qu+MAb2o=
 github.com/containerd/log v0.1.0 h1:TCJt7ioM2cr/tfR8GPbGf9/VRAX8D2B4PjzCpfX540I=
 github.com/containerd/log v0.1.0/go.mod h1:VRRf09a7mHDIRezVKTRCrOq78v577GXq3bSa3EhrzVo=
-github.com/containerd/platforms v1.0.0-rc.2 h1:0SPgaNZPVWGEi4grZdV8VRYQn78y+nm6acgLGv/QzE4=
-github.com/containerd/platforms v1.0.0-rc.2/go.mod h1:J71L7B+aiM5SdIEqmd9wp6THLVRzJGXfNuWCZCllLA4=
+github.com/containerd/platforms v1.0.0-rc.4 h1:M42JrUT4zfZTqtkUwkr0GzmUWbfyO5VO0Q5b3op97T4=
+github.com/containerd/platforms v1.0.0-rc.4/go.mod h1:lKlMXyLybmBedS/JJm11uDofzI8L2v0J2ZbYvNsbq1A=
 github.com/containerd/plugin v1.0.0 h1:c8Kf1TNl6+e2TtMHZt+39yAPDbouRH9WAToRjex483Y=
 github.com/containerd/plugin v1.0.0/go.mod h1:hQfJe5nmWfImiqT1q8Si3jLv3ynMUIBB47bQ+KexvO8=
 github.com/containerd/stargz-snapshotter/estargz v0.18.2 h1:yXkZFYIzz3eoLwlTUZKz2iQ4MrckBxJjkmD16ynUTrw=
@@ -345,10 +343,8 @@ github.com/distribution/reference v0.6.0 h1:0IXCQ5g4/QMHHkarYzh5l+u8T3t73zM5Qvfr
 github.com/distribution/reference v0.6.0/go.mod h1:BbU0aIcezP1/5jX/8MP0YiH4SdvB5Y4f/wlDRiLyi3E=
 github.com/djherbis/times v1.6.0 h1:w2ctJ92J8fBvWPxugmXIv7Nz7Q3iDMKNx9v5ocVH20c=
 github.com/djherbis/times v1.6.0/go.mod h1:gOHeRAz2h+VJNZ5Gmc/o7iD9k4wW7NMVqieYCY99oc0=
-github.com/docker/cli v29.2.1+incompatible h1:n3Jt0QVCN65eiVBoUTZQM9mcQICCJt3akW4pKAbKdJg=
-github.com/docker/cli v29.2.1+incompatible/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8=
-github.com/docker/distribution v2.8.3+incompatible h1:AtKxIZ36LoNK51+Z6RpzLpddBirtxJnzDrHLEKxTAYk=
-github.com/docker/distribution v2.8.3+incompatible/go.mod h1:J2gT2udsDAN96Uj4KfcMRqY0/ypR+oyYUYmja8H+y+w=
+github.com/docker/cli v29.4.0+incompatible h1:+IjXULMetlvWJiuSI0Nbor36lcJ5BTcVpUmB21KBoVM=
+github.com/docker/cli v29.4.0+incompatible/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8=
 github.com/docker/docker-credential-helpers v0.9.5 h1:EFNN8DHvaiK8zVqFA2DT6BjXE0GzfLOZ38ggPTKePkY=
 github.com/docker/docker-credential-helpers v0.9.5/go.mod h1:v1S+hepowrQXITkEfw6o4+BMbGot02wiKpzWhGUZK6c=
 github.com/docker/go-connections v0.6.0 h1:LlMG9azAe1TqfR7sO+NJttz1gy6KO7VJBh+pMmjSD94=
@@ -377,16 +373,16 @@ github.com/envoyproxy/go-control-plane v0.9.9-0.20210217033140-668b12f5399d/go.m
 github.com/envoyproxy/go-control-plane v0.9.9-0.20210512163311-63b5d3c536b0/go.mod h1:hliV/p42l8fGbc6Y9bQ70uLwIvmJyVE5k4iMKlh8wCQ=
 github.com/envoyproxy/go-control-plane v0.9.10-0.20210907150352-cf90f659a021/go.mod h1:AFq3mo9L8Lqqiid3OhADV3RfLJnjiw63cSpi+fDTRC0=
 github.com/envoyproxy/go-control-plane v0.10.1/go.mod h1:AY7fTTXNdv/aJ2O5jwpxAPOWUZ7hQAEvzN5Pf27BkQQ=
-github.com/envoyproxy/go-control-plane v0.13.4 h1:zEqyPVyku6IvWCFwux4x9RxkLOMUL+1vC9xUFv5l2/M=
-github.com/envoyproxy/go-control-plane v0.13.4/go.mod h1:kDfuBlDVsSj2MjrLEtRWtHlsWIFcGyB2RMO44Dc5GZA=
-github.com/envoyproxy/go-control-plane/envoy v1.32.4 h1:jb83lalDRZSpPWW2Z7Mck/8kXZ5CQAFYVjQcdVIr83A=
-github.com/envoyproxy/go-control-plane/envoy v1.32.4/go.mod h1:Gzjc5k8JcJswLjAx1Zm+wSYE20UrLtt7JZMWiWQXQEw=
+github.com/envoyproxy/go-control-plane v0.14.0 h1:hbG2kr4RuFj222B6+7T83thSPqLjwBIfQawTkC++2HA=
+github.com/envoyproxy/go-control-plane v0.14.0/go.mod h1:NcS5X47pLl/hfqxU70yPwL9ZMkUlwlKxtAohpi2wBEU=
+github.com/envoyproxy/go-control-plane/envoy v1.36.0 h1:yg/JjO5E7ubRyKX3m07GF3reDNEnfOboJ0QySbH736g=
+github.com/envoyproxy/go-control-plane/envoy v1.36.0/go.mod h1:ty89S1YCCVruQAm9OtKeEkQLTb+Lkz0k8v9W0Oxsv98=
 github.com/envoyproxy/go-control-plane/ratelimit v0.1.0 h1:/G9QYbddjL25KvtKTv3an9lx6VBE2cnb8wp1vEGNYGI=
 github.com/envoyproxy/go-control-plane/ratelimit v0.1.0/go.mod h1:Wk+tMFAFbCXaJPzVVHnPgRKdUdwW/KdbRt94AzgRee4=
 github.com/envoyproxy/protoc-gen-validate v0.1.0/go.mod h1:iSmxcyjqTsJpI2R4NaDN7+kN2VEUnK/pcBlmesArF7c=
 github.com/envoyproxy/protoc-gen-validate v0.6.2/go.mod h1:2t7qjJNvHPx8IjnBOzl9E9/baC+qXE/TeeyBRzgJDws=
-github.com/envoyproxy/protoc-gen-validate v1.2.1 h1:DEo3O99U8j4hBFwbJfrz9VtgcDfUKS7KJ7spH3d86P8=
-github.com/envoyproxy/protoc-gen-validate v1.2.1/go.mod h1:d/C80l/jxXLdfEIhX1W2TmLfsJ31lvEjwamM4DxlWXU=
+github.com/envoyproxy/protoc-gen-validate v1.3.0 h1:TvGH1wof4H33rezVKWSpqKz5NXWg5VPuZ0uONDT6eb4=
+github.com/envoyproxy/protoc-gen-validate v1.3.0/go.mod h1:HvYl7zwPa5mffgyeTUHA9zHIH36nmrm7oCbo4YKoSWA=
 github.com/erikgeiser/coninput v0.0.0-20211004153227-1c3628e74d0f h1:Y/CXytFA4m6baUTXGLOoWe4PQhGxaX0KpnayAqC48p4=
 github.com/erikgeiser/coninput v0.0.0-20211004153227-1c3628e74d0f/go.mod h1:vw97MGsxSvLiUE2X8qFplwetxpGLQrlU1Q9AUEIzCaM=
 github.com/facebookincubator/flog v0.0.0-20190930132826-d2511d0ce33c/go.mod h1:QGzNH9ujQ2ZUr/CjDGZGWeDAVStrWNjHeEcjJL96Nuk=
@@ -416,8 +412,8 @@ github.com/github/go-spdx/v2 v2.4.0 h1:+4IwVwJJbm3rzvrQ6P1nI9BDMcy3la4RchRy5uehV
 github.com/github/go-spdx/v2 v2.4.0/go.mod h1:/5rwgS0txhGtRdUZwc02bTglzg6HK3FfuEbECKlK2Sg=
 github.com/gkampitakis/ciinfo v0.3.2 h1:JcuOPk8ZU7nZQjdUhctuhQofk7BGHuIy0c9Ez8BNhXs=
 github.com/gkampitakis/ciinfo v0.3.2/go.mod h1:1NIwaOcFChN4fa/B0hEBdAb6npDlFL8Bwx4dfRLRqAo=
-github.com/gkampitakis/go-snaps v0.5.20 h1:FGKonEeQPJ12t7RQj6cTPa881fl5c8HYarMLv5vP7sg=
-github.com/gkampitakis/go-snaps v0.5.20/go.mod h1:gC3YqxQTPyIXvQrw/Vpt3a8VqR1MO8sVpZFWN4DGwNs=
+github.com/gkampitakis/go-snaps v0.5.21 h1:SvhSFeZviQXwlT+dnGyAIATVehkhqRVW6qfQZhCZH+Y=
+github.com/gkampitakis/go-snaps v0.5.21/go.mod h1:gC3YqxQTPyIXvQrw/Vpt3a8VqR1MO8sVpZFWN4DGwNs=
 github.com/glebarez/go-sqlite v1.20.3 h1:89BkqGOXR9oRmG58ZrzgoY/Fhy5x0M+/WV48U5zVrZ4=
 github.com/glebarez/go-sqlite v1.20.3/go.mod h1:u3N6D/wftiAzIOJtZl6BmedqxmmkDfH3q+ihjqxC9u0=
 github.com/gliderlabs/ssh v0.3.8 h1:a4YXD1V7xMF9g5nTkdfnja3Sxy1PVDCj1Zg4Wb8vY6c=
@@ -428,13 +424,13 @@ github.com/go-git/go-billy/v5 v5.8.0 h1:I8hjc3LbBlXTtVuFNJuwYuMiHvQJDq1AT6u4DwDz
 github.com/go-git/go-billy/v5 v5.8.0/go.mod h1:RpvI/rw4Vr5QA+Z60c6d6LXH0rYJo0uD5SqfmrrheCY=
 github.com/go-git/go-git-fixtures/v4 v4.3.2-0.20231010084843-55a94097c399 h1:eMje31YglSBqCdIqdhKBW8lokaMrL3uTkpGYlE2OOT4=
 github.com/go-git/go-git-fixtures/v4 v4.3.2-0.20231010084843-55a94097c399/go.mod h1:1OCfN199q1Jm3HZlxleg+Dw/mwps2Wbk9frAWm+4FII=
-github.com/go-git/go-git/v5 v5.17.0 h1:AbyI4xf+7DsjINHMu35quAh4wJygKBKBuXVjV/pxesM=
-github.com/go-git/go-git/v5 v5.17.0/go.mod h1:f82C4YiLx+Lhi8eHxltLeGC5uBTXSFa6PC5WW9o4SjI=
+github.com/go-git/go-git/v5 v5.18.0 h1:O831KI+0PR51hM2kep6T8k+w0/LIAD490gvqMCvL5hM=
+github.com/go-git/go-git/v5 v5.18.0/go.mod h1:pW/VmeqkanRFqR6AljLcs7EA7FbZaN5MQqO7oZADXpo=
 github.com/go-gl/glfw v0.0.0-20190409004039-e6da0acd62b1/go.mod h1:vR7hzQXu2zJy9AVAgeJqvqgH9Q5CA+iKCZ2gyEVpxRU=
 github.com/go-gl/glfw/v3.3/glfw v0.0.0-20191125211704-12ad95a8df72/go.mod h1:tQ2UAYgL5IevRw8kRxooKSPJfGvJ9fJQFa0TUsXzTg8=
 github.com/go-gl/glfw/v3.3/glfw v0.0.0-20200222043503-6f7a984d4dc4/go.mod h1:tQ2UAYgL5IevRw8kRxooKSPJfGvJ9fJQFa0TUsXzTg8=
-github.com/go-jose/go-jose/v4 v4.1.2 h1:TK/7NqRQZfgAh+Td8AlsrvtPoUyiHh0LqVvokh+1vHI=
-github.com/go-jose/go-jose/v4 v4.1.2/go.mod h1:22cg9HWM1pOlnRiY+9cQYJ9XHmya1bYW8OeDM6Ku6Oo=
+github.com/go-jose/go-jose/v4 v4.1.4 h1:moDMcTHmvE6Groj34emNPLs/qtYXRVcd6S7NHbHz3kA=
+github.com/go-jose/go-jose/v4 v4.1.4/go.mod h1:x4oUasVrzR7071A4TnHLGSPpNOm2a21K9Kf04k1rs08=
 github.com/go-kit/kit v0.8.0/go.mod h1:xBxKIO96dXMWWy0MnWVtmwkA9/13aqxPnvrjFYMA2as=
 github.com/go-kit/kit v0.9.0/go.mod h1:xBxKIO96dXMWWy0MnWVtmwkA9/13aqxPnvrjFYMA2as=
 github.com/go-logfmt/logfmt v0.3.0/go.mod h1:Qt1PoO58o5twSAckw1HlFXLmHsOX5/0LbT9GBnD5lWE=
@@ -515,8 +511,8 @@ github.com/google/go-cmp v0.5.5/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/
 github.com/google/go-cmp v0.5.6/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
 github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
 github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
-github.com/google/go-containerregistry v0.21.1 h1:sOt/o9BS2b87FnR7wxXPvRKU1XVJn2QCwOS5g8zQXlc=
-github.com/google/go-containerregistry v0.21.1/go.mod h1:ctO5aCaewH4AK1AumSF5DPW+0+R+d2FmylMJdp5G7p0=
+github.com/google/go-containerregistry v0.21.5 h1:KTJG9Pn/jC0VdZR6ctV3/jcN+q6/Iqlx0sTVz3ywZlM=
+github.com/google/go-containerregistry v0.21.5/go.mod h1:ySvMuiWg+dOsRW0Hw8GYwfMwBlNRTmpYBFJPlkco5zU=
 github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
 github.com/google/licensecheck v0.3.1 h1:QoxgoDkaeC4nFrtGN1jV7IPmDCHFNIVh54e5hSt6sPs=
 github.com/google/licensecheck v0.3.1/go.mod h1:ORkR35t/JjW+emNKtfJDII0zlciG9JgbT7SmsohlHmY=
@@ -551,14 +547,14 @@ github.com/google/s2a-go v0.1.9/go.mod h1:YA0Ei2ZQL3acow2O62kdp9UlnvMmU7kA6Eutn0
 github.com/google/uuid v1.1.2/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
 github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
 github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
-github.com/googleapis/enterprise-certificate-proxy v0.3.7 h1:zrn2Ee/nWmHulBx5sAVrGgAa0f2/R35S4DJwfFaUPFQ=
-github.com/googleapis/enterprise-certificate-proxy v0.3.7/go.mod h1:MkHOF77EYAE7qfSuSS9PU6g4Nt4e11cnsDUowfwewLA=
+github.com/googleapis/enterprise-certificate-proxy v0.3.14 h1:yh8ncqsbUY4shRD5dA6RlzjJaT4hi3kII+zYw8wmLb8=
+github.com/googleapis/enterprise-certificate-proxy v0.3.14/go.mod h1:vqVt9yG9480NtzREnTlmGSBmFrA+bzb0yl0TxoBQXOg=
 github.com/googleapis/gax-go/v2 v2.0.4/go.mod h1:0Wqv26UfaUD9n4G6kQubkQ+KchISgw+vpHVxEJEs9eg=
 github.com/googleapis/gax-go/v2 v2.0.5/go.mod h1:DWXyrwAJ9X0FpwwEdw+IPEYBICEFu5mhpdKc/us6bOk=
 github.com/googleapis/gax-go/v2 v2.1.0/go.mod h1:Q3nei7sK6ybPYH7twZdmQpAd1MKb7pfu6SK+H1/DsU0=
 github.com/googleapis/gax-go/v2 v2.1.1/go.mod h1:hddJymUZASv3XPyGkUpKj8pPO47Rmb0eJc8R6ouapiM=
-github.com/googleapis/gax-go/v2 v2.15.0 h1:SyjDc1mGgZU5LncH8gimWo9lW1DtIfPibOG81vgd/bo=
-github.com/googleapis/gax-go/v2 v2.15.0/go.mod h1:zVVkkxAQHa1RQpg9z2AUCMnKhi0Qld9rcmyfL1OZhoc=
+github.com/googleapis/gax-go/v2 v2.17.0 h1:RksgfBpxqff0EZkDWYuz9q/uWsTVz+kf43LsZ1J6SMc=
+github.com/googleapis/gax-go/v2 v2.17.0/go.mod h1:mzaqghpQp4JDh3HvADwrat+6M3MOIDp5YKHhb9PAgDY=
 github.com/gookit/assert v0.1.1 h1:lh3GcawXe/p+cU7ESTZ5Ui3Sm/x8JWpIis4/1aF0mY0=
 github.com/gookit/assert v0.1.1/go.mod h1:jS5bmIVQZTIwk42uXl4lyj4iaaxx32tqH16CFj0VX2E=
 github.com/gookit/color v1.2.5/go.mod h1:AhIE+pS6D4Ql0SQWbBeXPHw7gY0/sjHoA4s/n1KB7xg=
@@ -567,8 +563,8 @@ github.com/gookit/color v1.6.0/go.mod h1:9ACFc7/1IpHGBW8RwuDm/0YEnhg3dwwXpoMsmty
 github.com/gpustack/gguf-parser-go v0.24.0 h1:tdJceXYp9e5RhE9RwVYIuUpir72Jz2D68NEtDXkKCKc=
 github.com/gpustack/gguf-parser-go v0.24.0/go.mod h1:y4TwTtDqFWTK+xvprOjRUh+dowgU2TKCX37vRKvGiZ0=
 github.com/grpc-ecosystem/grpc-gateway v1.16.0/go.mod h1:BDjrQk3hbvj6Nolgz8mAMFbcEtjT1g+wF4CSlocrBnw=
-github.com/hashicorp/aws-sdk-go-base/v2 v2.0.0-beta.70 h1:0HADrxxqaQkGycO1JoUUA+B4FnIkuo8d2bz/hSaTFFQ=
-github.com/hashicorp/aws-sdk-go-base/v2 v2.0.0-beta.70/go.mod h1:fm2FdDCzJdtbXF7WKAMvBb5NEPouXPHFbGNYs9ShFns=
+github.com/hashicorp/aws-sdk-go-base/v2 v2.0.0-beta.72 h1:vTCWu1wbdYo7PEZFem/rlr01+Un+wwVmI7wiegFdRLk=
+github.com/hashicorp/aws-sdk-go-base/v2 v2.0.0-beta.72/go.mod h1:Vn+BBgKQHVQYdVQ4NZDICE1Brb+JfaONyDHr3q07oQc=
 github.com/hashicorp/consul/api v1.11.0/go.mod h1:XjsvQN+RJGWI2TWy1/kqaE16HrR2J/FWgkYjdZQsX9M=
 github.com/hashicorp/consul/sdk v0.8.0/go.mod h1:GBvyrGALthsZObzUGsfgHZQDXjg4lOjagTIwIR1vPms=
 github.com/hashicorp/errwrap v1.0.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
@@ -578,8 +574,8 @@ github.com/hashicorp/go-cleanhttp v0.5.0/go.mod h1:JpRdi6/HCYpAwUzNwuwqhbovhLtng
 github.com/hashicorp/go-cleanhttp v0.5.1/go.mod h1:JpRdi6/HCYpAwUzNwuwqhbovhLtngrth3wmdIIUrZ80=
 github.com/hashicorp/go-cleanhttp v0.5.2 h1:035FKYIWjmULyFRBKPs8TBQoi0x6d9G4xc9neXJWAZQ=
 github.com/hashicorp/go-cleanhttp v0.5.2/go.mod h1:kO/YDlP8L1346E6Sodw+PrpBSV4/SoxCXGY6BqNFT48=
-github.com/hashicorp/go-getter v1.8.4 h1:hGEd2xsuVKgwkMtPVufq73fAmZU/x65PPcqH3cb0D9A=
-github.com/hashicorp/go-getter v1.8.4/go.mod h1:x27pPGSg9kzoB147QXI8d/nDvp2IgYGcwuRjpaXE9Yg=
+github.com/hashicorp/go-getter v1.8.6 h1:9sQboWULaydVphxc4S64oAI4YqpuCk7nPmvbk131ebY=
+github.com/hashicorp/go-getter v1.8.6/go.mod h1:nVH12eOV2P58dIiL3rsU6Fh3wLeJEKBOJzhMmzlSWoo=
 github.com/hashicorp/go-hclog v0.12.0/go.mod h1:whpDNt7SSdeAju8AWKIWsul05p54N/39EeqMAyrmvFQ=
 github.com/hashicorp/go-hclog v1.0.0/go.mod h1:whpDNt7SSdeAju8AWKIWsul05p54N/39EeqMAyrmvFQ=
 github.com/hashicorp/go-immutable-radix v1.0.0/go.mod h1:0y9vanUI8NX6FsYoO3zeMjhV/C5i9g4Q3DwcSNZ4P60=
@@ -650,8 +646,8 @@ github.com/kevinburke/ssh_config v1.2.0/go.mod h1:CT57kijsi8u/K/BOFA39wgDQJ9CxiF
 github.com/kisielk/errcheck v1.5.0/go.mod h1:pFxgyoBC7bSaBwPgfKdkLd5X25qrDl4LWUI2bnpBCr8=
 github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+oQHNcck=
 github.com/klauspost/compress v1.4.1/go.mod h1:RyIbtBH6LamlWaDj8nUwkbUhJ87Yi3uG0guNDohfE1A=
-github.com/klauspost/compress v1.18.4 h1:RPhnKRAQ4Fh8zU2FY/6ZFDwTVTxgJ/EMydqSTzE9a2c=
-github.com/klauspost/compress v1.18.4/go.mod h1:R0h/fSBs8DE4ENlcrlib3PsXS61voFxhIs2DeRhCvJ4=
+github.com/klauspost/compress v1.18.5 h1:/h1gH5Ce+VWNLSWqPzOVn6XBO+vJbCNGvjoaGBFW2IE=
+github.com/klauspost/compress v1.18.5/go.mod h1:cwPg85FWrGar70rWktvGQj8/hthj3wpl0PGDogxkrSQ=
 github.com/klauspost/cpuid v1.2.0/go.mod h1:Pj4uuM528wm8OyEC2QMXAi2YiTZ96dNQPGgoMS4s3ek=
 github.com/klauspost/pgzip v1.2.6 h1:8RXeL5crjEUFnR2/Sn6GJNWtSQ3Dk8pq4CL3jvdDyjU=
 github.com/klauspost/pgzip v1.2.6/go.mod h1:Ch1tH69qFZu15pkjo5kYi6mth2Zzwzt50oCQKQE9RUs=
@@ -727,10 +723,10 @@ github.com/moby/docker-image-spec v1.3.1 h1:jMKff3w6PgbfSa69GfNg+zN/XLhfXJGnEx3N
 github.com/moby/docker-image-spec v1.3.1/go.mod h1:eKmb5VW8vQEh/BAr2yvVNvuiJuY6UIocYsFu/DxxRpo=
 github.com/moby/locker v1.0.1 h1:fOXqR41zeveg4fFODix+1Ch4mj/gT0NE1XJbp/epuBg=
 github.com/moby/locker v1.0.1/go.mod h1:S7SDdo5zpBK84bzzVlKr2V0hz+7x9hWbYC/kq7oQppc=
-github.com/moby/moby/api v1.53.0 h1:PihqG1ncw4W+8mZs69jlwGXdaYBeb5brF6BL7mPIS/w=
-github.com/moby/moby/api v1.53.0/go.mod h1:8mb+ReTlisw4pS6BRzCMts5M49W5M7bKt1cJy/YbAqc=
-github.com/moby/moby/client v0.2.2 h1:Pt4hRMCAIlyjL3cr8M5TrXCwKzguebPAc2do2ur7dEM=
-github.com/moby/moby/client v0.2.2/go.mod h1:2EkIPVNCqR05CMIzL1mfA07t0HvVUUOl85pasRz/GmQ=
+github.com/moby/moby/api v1.54.1 h1:TqVzuJkOLsgLDDwNLmYqACUuTehOHRGKiPhvH8V3Nn4=
+github.com/moby/moby/api v1.54.1/go.mod h1:+RQ6wluLwtYaTd1WnPLykIDPekkuyD/ROWQClE83pzs=
+github.com/moby/moby/client v0.4.0 h1:S+2XegzHQrrvTCvF6s5HFzcrywWQmuVnhOXe2kiWjIw=
+github.com/moby/moby/client v0.4.0/go.mod h1:QWPbvWchQbxBNdaLSpoKpCdf5E+WxFAgNHogCWDoa7g=
 github.com/moby/sys/mountinfo v0.7.2 h1:1shs6aH5s4o5H2zQLn796ADW1wMrIwHsyJ2v9KouLrg=
 github.com/moby/sys/mountinfo v0.7.2/go.mod h1:1YOa8w8Ih7uW0wALDUgT1dTTSBrZ+HiBLGws92L2RU4=
 github.com/moby/sys/sequential v0.6.0 h1:qrx7XFUd/5DxtqcoH1h438hF5TmOvzC/lspjy7zgvCU=
@@ -766,12 +762,12 @@ github.com/nwaples/rardecode/v2 v2.2.0 h1:4ufPGHiNe1rYJxYfehALLjup4Ls3ck42CWwjKi
 github.com/nwaples/rardecode/v2 v2.2.0/go.mod h1:7uz379lSxPe6j9nvzxUZ+n7mnJNgjsRNb6IbvGVHRmw=
 github.com/olekukonko/cat v0.0.0-20250911104152-50322a0618f6 h1:zrbMGy9YXpIeTnGj4EljqMiZsIcE09mmF8XsD5AYOJc=
 github.com/olekukonko/cat v0.0.0-20250911104152-50322a0618f6/go.mod h1:rEKTHC9roVVicUIfZK7DYrdIoM0EOr8mK1Hj5s3JjH0=
-github.com/olekukonko/errors v1.1.0 h1:RNuGIh15QdDenh+hNvKrJkmxxjV4hcS50Db478Ou5sM=
-github.com/olekukonko/errors v1.1.0/go.mod h1:ppzxA5jBKcO1vIpCXQ9ZqgDh8iwODz6OXIGKU8r5m4Y=
-github.com/olekukonko/ll v0.1.4-0.20260115111900-9e59c2286df0 h1:jrYnow5+hy3WRDCBypUFvVKNSPPCdqgSXIE9eJDD8LM=
-github.com/olekukonko/ll v0.1.4-0.20260115111900-9e59c2286df0/go.mod h1:b52bVQRRPObe+yyBl0TxNfhesL0nedD4Cht0/zx55Ew=
-github.com/olekukonko/tablewriter v1.1.3 h1:VSHhghXxrP0JHl+0NnKid7WoEmd9/urKRJLysb70nnA=
-github.com/olekukonko/tablewriter v1.1.3/go.mod h1:9VU0knjhmMkXjnMKrZ3+L2JhhtsQ/L38BbL3CRNE8tM=
+github.com/olekukonko/errors v1.2.0 h1:10Zcn4GeV59t/EGqJc8fUjtFT/FuUh5bTMzZ1XwmCRo=
+github.com/olekukonko/errors v1.2.0/go.mod h1:ppzxA5jBKcO1vIpCXQ9ZqgDh8iwODz6OXIGKU8r5m4Y=
+github.com/olekukonko/ll v0.1.6 h1:lGVTHO+Qc4Qm+fce/2h2m5y9LvqaW+DCN7xW9hsU3uA=
+github.com/olekukonko/ll v0.1.6/go.mod h1:NVUmjBb/aCtUpjKk75BhWrOlARz3dqsM+OtszpY4o88=
+github.com/olekukonko/tablewriter v1.1.4 h1:ORUMI3dXbMnRlRggJX3+q7OzQFDdvgbN9nVWj1drm6I=
+github.com/olekukonko/tablewriter v1.1.4/go.mod h1:+kedxuyTtgoZLwif3P1Em4hARJs+mVnzKxmsCL/C5RY=
 github.com/onsi/gomega v1.34.1 h1:EUMJIKUjM8sKjYbtxQI9A4z2o+rruxnzNvpknOXie6k=
 github.com/onsi/gomega v1.34.1/go.mod h1:kU1QgUvBDLXBJq618Xvm2LUX6rSAfRaFRTcdOeDLwwY=
 github.com/opencontainers/go-digest v1.0.0 h1:apOUWs51W5PlhuyGyz9FCeeBIOUDA/6nW8Oi/yOhh5U=
@@ -845,8 +841,8 @@ github.com/rust-secure-code/go-rustaudit v0.0.0-20250226111315-e20ec32e963c/go.m
 github.com/rwcarlsen/goexif v0.0.0-20190401172101-9e8deecbddbd/go.mod h1:hPqNNc0+uJM6H+SuU8sEs5K5IQeKccPqeSjfgcKGgPk=
 github.com/ryanuber/columnize v0.0.0-20160712163229-9b3edd62028f/go.mod h1:sm1tb6uqfes/u+d4ooFouqFdy9/2g9QGwK3SQygK0Ts=
 github.com/sagikazarmark/crypt v0.3.0/go.mod h1:uD/D+6UF4SrIR1uGEv7bBNkNqLGqUr43MRiaGWX1Nig=
-github.com/sagikazarmark/locafero v0.7.0 h1:5MqpDsTGNDhY8sGp0Aowyf0qKsPrhewaLSsFaodPcyo=
-github.com/sagikazarmark/locafero v0.7.0/go.mod h1:2za3Cg5rMaTMoG/2Ulr9AwtFaIppKXTRYnozin4aB5k=
+github.com/sagikazarmark/locafero v0.11.0 h1:1iurJgmM9G3PA/I+wWYIOw/5SyBtxapeHDcg+AAIFXc=
+github.com/sagikazarmark/locafero v0.11.0/go.mod h1:nVIGvgyzw595SUSUE6tvCp3YYTeHs15MvlmU87WwIik=
 github.com/sahilm/fuzzy v0.1.1 h1:ceu5RHF8DGgoi+/dR5PsECjCDH1BE3Fnmpo7aVXOdRA=
 github.com/sahilm/fuzzy v0.1.1/go.mod h1:VFvziUEIMCrT6A6tw2RFIXPXXmzXbOsSHF0DOI8ZK9Y=
 github.com/saintfish/chardet v0.0.0-20230101081208-5e3ef4b5456d h1:hrujxIzL1woJ7AwssoOcM/tq5JjjG2yYOc8odClEiXA=
@@ -877,8 +873,8 @@ github.com/smallnest/ringbuffer v0.0.0-20241116012123-461381446e3d h1:3VwvTjiRPA
 github.com/smallnest/ringbuffer v0.0.0-20241116012123-461381446e3d/go.mod h1:tAG61zBM1DYRaGIPloumExGvScf08oHuo0kFoOqdbT0=
 github.com/sorairolake/lzip-go v0.3.8 h1:j5Q2313INdTA80ureWYRhX+1K78mUXfMoPZCw/ivWik=
 github.com/sorairolake/lzip-go v0.3.8/go.mod h1:JcBqGMV0frlxwrsE9sMWXDjqn3EeVf0/54YPsw66qkU=
-github.com/sourcegraph/conc v0.3.0 h1:OQTbbt6P72L20UqAkXXuLOj79LfEanQ+YQFNpLA9ySo=
-github.com/sourcegraph/conc v0.3.0/go.mod h1:Sdozi7LEKbFPqYX2/J+iBAM6HpqSLTASQIKqDmF7Mt0=
+github.com/sourcegraph/conc v0.3.1-0.20240121214520-5f936abd7ae8 h1:+jumHNA0Wrelhe64i8F6HNlS8pkoyMv5sreGx2Ry5Rw=
+github.com/sourcegraph/conc v0.3.1-0.20240121214520-5f936abd7ae8/go.mod h1:3n1Cwaq1E1/1lhQhtRK2ts/ZwZEhjcQeJQ1RuC6Q/8U=
 github.com/spaolacci/murmur3 v0.0.0-20180118202830-f09979ecbc72/go.mod h1:JwIasOWyU6f++ZhiEuf87xNszmSA2myDM2Kzu9HwQUA=
 github.com/spdx/gordf v0.0.0-20201111095634-7098f93598fb h1:bLo8hvc8XFm9J47r690TUKBzcjSWdJDxmjXJZ+/f92U=
 github.com/spdx/gordf v0.0.0-20201111095634-7098f93598fb/go.mod h1:uKWaldnbMnjsSAXRurWqqrdyZen1R7kxl8TkmWk2OyM=
@@ -889,8 +885,8 @@ github.com/spf13/afero v1.6.0/go.mod h1:Ai8FlHk4v/PARR026UzYexafAt9roJ7LcLMAmO6Z
 github.com/spf13/afero v1.15.0 h1:b/YBCLWAJdFWJTN9cLhiXXcD7mzKn9Dm86dNnfyQw1I=
 github.com/spf13/afero v1.15.0/go.mod h1:NC2ByUVxtQs4b3sIUphxK0NioZnmxgyCrfzeuq8lxMg=
 github.com/spf13/cast v1.4.1/go.mod h1:Qx5cxh0v+4UWYiBimWS+eyWzqEqokIECu5etghLkUJE=
-github.com/spf13/cast v1.7.1 h1:cuNEagBQEHWN1FnbGEjCXL2szYEXqfJPbP2HNUaca9Y=
-github.com/spf13/cast v1.7.1/go.mod h1:ancEpBxwJDODSW/UG4rDrAqiKolqNNh2DX3mk86cAdo=
+github.com/spf13/cast v1.10.0 h1:h2x0u2shc1QuLHfxi+cTJvs30+ZAHOGRic8uyGTDWxY=
+github.com/spf13/cast v1.10.0/go.mod h1:jNfB8QC9IA6ZuY2ZjDp0KtFO2LZZlg4S/7bzP6qqeHo=
 github.com/spf13/cobra v1.3.0/go.mod h1:BrRVncBjOJa/eUcVVm9CE+oC6as8k+VYr4NY7WCi9V4=
 github.com/spf13/cobra v1.10.2 h1:DMTTonx5m65Ic0GOoRY2c16WCbHxOOw6xxezuLaBpcU=
 github.com/spf13/cobra v1.10.2/go.mod h1:7C1pvHqHw5A4vrJfjNwvOdzYu0Gml16OCs2GRiTUUS4=
@@ -900,10 +896,10 @@ github.com/spf13/pflag v1.0.9/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An
 github.com/spf13/pflag v1.0.10 h1:4EBh2KAYBwaONj6b2Ye1GiHfwjqyROoF4RwYO+vPwFk=
 github.com/spf13/pflag v1.0.10/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
 github.com/spf13/viper v1.10.0/go.mod h1:SoyBPwAtKDzypXNDFKN5kzH7ppppbGZtls1UpIy5AsM=
-github.com/spf13/viper v1.20.0 h1:zrxIyR3RQIOsarIrgL8+sAvALXul9jeEPa06Y0Ph6vY=
-github.com/spf13/viper v1.20.0/go.mod h1:P9Mdzt1zoHIG8m2eZQinpiBjo6kCmZSKBClNNqjJvu4=
-github.com/spiffe/go-spiffe/v2 v2.5.0 h1:N2I01KCUkv1FAjZXJMwh95KK1ZIQLYbPfhaxw8WS0hE=
-github.com/spiffe/go-spiffe/v2 v2.5.0/go.mod h1:P+NxobPc6wXhVtINNtFjNWGBTreew1GBUCwT2wPmb7g=
+github.com/spf13/viper v1.21.0 h1:x5S+0EU27Lbphp4UKm1C+1oQO+rKx36vfCoaVebLFSU=
+github.com/spf13/viper v1.21.0/go.mod h1:P0lhsswPGWD/1lZJ9ny3fYnVqxiegrlNrEmgLjbTCAY=
+github.com/spiffe/go-spiffe/v2 v2.6.0 h1:l+DolpxNWYgruGQVV0xsfeya3CsC7m8iBzDnMpsbLuo=
+github.com/spiffe/go-spiffe/v2 v2.6.0/go.mod h1:gm2SeUoMZEtpnzPNs2Csc0D/gX33k1xIx7lEzqblHEs=
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
 github.com/stretchr/objx v0.1.1/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
 github.com/stretchr/objx v0.4.0/go.mod h1:YvHI0jy2hoMjB+UWwv71VJQ9isScKT/TqJzVSSt89Yw=
@@ -925,8 +921,8 @@ github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD
 github.com/subosito/gotenv v1.2.0/go.mod h1:N0PQaV/YGNqwC0u51sEeR/aUtSLEXKX9iv69rRypqCw=
 github.com/subosito/gotenv v1.6.0 h1:9NlTDc1FTs4qu0DDq7AEtTPNw6SVm7uBMsUCUjABIf8=
 github.com/subosito/gotenv v1.6.0/go.mod h1:Dk4QP5c2W3ibzajGcXpNraDfq2IrhjMIvMSWPKKo0FU=
-github.com/sylabs/sif/v2 v2.23.0 h1:VWJC7iryINdIgyIK8EdxMCJkx8EDPVlvFaskgY+ruFk=
-github.com/sylabs/sif/v2 v2.23.0/go.mod h1:0UJk7MMSQS2n/95yYd+CvAfK7K2mE0aWHRYYybd+ouw=
+github.com/sylabs/sif/v2 v2.24.0 h1:1wB5uMDUQYjk8AckTySaDcP9YnpMb1LyDRr1Jt9A10w=
+github.com/sylabs/sif/v2 v2.24.0/go.mod h1:DbXWqWZ1hdLSU+K9ipdds5AmZeHWsyxCOj/oQakBa88=
 github.com/sylabs/squashfs v1.0.6 h1:PvJcDzxr+vIm2kH56mEMbaOzvGu79gK7P7IX+R7BDZI=
 github.com/sylabs/squashfs v1.0.6/go.mod h1:DlDeUawVXLWAsSRa085Eo0ZenGzAB32JdAUFaB0LZfE=
 github.com/terminalstatic/go-xsd-validate v0.1.6 h1:TenYeQ3eY631qNi1/cTmLH/s2slHPRKTTHT+XSHkepo=
@@ -984,8 +980,6 @@ github.com/zclconf/go-cty v1.16.3 h1:osr++gw2T61A8KVYHoQiFbFd1Lh3JOCXc/jFLJXKTxk
 github.com/zclconf/go-cty v1.16.3/go.mod h1:VvMs5i0vgZdhYawQNq5kePSpLAoz8u1xvZgrPIxfnZE=
 github.com/zclconf/go-cty-debug v0.0.0-20240509010212-0d6042c53940 h1:4r45xpDWB6ZMSMNJFMOjqrGHynW3DIBuR2H9j0ug+Mo=
 github.com/zclconf/go-cty-debug v0.0.0-20240509010212-0d6042c53940/go.mod h1:CmBdvvj3nqzfzJ6nTCIwDTPZ56aVGvDrmztiO5g3qrM=
-github.com/zeebo/errs v1.4.0 h1:XNdoD/RRMKP7HD0UhJnIzUy74ISdGGxURlYG8HSWSfM=
-github.com/zeebo/errs v1.4.0/go.mod h1:sgbWHsvVuTPHcqJJGQ1WhI5KbWlHYz+2+2C/LSEtCw4=
 github.com/zyedidia/generic v1.2.2-0.20230320175451-4410d2372cb1 h1:V+UsotZpAVvfj3X/LMoEytoLzSiP6Lg0F7wdVyu9gGg=
 github.com/zyedidia/generic v1.2.2-0.20230320175451-4410d2372cb1/go.mod h1:ly2RBz4mnz1yeuVbQA/VFwGjK3mnHGRj1JuoG336Bis=
 go.etcd.io/etcd/api/v3 v3.5.1/go.mod h1:cbVKeC6lCfl7j/8jBhAK6aIYO9XOjdptoxU/nLQcPvs=
@@ -1002,33 +996,29 @@ go.opencensus.io v0.24.0 h1:y73uSU6J157QMP2kn2r30vwW1A2W2WFwSCGnAVxeaD0=
 go.opencensus.io v0.24.0/go.mod h1:vNK8G9p7aAivkbmorf4v+7Hgx+Zs0yY+0fOtgBfjQKo=
 go.opentelemetry.io/auto/sdk v1.2.1 h1:jXsnJ4Lmnqd11kwkBV2LgLoFMZKizbCi5fNZ/ipaZ64=
 go.opentelemetry.io/auto/sdk v1.2.1/go.mod h1:KRTj+aOaElaLi+wW1kO/DZRXwkF4C5xPbEe3ZiIhN7Y=
-go.opentelemetry.io/contrib/detectors/gcp v1.36.0 h1:F7q2tNlCaHY9nMKHR6XH9/qkp8FktLnIcy6jJNyOCQw=
-go.opentelemetry.io/contrib/detectors/gcp v1.36.0/go.mod h1:IbBN8uAIIx734PTonTPxAxnjc2pQTxWNkwfstZ+6H2k=
+go.opentelemetry.io/contrib/detectors/gcp v1.39.0 h1:kWRNZMsfBHZ+uHjiH4y7Etn2FK26LAGkNFw7RHv1DhE=
+go.opentelemetry.io/contrib/detectors/gcp v1.39.0/go.mod h1:t/OGqzHBa5v6RHZwrDBJ2OirWc+4q/w2fTbLZwAKjTk=
 go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.63.0 h1:YH4g8lQroajqUwWbq/tr2QX1JFmEXaDLgG+ew9bLMWo=
 go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.63.0/go.mod h1:fvPi2qXDqFs8M4B4fmJhE92TyQs9Ydjlg3RvfUp+NbQ=
 go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.61.0 h1:F7Jx+6hwnZ41NSFTO5q4LYDtJRXBf2PD0rNBkeB/lus=
 go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.61.0/go.mod h1:UHB22Z8QsdRDrnAtX4PntOl36ajSxcdUMt1sF7Y6E7Q=
-go.opentelemetry.io/otel v1.40.0 h1:oA5YeOcpRTXq6NN7frwmwFR0Cn3RhTVZvXsP4duvCms=
-go.opentelemetry.io/otel v1.40.0/go.mod h1:IMb+uXZUKkMXdPddhwAHm6UfOwJyh4ct1ybIlV14J0g=
-go.opentelemetry.io/otel/exporters/stdout/stdoutmetric v1.38.0 h1:wm/Q0GAAykXv83wzcKzGGqAnnfLFyFe7RslekZuv+VI=
-go.opentelemetry.io/otel/exporters/stdout/stdoutmetric v1.38.0/go.mod h1:ra3Pa40+oKjvYh+ZD3EdxFZZB0xdMfuileHAm4nNN7w=
-go.opentelemetry.io/otel/metric v1.40.0 h1:rcZe317KPftE2rstWIBitCdVp89A2HqjkxR3c11+p9g=
-go.opentelemetry.io/otel/metric v1.40.0/go.mod h1:ib/crwQH7N3r5kfiBZQbwrTge743UDc7DTFVZrrXnqc=
-go.opentelemetry.io/otel/sdk v1.40.0 h1:KHW/jUzgo6wsPh9At46+h4upjtccTmuZCFAc9OJ71f8=
-go.opentelemetry.io/otel/sdk v1.40.0/go.mod h1:Ph7EFdYvxq72Y8Li9q8KebuYUr2KoeyHx0DRMKrYBUE=
-go.opentelemetry.io/otel/sdk/metric v1.40.0 h1:mtmdVqgQkeRxHgRv4qhyJduP3fYJRMX4AtAlbuWdCYw=
-go.opentelemetry.io/otel/sdk/metric v1.40.0/go.mod h1:4Z2bGMf0KSK3uRjlczMOeMhKU2rhUqdWNoKcYrtcBPg=
-go.opentelemetry.io/otel/trace v1.40.0 h1:WA4etStDttCSYuhwvEa8OP8I5EWu24lkOzp+ZYblVjw=
-go.opentelemetry.io/otel/trace v1.40.0/go.mod h1:zeAhriXecNGP/s2SEG3+Y8X9ujcJOTqQ5RgdEJcawiA=
+go.opentelemetry.io/otel v1.43.0 h1:mYIM03dnh5zfN7HautFE4ieIig9amkNANT+xcVxAj9I=
+go.opentelemetry.io/otel v1.43.0/go.mod h1:JuG+u74mvjvcm8vj8pI5XiHy1zDeoCS2LB1spIq7Ay0=
+go.opentelemetry.io/otel/exporters/stdout/stdoutmetric v1.40.0 h1:ZrPRak/kS4xI3AVXy8F7pipuDXmDsrO8Lg+yQjBLjw0=
+go.opentelemetry.io/otel/exporters/stdout/stdoutmetric v1.40.0/go.mod h1:3y6kQCWztq6hyW8Z9YxQDDm0Je9AJoFar2G0yDcmhRk=
+go.opentelemetry.io/otel/metric v1.43.0 h1:d7638QeInOnuwOONPp4JAOGfbCEpYb+K6DVWvdxGzgM=
+go.opentelemetry.io/otel/metric v1.43.0/go.mod h1:RDnPtIxvqlgO8GRW18W6Z/4P462ldprJtfxHxyKd2PY=
+go.opentelemetry.io/otel/sdk v1.43.0 h1:pi5mE86i5rTeLXqoF/hhiBtUNcrAGHLKQdhg4h4V9Dg=
+go.opentelemetry.io/otel/sdk v1.43.0/go.mod h1:P+IkVU3iWukmiit/Yf9AWvpyRDlUeBaRg6Y+C58QHzg=
+go.opentelemetry.io/otel/sdk/metric v1.43.0 h1:S88dyqXjJkuBNLeMcVPRFXpRw2fuwdvfCGLEo89fDkw=
+go.opentelemetry.io/otel/sdk/metric v1.43.0/go.mod h1:C/RJtwSEJ5hzTiUz5pXF1kILHStzb9zFlIEe85bhj6A=
+go.opentelemetry.io/otel/trace v1.43.0 h1:BkNrHpup+4k4w+ZZ86CZoHHEkohws8AY+WTX09nk+3A=
+go.opentelemetry.io/otel/trace v1.43.0/go.mod h1:/QJhyVBUUswCphDVxq+8mld+AvhXZLhe+8WVFxiFff0=
 go.opentelemetry.io/proto/otlp v0.7.0/go.mod h1:PqfVotwruBrMGOCsRd/89rSnXhoiJIqeYNgFYFoEGnI=
 go.uber.org/atomic v1.7.0/go.mod h1:fEN4uk6kAWBTFdckzkM89CLk9XfWZrxpCo0nPH17wJc=
-go.uber.org/atomic v1.9.0 h1:ECmE8Bn/WFTYwEW/bpKD3M8VtR/zQVbavAoalC1PYyE=
-go.uber.org/atomic v1.9.0/go.mod h1:fEN4uk6kAWBTFdckzkM89CLk9XfWZrxpCo0nPH17wJc=
 go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto=
 go.uber.org/goleak v1.3.0/go.mod h1:CoHD4mav9JJNrW/WLlf7HGZPjdw8EucARQHekz1X6bE=
 go.uber.org/multierr v1.6.0/go.mod h1:cdWPpRnG4AhwMwsgIHip0KRBQjJy5kYEpYjJxpXp9iU=
-go.uber.org/multierr v1.9.0 h1:7fIwc/ZtS0q++VgcfqFDxSBZVv/Xo49/SYnDFupUwlI=
-go.uber.org/multierr v1.9.0/go.mod h1:X2jQV1h+kxSjClGpnseKVIxpmcjrj7MNnI0bnlfKTVQ=
 go.uber.org/zap v1.17.0/go.mod h1:MXVU+bhUf/A7Xi2HNOnopQOrmycQ5Ih87HtOu4q5SSo=
 go.yaml.in/yaml/v3 v3.0.4 h1:tfq32ie2Jv2UxXFdLJdh3jXuOzWiL1fo0bu/FbuKpbc=
 go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg=
@@ -1046,8 +1036,8 @@ golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPh
 golang.org/x/crypto v0.0.0-20210817164053-32db794688a5/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
 golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
 golang.org/x/crypto v0.0.0-20220622213112-05595931fe9d/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=
-golang.org/x/crypto v0.48.0 h1:/VRzVqiRSggnhY7gNRxPauEQ5Drw9haKdM0jqfcCFts=
-golang.org/x/crypto v0.48.0/go.mod h1:r0kV5h3qnFPlQnBSrULhlsRfryS2pmewsg+XfMgkVos=
+golang.org/x/crypto v0.50.0 h1:zO47/JPrL6vsNkINmLoo/PH1gcxpls50DNogFvB5ZGI=
+golang.org/x/crypto v0.50.0/go.mod h1:3muZ7vA7PBCE6xgPX7nkzzjiUq87kRItoJQM1Yo8S+Q=
 golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
 golang.org/x/exp v0.0.0-20190306152737-a1d7652674e8/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
 golang.org/x/exp v0.0.0-20190510132918-efd6b22b2522/go.mod h1:ZjyILWgesfNpC6sMxTJOJm9Kp84zZh5NQWvqDGG3Qr8=
@@ -1087,8 +1077,8 @@ golang.org/x/mod v0.4.1/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.4.2/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.5.0/go.mod h1:5OXOZSfqPIIbmVBIIKWRFfZjPR0E5r58TLhUjH0a2Ro=
 golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4=
-golang.org/x/mod v0.33.0 h1:tHFzIWbBifEmbwtGz65eaWyGiGZatSrT9prnU8DbVL8=
-golang.org/x/mod v0.33.0/go.mod h1:swjeQEj+6r7fODbD2cqrnje9PnziFuw4bmLbBZFrQ5w=
+golang.org/x/mod v0.35.0 h1:Ww1D637e6Pg+Zb2KrWfHQUnH2dQRLBQyAtpr/haaJeM=
+golang.org/x/mod v0.35.0/go.mod h1:+GwiRhIInF8wPm+4AoT6L0FA1QWAad3OMdTRx4tFYlU=
 golang.org/x/net v0.0.0-20180724234803-3673e40ba225/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20180826012351-8a410e7b638d/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20181023162649-9b4f9f5ad519/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
@@ -1133,8 +1123,8 @@ golang.org/x/net v0.0.0-20210813160813-60bc85c4be6d/go.mod h1:9nx3DQGgdP8bBQD5qx
 golang.org/x/net v0.0.0-20211112202133-69e39bad7dc2/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
 golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
 golang.org/x/net v0.7.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=
-golang.org/x/net v0.51.0 h1:94R/GTO7mt3/4wIKpcR5gkGmRLOuE/2hNGeWq/GBIFo=
-golang.org/x/net v0.51.0/go.mod h1:aamm+2QF5ogm02fjy5Bb7CQ0WMt1/WVM7FtyaTLlA9Y=
+golang.org/x/net v0.53.0 h1:d+qAbo5L0orcWAr0a9JweQpjXF19LMXJE8Ey7hwOdUA=
+golang.org/x/net v0.53.0/go.mod h1:JvMuJH7rrdiCfbeHoo3fCQU24Lf5JJwT9W3sJFulfgs=
 golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
 golang.org/x/oauth2 v0.0.0-20190226205417-e64efc72b421/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
 golang.org/x/oauth2 v0.0.0-20190604053449-0f29369cfe45/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
@@ -1152,8 +1142,8 @@ golang.org/x/oauth2 v0.0.0-20210805134026-6f1e6394065a/go.mod h1:KelEdhl1UZF7XfJ
 golang.org/x/oauth2 v0.0.0-20210819190943-2bc19b11175f/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A=
 golang.org/x/oauth2 v0.0.0-20211005180243-6b3c2da341f1/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A=
 golang.org/x/oauth2 v0.0.0-20211104180415-d3ed0bb246c8/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A=
-golang.org/x/oauth2 v0.35.0 h1:Mv2mzuHuZuY2+bkyWXIHMfhNdJAdwW3FuWeCPYN5GVQ=
-golang.org/x/oauth2 v0.35.0/go.mod h1:lzm5WQJQwKZ3nwavOZ3IS5Aulzxi68dUSgRHujetwEA=
+golang.org/x/oauth2 v0.36.0 h1:peZ/1z27fi9hUOFCAZaHyrpWG5lwe0RJEEEeH0ThlIs=
+golang.org/x/oauth2 v0.36.0/go.mod h1:YDBUJMTkDnJS+A4BP4eZBjCqtokkg1hODuPjwiGPO7Q=
 golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20181108010431-42b317875d0f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20181221193216-37e7f081c4d4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
@@ -1166,8 +1156,8 @@ golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJ
 golang.org/x/sync v0.0.0-20201207232520-09787c993a3a/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20210220032951-036812b2e83c/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.19.0 h1:vV+1eWNmZ5geRlYjzm2adRgW2/mcpevXNg50YZtPCE4=
-golang.org/x/sync v0.19.0/go.mod h1:9KTHXmSnoGruLpwFjVSX0lNNA75CykiMECbovNTZqGI=
+golang.org/x/sync v0.20.0 h1:e0PTpb7pjO8GAtTs2dQ6jYa5BWYlMuX047Dco/pItO4=
+golang.org/x/sync v0.20.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
 golang.org/x/sys v0.0.0-20180823144017-11551d06cbcc/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20180830151530-49385e6e1522/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20180905080454-ebe1bf3edb33/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
@@ -1242,13 +1232,13 @@ golang.org/x/sys v0.0.0-20220715151400-c0bba94af5f8/go.mod h1:oPkhp1MJrh7nUepCBc
 golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.41.0 h1:Ivj+2Cp/ylzLiEU89QhWblYnOE9zerudt9Ftecq2C6k=
-golang.org/x/sys v0.41.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks=
+golang.org/x/sys v0.43.0 h1:Rlag2XtaFTxp19wS8MXlJwTvoh8ArU6ezoyFsMyCTNI=
+golang.org/x/sys v0.43.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
 golang.org/x/term v0.5.0/go.mod h1:jMB1sMXY+tzblOD4FWmEbocvup2/aLOaQEp7JmGp78k=
-golang.org/x/term v0.40.0 h1:36e4zGLqU4yhjlmxEaagx2KuYbJq3EwY8K943ZsHcvg=
-golang.org/x/term v0.40.0/go.mod h1:w2P8uVp06p2iyKKuvXIm7N/y0UCRt3UfJTfZ7oOpglM=
+golang.org/x/term v0.42.0 h1:UiKe+zDFmJobeJ5ggPwOshJIVt6/Ft0rcfrXZDLWAWY=
+golang.org/x/term v0.42.0/go.mod h1:Dq/D+snpsbazcBG5+F9Q1n2rXV8Ma+71xEjTRufARgY=
 golang.org/x/text v0.0.0-20170915032832-14c0d48ead0c/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.1-0.20180807135948-17ff2d5776d2/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
@@ -1259,13 +1249,13 @@ golang.org/x/text v0.3.5/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
 golang.org/x/text v0.7.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
-golang.org/x/text v0.34.0 h1:oL/Qq0Kdaqxa1KbNeMKwQq0reLCCaFtqu2eNuSeNHbk=
-golang.org/x/text v0.34.0/go.mod h1:homfLqTYRFyVYemLBFl5GgL/DWEiH5wcsQ5gSh1yziA=
+golang.org/x/text v0.36.0 h1:JfKh3XmcRPqZPKevfXVpI1wXPTqbkE5f7JA92a55Yxg=
+golang.org/x/text v0.36.0/go.mod h1:NIdBknypM8iqVmPiuco0Dh6P5Jcdk8lJL0CUebqK164=
 golang.org/x/time v0.0.0-20181108054448-85acf8d2951c/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.0.0-20190308202827-9d24e82272b4/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.0.0-20191024005414-555d28b269f0/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
-golang.org/x/time v0.14.0 h1:MRx4UaLrDotUKUdCIqzPC48t1Y9hANFKIRpNx+Te8PI=
-golang.org/x/time v0.14.0/go.mod h1:eL/Oa2bBBK0TkX57Fyni+NgnyQQN4LitPmob2Hjnqw4=
+golang.org/x/time v0.15.0 h1:bbrp8t3bGUeFOx08pvsMYRTCVSMk89u4tKbNOZbp88U=
+golang.org/x/time v0.15.0/go.mod h1:Y4YMaQmXwGQZoFaVFk4YpCt4FLQMYKZe9oeV/f4MSno=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20190114222345-bf090417da8b/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20190226205152-f727befe758c/go.mod h1:9Yl7xja0Znq3iFh3HoIrodX9oNMXvdceNzlUR8zjMvY=
@@ -1321,8 +1311,8 @@ golang.org/x/tools v0.1.3/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk=
 golang.org/x/tools v0.1.4/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk=
 golang.org/x/tools v0.1.5/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk=
 golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc=
-golang.org/x/tools v0.42.0 h1:uNgphsn75Tdz5Ji2q36v/nsFSfR/9BRFvqhGBaJGd5k=
-golang.org/x/tools v0.42.0/go.mod h1:Ma6lCIwGZvHK6XtgbswSoWroEkhugApmsXyrUmBhfr0=
+golang.org/x/tools v0.44.0 h1:UP4ajHPIcuMjT1GqzDWRlalUEoY+uzoZKnhOjbIPD2c=
+golang.org/x/tools v0.44.0/go.mod h1:KA0AfVErSdxRZIsOVipbv3rQhVXTnlU6UhKxHd1seDI=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
@@ -1363,8 +1353,8 @@ google.golang.org/api v0.57.0/go.mod h1:dVPlbZyBo2/OjBpmvNdpn2GRm6rPy75jyU7bmhdr
 google.golang.org/api v0.59.0/go.mod h1:sT2boj7M9YJxZzgeZqXogmhfmRWDtPzT31xkieUbuZU=
 google.golang.org/api v0.61.0/go.mod h1:xQRti5UdCmoCEqFxcz93fTl338AVqDgyaDRuOZ3hg9I=
 google.golang.org/api v0.62.0/go.mod h1:dKmwPCydfsad4qCH08MSdgWjfHOyfpd4VtDGgRFdavw=
-google.golang.org/api v0.256.0 h1:u6Khm8+F9sxbCTYNoBHg6/Hwv0N/i+V94MvkOSor6oI=
-google.golang.org/api v0.256.0/go.mod h1:KIgPhksXADEKJlnEoRa9qAII4rXcy40vfI8HRqcU964=
+google.golang.org/api v0.271.0 h1:cIPN4qcUc61jlh7oXu6pwOQqbJW2GqYh5PS6rB2C/JY=
+google.golang.org/api v0.271.0/go.mod h1:CGT29bhwkbF+i11qkRUJb2KMKqcJ1hdFceEIRd9u64Q=
 google.golang.org/appengine v1.1.0/go.mod h1:EbEs0AVv82hx2wNQdGPgUI5lhzA/G0D9YwlJXL52JkM=
 google.golang.org/appengine v1.4.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4=
 google.golang.org/appengine v1.5.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4=
@@ -1435,12 +1425,12 @@ google.golang.org/genproto v0.0.0-20211129164237-f09f9a12af12/go.mod h1:5CzLGKJ6
 google.golang.org/genproto v0.0.0-20211203200212-54befc351ae9/go.mod h1:5CzLGKJ67TSI2B9POpiiyGha0AjJvZIUgRMt1dSmuhc=
 google.golang.org/genproto v0.0.0-20211206160659-862468c7d6e0/go.mod h1:5CzLGKJ67TSI2B9POpiiyGha0AjJvZIUgRMt1dSmuhc=
 google.golang.org/genproto v0.0.0-20211208223120-3a66f561d7aa/go.mod h1:5CzLGKJ67TSI2B9POpiiyGha0AjJvZIUgRMt1dSmuhc=
-google.golang.org/genproto v0.0.0-20250922171735-9219d122eba9 h1:LvZVVaPE0JSqL+ZWb6ErZfnEOKIqqFWUJE2D0fObSmc=
-google.golang.org/genproto v0.0.0-20250922171735-9219d122eba9/go.mod h1:QFOrLhdAe2PsTp3vQY4quuLKTi9j3XG3r6JPPaw7MSc=
-google.golang.org/genproto/googleapis/api v0.0.0-20251111163417-95abcf5c77ba h1:B14OtaXuMaCQsl2deSvNkyPKIzq3BjfxQp8d00QyWx4=
-google.golang.org/genproto/googleapis/api v0.0.0-20251111163417-95abcf5c77ba/go.mod h1:G5IanEx8/PgI9w6CFcYQf7jMtHQhZruvfM1i3qOqk5U=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20251111163417-95abcf5c77ba h1:UKgtfRM7Yh93Sya0Fo8ZzhDP4qBckrrxEr2oF5UIVb8=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20251111163417-95abcf5c77ba/go.mod h1:7i2o+ce6H/6BluujYR+kqX3GKH+dChPTQU19wjRPiGk=
+google.golang.org/genproto v0.0.0-20260128011058-8636f8732409 h1:VQZ/yAbAtjkHgH80teYd2em3xtIkkHd7ZhqfH2N9CsM=
+google.golang.org/genproto v0.0.0-20260128011058-8636f8732409/go.mod h1:rxKD3IEILWEu3P44seeNOAwZN4SaoKaQ/2eTg4mM6EM=
+google.golang.org/genproto/googleapis/api v0.0.0-20260203192932-546029d2fa20 h1:7ei4lp52gK1uSejlA8AZl5AJjeLUOHBQscRQZUgAcu0=
+google.golang.org/genproto/googleapis/api v0.0.0-20260203192932-546029d2fa20/go.mod h1:ZdbssH/1SOVnjnDlXzxDHK2MCidiqXtbYccJNzNYPEE=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20260226221140-a57be14db171 h1:ggcbiqK8WWh6l1dnltU4BgWGIGo+EVYxCaAPih/zQXQ=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20260226221140-a57be14db171/go.mod h1:4Hqkh8ycfw05ld/3BWL7rJOSfebL2Q+DVDeRgYgxUU8=
 google.golang.org/grpc v1.19.0/go.mod h1:mqu4LbDTu4XGKhr4mRzUsmM4RtVoemTSY81AxZiDr8c=
 google.golang.org/grpc v1.20.1/go.mod h1:10oTOabMzJvdu6/UiuZezV6QK5dSlG84ov/aaiqXj38=
 google.golang.org/grpc v1.21.1/go.mod h1:oYelfM1adQP15Ek0mdvEgi9Df8B9CZIaU1084ijfRaM=
@@ -1468,8 +1458,8 @@ google.golang.org/grpc v1.39.1/go.mod h1:PImNr+rS9TWYb2O4/emRugxiyHZ5JyHW5F+RPnD
 google.golang.org/grpc v1.40.0/go.mod h1:ogyxbiOoUXAkP+4+xa6PZSE9DZgIHtSpzjDTB9KAK34=
 google.golang.org/grpc v1.40.1/go.mod h1:ogyxbiOoUXAkP+4+xa6PZSE9DZgIHtSpzjDTB9KAK34=
 google.golang.org/grpc v1.42.0/go.mod h1:k+4IHHFw41K8+bbowsex27ge2rCb65oeWqe4jJ590SU=
-google.golang.org/grpc v1.76.0 h1:UnVkv1+uMLYXoIz6o7chp59WfQUYA2ex/BXQ9rHZu7A=
-google.golang.org/grpc v1.76.0/go.mod h1:Ju12QI8M6iQJtbcsV+awF5a4hfJMLi4X0JLo94ULZ6c=
+google.golang.org/grpc v1.79.3 h1:sybAEdRIEtvcD68Gx7dmnwjZKlyfuc61Dyo9pGXXkKE=
+google.golang.org/grpc v1.79.3/go.mod h1:KmT0Kjez+0dde/v2j9vzwoAScgEPx/Bw1CYChhHLrHQ=
 google.golang.org/grpc/cmd/protoc-gen-go-grpc v1.1.0/go.mod h1:6Kw0yEErY5E/yWrBtf03jp27GLLJujG4z/JK95pnjjw=
 google.golang.org/protobuf v0.0.0-20200109180630-ec00e32a8dfd/go.mod h1:DFci5gLYBciE7Vtevhsrf46CRTquxDuWsQurQQe4oz8=
 google.golang.org/protobuf v0.0.0-20200221191635-4d8936d0db64/go.mod h1:kwYJMbMJ01Woi6D6+Kah6886xMZcty6N08ah7+eCXa0=
@@ -1518,18 +1508,18 @@ honnef.co/go/tools v0.0.1-2020.1.3/go.mod h1:X/FiERA/W4tHapMX5mGpAtMSVEeEUOyHaw9
 honnef.co/go/tools v0.0.1-2020.1.4/go.mod h1:X/FiERA/W4tHapMX5mGpAtMSVEeEUOyHaw9vFzvIQ3k=
 modernc.org/cc/v4 v4.27.1 h1:9W30zRlYrefrDV2JE2O8VDtJ1yPGownxciz5rrbQZis=
 modernc.org/cc/v4 v4.27.1/go.mod h1:uVtb5OGqUKpoLWhqwNQo/8LwvoiEBLvZXIQ/SmO6mL0=
-modernc.org/ccgo/v4 v4.30.1 h1:4r4U1J6Fhj98NKfSjnPUN7Ze2c6MnAdL0hWw6+LrJpc=
-modernc.org/ccgo/v4 v4.30.1/go.mod h1:bIOeI1JL54Utlxn+LwrFyjCx2n2RDiYEaJVSrgdrRfM=
-modernc.org/fileutil v1.3.40 h1:ZGMswMNc9JOCrcrakF1HrvmergNLAmxOPjizirpfqBA=
-modernc.org/fileutil v1.3.40/go.mod h1:HxmghZSZVAz/LXcMNwZPA/DRrQZEVP9VX0V4LQGQFOc=
+modernc.org/ccgo/v4 v4.32.0 h1:hjG66bI/kqIPX1b2yT6fr/jt+QedtP2fqojG2VrFuVw=
+modernc.org/ccgo/v4 v4.32.0/go.mod h1:6F08EBCx5uQc38kMGl+0Nm0oWczoo1c7cgpzEry7Uc0=
+modernc.org/fileutil v1.4.0 h1:j6ZzNTftVS054gi281TyLjHPp6CPHr2KCxEXjEbD6SM=
+modernc.org/fileutil v1.4.0/go.mod h1:EqdKFDxiByqxLk8ozOxObDSfcVOv/54xDs/DUHdvCUU=
 modernc.org/gc/v2 v2.6.5 h1:nyqdV8q46KvTpZlsw66kWqwXRHdjIlJOhG6kxiV/9xI=
 modernc.org/gc/v2 v2.6.5/go.mod h1:YgIahr1ypgfe7chRuJi2gD7DBQiKSLMPgBQe9oIiito=
-modernc.org/gc/v3 v3.1.1 h1:k8T3gkXWY9sEiytKhcgyiZ2L0DTyCQ/nvX+LoCljoRE=
-modernc.org/gc/v3 v3.1.1/go.mod h1:HFK/6AGESC7Ex+EZJhJ2Gni6cTaYpSMmU/cT9RmlfYY=
+modernc.org/gc/v3 v3.1.2 h1:ZtDCnhonXSZexk/AYsegNRV1lJGgaNZJuKjJSWKyEqo=
+modernc.org/gc/v3 v3.1.2/go.mod h1:HFK/6AGESC7Ex+EZJhJ2Gni6cTaYpSMmU/cT9RmlfYY=
 modernc.org/goabi0 v0.2.0 h1:HvEowk7LxcPd0eq6mVOAEMai46V+i7Jrj13t4AzuNks=
 modernc.org/goabi0 v0.2.0/go.mod h1:CEFRnnJhKvWT1c1JTI3Avm+tgOWbkOu5oPA8eH8LnMI=
-modernc.org/libc v1.67.6 h1:eVOQvpModVLKOdT+LvBPjdQqfrZq+pC39BygcT+E7OI=
-modernc.org/libc v1.67.6/go.mod h1:JAhxUVlolfYDErnwiqaLvUqc8nfb2r6S6slAgZOnaiE=
+modernc.org/libc v1.70.0 h1:U58NawXqXbgpZ/dcdS9kMshu08aiA6b7gusEusqzNkw=
+modernc.org/libc v1.70.0/go.mod h1:OVmxFGP1CI/Z4L3E0Q3Mf1PDE0BucwMkcXjjLntvHJo=
 modernc.org/mathutil v1.7.1 h1:GCZVGXdaN8gTqB1Mf/usp1Y/hSqgI2vAGGP4jZMCxOU=
 modernc.org/mathutil v1.7.1/go.mod h1:4p5IwJITfppl0G4sUEDtCr4DthTaT47/N3aT6MhfgJg=
 modernc.org/memory v1.11.0 h1:o4QC8aMQzmcwCK3t3Ux/ZHmwFPzE6hf2Y5LbkRs+hbI=
@@ -1538,8 +1528,8 @@ modernc.org/opt v0.1.4 h1:2kNGMRiUjrp4LcaPuLY2PzUfqM/w9N23quVwhKt5Qm8=
 modernc.org/opt v0.1.4/go.mod h1:03fq9lsNfvkYSfxrfUhZCWPk1lm4cq4N+Bh//bEtgns=
 modernc.org/sortutil v1.2.1 h1:+xyoGf15mM3NMlPDnFqrteY07klSFxLElE2PVuWIJ7w=
 modernc.org/sortutil v1.2.1/go.mod h1:7ZI3a3REbai7gzCLcotuw9AC4VZVpYMjDzETGsSMqJE=
-modernc.org/sqlite v1.46.1 h1:eFJ2ShBLIEnUWlLy12raN0Z1plqmFX9Qe3rjQTKt6sU=
-modernc.org/sqlite v1.46.1/go.mod h1:CzbrU2lSB1DKUusvwGz7rqEKIq+NUd8GWuBBZDs9/nA=
+modernc.org/sqlite v1.46.2 h1:gkXQ6R0+AjxFC/fTDaeIVLbNLNrRoOK7YYVz5BKhTcE=
+modernc.org/sqlite v1.46.2/go.mod h1:hWjRO6Tj/5Ik8ieqxQybiEOUXy0NJFNp2tpvVpKlvig=
 modernc.org/strutil v1.2.1 h1:UneZBkQA+DX2Rp35KcM69cSsNES9ly8mQWD71HKlOA0=
 modernc.org/strutil v1.2.1/go.mod h1:EHkiggD70koQxjVdSBM3JKM7k6L0FbGE5eymy9i3B9A=
 modernc.org/token v1.1.0 h1:Xl7Ap9dKaEs5kLoOQeQmPWevfnk/DM5qcLcYlA8ys6Y=

install.sh

@@ -154,6 +154,7 @@ uname_arch_check() (
     mipsle) return 0 ;;
     mips64) return 0 ;;
     mips64le) return 0 ;;
+    riscv64) return 0 ;;
     s390x) return 0 ;;
     amd64p32) return 0 ;;
   esac

internal/capabilities/evaluation.go

@@ -5,8 +5,8 @@ import "reflect"
 // EvaluateCapabilities evaluates a capability set against a given configuration
 // and returns the effective capability values as a flat map.
 // Example: {"license": false, "dependency.depth": ["direct", "indirect"]}
-func EvaluateCapabilities(caps CapabilitySet, config map[string]interface{}) map[string]interface{} {
-	result := make(map[string]interface{})
+func EvaluateCapabilities(caps CapabilitySet, config map[string]any) map[string]any {
+	result := make(map[string]any)
 	for _, capField := range caps {
 		result[capField.Name] = EvaluateField(capField, config)
 	}
@@ -16,7 +16,7 @@ func EvaluateCapabilities(caps CapabilitySet, config map[string]interface{}) map
 // EvaluateField evaluates a single capability field against a configuration.
 // Conditions are evaluated in order, and the first matching condition's value is returned.
 // If no conditions match, the default value is returned.
-func EvaluateField(capField CapabilityField, config map[string]interface{}) interface{} {
+func EvaluateField(capField CapabilityField, config map[string]any) any {
 	// check conditions in order (first match wins)
 	for _, cond := range capField.Conditions {
 		if ConditionMatches(cond.When, config) {
@@ -30,7 +30,7 @@ func EvaluateField(capField CapabilityField, config map[string]interface{}) inte
 // ConditionMatches checks if a condition's when clause matches the given configuration.
 // All fields in the when clause must match the config (AND logic).
 // Returns true if all key-value pairs in when match the config.
-func ConditionMatches(when map[string]interface{}, config map[string]interface{}) bool {
+func ConditionMatches(when map[string]any, config map[string]any) bool {
 	// all fields in when must match config (AND logic)
 	for key, expectedValue := range when {
 		actualValue, exists := config[key]
@@ -46,7 +46,7 @@ func ConditionMatches(when map[string]interface{}, config map[string]interface{}
 
 // valuesEqual compares two values for equality, handling different types appropriately.
 // Uses reflect.DeepEqual for complex types like slices and maps.
-func valuesEqual(a, b interface{}) bool {
+func valuesEqual(a, b any) bool {
 	// handle nil cases
 	if a == nil && b == nil {
 		return true

internal/capabilities/evaluation_test.go

@@ -10,8 +10,8 @@ import (
 func Test_valuesEqual(t *testing.T) {
 	tests := []struct {
 		name string
-		a    interface{}
-		b    interface{}
+		a    any
+		b    any
 		want bool
 	}{
 		{
@@ -123,47 +123,47 @@ func Test_valuesEqual(t *testing.T) {
 func TestConditionMatches(t *testing.T) {
 	tests := []struct {
 		name   string
-		when   map[string]interface{}
-		config map[string]interface{}
+		when   map[string]any
+		config map[string]any
 		want   bool
 	}{
 		{
 			name:   "empty when clause matches anything",
-			when:   map[string]interface{}{},
-			config: map[string]interface{}{"key": "value"},
+			when:   map[string]any{},
+			config: map[string]any{"key": "value"},
 			want:   true,
 		},
 		{
 			name:   "empty when clause with empty config",
-			when:   map[string]interface{}{},
-			config: map[string]interface{}{},
+			when:   map[string]any{},
+			config: map[string]any{},
 			want:   true,
 		},
 		{
 			name:   "single key match",
-			when:   map[string]interface{}{"SearchLocalModCacheLicenses": true},
-			config: map[string]interface{}{"SearchLocalModCacheLicenses": true},
+			when:   map[string]any{"SearchLocalModCacheLicenses": true},
+			config: map[string]any{"SearchLocalModCacheLicenses": true},
 			want:   true,
 		},
 		{
 			name:   "single key mismatch",
-			when:   map[string]interface{}{"SearchLocalModCacheLicenses": true},
-			config: map[string]interface{}{"SearchLocalModCacheLicenses": false},
+			when:   map[string]any{"SearchLocalModCacheLicenses": true},
+			config: map[string]any{"SearchLocalModCacheLicenses": false},
 			want:   false,
 		},
 		{
 			name:   "key missing from config",
-			when:   map[string]interface{}{"SearchLocalModCacheLicenses": true},
-			config: map[string]interface{}{},
+			when:   map[string]any{"SearchLocalModCacheLicenses": true},
+			config: map[string]any{},
 			want:   false,
 		},
 		{
 			name: "multiple keys all match",
-			when: map[string]interface{}{
+			when: map[string]any{
 				"SearchLocalModCacheLicenses": true,
 				"UseNetwork":                  true,
 			},
-			config: map[string]interface{}{
+			config: map[string]any{
 				"SearchLocalModCacheLicenses": true,
 				"UseNetwork":                  true,
 				"ExtraKey":                    "ignored",
@@ -172,11 +172,11 @@ func TestConditionMatches(t *testing.T) {
 		},
 		{
 			name: "multiple keys one mismatch",
-			when: map[string]interface{}{
+			when: map[string]any{
 				"SearchLocalModCacheLicenses": true,
 				"UseNetwork":                  true,
 			},
-			config: map[string]interface{}{
+			config: map[string]any{
 				"SearchLocalModCacheLicenses": true,
 				"UseNetwork":                  false,
 			},
@@ -184,31 +184,31 @@ func TestConditionMatches(t *testing.T) {
 		},
 		{
 			name: "multiple keys one missing",
-			when: map[string]interface{}{
+			when: map[string]any{
 				"SearchLocalModCacheLicenses": true,
 				"UseNetwork":                  true,
 			},
-			config: map[string]interface{}{
+			config: map[string]any{
 				"SearchLocalModCacheLicenses": true,
 			},
 			want: false,
 		},
 		{
 			name:   "string value match",
-			when:   map[string]interface{}{"mode": "fast"},
-			config: map[string]interface{}{"mode": "fast"},
+			when:   map[string]any{"mode": "fast"},
+			config: map[string]any{"mode": "fast"},
 			want:   true,
 		},
 		{
 			name:   "slice value match",
-			when:   map[string]interface{}{"formats": []string{"json", "yaml"}},
-			config: map[string]interface{}{"formats": []string{"json", "yaml"}},
+			when:   map[string]any{"formats": []string{"json", "yaml"}},
+			config: map[string]any{"formats": []string{"json", "yaml"}},
 			want:   true,
 		},
 		{
 			name:   "slice value mismatch",
-			when:   map[string]interface{}{"formats": []string{"json", "yaml"}},
-			config: map[string]interface{}{"formats": []string{"json", "xml"}},
+			when:   map[string]any{"formats": []string{"json", "yaml"}},
+			config: map[string]any{"formats": []string{"json", "xml"}},
 			want:   false,
 		},
 	}
@@ -225,8 +225,8 @@ func TestEvaluateField(t *testing.T) {
 	tests := []struct {
 		name     string
 		capField CapabilityField
-		config   map[string]interface{}
-		want     interface{}
+		config   map[string]any
+		want     any
 	}{
 		{
 			name: "no conditions returns default",
@@ -235,7 +235,7 @@ func TestEvaluateField(t *testing.T) {
 				Default:    false,
 				Conditions: nil,
 			},
-			config: map[string]interface{}{},
+			config: map[string]any{},
 			want:   false,
 		},
 		{
@@ -245,7 +245,7 @@ func TestEvaluateField(t *testing.T) {
 				Default:    false,
 				Conditions: []CapabilityCondition{},
 			},
-			config: map[string]interface{}{},
+			config: map[string]any{},
 			want:   false,
 		},
 		{
@@ -260,7 +260,7 @@ func TestEvaluateField(t *testing.T) {
 					},
 				},
 			},
-			config: map[string]interface{}{"SearchLocalModCacheLicenses": true},
+			config: map[string]any{"SearchLocalModCacheLicenses": true},
 			want:   true,
 		},
 		{
@@ -275,7 +275,7 @@ func TestEvaluateField(t *testing.T) {
 					},
 				},
 			},
-			config: map[string]interface{}{"SearchLocalModCacheLicenses": false},
+			config: map[string]any{"SearchLocalModCacheLicenses": false},
 			want:   false,
 		},
 		{
@@ -294,7 +294,7 @@ func TestEvaluateField(t *testing.T) {
 					},
 				},
 			},
-			config: map[string]interface{}{
+			config: map[string]any{
 				"SearchLocalModCacheLicenses": true,
 				"SearchRemoteLicenses":        true,
 			},
@@ -316,7 +316,7 @@ func TestEvaluateField(t *testing.T) {
 					},
 				},
 			},
-			config: map[string]interface{}{
+			config: map[string]any{
 				"SearchLocalModCacheLicenses": false,
 				"SearchRemoteLicenses":        true,
 			},
@@ -338,7 +338,7 @@ func TestEvaluateField(t *testing.T) {
 					},
 				},
 			},
-			config: map[string]interface{}{
+			config: map[string]any{
 				"SearchLocalModCacheLicenses": false,
 				"SearchRemoteLicenses":        false,
 			},
@@ -351,7 +351,7 @@ func TestEvaluateField(t *testing.T) {
 				Default:    []string{"direct", "indirect"},
 				Conditions: nil,
 			},
-			config: map[string]interface{}{},
+			config: map[string]any{},
 			want:   []string{"direct", "indirect"},
 		},
 		{
@@ -369,7 +369,7 @@ func TestEvaluateField(t *testing.T) {
 					},
 				},
 			},
-			config: map[string]interface{}{
+			config: map[string]any{
 				"EnableFeatureA": true,
 				"EnableFeatureB": true,
 			},
@@ -390,7 +390,7 @@ func TestEvaluateField(t *testing.T) {
 					},
 				},
 			},
-			config: map[string]interface{}{
+			config: map[string]any{
 				"EnableFeatureA": true,
 				"EnableFeatureB": false,
 			},
@@ -412,14 +412,14 @@ func TestEvaluateCapabilities(t *testing.T) {
 	tests := []struct {
 		name   string
 		caps   CapabilitySet
-		config map[string]interface{}
-		want   map[string]interface{}
+		config map[string]any
+		want   map[string]any
 	}{
 		{
 			name:   "empty capability set",
 			caps:   CapabilitySet{},
-			config: map[string]interface{}{},
-			want:   map[string]interface{}{},
+			config: map[string]any{},
+			want:   map[string]any{},
 		},
 		{
 			name: "single capability no conditions",
@@ -429,8 +429,8 @@ func TestEvaluateCapabilities(t *testing.T) {
 					Default: false,
 				},
 			},
-			config: map[string]interface{}{},
-			want: map[string]interface{}{
+			config: map[string]any{},
+			want: map[string]any{
 				"license": false,
 			},
 		},
@@ -448,8 +448,8 @@ func TestEvaluateCapabilities(t *testing.T) {
 					},
 				},
 			},
-			config: map[string]interface{}{"SearchLocalModCacheLicenses": true},
-			want: map[string]interface{}{
+			config: map[string]any{"SearchLocalModCacheLicenses": true},
+			want: map[string]any{
 				"license": true,
 			},
 		},
@@ -475,8 +475,8 @@ func TestEvaluateCapabilities(t *testing.T) {
 					Default: "flat",
 				},
 			},
-			config: map[string]interface{}{"SearchLocalModCacheLicenses": true},
-			want: map[string]interface{}{
+			config: map[string]any{"SearchLocalModCacheLicenses": true},
+			want: map[string]any{
 				"license":          true,
 				"dependency.depth": []string{"direct", "indirect"},
 				"dependency.edges": "flat",
@@ -512,11 +512,11 @@ func TestEvaluateCapabilities(t *testing.T) {
 					Default: false,
 				},
 			},
-			config: map[string]interface{}{
+			config: map[string]any{
 				"SearchLocalModCacheLicenses": false,
 				"SearchRemoteLicenses":        true,
 			},
-			want: map[string]interface{}{
+			want: map[string]any{
 				"license":                       true,
 				"dependency.depth":              []string{"direct", "indirect"},
 				"dependency.edges":              "flat",
@@ -526,10 +526,10 @@ func TestEvaluateCapabilities(t *testing.T) {
 		{
 			name: "nil capability set",
 			caps: nil,
-			config: map[string]interface{}{
+			config: map[string]any{
 				"anything": true,
 			},
-			want: map[string]interface{}{},
+			want: map[string]any{},
 		},
 	}
 

internal/capabilities/generate/discover_app_config.go

@@ -15,9 +15,9 @@ import (
 
 // AppConfigField represents an application-level configuration field for catalogers
 type AppConfigField struct {
-	Key          string      // e.g., "golang.search-local-mod-cache-licenses"
-	Description  string      // extracted from DescribeFields() method
-	DefaultValue interface{} // extracted from Default*() functions
+	Key          string // e.g., "golang.search-local-mod-cache-licenses"
+	Description  string // extracted from DescribeFields() method
+	DefaultValue any    // extracted from Default*() functions
 }
 
 // extractEcosystemConfigFieldsFromCatalog parses catalog.go and extracts the ecosystem-specific
@@ -390,7 +390,7 @@ func extractDescriptionsFromDescribeFields(f *ast.File) map[string]string {
 }
 
 // extractNestedAppConfigs handles nested config structs like golang.MainModuleVersion
-func extractNestedAppConfigs(f *ast.File, parentKey, parentFieldName string, fieldType ast.Expr, descriptions map[string]string, defaults map[string]interface{}) []AppConfigField {
+func extractNestedAppConfigs(f *ast.File, parentKey, parentFieldName string, fieldType ast.Expr, descriptions map[string]string, defaults map[string]any) []AppConfigField {
 	var configs []AppConfigField
 
 	// find the nested struct type
@@ -449,8 +449,8 @@ func extractNestedAppConfigs(f *ast.File, parentKey, parentFieldName string, fie
 		description := descriptions[nestedPath]
 
 		// try to get default value from nested defaults
-		var defaultValue interface{}
-		if nestedDefaults, ok := defaults[parentFieldName].(map[string]interface{}); ok {
+		var defaultValue any
+		if nestedDefaults, ok := defaults[parentFieldName].(map[string]any); ok {
 			defaultValue = nestedDefaults[fieldName]
 		}
 
@@ -465,8 +465,8 @@ func extractNestedAppConfigs(f *ast.File, parentKey, parentFieldName string, fie
 }
 
 // extractAppDefaultValues extracts default values from the default*Config function
-func extractAppDefaultValues(f *ast.File) map[string]interface{} {
-	defaults := make(map[string]interface{})
+func extractAppDefaultValues(f *ast.File) map[string]any {
+	defaults := make(map[string]any)
 
 	for _, decl := range f.Decls {
 		funcDecl, ok := decl.(*ast.FuncDecl)
@@ -518,7 +518,7 @@ func extractAppDefaultValues(f *ast.File) map[string]interface{} {
 }
 
 // extractAppValue extracts a Go value from an AST expression
-func extractAppValue(expr ast.Expr) interface{} {
+func extractAppValue(expr ast.Expr) any {
 	switch v := expr.(type) {
 	case *ast.BasicLit:
 		// string, int, bool literals
@@ -543,7 +543,7 @@ func extractAppValue(expr ast.Expr) interface{} {
 		}
 	case *ast.CompositeLit:
 		// nested struct literal
-		nested := make(map[string]interface{})
+		nested := make(map[string]any)
 		for _, elt := range v.Elts {
 			kvExpr, ok := elt.(*ast.KeyValueExpr)
 			if !ok {

internal/capabilities/generate/discover_app_config_test.go

@@ -340,7 +340,7 @@ func TestExtractAppValue(t *testing.T) {
 	tests := []struct {
 		name string
 		src  string
-		want interface{}
+		want any
 	}{
 		{
 			name: "string literal",
@@ -406,7 +406,7 @@ func TestExtractAppValue_NestedStruct(t *testing.T) {
 	got := extractAppValue(compositeLit)
 
 	// verify it's a map with the expected values
-	gotMap, ok := got.(map[string]interface{})
+	gotMap, ok := got.(map[string]any)
 	require.True(t, ok)
 	require.Equal(t, "value", gotMap["Field1"])
 	require.Equal(t, true, gotMap["Field2"])

internal/capabilities/generate/discover_catalogers.go

@@ -567,8 +567,8 @@ func resolveImportedConstant(pkgName, constName string, ctx *parseContext) strin
 // resolveImportPath converts an import path to a file system path
 func resolveImportPath(importPath, repoRoot string) string {
 	// for github.com/anchore/syft/... imports, convert to repo-relative path
-	if strings.HasPrefix(importPath, "github.com/anchore/syft/") {
-		relPath := strings.TrimPrefix(importPath, "github.com/anchore/syft/")
+	if after, ok := strings.CutPrefix(importPath, "github.com/anchore/syft/"); ok {
+		relPath := after
 		return filepath.Join(repoRoot, relPath)
 	}
 

internal/capabilities/generate/io.go

@@ -214,7 +214,7 @@ func mapCatalogerToEcosystem(cat capabilities.CatalogerEntry) string {
 }
 
 // updateNodeTreeEcosystem updates an existing ecosystem YAML node tree
-func updateNodeTreeEcosystem(rootNode *yaml.Node, doc interface{}) error {
+func updateNodeTreeEcosystem(rootNode *yaml.Node, doc any) error {
 	var newNode yaml.Node
 	if err := newNode.Encode(doc); err != nil {
 		return err
@@ -242,7 +242,7 @@ func updateNodeTreeEcosystem(rootNode *yaml.Node, doc interface{}) error {
 }
 
 // updateNodeTreeAppConfig updates appconfig YAML node tree
-func updateNodeTreeAppConfig(rootNode *yaml.Node, doc interface{}) error {
+func updateNodeTreeAppConfig(rootNode *yaml.Node, doc any) error {
 	return updateNodeTreeEcosystem(rootNode, doc)
 }
 

internal/capabilities/internal/load_capabilities_test.go

@@ -30,7 +30,7 @@ const requireParserObservations = false
 
 // metadataTypeCoverageExceptions lists metadata types that are allowed to not be represented in any cataloger
 var metadataTypeCoverageExceptions = strset.New(
-	reflect.TypeOf(pkg.MicrosoftKbPatch{}).Name(),
+	reflect.TypeFor[pkg.MicrosoftKbPatch]().Name(),
 )
 
 // packageTypeCoverageExceptions lists package types that are allowed to not be represented in any cataloger
@@ -408,7 +408,7 @@ func TestCapabilityValueTypes(t *testing.T) {
 }
 
 // validateCapabilityValueType checks if a value matches the expected type for a capability field
-func validateCapabilityValueType(fieldPath string, value interface{}) error {
+func validateCapabilityValueType(fieldPath string, value any) error {
 	if value == nil {
 		return nil // nil is acceptable
 	}
@@ -428,7 +428,7 @@ func validateCapabilityValueType(fieldPath string, value interface{}) error {
 		switch v := value.(type) {
 		case []string:
 			// ok
-		case []interface{}:
+		case []any:
 			// check each element is a string
 			for i, elem := range v {
 				if _, ok := elem.(string); !ok {
@@ -829,7 +829,6 @@ func TestCapabilityEvidenceFieldReferences(t *testing.T) {
 
 	// validate each evidence reference
 	for _, ref := range allReferences {
-		ref := ref // capture for subtest
 
 		// create test name
 		testName := ref.catalogerName
@@ -989,7 +988,6 @@ func validateCapabilitiesFilled(t *testing.T, catalogers []capabilities.Cataloge
 	checkCompletenessTestsEnabled(t)
 
 	for _, c := range catalogers {
-		c := c // capture loop variable for subtest
 
 		t.Run(c.Name, func(t *testing.T) {
 			if c.Type == "generic" {
@@ -997,7 +995,6 @@ func validateCapabilitiesFilled(t *testing.T, catalogers []capabilities.Cataloge
 				require.NotEmpty(t, c.Parsers, "generic cataloger must have at least one parser")
 
 				for _, p := range c.Parsers {
-					p := p // capture loop variable for subtest
 
 					t.Run(p.ParserFunction, func(t *testing.T) {
 						require.NotEmpty(t, p.Capabilities, "parser must have at least one capability field defined")
@@ -1120,7 +1117,6 @@ func TestCatalogerStructure(t *testing.T) {
 	require.NoError(t, err)
 
 	for _, c := range catalogerEntries {
-		c := c // capture loop variable for subtest
 
 		t.Run(c.Name, func(t *testing.T) {
 			// ecosystem must always be set (it's MANUAL)

internal/file/copy.go

@@ -12,8 +12,20 @@ const perFileReadLimit = 2 * GB
 // protect against decompression bomb attacks.
 func safeCopy(writer io.Writer, reader io.Reader) error {
 	numBytes, err := io.Copy(writer, io.LimitReader(reader, perFileReadLimit))
-	if numBytes >= perFileReadLimit || errors.Is(err, io.EOF) {
+	if numBytes >= perFileReadLimit {
 		return fmt.Errorf("zip read limit hit (potential decompression bomb attack)")
 	}
+	// Propagate decompression / read errors up to the caller. io.Copy
+	// on the happy path returns (n, nil); the only way err is non-nil
+	// here is that the underlying reader surfaced a real failure
+	// ("flate: corrupt input before offset X" on a mangled ZIP entry,
+	// a network-backed reader erroring mid-stream, etc.). The previous
+	// implementation dropped that error and the caller stored a
+	// partial / empty buffer as a "successful" extract, which silently
+	// downgraded Java cataloger output and caused SBOM scanners to
+	// miss known CVEs (#4806).
+	if err != nil && !errors.Is(err, io.EOF) {
+		return fmt.Errorf("failed to read archive entry: %w", err)
+	}
 	return nil
 }

internal/file/copy_test.go

@@ -0,0 +1,64 @@
+package file
+
+import (
+	"bytes"
+	"errors"
+	"io"
+	"strings"
+	"testing"
+)
+
+// errReader returns a deterministic non-EOF error after emitting some
+// bytes, mimicking what compress/flate does when it hits a corrupt
+// stream mid-entry.
+type errReader struct {
+	data []byte
+	err  error
+	off  int
+}
+
+func (r *errReader) Read(p []byte) (int, error) {
+	if r.off >= len(r.data) {
+		return 0, r.err
+	}
+	n := copy(p, r.data[r.off:])
+	r.off += n
+	return n, nil
+}
+
+func TestSafeCopy(t *testing.T) {
+	t.Run("clean copy returns nil", func(t *testing.T) {
+		var buf bytes.Buffer
+		if err := safeCopy(&buf, strings.NewReader("hello")); err != nil {
+			t.Fatalf("unexpected error: %v", err)
+		}
+		if got := buf.String(); got != "hello" {
+			t.Fatalf("unexpected buffer contents: %q", got)
+		}
+	})
+
+	t.Run("propagates decompression error", func(t *testing.T) {
+		// #4806: safeCopy used to drop non-EOF errors, so the caller
+		// would persist a partial buffer as a successful extract and
+		// downstream catalogers silently read empty manifests.
+		sentinel := errors.New("flate: corrupt input before offset 42")
+		var buf bytes.Buffer
+		err := safeCopy(&buf, &errReader{data: []byte("partial"), err: sentinel})
+		if err == nil {
+			t.Fatalf("expected error to be returned, got nil")
+		}
+		if !errors.Is(err, sentinel) {
+			t.Fatalf("error does not wrap sentinel: %v", err)
+		}
+	})
+
+	t.Run("EOF is not treated as an error", func(t *testing.T) {
+		// The old code had a dead io.EOF branch that labelled clean
+		// reads as decompression bombs; keep the happy path clean.
+		var buf bytes.Buffer
+		err := safeCopy(&buf, io.LimitReader(strings.NewReader("abc"), 3))
+		if err != nil {
+			t.Fatalf("unexpected error on clean copy: %v", err)
+		}
+	})
+}

internal/file/getter_test.go

@@ -151,11 +151,11 @@ func TestGetter_GetToDir_CertConcerns(t *testing.T) {
 	}
 }
 
-func assertUnknownAuthorityError(t assert.TestingT, err error, _ ...interface{}) bool {
+func assertUnknownAuthorityError(t assert.TestingT, err error, _ ...any) bool {
 	return assert.ErrorAs(t, err, &x509.UnknownAuthorityError{})
 }
 
-func assertErrNonArchiveSource(t assert.TestingT, err error, _ ...interface{}) bool {
+func assertErrNonArchiveSource(t assert.TestingT, err error, _ ...any) bool {
 	return assert.ErrorIs(t, err, ErrNonArchiveSource)
 }
 

internal/file/zip_file_manifest_test.go

@@ -1,5 +1,4 @@
 //go:build !windows
-// +build !windows
 
 package file
 

internal/file/zip_file_traversal_test.go

@@ -1,5 +1,4 @@
 //go:build !windows
-// +build !windows
 
 package file
 
@@ -242,8 +241,8 @@ func assertZipSourceFixtureContents(t testing.TB, actual map[string]string, expe
 }
 
 // looks like there isn't a helper for this yet? https://github.com/stretchr/testify/issues/497
-func assertErrorAs(expectedErr interface{}) assert.ErrorAssertionFunc {
-	return func(t assert.TestingT, actualErr error, i ...interface{}) bool {
+func assertErrorAs(expectedErr any) assert.ErrorAssertionFunc {
+	return func(t assert.TestingT, actualErr error, i ...any) bool {
 		return errors.As(actualErr, &expectedErr)
 	}
 }

internal/jsonschema/main.go

@@ -143,7 +143,7 @@ func build() *jsonschema.Schema {
 	// srcMetadataContainer := assembleTypeContainer(sourcemetadata.AllTypes())
 	// srcMetadataContainerType := reflect.TypeOf(srcMetadataContainer)
 
-	documentSchema := reflector.ReflectFromType(reflect.TypeOf(&syftJsonModel.Document{}))
+	documentSchema := reflector.ReflectFromType(reflect.TypeFor[*syftJsonModel.Document]())
 	pkgMetadataSchema := reflector.ReflectFromType(reflect.TypeOf(pkgMetadataContainer))
 	// srcMetadataSchema := reflector.ReflectFromType(reflect.TypeOf(srcMetadataContainer))
 
@@ -215,7 +215,7 @@ func write(schema []byte) {
 			panic(err)
 		}
 
-		existingSchemaBytes, err := io.ReadAll(existingFh)
+		existingSchemaBytes, err := io.ReadAll(existingFh) //nolint:gocritic // offline code generator
 		if err != nil {
 			panic(err)
 		}

internal/licenses/find_evidence.go

@@ -10,7 +10,7 @@ func (s *scanner) FindEvidence(_ context.Context, reader io.Reader) (evidence []
 		return nil, nil, nil
 	}
 
-	content, err = io.ReadAll(reader)
+	content, err = io.ReadAll(reader) //nolint:gocritic // license scanner requires full content
 	if err != nil {
 		return nil, nil, err
 	}

internal/log/log.go

@@ -30,61 +30,61 @@ func Get() logger.Logger {
 }
 
 // Errorf takes a formatted template string and template arguments for the error logging level.
-func Errorf(format string, args ...interface{}) {
+func Errorf(format string, args ...any) {
 	log.Errorf(format, args...)
 }
 
 // Error logs the given arguments at the error logging level.
-func Error(args ...interface{}) {
+func Error(args ...any) {
 	log.Error(args...)
 }
 
 // Warnf takes a formatted template string and template arguments for the warning logging level.
-func Warnf(format string, args ...interface{}) {
+func Warnf(format string, args ...any) {
 	log.Warnf(format, args...)
 }
 
 // Warn logs the given arguments at the warning logging level.
-func Warn(args ...interface{}) {
+func Warn(args ...any) {
 	log.Warn(args...)
 }
 
 // Infof takes a formatted template string and template arguments for the info logging level.
-func Infof(format string, args ...interface{}) {
+func Infof(format string, args ...any) {
 	log.Infof(format, args...)
 }
 
 // Info logs the given arguments at the info logging level.
-func Info(args ...interface{}) {
+func Info(args ...any) {
 	log.Info(args...)
 }
 
 // Debugf takes a formatted template string and template arguments for the debug logging level.
-func Debugf(format string, args ...interface{}) {
+func Debugf(format string, args ...any) {
 	log.Debugf(format, args...)
 }
 
 // Debug logs the given arguments at the debug logging level.
-func Debug(args ...interface{}) {
+func Debug(args ...any) {
 	log.Debug(args...)
 }
 
 // Tracef takes a formatted template string and template arguments for the trace logging level.
-func Tracef(format string, args ...interface{}) {
+func Tracef(format string, args ...any) {
 	log.Tracef(format, args...)
 }
 
 // Trace logs the given arguments at the trace logging level.
-func Trace(args ...interface{}) {
+func Trace(args ...any) {
 	log.Trace(args...)
 }
 
 // WithFields returns a message logger with multiple key-value fields.
-func WithFields(fields ...interface{}) logger.MessageLogger {
+func WithFields(fields ...any) logger.MessageLogger {
 	return log.WithFields(fields...)
 }
 
 // Nested returns a new logger with hard coded key-value pairs
-func Nested(fields ...interface{}) logger.Logger {
+func Nested(fields ...any) logger.Logger {
 	return log.Nested(fields...)
 }

internal/packagemetadata/names_test.go

@@ -40,28 +40,28 @@ func TestReflectTypeFromJSONName(t *testing.T) {
 		{
 			name:       "exact match on ID",
 			lookup:     "rust-cargo-lock-entry",
-			wantRecord: reflect.TypeOf(pkg.RustCargoLockEntry{}),
+			wantRecord: reflect.TypeFor[pkg.RustCargoLockEntry](),
 		},
 		{
 			name:       "exact match on former name",
 			lookup:     "RustCargoPackageMetadata",
-			wantRecord: reflect.TypeOf(pkg.RustCargoLockEntry{}),
+			wantRecord: reflect.TypeFor[pkg.RustCargoLockEntry](),
 		},
 		{
 			name:       "case insensitive on ID",
 			lookup:     "RUST-CARGO-lock-entrY",
-			wantRecord: reflect.TypeOf(pkg.RustCargoLockEntry{}),
+			wantRecord: reflect.TypeFor[pkg.RustCargoLockEntry](),
 		},
 		{
 			name:       "case insensitive on alias",
 			lookup:     "rusTcArgopacKagEmEtadATa",
-			wantRecord: reflect.TypeOf(pkg.RustCargoLockEntry{}),
+			wantRecord: reflect.TypeFor[pkg.RustCargoLockEntry](),
 		},
 		{
 			name: "consistent override",
 			// there are two correct answers for this -- we should always get the same answer.
 			lookup:     "HackageMetadataType",
-			wantRecord: reflect.TypeOf(pkg.HackageStackYamlLockEntry{}),
+			wantRecord: reflect.TypeFor[pkg.HackageStackYamlLockEntry](),
 		},
 	}
 	for _, tt := range tests {
@@ -83,142 +83,142 @@ func TestReflectTypeFromJSONName_LegacyValues(t *testing.T) {
 		{
 			name:     "map pkg.AlpmDBEntry struct type",
 			input:    "AlpmMetadata",
-			expected: reflect.TypeOf(pkg.AlpmDBEntry{}),
+			expected: reflect.TypeFor[pkg.AlpmDBEntry](),
 		},
 		{
 			name:     "map pkg.ApkDBEntry struct type",
 			input:    "ApkMetadata",
-			expected: reflect.TypeOf(pkg.ApkDBEntry{}),
+			expected: reflect.TypeFor[pkg.ApkDBEntry](),
 		},
 		{
 			name:     "map pkg.BinarySignature struct type",
 			input:    "BinaryMetadata",
-			expected: reflect.TypeOf(pkg.BinarySignature{}),
+			expected: reflect.TypeFor[pkg.BinarySignature](),
 		},
 		{
 			name:     "map pkg.CocoaPodfileLockEntry struct type",
 			input:    "CocoapodsMetadataType",
-			expected: reflect.TypeOf(pkg.CocoaPodfileLockEntry{}),
+			expected: reflect.TypeFor[pkg.CocoaPodfileLockEntry](),
 		},
 		{
 			name:     "map pkg.ConanLockEntry struct type",
 			input:    "ConanLockMetadataType",
-			expected: reflect.TypeOf(pkg.ConanV1LockEntry{}),
+			expected: reflect.TypeFor[pkg.ConanV1LockEntry](),
 		},
 		{
 			name:     "map pkg.ConanfileEntry struct type",
 			input:    "ConanMetadataType",
-			expected: reflect.TypeOf(pkg.ConanfileEntry{}),
+			expected: reflect.TypeFor[pkg.ConanfileEntry](),
 		},
 		{
 			name:     "map pkg.DartPubspecLockEntry struct type",
 			input:    "DartPubMetadata",
-			expected: reflect.TypeOf(pkg.DartPubspecLockEntry{}),
+			expected: reflect.TypeFor[pkg.DartPubspecLockEntry](),
 		},
 		{
 			name:     "map pkg.DotnetDepsEntry struct type",
 			input:    "DotnetDepsMetadata",
-			expected: reflect.TypeOf(pkg.DotnetDepsEntry{}),
+			expected: reflect.TypeFor[pkg.DotnetDepsEntry](),
 		},
 		{
 			name:     "map pkg.DpkgDBEntry struct type",
 			input:    "DpkgMetadata",
-			expected: reflect.TypeOf(pkg.DpkgDBEntry{}),
+			expected: reflect.TypeFor[pkg.DpkgDBEntry](),
 		},
 		{
 			name:     "map pkg.RubyGemspec struct type",
 			input:    "GemMetadata",
-			expected: reflect.TypeOf(pkg.RubyGemspec{}),
+			expected: reflect.TypeFor[pkg.RubyGemspec](),
 		},
 		{
 			name:     "map pkg.GolangBinaryBuildinfoEntry struct type",
 			input:    "GolangBinMetadata",
-			expected: reflect.TypeOf(pkg.GolangBinaryBuildinfoEntry{}),
+			expected: reflect.TypeFor[pkg.GolangBinaryBuildinfoEntry](),
 		},
 		{
 			name:     "map pkg.GolangModuleEntry struct type",
 			input:    "GolangModMetadata",
-			expected: reflect.TypeOf(pkg.GolangModuleEntry{}),
+			expected: reflect.TypeFor[pkg.GolangModuleEntry](),
 		},
 		{
 			name:     "map pkg.JavaArchive struct type",
 			input:    "JavaMetadata",
-			expected: reflect.TypeOf(pkg.JavaArchive{}),
+			expected: reflect.TypeFor[pkg.JavaArchive](),
 		},
 		{
 			name:     "map pkg.MicrosoftKbPatch struct type",
 			input:    "KbPatchMetadata",
-			expected: reflect.TypeOf(pkg.MicrosoftKbPatch{}),
+			expected: reflect.TypeFor[pkg.MicrosoftKbPatch](),
 		},
 		{
 			name:     "map pkg.LinuxKernel struct type",
 			input:    "LinuxKernel",
-			expected: reflect.TypeOf(pkg.LinuxKernel{}),
+			expected: reflect.TypeFor[pkg.LinuxKernel](),
 		},
 		{
 			name:     "map pkg.LinuxKernelModule struct type",
 			input:    "LinuxKernelModule",
-			expected: reflect.TypeOf(pkg.LinuxKernelModule{}),
+			expected: reflect.TypeFor[pkg.LinuxKernelModule](),
 		},
 		{
 			name:     "map pkg.ElixirMixLockEntry struct type",
 			input:    "MixLockMetadataType",
-			expected: reflect.TypeOf(pkg.ElixirMixLockEntry{}),
+			expected: reflect.TypeFor[pkg.ElixirMixLockEntry](),
 		},
 		{
 			name:     "map pkg.NixStoreEntry struct type",
 			input:    "NixStoreMetadata",
-			expected: reflect.TypeOf(pkg.NixStoreEntry{}),
+			expected: reflect.TypeFor[pkg.NixStoreEntry](),
 		},
 		{
 			name:     "map pkg.NpmPackage struct type",
 			input:    "NpmPackageJsonMetadata",
-			expected: reflect.TypeOf(pkg.NpmPackage{}),
+			expected: reflect.TypeFor[pkg.NpmPackage](),
 		},
 		{
 			name:     "map pkg.NpmPackageLockEntry struct type",
 			input:    "NpmPackageLockJsonMetadata",
-			expected: reflect.TypeOf(pkg.NpmPackageLockEntry{}),
+			expected: reflect.TypeFor[pkg.NpmPackageLockEntry](),
 		},
 		{
 			name:     "map pkg.PortageEntry struct type",
 			input:    "PortageMetadata",
-			expected: reflect.TypeOf(pkg.PortageEntry{}),
+			expected: reflect.TypeFor[pkg.PortageEntry](),
 		},
 		{
 			name:     "map pkg.PythonPackage struct type",
 			input:    "PythonPackageMetadata",
-			expected: reflect.TypeOf(pkg.PythonPackage{}),
+			expected: reflect.TypeFor[pkg.PythonPackage](),
 		},
 		{
 			name:     "map pkg.PythonPipfileLockEntry struct type",
 			input:    "PythonPipfileLockMetadata",
-			expected: reflect.TypeOf(pkg.PythonPipfileLockEntry{}),
+			expected: reflect.TypeFor[pkg.PythonPipfileLockEntry](),
 		},
 		{
 			name:     "map pkg.PythonRequirementsEntry struct type",
 			input:    "PythonRequirementsMetadata",
-			expected: reflect.TypeOf(pkg.PythonRequirementsEntry{}),
+			expected: reflect.TypeFor[pkg.PythonRequirementsEntry](),
 		},
 		{
 			name:     "map pkg.PhpPeclEntry struct type",
 			input:    "PhpPeclMetadata",
-			expected: reflect.TypeOf(pkg.PhpPeclEntry{}),
+			expected: reflect.TypeFor[pkg.PhpPeclEntry](),
 		},
 		{
 			name:     "map pkg.ErlangRebarLockEntry struct type",
 			input:    "RebarLockMetadataType",
-			expected: reflect.TypeOf(pkg.ErlangRebarLockEntry{}),
+			expected: reflect.TypeFor[pkg.ErlangRebarLockEntry](),
 		},
 		{
 			name:     "map pkg.RDescription struct type",
 			input:    "RDescriptionFileMetadataType",
-			expected: reflect.TypeOf(pkg.RDescription{}),
+			expected: reflect.TypeFor[pkg.RDescription](),
 		},
 		{
 			name:     "map pkg.RpmDBEntry struct type",
 			input:    "RpmdbMetadata",
-			expected: reflect.TypeOf(pkg.RpmDBEntry{}),
+			expected: reflect.TypeFor[pkg.RpmDBEntry](),
 		},
 		// these cases are 1:many
 		{
@@ -228,28 +228,28 @@ func TestReflectTypeFromJSONName_LegacyValues(t *testing.T) {
 			// from a data-shape perspective either would be equally correct
 			// however, the RPMDBMetadata has been around longer and may have been more widely used
 			// so we'll map to that type for backwards compatibility.
-			expected: reflect.TypeOf(pkg.RpmDBEntry{}),
+			expected: reflect.TypeFor[pkg.RpmDBEntry](),
 		},
 		{
 			name:  "map pkg.HackageStackYamlLockEntry struct type - overlap with HackageStack*Metadata",
 			input: "HackageMetadataType",
 			// this used to be shared as a use case for both HackageStackYamlLockEntry and HackageStackYamlEntry
 			// but the HackageStackYamlLockEntry maps most closely to the original data shape.
-			expected: reflect.TypeOf(pkg.HackageStackYamlLockEntry{}),
+			expected: reflect.TypeFor[pkg.HackageStackYamlLockEntry](),
 		},
 		{
 			name:  "map pkg.PhpComposerLockEntry struct type",
 			input: "PhpComposerJsonMetadata",
 			// this used to be shared as a use case for both PhpComposerLockEntry and PhpComposerInstalledEntry
 			// neither of these is more correct over the other. These parsers were also introduced at the same time.
-			expected: reflect.TypeOf(pkg.PhpComposerLockEntry{}),
+			expected: reflect.TypeFor[pkg.PhpComposerLockEntry](),
 		},
 		{
 			name:  "map pkg.RustCargoLockEntry struct type",
 			input: "RustCargoPackageMetadata",
 			// this used to be shared as a use case for both RustCargoLockEntry and RustBinaryAuditEntry
 			// neither of these is more correct over the other.
-			expected: reflect.TypeOf(pkg.RustCargoLockEntry{}),
+			expected: reflect.TypeFor[pkg.RustCargoLockEntry](),
 		},
 	}
 

internal/regex_helpers.go

@@ -92,10 +92,7 @@ func processReaderInChunks(rdr io.Reader, chunkSize int, handler func(data []byt
 	lastRead := 0
 
 	for {
-		offset := half
-		if lastRead < half {
-			offset = lastRead
-		}
+		offset := min(lastRead, half)
 		start := half - offset
 		if lastRead > 0 {
 			copy(buf[start:], buf[half+offset:half+lastRead])

internal/relationship/exclude_binaries_by_file_ownership_overlap.go

@@ -26,9 +26,9 @@ var (
 		pkg.BitnamiPkg,
 	}
 	binaryMetadataTypes = []string{
-		reflect.TypeOf(pkg.ELFBinaryPackageNoteJSONPayload{}).Name(),
-		reflect.TypeOf(pkg.BinarySignature{}).Name(),
-		reflect.TypeOf(pkg.JavaVMInstallation{}).Name(),
+		reflect.TypeFor[pkg.ELFBinaryPackageNoteJSONPayload]().Name(),
+		reflect.TypeFor[pkg.BinarySignature]().Name(),
+		reflect.TypeFor[pkg.JavaVMInstallation]().Name(),
 	}
 )
 

internal/relationship/exclude_binaries_by_file_ownership_overlap_test.go

@@ -15,7 +15,6 @@ func TestExcludeByFileOwnershipOverlap(t *testing.T) {
 	packageC := pkg.Package{Name: "package-c", Type: pkg.BinaryPkg, Metadata: pkg.ELFBinaryPackageNoteJSONPayload{Type: "rpm"}}
 	packageD := pkg.Package{Name: "package-d", Type: pkg.BitnamiPkg}
 	for _, p := range []*pkg.Package{&packageA, &packageB, &packageC, &packageD} {
-		p := p
 		p.SetID()
 	}
 

internal/sourcemetadata/names.go

@@ -8,11 +8,11 @@ import (
 )
 
 var jsonNameFromType = map[reflect.Type][]string{
-	reflect.TypeOf(source.DirectoryMetadata{}): {"directory", "dir"},
-	reflect.TypeOf(source.FileMetadata{}):      {"file"},
-	reflect.TypeOf(source.ImageMetadata{}):     {"image"},
-	reflect.TypeOf(source.SnapMetadata{}):      {"snap"},
-	reflect.TypeOf(source.OCIModelMetadata{}):  {"oci-model"},
+	reflect.TypeFor[source.DirectoryMetadata](): {"directory", "dir"},
+	reflect.TypeFor[source.FileMetadata]():      {"file"},
+	reflect.TypeFor[source.ImageMetadata]():     {"image"},
+	reflect.TypeFor[source.SnapMetadata]():      {"snap"},
+	reflect.TypeFor[source.OCIModelMetadata]():  {"oci-model"},
 }
 
 func AllTypeNames() []string {

internal/string_helpers.go

@@ -1,6 +1,9 @@
 package internal
 
-import "strings"
+import (
+	"slices"
+	"strings"
+)
 
 // HasAnyOfPrefixes returns an indication if the given string has any of the given prefixes.
 func HasAnyOfPrefixes(input string, prefixes ...string) bool {
@@ -32,12 +35,7 @@ func TruncateMiddleEllipsis(input string, maxLen int) string {
 }
 
 func StringInSlice(a string, list []string) bool {
-	for _, b := range list {
-		if b == a {
-			return true
-		}
-	}
-	return false
+	return slices.Contains(list, a)
 }
 
 func SplitAny(s string, seps string) []string {

internal/testutils/golden_files.go

@@ -31,7 +31,7 @@ func UpdateGoldenFileContents(t *testing.T, contents []byte) {
 
 	t.Log(dangerText("!!! UPDATING GOLDEN FILE !!!"), goldenFilePath)
 
-	err := os.WriteFile(goldenFilePath, contents, 0600)
+	err := os.WriteFile(goldenFilePath, contents, 0o600)
 	if err != nil {
 		t.Fatalf("could not update golden file (%s): %+v", goldenFilePath, err)
 	}
@@ -50,7 +50,9 @@ func GetGoldenFileContents(t *testing.T) []byte {
 	}
 	defer f.Close()
 
-	bytes, err := io.ReadAll(f)
+	// suppress lint prohibiting ReadAll since golden files are source files in Syft's repository
+	// and not user provided artifacts.
+	bytes, err := io.ReadAll(f) //nolint:gocritic // golden files are trusted source files, not user artifacts
 	if err != nil {
 		t.Fatalf("could not read file (%s): %+v", goldenPath, err)
 	}

internal/tmpdir/tmpdir.go

@@ -0,0 +1,121 @@
+package tmpdir
+
+import (
+	"context"
+	"fmt"
+	"os"
+	"sync"
+	"sync/atomic"
+)
+
+type ctxKey struct{}
+
+// Root creates a new root temp directory with the given prefix and returns a context with the
+// TempDir attached. Callers should defer Cleanup() on the returned TempDir to ensure all
+// temp files are removed.
+func Root(ctx context.Context, prefix string) (context.Context, *TempDir) {
+	td := &TempDir{prefix: prefix}
+	return context.WithValue(ctx, ctxKey{}, td), td
+}
+
+// FromPath creates a TempDir backed by an existing directory. The caller owns the lifecycle of
+// the directory; Cleanup() is a no-op. This is useful for wrapping a directory from t.TempDir()
+// where the test framework handles cleanup automatically.
+func FromPath(dir string) *TempDir {
+	td := &TempDir{}
+	td.root = dir
+	td.initOnce.Do(func() {}) // mark as initialized
+	return td
+}
+
+// WithValue returns a new context with the given TempDir attached. Use this to inject an
+// existing TempDir into a context (e.g., sharing a TempDir across multiple test contexts).
+func WithValue(ctx context.Context, td *TempDir) context.Context {
+	return context.WithValue(ctx, ctxKey{}, td)
+}
+
+// FromContext returns the TempDir from the context, or nil if none is set.
+func FromContext(ctx context.Context) *TempDir {
+	td, _ := ctx.Value(ctxKey{}).(*TempDir)
+	return td
+}
+
+// TempDir manages a tree of temporary directories. All files and child directories live under
+// a single root path that can be removed in one shot via Cleanup(). After initialization, the
+// struct has no mutable state — NewChild and NewFile delegate uniqueness to os.MkdirTemp and
+// os.CreateTemp respectively, so no locking is needed on the hot path.
+type TempDir struct {
+	prefix      string
+	root        string // set exactly once by initOnce
+	initOnce    sync.Once
+	initErr     error
+	cleanupOnce sync.Once
+	cleaned     atomic.Bool
+}
+
+func noop() {}
+
+// path returns the root directory, lazily creating it on the first call.
+func (t *TempDir) path() (string, error) {
+	t.initOnce.Do(func() {
+		t.root, t.initErr = os.MkdirTemp("", t.prefix+"-")
+	})
+	if t.initErr != nil {
+		return "", fmt.Errorf("failed to create root temp dir: %w", t.initErr)
+	}
+	if t.cleaned.Load() {
+		return "", fmt.Errorf("temp dir has been cleaned up")
+	}
+	return t.root, nil
+}
+
+// NewChild creates a named subdirectory under this TempDir. The returned cleanup function removes
+// the subdirectory and all contents; callers should defer it to reclaim space early. The root
+// Cleanup acts as a safety net if the per-child cleanup is missed. The cleanup function is safe
+// to call multiple times and is safe to call after the root has already been cleaned up.
+func (t *TempDir) NewChild(name string) (string, func(), error) {
+	root, err := t.path()
+	if err != nil {
+		return "", noop, err
+	}
+	dir, err := os.MkdirTemp(root, name+"-")
+	if err != nil {
+		return "", noop, fmt.Errorf("failed to create child temp dir: %w", err)
+	}
+	cleanup := func() {
+		_ = os.RemoveAll(dir)
+	}
+	return dir, cleanup, nil
+}
+
+// NewFile creates a new temp file under this TempDir with the given name pattern (as in os.CreateTemp).
+// The caller is responsible for closing the file. The returned cleanup function removes the file;
+// callers should defer it to reclaim space early. The root Cleanup acts as a safety net if the
+// per-file cleanup is missed. The cleanup function is safe to call multiple times.
+func (t *TempDir) NewFile(pattern string) (*os.File, func(), error) {
+	root, err := t.path()
+	if err != nil {
+		return nil, noop, err
+	}
+	f, err := os.CreateTemp(root, pattern)
+	if err != nil {
+		return nil, noop, fmt.Errorf("failed to create temp file: %w", err)
+	}
+	cleanup := func() {
+		_ = os.Remove(f.Name())
+	}
+	return f, cleanup, nil
+}
+
+// Cleanup removes the entire root directory and all contents. Safe to call multiple times.
+func (t *TempDir) Cleanup() error {
+	var err error
+	t.cleanupOnce.Do(func() {
+		t.cleaned.Store(true)
+		if t.root == "" {
+			return
+		}
+		err = os.RemoveAll(t.root)
+	})
+	return err
+}

internal/tmpdir/tmpdir_test.go

@@ -0,0 +1,295 @@
+package tmpdir
+
+import (
+	"context"
+	"os"
+	"path/filepath"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestRootAndFromContext(t *testing.T) {
+	ctx := context.Background()
+	assert.Nil(t, FromContext(ctx))
+
+	ctx, td := Root(ctx, "test")
+	require.NotNil(t, FromContext(ctx))
+	assert.Same(t, td, FromContext(ctx))
+}
+
+func TestWithValue(t *testing.T) {
+	_, td := Root(context.Background(), "test")
+	defer td.Cleanup()
+
+	// inject the existing TempDir into a fresh context
+	ctx := WithValue(context.Background(), td)
+	assert.Same(t, td, FromContext(ctx))
+
+	// the injected TempDir is fully functional
+	f, cleanup, err := FromContext(ctx).NewFile("with-value-*.txt")
+	require.NoError(t, err)
+	defer cleanup()
+	require.NoError(t, f.Close())
+}
+
+func TestNewChild(t *testing.T) {
+	ctx, td := Root(context.Background(), "test")
+	defer td.Cleanup()
+	_ = ctx
+
+	child1, cleanup1, err := td.NewChild("sub")
+	require.NoError(t, err)
+	defer cleanup1()
+	child2, cleanup2, err := td.NewChild("sub")
+	require.NoError(t, err)
+	defer cleanup2()
+
+	// children are distinct
+	assert.NotEqual(t, child1, child2)
+
+	// both exist and are under the same root
+	info1, err := os.Stat(child1)
+	require.NoError(t, err)
+	assert.True(t, info1.IsDir())
+
+	info2, err := os.Stat(child2)
+	require.NoError(t, err)
+	assert.True(t, info2.IsDir())
+
+	assert.Equal(t, filepath.Dir(child1), filepath.Dir(child2))
+}
+
+func TestNewFile(t *testing.T) {
+	_, td := Root(context.Background(), "test")
+	defer td.Cleanup()
+
+	f, cleanup, err := td.NewFile("hello-*.txt")
+	require.NoError(t, err)
+	defer cleanup()
+
+	_, err = f.WriteString("hello")
+	require.NoError(t, err)
+	require.NoError(t, f.Close())
+
+	content, err := os.ReadFile(f.Name())
+	require.NoError(t, err)
+	assert.Equal(t, "hello", string(content))
+}
+
+func TestCleanup(t *testing.T) {
+	_, td := Root(context.Background(), "test")
+
+	child, _, err := td.NewChild("sub")
+	require.NoError(t, err)
+
+	f, _, err := td.NewFile("file-*")
+	require.NoError(t, err)
+	fname := f.Name()
+	f.Close()
+
+	// write a file inside the child dir too
+	require.NoError(t, os.WriteFile(filepath.Join(child, "inner.txt"), []byte("x"), 0600))
+
+	// everything exists
+	_, err = os.Stat(child)
+	require.NoError(t, err)
+	_, err = os.Stat(fname)
+	require.NoError(t, err)
+
+	// cleanup
+	require.NoError(t, td.Cleanup())
+
+	// everything is gone
+	_, err = os.Stat(child)
+	assert.True(t, os.IsNotExist(err))
+	_, err = os.Stat(fname)
+	assert.True(t, os.IsNotExist(err))
+
+	// double cleanup is safe
+	require.NoError(t, td.Cleanup())
+}
+
+func TestCleanupPreventsNewAllocation(t *testing.T) {
+	_, td := Root(context.Background(), "test")
+	require.NoError(t, td.Cleanup())
+
+	_, _, err := td.NewChild("nope")
+	assert.Error(t, err)
+
+	_, _, err = td.NewFile("nope-*")
+	assert.Error(t, err)
+}
+
+func TestEarlyCleanupFile(t *testing.T) {
+	_, td := Root(context.Background(), "test")
+	defer td.Cleanup()
+
+	f, cleanup, err := td.NewFile("early-*.txt")
+	require.NoError(t, err)
+
+	fname := f.Name()
+	require.NoError(t, f.Close())
+
+	// file exists before cleanup
+	_, err = os.Stat(fname)
+	require.NoError(t, err)
+
+	// early cleanup removes the file
+	cleanup()
+	_, err = os.Stat(fname)
+	assert.True(t, os.IsNotExist(err))
+
+	// calling cleanup again is safe (idempotent)
+	cleanup()
+}
+
+func TestEarlyCleanupChild(t *testing.T) {
+	_, td := Root(context.Background(), "test")
+	defer td.Cleanup()
+
+	child, cleanup, err := td.NewChild("early")
+	require.NoError(t, err)
+
+	// child dir exists
+	_, err = os.Stat(child)
+	require.NoError(t, err)
+
+	// early cleanup removes it
+	cleanup()
+	_, err = os.Stat(child)
+	assert.True(t, os.IsNotExist(err))
+
+	// calling cleanup again is safe (idempotent)
+	cleanup()
+}
+
+func TestEarlyCleanupThenRootCleanup(t *testing.T) {
+	_, td := Root(context.Background(), "test")
+
+	f, cleanupFile, err := td.NewFile("combo-*.txt")
+	require.NoError(t, err)
+	fname := f.Name()
+	f.Close()
+
+	child, cleanupChild, err := td.NewChild("combo")
+	require.NoError(t, err)
+
+	// early cleanup both
+	cleanupFile()
+	cleanupChild()
+
+	// files are already gone
+	_, err = os.Stat(fname)
+	assert.True(t, os.IsNotExist(err))
+	_, err = os.Stat(child)
+	assert.True(t, os.IsNotExist(err))
+
+	// root cleanup still works (no error on already-removed contents)
+	require.NoError(t, td.Cleanup())
+}
+
+func TestConcurrentNewChildAndNewFile(t *testing.T) {
+	_, td := Root(context.Background(), "test")
+	defer td.Cleanup()
+
+	const goroutines = 20
+	errs := make(chan error, goroutines)
+	paths := make(chan string, goroutines)
+
+	for i := range goroutines {
+		go func(i int) {
+			if i%2 == 0 {
+				child, cleanup, err := td.NewChild("concurrent")
+				if err != nil {
+					errs <- err
+					return
+				}
+				defer cleanup()
+				paths <- child
+			} else {
+				f, cleanup, err := td.NewFile("concurrent-*.txt")
+				if err != nil {
+					errs <- err
+					return
+				}
+				defer cleanup()
+				_ = f.Close()
+				paths <- f.Name()
+			}
+			errs <- nil
+		}(i)
+	}
+
+	seen := make(map[string]bool)
+	for range goroutines {
+		err := <-errs
+		require.NoError(t, err)
+	}
+	close(paths)
+	for p := range paths {
+		assert.False(t, seen[p], "duplicate path: %s", p)
+		seen[p] = true
+	}
+	assert.Len(t, seen, goroutines)
+}
+
+func TestConcurrentNewChildDuringCleanup(t *testing.T) {
+	_, td := Root(context.Background(), "test")
+
+	// trigger root creation
+	_, cleanup, err := td.NewChild("init")
+	require.NoError(t, err)
+	cleanup()
+
+	// cleanup and concurrent NewChild should not panic
+	done := make(chan struct{})
+	go func() {
+		_ = td.Cleanup()
+		close(done)
+	}()
+	// try creating children concurrently with cleanup — should get errors, not panics
+	for range 10 {
+		_, c, _ := td.NewChild("race")
+		if c != nil {
+			c()
+		}
+	}
+	<-done
+}
+
+func TestLazyCreation(t *testing.T) {
+	_, td := Root(context.Background(), "test")
+
+	// root dir is not created until needed
+	assert.Equal(t, "", td.root)
+
+	_, _, err := td.NewFile("trigger-*")
+	require.NoError(t, err)
+
+	assert.NotEmpty(t, td.root)
+
+	require.NoError(t, td.Cleanup())
+}
+
+func TestFromPath(t *testing.T) {
+	dir := t.TempDir()
+	td := FromPath(dir)
+
+	// can create children
+	child, cleanup, err := td.NewChild("sub")
+	require.NoError(t, err)
+	defer cleanup()
+	assert.DirExists(t, child)
+
+	// can create files
+	f, cleanupFile, err := td.NewFile("file-*.txt")
+	require.NoError(t, err)
+	defer cleanupFile()
+	require.NoError(t, f.Close())
+	assert.FileExists(t, f.Name())
+
+	// root is the provided dir
+	assert.Equal(t, dir, filepath.Dir(child))
+}

internal/tprint.go

@@ -6,7 +6,7 @@ import (
 )
 
 // Tprintf renders a string from a given template string and field values
-func Tprintf(tmpl string, data map[string]interface{}) string {
+func Tprintf(tmpl string, data map[string]any) string {
 	t := template.Must(template.New("").Parse(tmpl))
 	buf := &bytes.Buffer{}
 	if err := t.Execute(buf, data); err != nil {

internal/unknown/coordinate_error.go

@@ -3,6 +3,7 @@ package unknown
 import (
 	"errors"
 	"fmt"
+	"slices"
 	"strings"
 
 	"github.com/anchore/syft/internal/log"
@@ -155,12 +156,7 @@ func containsErr(out []error, err error) bool {
 			log.Tracef("error comparing errors: %v", err)
 		}
 	}()
-	for _, e := range out {
-		if e == err {
-			return true
-		}
-	}
-	return false
+	return slices.Contains(out, err)
 }
 
 // visitErrors visits every wrapped error. the returned error replaces the provided error, null errors are omitted from

schema/cyclonedx/cyclonedx.json

@@ -5132,6 +5132,7 @@
                 "armv9-a",
                 "armv9-m",
                 "s390x",
+                "riscv64",
                 "ppc64",
                 "ppc64le",
                 "other",

schema/cyclonedx/cyclonedx.xsd

@@ -6471,6 +6471,7 @@ limitations under the License.
                                     <xs:enumeration value="armv9-a"/>
                                     <xs:enumeration value="armv9-m"/>
                                     <xs:enumeration value="s390x"/>
+                                    <xs:enumeration value="riscv64"/>
                                     <xs:enumeration value="ppc64"/>
                                     <xs:enumeration value="ppc64le"/>
                                     <xs:enumeration value="other"/>

syft/artifact/id.go

@@ -13,7 +13,7 @@ type Identifiable interface {
 	ID() ID
 }
 
-func IDByHash(obj interface{}) (ID, error) {
+func IDByHash(obj any) (ID, error) {
 	f, err := hashstructure.Hash(obj, &hashstructure.HashOptions{
 		ZeroNil:      true,
 		SlicesAsSets: true,

syft/artifact/relationship.go

@@ -38,5 +38,5 @@ type Relationship struct {
 	From Identifiable
 	To   Identifiable
 	Type RelationshipType
-	Data interface{}
+	Data any
 }

syft/configuration_audit_trail.go

@@ -41,7 +41,7 @@ func (cfg configurationAuditTrail) MarshalJSON() ([]byte, error) {
 		return nil, err
 	}
 
-	var dataMap map[string]interface{}
+	var dataMap map[string]any
 	if err := json.Unmarshal(initialJSON, &dataMap); err != nil {
 		return nil, err
 	}
@@ -55,13 +55,13 @@ func (cfg configurationAuditTrail) MarshalJSON() ([]byte, error) {
 }
 
 // marshalSorted recursively marshals a map with sorted keys
-func marshalSorted(m interface{}) ([]byte, error) {
+func marshalSorted(m any) ([]byte, error) {
 	if reflect.TypeOf(m).Kind() != reflect.Map {
 		return json.Marshal(m)
 	}
 
 	val := reflect.ValueOf(m)
-	sortedMap := make(map[string]interface{})
+	sortedMap := make(map[string]any)
 
 	for _, key := range val.MapKeys() {
 		value := val.MapIndex(key).Interface()

syft/configuration_audit_trail_test.go

@@ -33,7 +33,7 @@ func Test_configurationAuditTrail_StructTags(t *testing.T) {
 
 }
 
-func getJSONTags(t *testing.T, v interface{}) []string {
+func getJSONTags(t *testing.T, v any) []string {
 	var tags []string
 	err := collectJSONTags(t, reflect.ValueOf(v), &tags, "", "")
 	require.NoError(t, err)
@@ -142,7 +142,7 @@ func Test_collectJSONTags(t *testing.T) {
 
 	tests := []struct {
 		name    string
-		v       interface{}
+		v       any
 		want    []string
 		wantErr require.ErrorAssertionFunc
 	}{

syft/create_sbom.go

@@ -12,8 +12,10 @@ import (
 	"github.com/anchore/go-sync"
 	"github.com/anchore/syft/internal/bus"
 	"github.com/anchore/syft/internal/licenses"
+	"github.com/anchore/syft/internal/log"
 	"github.com/anchore/syft/internal/sbomsync"
 	"github.com/anchore/syft/internal/task"
+	"github.com/anchore/syft/internal/tmpdir"
 	"github.com/anchore/syft/syft/artifact"
 	"github.com/anchore/syft/syft/cataloging"
 	"github.com/anchore/syft/syft/event/monitor"
@@ -24,6 +26,8 @@ import (
 
 // CreateSBOM creates a software bill-of-materials from the given source. If the CreateSBOMConfig is nil, then
 // default options will be used.
+//
+//nolint:funlen
 func CreateSBOM(ctx context.Context, src source.Source, cfg *CreateSBOMConfig) (*sbom.SBOM, error) {
 	if cfg == nil {
 		cfg = DefaultCreateSBOMConfig()
@@ -65,12 +69,25 @@ func CreateSBOM(ctx context.Context, src source.Source, cfg *CreateSBOMConfig) (
 		},
 	}
 
-	// setup everything we need in context: license scanner, executors, etc.
+	// check if the caller already provided a TempDir; if so, don't clean it up (the caller owns it)
+	callerOwnsTempDir := tmpdir.FromContext(ctx) != nil
+
+	// setup everything we need in context: license scanner, executors, temp storage, etc.
 	ctx, err = setupContext(ctx, cfg)
 	if err != nil {
 		return nil, err
 	}
 
+	if !callerOwnsTempDir {
+		if td := tmpdir.FromContext(ctx); td != nil {
+			defer func() {
+				if err := td.Cleanup(); err != nil {
+					log.Warnf("failed to clean up temp dir: %v", err)
+				}
+			}()
+		}
+	}
+
 	catalogingProgress := monitorCatalogingTask(src.ID(), taskGroups)
 	packageCatalogingProgress := monitorPackageCatalogingTask()
 
@@ -95,6 +112,11 @@ func setupContext(ctx context.Context, cfg *CreateSBOMConfig) (context.Context,
 	// configure parallel executors
 	ctx = setContextExecutors(ctx, cfg)
 
+	// configure temp dir factory for catalogers (if not already set)
+	if tmpdir.FromContext(ctx) == nil {
+		ctx, _ = tmpdir.Root(ctx, "syft-cataloger")
+	}
+
 	// configure license scanner
 	// skip injecting a license scanner if one already set on context
 	if licenses.IsContextLicenseScannerSet(ctx) {

syft/create_sbom_config.go

@@ -34,7 +34,7 @@ type CreateSBOMConfig struct {
 	// audit what tool is being used to generate the SBOM
 	ToolName          string
 	ToolVersion       string
-	ToolConfiguration interface{}
+	ToolConfiguration any
 
 	packageTaskFactories       task.Factories
 	packageCatalogerReferences []pkgcataloging.CatalogerReference

syft/event/parsers/parsers.go

@@ -17,14 +17,14 @@ import (
 type ErrBadPayload struct {
 	Type  partybus.EventType
 	Field string
-	Value interface{}
+	Value any
 }
 
 func (e *ErrBadPayload) Error() string {
 	return fmt.Sprintf("event='%s' has bad event payload field=%q: %q", string(e.Type), e.Field, e.Value)
 }
 
-func newPayloadErr(t partybus.EventType, field string, value interface{}) error {
+func newPayloadErr(t partybus.EventType, field string, value any) error {
 	return &ErrBadPayload{
 		Type:  t,
 		Field: field,

syft/file/cataloger/executable/testdata/elf/Makefile

@@ -22,7 +22,7 @@ tools-check:
 # docker buildx build --platform linux/amd64 -t $(TOOL_IMAGE) .
 
 tools:
-	@(docker inspect $(TOOL_IMAGE) > /dev/null && make tools-check) || (docker build -t $(TOOL_IMAGE) . && sha256sum Dockerfile > Dockerfile.sha256)
+	@(docker image inspect $(TOOL_IMAGE) > /dev/null 2>&1 && make tools-check) || (docker build -t $(TOOL_IMAGE) . && sha256sum Dockerfile > Dockerfile.sha256)
 
 build: tools
 	mkdir -p $(BIN)
@@ -31,7 +31,7 @@ build: tools
 verify: tools
 	@rm -f $(VERIFY_FILE)
 	docker run -i -v $(shell pwd):/mount -w /mount/project $(TOOL_IMAGE) make verify > $(VERIFY_FILE)
-	@python ./differ expected_verify $(VERIFY_FILE)
+	@python3 ./differ expected_verify $(VERIFY_FILE)
 
 debug:
 	docker run -i --rm -v $(shell pwd):/mount -w /mount/project $(TOOL_IMAGE) bash

syft/file/cataloger/executable/testdata/shared-info/Dockerfile

@@ -1,10 +1,9 @@
 # syntax=docker/dockerfile:1
 
 ARG OSXCROSS_VERSION=13.1
-ARG BUILDPLATFORM=linux/amd64
-FROM --platform=$BUILDPLATFORM crazymax/osxcross:${OSXCROSS_VERSION}-ubuntu AS osxcross
+FROM --platform=linux/amd64 crazymax/osxcross:${OSXCROSS_VERSION}-ubuntu AS osxcross
 
-FROM --platform=$BUILDPLATFORM ubuntu:22.04
+FROM --platform=linux/amd64 ubuntu:22.04
 
 RUN apt update -y && apt install -y \
     curl wget \

syft/file/cataloger/executable/testdata/shared-info/Makefile

@@ -19,7 +19,7 @@ tools-check:
 	@sha256sum -c Dockerfile.sha256 || (echo "Tools Dockerfile has changed" && exit 1)
 
 tools:
-	@(docker inspect $(TOOL_IMAGE) > /dev/null && make tools-check) || (docker build -t $(TOOL_IMAGE) . && sha256sum Dockerfile > Dockerfile.sha256)
+	@(docker image inspect $(TOOL_IMAGE) > /dev/null 2>&1 && make tools-check) || (docker build --platform linux/amd64 -t $(TOOL_IMAGE) . && sha256sum Dockerfile > Dockerfile.sha256)
 
 build: tools
 	@mkdir -p $(BIN)

syft/file/search_result.go

@@ -26,5 +26,5 @@ type SearchResult struct {
 }
 
 func (s SearchResult) String() string {
-	return fmt.Sprintf("SearchResult(classification=%q seek=%q length=%q)", s.Classification, s.SeekPosition, s.Length)
+	return fmt.Sprintf("SearchResult(classification=%q seek=%d length=%d)", s.Classification, s.SeekPosition, s.Length)
 }

syft/format/common/spdxhelpers/to_format_model.go

@@ -310,9 +310,9 @@ func toRootPackage(s source.Description) *spdx.Package {
 
 func toSPDXID(identifiable artifact.Identifiable) spdx.ElementID {
 	id := string(identifiable.ID())
-	if strings.HasPrefix(id, "SPDXRef-") {
+	if after, ok := strings.CutPrefix(id, "SPDXRef-"); ok {
 		// this is already an SPDX ID, no need to change it (except for the prefix)
-		return spdx.ElementID(helpers.SanitizeElementID(strings.TrimPrefix(id, "SPDXRef-")))
+		return spdx.ElementID(helpers.SanitizeElementID(after))
 	}
 	maxLen := 40
 	switch it := identifiable.(type) {

syft/format/common/spdxhelpers/to_syft_model.go

@@ -479,7 +479,7 @@ func toSyftLocation(f *spdx.File) file.Location {
 	return l
 }
 
-func requireAndTrimPrefix(val interface{}, prefix string) string {
+func requireAndTrimPrefix(val any, prefix string) string {
 	if v, ok := val.(string); ok {
 		if i := strings.Index(v, prefix); i == 0 {
 			return strings.Replace(v, prefix, "", 1)

syft/format/common/spdxhelpers/to_syft_model_test.go

@@ -119,7 +119,7 @@ func Test_extractMetadata(t *testing.T) {
 	oneTwoThreeFour := 1234
 	tests := []struct {
 		pkg  spdx.Package
-		meta interface{}
+		meta any
 	}{
 		{
 			pkg: spdx.Package{

syft/format/github/internal/model/github_dependency_api.go

@@ -73,6 +73,6 @@ type DependencyGraph map[string]DependencyNode
 
 type ISO8601Date = string
 
-type Scalar interface{} // should be: null | boolean | string | number
+type Scalar any // should be: null | boolean | string | number
 
 type Metadata map[string]Scalar

syft/format/internal/backfill.go

@@ -151,13 +151,13 @@ var epochPrefix = regexp.MustCompile(`^\d+:`)
 // nameFromPurl returns the syft package name of the package from the purl. If the purl includes a namespace,
 // the name is prefixed as appropriate based on the PURL type
 func nameFromPurl(purl packageurl.PackageURL) string {
-	if !nameExcludesPurlNamespace(purl.Type) && purl.Namespace != "" {
+	if !NameExcludesPurlNamespace(purl.Type) && purl.Namespace != "" {
 		return fmt.Sprintf("%s/%s", purl.Namespace, purl.Name)
 	}
 	return purl.Name
 }
 
-func nameExcludesPurlNamespace(purlType string) bool {
+func NameExcludesPurlNamespace(purlType string) bool {
 	switch purlType {
 	case packageurl.TypeAlpine,
 		packageurl.TypeAlpm,

syft/format/internal/cyclonedxutil/helpers/author.go

@@ -31,7 +31,7 @@ func encodeAuthor(p pkg.Package) string {
 	return ""
 }
 
-func decodeAuthor(author string, metadata interface{}) {
+func decodeAuthor(author string, metadata any) {
 	switch meta := metadata.(type) {
 	case *pkg.NpmPackage:
 		meta.Author = author

syft/format/internal/cyclonedxutil/helpers/component.go

@@ -165,6 +165,7 @@ func getPURL(c *cyclonedx.Component, ty pkg.Type) string {
 	return purl.ToString()
 }
 
+//nolint:gocognit
 func setPackageName(p *pkg.Package, c *cyclonedx.Component) {
 	name := c.Name
 	if c.Group != "" {
@@ -195,14 +196,16 @@ func setPackageName(p *pkg.Package, c *cyclonedx.Component) {
 				}
 			}
 		default:
-			name = fmt.Sprintf("%s/%s", c.Group, name)
+			if !internal.NameExcludesPurlNamespace(p.Type.PackageURLType()) {
+				name = fmt.Sprintf("%s/%s", c.Group, name)
+			}
 		}
 	}
 	p.Name = name
 }
 
 func decodeLocations(vals map[string]string) file.LocationSet {
-	v := Decode(reflect.TypeOf([]file.Location{}), vals, "syft:location", CycloneDXFields)
+	v := Decode(reflect.TypeFor[[]file.Location](), vals, "syft:location", CycloneDXFields)
 	out, ok := v.([]file.Location)
 	if !ok {
 		out = nil
@@ -210,7 +213,7 @@ func decodeLocations(vals map[string]string) file.LocationSet {
 	return file.NewLocationSet(out...)
 }
 
-func decodePackageMetadata(vals map[string]string, c *cyclonedx.Component, typeName string) interface{} {
+func decodePackageMetadata(vals map[string]string, c *cyclonedx.Component, typeName string) any {
 	if typeName != "" && c.Properties != nil {
 		metadataType := packagemetadata.ReflectTypeFromJSONName(typeName)
 		if metadataType == nil {

syft/format/internal/cyclonedxutil/helpers/component_test.go

@@ -384,6 +384,65 @@ func Test_decodeComponent(t *testing.T) {
 	}
 }
 
+func Test_setPackageName(t *testing.T) {
+	tests := []struct {
+		name     string
+		pkg      pkg.Package
+		comp     cyclonedx.Component
+		wantName string
+	}{
+		{
+			name:     "debian group excluded from name",
+			pkg:      pkg.Package{Type: pkg.DebPkg},
+			comp:     cyclonedx.Component{Name: "wget", Group: "debian"},
+			wantName: "wget",
+		},
+		{
+			name:     "rpm group excluded from name",
+			pkg:      pkg.Package{Type: pkg.RpmPkg},
+			comp:     cyclonedx.Component{Name: "acl", Group: "centos"},
+			wantName: "acl",
+		},
+		{
+			name:     "apk group excluded from name",
+			pkg:      pkg.Package{Type: pkg.ApkPkg},
+			comp:     cyclonedx.Component{Name: "musl", Group: "alpine"},
+			wantName: "musl",
+		},
+		{
+			name:     "npm group included in name",
+			pkg:      pkg.Package{Type: pkg.NpmPkg},
+			comp:     cyclonedx.Component{Name: "node", Group: "@types"},
+			wantName: "@types/node",
+		},
+		{
+			name:     "go module group included in name",
+			pkg:      pkg.Package{Type: pkg.GoModulePkg},
+			comp:     cyclonedx.Component{Name: "net", Group: "golang.org/x"},
+			wantName: "golang.org/x/net",
+		},
+		{
+			name:     "no group leaves name unchanged",
+			pkg:      pkg.Package{Type: pkg.DebPkg},
+			comp:     cyclonedx.Component{Name: "wget"},
+			wantName: "wget",
+		},
+		{
+			name:     "java group stored in metadata not name",
+			pkg:      pkg.Package{Type: pkg.JavaPkg},
+			comp:     cyclonedx.Component{Name: "log4j", Group: "org.apache.logging.log4j"},
+			wantName: "log4j",
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			p := tt.pkg
+			setPackageName(&p, &tt.comp)
+			assert.Equal(t, tt.wantName, p.Name)
+		})
+	}
+}
+
 func TestGetPURL(t *testing.T) {
 	tests := []struct {
 		name      string

syft/format/internal/cyclonedxutil/helpers/decoder.go

@@ -26,7 +26,7 @@ func ToSyftModel(bom *cyclonedx.BOM) (*sbom.SBOM, error) {
 		Descriptor: extractDescriptor(bom.Metadata),
 	}
 
-	idMap := make(map[string]interface{})
+	idMap := make(map[string]any)
 
 	if err := collectBomPackages(bom, s, idMap); err != nil {
 		return nil, err
@@ -37,7 +37,7 @@ func ToSyftModel(bom *cyclonedx.BOM) (*sbom.SBOM, error) {
 	return s, nil
 }
 
-func collectBomPackages(bom *cyclonedx.BOM, s *sbom.SBOM, idMap map[string]interface{}) error {
+func collectBomPackages(bom *cyclonedx.BOM, s *sbom.SBOM, idMap map[string]any) error {
 	componentsPresent := false
 	if bom.Components != nil {
 		for i := range *bom.Components {
@@ -58,7 +58,7 @@ func collectBomPackages(bom *cyclonedx.BOM, s *sbom.SBOM, idMap map[string]inter
 	return nil
 }
 
-func collectPackages(component *cyclonedx.Component, s *sbom.SBOM, idMap map[string]interface{}) {
+func collectPackages(component *cyclonedx.Component, s *sbom.SBOM, idMap map[string]any) {
 	switch component.Type {
 	case cyclonedx.ComponentTypeOS:
 	case cyclonedx.ComponentTypeContainer:
@@ -168,7 +168,7 @@ func getPropertyValue(component *cyclonedx.Component, name string) string {
 	return ""
 }
 
-func collectRelationships(bom *cyclonedx.BOM, s *sbom.SBOM, idMap map[string]interface{}) {
+func collectRelationships(bom *cyclonedx.BOM, s *sbom.SBOM, idMap map[string]any) {
 	if bom.Dependencies == nil {
 		return
 	}

syft/format/internal/cyclonedxutil/helpers/description.go

@@ -14,7 +14,7 @@ func encodeDescription(p pkg.Package) string {
 	return ""
 }
 
-func decodeDescription(description string, metadata interface{}) {
+func decodeDescription(description string, metadata any) {
 	switch meta := metadata.(type) {
 	case *pkg.ApkDBEntry:
 		meta.Description = description

syft/format/internal/cyclonedxutil/helpers/external_references.go

@@ -100,7 +100,7 @@ func toCycloneDXAlgorithm(algorithm string) cyclonedx.HashAlgorithm {
 	return validMap[strings.ToLower(algorithm)]
 }
 
-func decodeExternalReferences(c *cyclonedx.Component, metadata interface{}) {
+func decodeExternalReferences(c *cyclonedx.Component, metadata any) {
 	if c.ExternalReferences == nil {
 		return
 	}

syft/format/internal/cyclonedxutil/helpers/group.go

@@ -11,7 +11,7 @@ func encodeGroup(p pkg.Package) string {
 	return ""
 }
 
-func decodeGroup(group string, metadata interface{}) {
+func decodeGroup(group string, metadata any) {
 	if meta, ok := metadata.(*pkg.JavaArchive); ok {
 		if meta.PomProperties == nil {
 			meta.PomProperties = &pkg.JavaPomProperties{}

syft/format/internal/cyclonedxutil/helpers/properties.go

@@ -10,7 +10,7 @@ var (
 	CycloneDXFields = RequiredTag("cyclonedx")
 )
 
-func EncodeProperties(obj interface{}, prefix string) (out []cyclonedx.Property) {
+func EncodeProperties(obj any, prefix string) (out []cyclonedx.Property) {
 	for _, p := range Sorted(Encode(obj, prefix, CycloneDXFields)) {
 		out = append(out, cyclonedx.Property{
 			Name:  p.Name,
@@ -23,8 +23,8 @@ func EncodeProperties(obj interface{}, prefix string) (out []cyclonedx.Property)
 func decodeProperties(properties []cyclonedx.Property, prefix string) map[string]string {
 	labels := make(map[string]string)
 	for _, property := range properties {
-		if strings.HasPrefix(property.Name, prefix) {
-			labelName := strings.TrimPrefix(property.Name, prefix)
+		if after, ok := strings.CutPrefix(property.Name, prefix); ok {
+			labelName := after
 			labels[labelName] = property.Value
 		}
 	}

syft/format/internal/cyclonedxutil/helpers/property_encoder.go

@@ -300,8 +300,8 @@ func decode(vals map[string]string, value reflect.Value, prefix string, fn Field
 		// NOTE: this will not work for nested maps
 		for key := range vals {
 			// test for map prefix
-			if strings.HasPrefix(key, str) {
-				keyVals[key] = strings.TrimPrefix(key, str)
+			if after, ok := strings.CutPrefix(key, str); ok {
+				keyVals[key] = after
 				// create new placeholder and decode key
 				newKeyType := keyType
 				if keyType.Kind() == reflect.Ptr {

syft/format/internal/cyclonedxutil/helpers/property_encoder_test.go

@@ -46,7 +46,7 @@ func Test_EncodeDecodeCycle(t *testing.T) {
 
 	tests := []struct {
 		name  string
-		value interface{}
+		value any
 	}{
 		{
 			name: "all values",

syft/format/internal/cyclonedxutil/helpers/publisher.go

@@ -18,7 +18,7 @@ func encodePublisher(p pkg.Package) string {
 	return ""
 }
 
-func decodePublisher(publisher string, metadata interface{}) {
+func decodePublisher(publisher string, metadata any) {
 	switch meta := metadata.(type) {
 	case *pkg.ApkDBEntry:
 		meta.Maintainer = publisher

syft/format/internal/stream/seekable_reader.go

@@ -20,7 +20,7 @@ func SeekableReader(reader io.Reader) (io.ReadSeeker, error) {
 		return getOffsetReadSeeker(r)
 	}
 
-	content, err := io.ReadAll(reader)
+	content, err := io.ReadAll(reader) //nolint:gocritic // buffering non-seekable to seekable reader
 	if err != nil {
 		return nil, err
 	}

syft/format/syftjson/model/document.go

@@ -17,8 +17,8 @@ type Document struct {
 }
 
 func (d *Document) UnmarshalJSON(data []byte) error {
-	type Alias *Document
-	aux := Alias(d)
+	type Alias Document
+	aux := (*Alias)(d)
 
 	if err := json.Unmarshal(data, aux); err != nil {
 		return fmt.Errorf("could not unmarshal syft JSON document: %w", err)
@@ -44,7 +44,7 @@ type Descriptor struct {
 	Version string `json:"version"`
 
 	// Configuration contains the tool configuration used during SBOM generation.
-	Configuration interface{} `json:"configuration,omitempty"`
+	Configuration any `json:"configuration,omitempty"`
 }
 
 // Schema specifies the JSON schema version and URL reference that defines the structure and validation rules for this document format.

syft/format/syftjson/model/document_test.go

@@ -2,12 +2,48 @@ package model
 
 import (
 	"encoding/json"
+	"runtime/debug"
 	"testing"
+	"time"
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
 
+// TestDocumentUnmarshalJSON_NoInfiniteRecursion guards against the regression
+// where encoding/json/v2 (GOEXPERIMENT=jsonv2) would call UnmarshalJSON
+// recursively on the alias type, causing a goroutine stack overflow.
+// See: https://github.com/golang/go/issues/75361
+func TestDocumentUnmarshalJSON_NoInfiniteRecursion(t *testing.T) {
+	data := `{
+		"artifacts": [
+			{"id": "1", "name": "pkg-a", "version": "1.0", "type": "npm", "foundBy": "cataloger", "locations": [], "licenses": [], "language": "javascript", "cpes": [], "purl": "pkg:npm/pkg-a@1.0"},
+			{"id": "2", "name": "pkg-b", "version": "2.0", "type": "gem", "foundBy": "cataloger", "locations": [], "licenses": [], "language": "ruby",      "cpes": [], "purl": "pkg:gem/pkg-b@2.0"}
+		],
+		"schema": {"version": "16.0.0", "url": "https://example.com"},
+		"descriptor": {"name": "syft", "version": "1.0.0"}
+	}`
+
+	// Shrink the max goroutine stack to 8MB so that infinite recursion
+	// (golang/go#75361 — encoding/json/v2 re-dispatching to UnmarshalJSON
+	// via type Alias *Document) overflows quickly rather than after minutes.
+	old := debug.SetMaxStack(8 * 1024 * 1024)
+	defer debug.SetMaxStack(old)
+
+	done := make(chan error, 1)
+	go func() {
+		var doc Document
+		done <- json.Unmarshal([]byte(data), &doc)
+	}()
+
+	select {
+	case err := <-done:
+		require.NoError(t, err)
+	case <-time.After(5 * time.Second):
+		t.Fatal("json.Unmarshal did not complete — likely infinite recursion in UnmarshalJSON")
+	}
+}
+
 func TestDocumentUnmarshalJSON_SchemaDetection(t *testing.T) {
 	tests := []struct {
 		name     string

syft/format/syftjson/model/linux_release_test.go

@@ -11,7 +11,7 @@ import (
 func TestIDLikes_UnmarshalJSON(t *testing.T) {
 	tests := []struct {
 		name     string
-		data     interface{}
+		data     any
 		expected IDLikes
 	}{
 		{

syft/format/syftjson/model/package.go

@@ -205,7 +205,7 @@ func unpackPkgMetadata(p *Package, unpacker packageMetadataUnpacker) error {
 	if typ == nil {
 		// capture unknown metadata as a generic struct
 		if len(unpacker.Metadata) > 0 {
-			var val interface{}
+			var val any
 			if err := json.Unmarshal(unpacker.Metadata, &val); err != nil {
 				return err
 			}

syft/format/syftjson/model/package_test.go

@@ -207,7 +207,7 @@ func Test_UnmarshalJSON(t *testing.T) {
 `),
 			assert: func(p *Package) {
 				assert.Equal(t, pkg.RpmPkg, p.Type)
-				assert.Equal(t, reflect.TypeOf(pkg.RpmDBEntry{}).Name(), reflect.TypeOf(p.Metadata).Name())
+				assert.Equal(t, reflect.TypeFor[pkg.RpmDBEntry]().Name(), reflect.TypeOf(p.Metadata).Name())
 			},
 		},
 		{
@@ -248,7 +248,7 @@ func Test_UnmarshalJSON(t *testing.T) {
 `),
 			assert: func(p *Package) {
 				assert.Equal(t, pkg.RpmPkg, p.Type)
-				assert.Equal(t, reflect.TypeOf(pkg.RpmArchive{}).Name(), reflect.TypeOf(p.Metadata).Name())
+				assert.Equal(t, reflect.TypeFor[pkg.RpmArchive]().Name(), reflect.TypeOf(p.Metadata).Name())
 			},
 		},
 		{
@@ -287,7 +287,7 @@ func Test_UnmarshalJSON(t *testing.T) {
 }`),
 			assert: func(p *Package) {
 				assert.Equal(t, pkg.HackagePkg, p.Type)
-				assert.Equal(t, reflect.TypeOf(pkg.HackageStackYamlEntry{}).Name(), reflect.TypeOf(p.Metadata).Name())
+				assert.Equal(t, reflect.TypeFor[pkg.HackageStackYamlEntry]().Name(), reflect.TypeOf(p.Metadata).Name())
 			},
 		},
 		{
@@ -327,7 +327,7 @@ func Test_UnmarshalJSON(t *testing.T) {
 }`),
 			assert: func(p *Package) {
 				assert.Equal(t, pkg.HackagePkg, p.Type)
-				assert.Equal(t, reflect.TypeOf(pkg.HackageStackYamlLockEntry{}).Name(), reflect.TypeOf(p.Metadata).Name())
+				assert.Equal(t, reflect.TypeFor[pkg.HackageStackYamlLockEntry]().Name(), reflect.TypeOf(p.Metadata).Name())
 			},
 		},
 		{
@@ -355,7 +355,7 @@ func Test_UnmarshalJSON(t *testing.T) {
 }`),
 			assert: func(p *Package) {
 				assert.Equal(t, pkg.HackagePkg, p.Type)
-				assert.Equal(t, reflect.TypeOf(pkg.RustCargoLockEntry{}).Name(), reflect.TypeOf(p.Metadata).Name())
+				assert.Equal(t, reflect.TypeFor[pkg.RustCargoLockEntry]().Name(), reflect.TypeOf(p.Metadata).Name())
 			},
 		},
 		{
@@ -383,7 +383,7 @@ func Test_UnmarshalJSON(t *testing.T) {
 }`),
 			assert: func(p *Package) {
 				assert.Equal(t, pkg.HackagePkg, p.Type)
-				assert.Equal(t, reflect.TypeOf(pkg.RustBinaryAuditEntry{}).Name(), reflect.TypeOf(p.Metadata).Name())
+				assert.Equal(t, reflect.TypeFor[pkg.RustBinaryAuditEntry]().Name(), reflect.TypeOf(p.Metadata).Name())
 			},
 		},
 		{
@@ -654,7 +654,7 @@ func Test_unpackMetadata(t *testing.T) {
 				}
 			}`),
 			wantErr: require.Error,
-			wantMetadata: map[string]interface{}{
+			wantMetadata: map[string]any{
 				"thing": "thing-1",
 			},
 		},

syft/format/syftjson/model/relationship.go

@@ -12,5 +12,5 @@ type Relationship struct {
 	Type string `json:"type"`
 
 	// Metadata contains additional relationship-specific metadata.
-	Metadata interface{} `json:"metadata,omitempty"`
+	Metadata any `json:"metadata,omitempty"`
 }

syft/format/syftjson/model/source.go

@@ -30,7 +30,7 @@ type Source struct {
 	Type string `json:"type"`
 
 	// Metadata contains additional source-specific metadata.
-	Metadata interface{} `json:"metadata"`
+	Metadata any `json:"metadata"`
 }
 
 // sourceUnpacker is used to unmarshal Source objects
@@ -97,7 +97,7 @@ func cleanPreSchemaV9MetadataType(t string) string {
 	return t
 }
 
-func extractPreSchemaV9Metadata(t string, target []byte) (interface{}, error) {
+func extractPreSchemaV9Metadata(t string, target []byte) (any, error) {
 	switch t {
 	case "directory", "dir":
 		cleanTarget, err := strconv.Unquote(string(target))