redefine unknown dependency completeness enum

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
rename mixed enum and fix golang
2026-10-14 07:07:18 +02:00 · 2024-12-05 09:47:02 -05:00 · 2024-11-22 17:25:29 -05:00 · 2024-11-15 11:21:21 -05:00 · 2024-11-15 09:51:20 -05:00 · 2024-11-15 09:36:21 -05:00
223 changed files with 9020 additions and 3838 deletions
@@ -18,7 +18,7 @@ tools:
  # used to sign mac binaries at release
  - name: quill
    version:
-      want: v0.4.2
+      want: v0.5.0
    method: github-release
    with:
      repo: anchore/quill
@@ -26,7 +26,7 @@ tools:
  # used for linting
  - name: golangci-lint
    version:
-      want: v1.61.0
+      want: v1.62.0
    method: github-release
    with:
      repo: golangci/golangci-lint
@@ -58,7 +58,7 @@ tools:
  # used to release all artifacts
  - name: goreleaser
    version:
-      want: v2.3.2
+      want: v2.4.5
    method: github-release
    with:
      repo: goreleaser/goreleaser
@@ -103,7 +103,7 @@ tools:
  # used for running all local and CI tasks
  - name: task
    version:
-      want: v3.39.2
+      want: v3.40.0
    method: github-release
    with:
      repo: go-task/task
@@ -111,7 +111,7 @@ tools:
  # used for triggering a release
  - name: gh
    version:
-      want: v2.58.0
+      want: v2.62.0
    method: github-release
    with:
      repo: cli/cli
@@ -17,13 +17,13 @@ jobs:
    # the job by event.
    steps:
      - name: Checkout code
-        uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 # v4.2.0
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

      - name: Bootstrap environment
        uses: ./.github/actions/bootstrap

      - name: Restore base benchmark result
-        uses: actions/cache@2cdf405574d6ef1f33a1d12acccd3ae82f47b3f2 #v4.1.0
+        uses: actions/cache@6849a6489940f00c2f30c0fb92c6274307ccb58a #v4.1.2
        with:
          path: test/results/benchmark-main.txt
          # use base sha for PR or new commit hash for main push in benchmark result key
@@ -39,7 +39,7 @@ jobs:
          OUTPUT="${OUTPUT//$'\r'/'%0D'}" # URL encode all '\r' characters
          echo "result=$OUTPUT" >> $GITHUB_OUTPUT

-      - uses: actions/upload-artifact@50769540e7f4bd5e21e526ee35c689e35e0d6874 # v4.4.0
+      - uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4.4.3
        with:
          name: benchmark-test-results
          path: test/results/**/*
@@ -36,16 +36,16 @@ jobs:

    steps:
    - name: Checkout repository
-      uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 #v4.2.0
+      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 #v4.2.2

    - name: Install Go
-      uses: actions/setup-go@0a12ed9d6a96ab950c8f026ed9f722fe0da7ef32 #v5.0.2
+      uses: actions/setup-go@41dfa10bad2bb2ae585af6ee5bb4d7d973ad74ed #v5.1.0
      with:
        go-version-file: go.mod

    # Initializes the CodeQL tools for scanning.
    - name: Initialize CodeQL
-      uses: github/codeql-action/init@6db8d6351fd0be61f9ed8ebd12ccd35dcec51fea #v3.26.11
+      uses: github/codeql-action/init@ea9e4e37992a54ee68a9622e985e60c8e8f12d9f #v3.27.4
      with:
        languages: ${{ matrix.language }}
        # If you wish to specify custom queries, you can do so here or in a config file.
@@ -56,7 +56,7 @@ jobs:
    # Autobuild attempts to build any compiled languages  (C/C++, C#, or Java).
    # If this step fails, then you should remove it and run the build manually (see below)
    - name: Autobuild
-      uses: github/codeql-action/autobuild@6db8d6351fd0be61f9ed8ebd12ccd35dcec51fea #v3.26.11
+      uses: github/codeql-action/autobuild@ea9e4e37992a54ee68a9622e985e60c8e8f12d9f #v3.27.4

    # ℹ️ Command-line programs to run using the OS shell.
    # 📚 https://git.io/JvXDl
@@ -70,4 +70,4 @@ jobs:
    #   make release

    - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@6db8d6351fd0be61f9ed8ebd12ccd35dcec51fea #v3.26.11
+      uses: github/codeql-action/analyze@ea9e4e37992a54ee68a9622e985e60c8e8f12d9f #v3.27.4
@@ -30,7 +30,7 @@ jobs:
    runs-on: ubuntu-22.04
    steps:

-      - uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 #v4.2.0
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 #v4.2.2

      - run: python .github/scripts/labeler.py
        env:
@@ -20,7 +20,7 @@ jobs:
  release:
    runs-on: ubuntu-20.04
    steps:
-      - uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 #v4.2.0
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 #v4.2.2

      - name: Update version file
        run: make ci-release-version-file
@@ -15,7 +15,7 @@ jobs:
    environment: release
    runs-on: ubuntu-20.04
    steps:
-      - uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 #v4.2.0
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 #v4.2.2

      - name: Check if running on main
        if: github.ref != 'refs/heads/main'
@@ -105,7 +105,7 @@ jobs:
      # required for goreleaser signs section with cosign
      id-token: write
    steps:
-      - uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 #v4.2.0
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 #v4.2.2
        with:
          fetch-depth: 0

@@ -148,9 +148,10 @@ jobs:
          # for updating brew formula in anchore/homebrew-syft
          GITHUB_BREW_TOKEN: ${{ secrets.ANCHOREOPS_GITHUB_OSS_WRITE_TOKEN }}

-      - uses: anchore/sbom-action@61119d458adab75f756bc0b9e4bde25725f86a7a #v0.17.2
+      - uses: anchore/sbom-action@fc46e51fd3cb168ffb36c6d1915723c47db58abb #v0.17.7
        continue-on-error: true
        with:
+          file: go.mod
          artifact-name: sbom.spdx.json

      - uses: 8398a7/action-slack@28ba43ae48961b90635b50953d216767a6bea486 #v3.16.2
@@ -18,7 +18,7 @@ jobs:
    permissions:
      packages: write
    steps:
-      - uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 #v4.2.0
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 #v4.2.2

      - name: Bootstrap environment
        uses: ./.github/actions/bootstrap
@@ -13,7 +13,7 @@ jobs:
    runs-on: ubuntu-latest
    if: github.repository == 'anchore/syft' # only run for main repo
    steps:
-      - uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 #v4.2.0
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 #v4.2.2

      - name: Bootstrap environment
        uses: ./.github/actions/bootstrap
@@ -16,7 +16,7 @@ jobs:
    runs-on: ubuntu-latest
    if: github.repository == 'anchore/syft' # only run for main repo
    steps:
-      - uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 #v4.2.0
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 #v4.2.2

      - name: Bootstrap environment
        uses: ./.github/actions/bootstrap
@@ -17,9 +17,9 @@ jobs:
    runs-on: ubuntu-latest
    if: github.repository == 'anchore/syft' # only run for main repo
    steps:
-      - uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 #v4.2.0
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 #v4.2.2

-      - uses: actions/setup-go@0a12ed9d6a96ab950c8f026ed9f722fe0da7ef32 #v5.0.2
+      - uses: actions/setup-go@41dfa10bad2bb2ae585af6ee5bb4d7d973ad74ed #v5.1.0
        with:
          go-version: ${{ env.GO_VERSION }}
          stable: ${{ env.GO_STABLE_VERSION }}
@@ -17,7 +17,7 @@ jobs:
    name: "Static analysis"
    runs-on: ubuntu-20.04
    steps:
-      - uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 #v4.2.0
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 #v4.2.2

      - name: Bootstrap environment
        uses: ./.github/actions/bootstrap
@@ -31,7 +31,7 @@ jobs:
    name: "Unit tests"
    runs-on: ubuntu-20.04
    steps:
-      - uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 #v4.2.0
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 #v4.2.2

      - name: Bootstrap environment
        uses: ./.github/actions/bootstrap
@@ -47,7 +47,7 @@ jobs:
    name: "Integration tests"
    runs-on: ubuntu-20.04
    steps:
-      - uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 #v4.2.0
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 #v4.2.2

      - name: Bootstrap environment
        uses: ./.github/actions/bootstrap
@@ -65,7 +65,7 @@ jobs:
    name: "Build snapshot artifacts"
    runs-on: ubuntu-20.04
    steps:
-      - uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 #v4.2.0
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 #v4.2.2

      - name: Bootstrap environment
        uses: ./.github/actions/bootstrap
@@ -78,7 +78,7 @@ jobs:
      # why not use actions/upload-artifact? It is very slow (3 minutes to upload ~600MB of data, vs 10 seconds with this approach).
      # see https://github.com/actions/upload-artifact/issues/199 for more info
      - name: Upload snapshot artifacts
-        uses: actions/cache/save@2cdf405574d6ef1f33a1d12acccd3ae82f47b3f2 #v4.1.0
+        uses: actions/cache/save@6849a6489940f00c2f30c0fb92c6274307ccb58a #v4.1.2
        with:
          # we need to preserve the snapshot data itself as well as the task data that confirms if the
          # snapshot build is stale or not. Otherwise the downstream jobs will attempt to rebuild the snapshot
@@ -95,7 +95,7 @@ jobs:
    needs: [Build-Snapshot-Artifacts]
    runs-on: ubuntu-20.04
    steps:
-      - uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 #v4.2.0
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 #v4.2.2

      - name: Bootstrap environment
        uses: ./.github/actions/bootstrap
@@ -104,7 +104,7 @@ jobs:

      - name: Download snapshot build
        id: snapshot-cache
-        uses: actions/cache/restore@2cdf405574d6ef1f33a1d12acccd3ae82f47b3f2 #v4.1.0
+        uses: actions/cache/restore@6849a6489940f00c2f30c0fb92c6274307ccb58a #v4.1.2
        with:
          path: |
            snapshot
@@ -141,7 +141,7 @@ jobs:
      - name: Install Cosign
        uses: sigstore/cosign-installer@v3.7.0

-      - uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 #v4.2.0
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 #v4.2.2

      - name: Bootstrap environment
        uses: ./.github/actions/bootstrap
@@ -152,7 +152,7 @@ jobs:

      - name: Download snapshot build
        id: snapshot-cache
-        uses: actions/cache/restore@2cdf405574d6ef1f33a1d12acccd3ae82f47b3f2 #v4.1.0
+        uses: actions/cache/restore@6849a6489940f00c2f30c0fb92c6274307ccb58a #v4.1.2
        with:
          path: |
            snapshot
@@ -178,7 +178,7 @@ jobs:
    needs: [Build-Snapshot-Artifacts]
    runs-on: ubuntu-20.04
    steps:
-      - uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 #v4.2.0
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 #v4.2.2

      - name: Bootstrap environment
        uses: ./.github/actions/bootstrap
@@ -187,7 +187,7 @@ jobs:

      - name: Download snapshot build
        id: snapshot-cache
-        uses: actions/cache/restore@2cdf405574d6ef1f33a1d12acccd3ae82f47b3f2 #v4.1.0
+        uses: actions/cache/restore@6849a6489940f00c2f30c0fb92c6274307ccb58a #v4.1.2
        with:
          path: |
            snapshot
@@ -215,7 +215,7 @@ jobs:
      - Acceptance-Mac
      - Cli-Linux
    steps:
-      - uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 #v4.2.0
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 #v4.2.2

      - name: Delete snapshot cache
        run: gh cache delete "snapshot-build-${{ github.run_id }}"
@@ -13,6 +13,7 @@
 &nbsp;<a href="https://github.com/anchore/syft" target="_blank"><img alt="GitHub go.mod Go version" src="https://img.shields.io/github/go-mod/go-version/anchore/syft.svg"></a>&nbsp;
 &nbsp;<a href="" target="_blank"><img alt="License: Apache-2.0" src="https://img.shields.io/badge/License-Apache%202.0-blue.svg"></a>&nbsp;
 &nbsp;<a href="https://anchore.com/discourse" target="_blank"><img alt="Join our Discourse" src="https://img.shields.io/badge/Discourse-Join-blue?logo=discourse"/></a>&nbsp;
+ &nbsp;<a rel="me" href="https://fosstodon.org/@syft"><img alt="Follow on Mastodon" src="https://img.shields.io/badge/Mastodon-Follow-blue?logoColor=white&logo=mastodon"/></a>&nbsp;
 </p>

 ![syft-demo](https://user-images.githubusercontent.com/590471/90277200-2a253000-de33-11ea-893f-32c219eea11a.gif)
@@ -178,3 +179,7 @@ The Syft Team hold regular community meetings online. All are welcome to join to
 - Check the [calendar](https://calendar.google.com/calendar/u/0/r?cid=Y182OTM4dGt0MjRtajI0NnNzOThiaGtnM29qNEBncm91cC5jYWxlbmRhci5nb29nbGUuY29t) for the next meeting date. 
 - Add items to the [agenda](https://docs.google.com/document/d/1ZtSAa6fj2a6KRWviTn3WoJm09edvrNUp4Iz_dOjjyY8/edit?usp=sharing) (join [this group](https://groups.google.com/g/anchore-oss-community) for write access to the [agenda](https://docs.google.com/document/d/1ZtSAa6fj2a6KRWviTn3WoJm09edvrNUp4Iz_dOjjyY8/edit?usp=sharing))
 - See you there!
+
+## Syft Logo
+
+<p xmlns:cc="http://creativecommons.org/ns#" xmlns:dct="http://purl.org/dc/terms/"><a property="dct:title" rel="cc:attributionURL" href="https://anchore.com/wp-content/uploads/2024/11/syft-logo.svg">Syft Logo</a> by <a rel="cc:attributionURL dct:creator" property="cc:attributionName" href="https://anchore.com/">Anchore</a> is licensed under <a href="https://creativecommons.org/licenses/by/4.0/" target="_blank" rel="license noopener noreferrer" style="display:inline-block;">CC BY 4.0<img style="height:22px!important;margin-left:3px;vertical-align:text-bottom;" src="https://mirrors.creativecommons.org/presskit/icons/cc.svg" alt=""><img style="height:22px!important;margin-left:3px;vertical-align:text-bottom;" src="https://mirrors.creativecommons.org/presskit/icons/by.svg" alt=""></a></p>
@@ -1,5 +1,16 @@
 # Release

+A release of syft comprises:
+- a new semver git tag from the current tip of the main branch
+- a new [github release](https://github.com/anchore/syft/releases) with a changelog and archived binary assets
+- docker images published to `ghcr.io` and `dockerhub`, including multi architecture images + manifest
+- [`anchore/homebrew-syft`](https://github.com/anchore/homebrew-syft) tap updated to point to assets in the latest github release
+
+Ideally releasing should be done often with small increments when possible. Unless a
+breaking change is blocking the release, or no fixes/features have been merged, a good
+target release cadence is between every 1 or 2 weeks.
+
+
 ## Creating a release

 This release process itself should be as automated as possible, and has only a few steps:
@@ -9,16 +20,10 @@ This release process itself should be as automated as possible, and has only a f
  you can abort and adjust the labels on the PRs and issues to be included in the release and
  re-run the release trigger command.

-1. A release admin must approve the release on the GitHub Actions release pipeline run page.
+1. A release admin must approve the release on the GitHub Actions [release pipeline](https://github.com/anchore/syft/actions/workflows/release.yaml) run page.
   Once approved, the release pipeline will generate all assets and publish a GitHub Release.

-1. If there is a release Milestone, close it.
-
-Ideally releasing should be done often with small increments when possible. Unless a
-breaking change is blocking the release, or no fixes/features have been merged, a good
-target release cadence is between every 1 or 2 weeks.
-
-
+   
 ## Retracting a release

 If a release is found to be problematic, it can be retracted with the following steps:
@@ -32,81 +37,3 @@ If a release is found to be problematic, it can be retracted with the following
 in the go proxy, which will cause confusion when trying to reuse the tag later (the H1 hash will not match and there
 will be a warning when users try to pull the new release).

-
-## Background
-
-A good release process has the following qualities:
-
-1. There is a way to plan what should be in a release
-1. There is a way to see what is actually in a release
-1. Allow for different kinds of releases (major breaking vs backwards compatible enhancements vs patch updates)
-1. Specify a repeatable way to build and publish software artifacts
-
-
-### Planning a release
-
-To indicate a set of features to be released together add each issue to an in-repository
-Milestone named with major-minor version to be released (e.g. `v0.1`). It is OK for other
-features to be in the release that were not originally planned, and these issues and PRs
-do not need to be added to the Milestone in question. Only the set of features that, when
-completed, would allow the release to be considered complete. A Milestone is only used to:
-
- Plan what is desired to be in a release
- Track progress to indicate when we may be ready to cut a new release
-
-Not all releases need to be planned. For instance, patch releases for fixes should be
-released when they are ready and when releasing would not interfere with another current
-release (where some partial or breaking features have already been merged).
-
-Unless necessary, feature releases should be small and frequent, which may obviate the
-need for regular release planning under a Milestone.
-
-
-### What is in a release
-
-Milestones are specifically for planning a release, not necessarily tracking all changes
-that a release may bring (and more importantly, not all releases are necessarily planned
-either).
-
-This is one of the (many) reasons for a Changelog. A good Changelog lists changes grouped
-by the type of change (new, enhancement, deprecation, breaking, bug fix, security fix), in
-chronological order (within groups), linking the PR where the change was made in the
-Changelog line. Furthermore, there should be a place to see all released versions, the
-release date for each release, the semantic version of the release, and the set of changes
-for each release.
-
-**This project auto-generates the Changelog contents for each current release and posts the
-generated contents to the GitHub Release page**. Leveraging the GitHub Releases feature
-allows GitHub to manage the Changelog on each release outside of the git source tree while
-still being hosted with the released assets.
-
-The Changelog is generated from the metadata from in-repository issues and PRs, using
-labels to guide what kind of change each item is (e.g. breaking, new feature, bug fix,
-etx). Only issues/PRs with select labels are included in the Changelog, and only if the
-issue/PR was created after the last release. Additional labels are used to exclude items
-from the Changelog.
-
-The above suggestions imply that we should:
-
- Ensure there is a sufficient title for each PR and issue title to be included in the
-  Changelog
- The appropriate label is applied to PRs and/or issues to drive specific change type
-  sections (deprecated, breaking, security, bug, etc)
-
-**With this approach as we cultivate good organization of PRs and issues we automatically
-get an equally good Changelog.**
-
-
-### Major, minor, and patch releases
-
-The latest version of the tool is the only supported version, which implies that multiple
-parallel release branches will not be a regular process (if ever). Multiple releases can
-be planned in parallel, however, only one can be actively developed at a time. That is, if
-PRs attached to a release Milestone have been merged into the main branch, that release is
-now the "next" release. **This implies that the source of truth for release lies with the
-git log and Changelog, not with the release Milestones** (which are purely for planning and
-tracking).
-
-Semantic versioning should be used to indicate breaking changes, new features, and fixes.
-The exception to this is `< 1.0`, where the major version is not bumped for breaking changes,
-instead the minor version indicates both new features and breaking changes.
@@ -20,18 +20,18 @@ func AppClioSetupConfig(id clio.Identification, out io.Writer) *clio.SetupConfig
 		WithConfigInRootHelp().   // --help on the root command renders the full application config in the help text
 		WithUIConstructor(
 			// select a UI based on the logging configuration and state of stdin (if stdin is a tty)
-			func(cfg clio.Config) ([]clio.UI, error) {
+			func(cfg clio.Config) (*clio.UICollection, error) {
 				noUI := ui.None(out, cfg.Log.Quiet)
 				if !cfg.Log.AllowUI(os.Stdin) || cfg.Log.Quiet {
-					return []clio.UI{noUI}, nil
+					return clio.NewUICollection(noUI), nil
 				}

-				return []clio.UI{
+				return clio.NewUICollection(
 					ui.New(out, cfg.Log.Quiet,
 						ui2.New(ui2.DefaultHandlerConfig()),
 					),
 					noUI,
-				}, nil
+				), nil
 			},
 		).
 		WithInitializers(
@@ -17,7 +17,7 @@ import (

 const (
 	convertExample = `  {{.appName}} {{.command}} img.syft.json -o spdx-json                      convert a syft SBOM to spdx-json, output goes to stdout
-  {{.appName}} {{.command}} img.syft.json -o cyclonedx-json=img.cdx.json    convert a syft SBOM to CycloneDX, output is written to the file "img.cdx.json""
+  {{.appName}} {{.command}} img.syft.json -o cyclonedx-json=img.cdx.json    convert a syft SBOM to CycloneDX, output is written to the file "img.cdx.json"
  {{.appName}} {{.command}} - -o spdx-json                                  convert an SBOM from STDIN to spdx-json
 `
 )
@@ -39,7 +39,7 @@ func Convert(app clio.Application) *cobra.Command {
 	return app.SetupCommand(&cobra.Command{
 		Use:   "convert [SOURCE-SBOM] -o [FORMAT]",
 		Short: "Convert between SBOM formats",
-		Long:  "[Experimental] Convert SBOM files to, and from, SPDX, CycloneDX and Syft's format. For more info about data loss between formats see https://github.com/anchore/syft#format-conversion-experimental",
+		Long:  "[Experimental] Convert SBOM files to, and from, SPDX, CycloneDX and Syft's format. For more info about data loss between formats see https://github.com/anchore/syft/wiki/format-conversion",
 		Example: internal.Tprintf(convertExample, map[string]interface{}{
 			"appName": id.Name,
 			"command": "convert",
@@ -13,6 +13,7 @@ import (
 	"gopkg.in/yaml.v3"

 	"github.com/anchore/clio"
+	"github.com/anchore/fangs"
 	"github.com/anchore/go-collections"
 	"github.com/anchore/stereoscope"
 	"github.com/anchore/stereoscope/pkg/image"
@@ -109,7 +110,7 @@ func (o *scanOptions) PostLoad() error {
 }

 func (o *scanOptions) validateLegacyOptionsNotUsed() error {
-	if o.Config.ConfigFile == "" {
+	if len(fangs.Flatten(o.Config.ConfigFile)) == 0 {
 		return nil
 	}

@@ -121,32 +122,33 @@ func (o *scanOptions) validateLegacyOptionsNotUsed() error {
 		File                            any     `yaml:"file" json:"file" mapstructure:"file"`
 	}

-	by, err := os.ReadFile(o.Config.ConfigFile)
-	if err != nil {
-		return fmt.Errorf("unable to read config file during validations %q: %w", o.Config.ConfigFile, err)
-	}
+	for _, f := range fangs.Flatten(o.Config.ConfigFile) {
+		by, err := os.ReadFile(f)
+		if err != nil {
+			return fmt.Errorf("unable to read config file during validations %q: %w", f, err)
+		}

-	var legacy legacyConfig
-	if err := yaml.Unmarshal(by, &legacy); err != nil {
-		return fmt.Errorf("unable to parse config file during validations %q: %w", o.Config.ConfigFile, err)
-	}
+		var legacy legacyConfig
+		if err := yaml.Unmarshal(by, &legacy); err != nil {
+			return fmt.Errorf("unable to parse config file during validations %q: %w", f, err)
+		}

-	if legacy.DefaultImagePullSource != nil {
-		return fmt.Errorf("the config file option 'default-image-pull-source' has been removed, please use 'source.image.default-pull-source' instead")
-	}
+		if legacy.DefaultImagePullSource != nil {
+			return fmt.Errorf("the config file option 'default-image-pull-source' has been removed, please use 'source.image.default-pull-source' instead")
+		}

-	if legacy.ExcludeBinaryOverlapByOwnership != nil {
-		return fmt.Errorf("the config file option 'exclude-binary-overlap-by-ownership' has been removed, please use 'package.exclude-binary-overlap-by-ownership' instead")
-	}
+		if legacy.ExcludeBinaryOverlapByOwnership != nil {
+			return fmt.Errorf("the config file option 'exclude-binary-overlap-by-ownership' has been removed, please use 'package.exclude-binary-overlap-by-ownership' instead")
+		}

-	if legacy.BasePath != nil {
-		return fmt.Errorf("the config file option 'base-path' has been removed, please use 'source.base-path' instead")
-	}
+		if legacy.BasePath != nil {
+			return fmt.Errorf("the config file option 'base-path' has been removed, please use 'source.base-path' instead")
+		}

-	if legacy.File != nil && reflect.TypeOf(legacy.File).Kind() == reflect.String {
-		return fmt.Errorf("the config file option 'file' has been removed, please use 'outputs' instead")
+		if legacy.File != nil && reflect.TypeOf(legacy.File).Kind() == reflect.String {
+			return fmt.Errorf("the config file option 'file' has been removed, please use 'outputs' instead")
+		}
 	}
-
 	return nil
 }

@@ -154,13 +156,13 @@ func validateScanArgs(cmd *cobra.Command, args []string) error {
 	return validateArgs(cmd, args, "an image/directory argument is required")
 }

-func validateArgs(cmd *cobra.Command, args []string, error string) error {
+func validateArgs(cmd *cobra.Command, args []string, err string) error {
 	if len(args) == 0 {
 		// in the case that no arguments are given we want to show the help text and return with a non-0 return code.
 		if err := cmd.Help(); err != nil {
 			return fmt.Errorf("unable to display help: %w", err)
 		}
-		return fmt.Errorf("%v", error)
+		return fmt.Errorf("%v", err)
 	}

 	return cobra.MaximumNArgs(1)(cmd, args)
@@ -166,6 +166,7 @@ func (cfg Catalog) ToPackagesConfig() pkgcataloging.Config {
 					WithFromLDFlags(cfg.Golang.MainModuleVersion.FromLDFlags),
 			),
 		JavaScript: javascript.DefaultCatalogerConfig().
+			WithIncludeDevDependencies(*multiLevelOption(false, cfg.JavaScript.IncludeDevDependencies)).
 			WithSearchRemoteLicenses(*multiLevelOption(false, enrichmentEnabled(cfg.Enrich, task.JavaScript, task.Node, task.NPM), cfg.JavaScript.SearchRemoteLicenses)).
 			WithNpmBaseURL(cfg.JavaScript.NpmBaseURL),
 		LinuxKernel: kernel.LinuxKernelCatalogerConfig{
@@ -179,7 +180,8 @@ func (cfg Catalog) ToPackagesConfig() pkgcataloging.Config {
 			WithMavenLocalRepositoryDir(cfg.Java.MavenLocalRepositoryDir).
 			WithUseNetwork(*multiLevelOption(false, enrichmentEnabled(cfg.Enrich, task.Java, task.Maven), cfg.Java.UseNetwork)).
 			WithMavenBaseURL(cfg.Java.MavenURL).
-			WithArchiveTraversal(archiveSearch, cfg.Java.MaxParentRecursiveDepth),
+			WithArchiveTraversal(archiveSearch, cfg.Java.MaxParentRecursiveDepth).
+			WithResolveTransitiveDependencies(cfg.Java.ResolveTransitiveDependencies),
 	}
 }

@@ -2,11 +2,11 @@ package options

 import "github.com/anchore/fangs"

-// Config holds a reference to the specific config file that was used to load application configuration
+// Config holds a reference to the specific config file(s) that were used to load application configuration
 type Config struct {
 	ConfigFile string `yaml:"config" json:"config" mapstructure:"config"`
 }

 func (cfg *Config) DescribeFields(descriptions fangs.FieldDescriptionSet) {
-	descriptions.Add(&cfg.ConfigFile, "the configuration file that was used to load application configuration")
+	descriptions.Add(&cfg.ConfigFile, "the configuration file(s) used to load application configuration")
 }
@@ -6,22 +6,24 @@ import (
 )

 type javaConfig struct {
-	UseNetwork              *bool  `yaml:"use-network" json:"use-network" mapstructure:"use-network"`
-	UseMavenLocalRepository *bool  `yaml:"use-maven-local-repository" json:"use-maven-local-repository" mapstructure:"use-maven-local-repository"`
-	MavenLocalRepositoryDir string `yaml:"maven-local-repository-dir" json:"maven-local-repository-dir" mapstructure:"maven-local-repository-dir"`
-	MavenURL                string `yaml:"maven-url" json:"maven-url" mapstructure:"maven-url"`
-	MaxParentRecursiveDepth int    `yaml:"max-parent-recursive-depth" json:"max-parent-recursive-depth" mapstructure:"max-parent-recursive-depth"`
+	UseNetwork                    *bool  `yaml:"use-network" json:"use-network" mapstructure:"use-network"`
+	UseMavenLocalRepository       *bool  `yaml:"use-maven-local-repository" json:"use-maven-local-repository" mapstructure:"use-maven-local-repository"`
+	MavenLocalRepositoryDir       string `yaml:"maven-local-repository-dir" json:"maven-local-repository-dir" mapstructure:"maven-local-repository-dir"`
+	MavenURL                      string `yaml:"maven-url" json:"maven-url" mapstructure:"maven-url"`
+	MaxParentRecursiveDepth       int    `yaml:"max-parent-recursive-depth" json:"max-parent-recursive-depth" mapstructure:"max-parent-recursive-depth"`
+	ResolveTransitiveDependencies bool   `yaml:"resolve-transitive-dependencies" json:"resolve-transitive-dependencies" mapstructure:"resolve-transitive-dependencies"`
 }

 func defaultJavaConfig() javaConfig {
 	def := java.DefaultArchiveCatalogerConfig()

 	return javaConfig{
-		UseNetwork:              nil, // this defaults to false, which is the API default
-		MaxParentRecursiveDepth: def.MaxParentRecursiveDepth,
-		UseMavenLocalRepository: nil, // this defaults to false, which is the API default
-		MavenLocalRepositoryDir: def.MavenLocalRepositoryDir,
-		MavenURL:                def.MavenBaseURL,
+		UseNetwork:                    nil, // this defaults to false, which is the API default
+		MaxParentRecursiveDepth:       def.MaxParentRecursiveDepth,
+		UseMavenLocalRepository:       nil, // this defaults to false, which is the API default
+		MavenLocalRepositoryDir:       def.MavenLocalRepositoryDir,
+		MavenURL:                      def.MavenBaseURL,
+		ResolveTransitiveDependencies: def.ResolveTransitiveDependencies,
 	}
 }

@@ -43,4 +45,5 @@ TIP: If you want to download all required pom files to the local repository with
 build, run 'mvn help:effective-pom' before performing the scan with syft.`)
 	descriptions.Add(&o.MavenLocalRepositoryDir, `override the default location of the local Maven repository. 
 the default is the subdirectory '.m2/repository' in your home directory`)
+	descriptions.Add(&o.ResolveTransitiveDependencies, `resolve transient dependencies such as those defined in a dependency's POM on Maven central`)
 }
@@ -3,8 +3,9 @@ package options
 import "github.com/anchore/clio"

 type javaScriptConfig struct {
-	SearchRemoteLicenses *bool  `json:"search-remote-licenses" yaml:"search-remote-licenses" mapstructure:"search-remote-licenses"`
-	NpmBaseURL           string `json:"npm-base-url" yaml:"npm-base-url" mapstructure:"npm-base-url"`
+	SearchRemoteLicenses   *bool  `json:"search-remote-licenses" yaml:"search-remote-licenses" mapstructure:"search-remote-licenses"`
+	NpmBaseURL             string `json:"npm-base-url" yaml:"npm-base-url" mapstructure:"npm-base-url"`
+	IncludeDevDependencies *bool  `json:"include-dev-dependencies" yaml:"include-dev-dependencies" mapstructure:"include-dev-dependencies"`
 }

 var _ interface {
@@ -14,4 +15,5 @@ var _ interface {
 func (o *javaScriptConfig) DescribeFields(descriptions clio.FieldDescriptionSet) {
 	descriptions.Add(&o.SearchRemoteLicenses, `enables Syft to use the network to fill in more detailed license information`)
 	descriptions.Add(&o.NpmBaseURL, `base NPM url to use`)
+	descriptions.Add(&o.IncludeDevDependencies, `include development-scoped dependencies`)
 }
@@ -28,7 +28,7 @@ func (o *OutputFile) AddFlags(flags clio.FlagSet) {

 		if pfp, ok := flags.(fangs.PFlagSetProvider); ok {
 			flagSet := pfp.PFlagSet()
-			flagSet.Lookup("file").Deprecated = "use: output"
+			flagSet.Lookup("file").Deprecated = "use: --output FORMAT=PATH"
 		}
 	}
 }
@@ -265,7 +265,7 @@ var dirOnlyTestCases = []testCase{
 		name:        "find java packages including pom.xml", // directory scans can include packages that have yet to be installed
 		pkgType:     pkg.JavaPkg,
 		pkgLanguage: pkg.Java,
-		duplicates:  1, // joda-time is included in both pom.xml AND the .jar collection
+		duplicates:  2, // joda-time and example-java-app-maven are included in both pom.xml AND the .jar collection
 		pkgInfo: map[string]string{
 			"example-java-app-maven": "0.1.0",
 			"joda-time":              "2.9.2",
@@ -25,7 +25,7 @@ func TestNpmPackageLockDirectory(t *testing.T) {
 	}

 	// ensure that integration test commonTestCases stay in sync with the available catalogers
-	const expectedPackageCount = 6
+	const expectedPackageCount = 2
 	if foundPackages.Size() != expectedPackageCount {
 		t.Errorf("found the wrong set of npm package-lock.json packages (expected: %d, actual: %d)", expectedPackageCount, foundPackages.Size())
 	}
@@ -17,11 +17,11 @@ const defaultStdoutLogBufferSize = 1024
 //	restore := CaptureStdoutToTraceLog()
 //	// here, stdout will be captured and redirected to the provided writer
 //	restore() // block until the output has all been sent to the writer and restore the original stdout
-func CaptureStdoutToTraceLog() (close func()) {
+func CaptureStdoutToTraceLog() func() {
 	return capture(&os.Stdout, newLogWriter(), defaultStdoutLogBufferSize)
 }

-func capture(target **os.File, writer io.Writer, bufSize int) (close func()) {
+func capture(target **os.File, writer io.Writer, bufSize int) func() {
 	original := *target

 	r, w, _ := os.Pipe()
@@ -78,6 +78,13 @@ func (m *UI) Handle(e partybus.Event) error {
 }

 func (m *UI) Teardown(force bool) error {
+	defer func() {
+		// allow for traditional logging to resume now that the UI is shutting down
+		if logWrapper, ok := log.Get().(logger.Controller); ok {
+			logWrapper.SetOutput(m.err)
+		}
+	}()
+
 	if !force {
 		m.handler.Wait()
 		m.program.Quit()
@@ -1,6 +1,6 @@
 module github.com/anchore/syft

-go 1.22.0
+go 1.22.9

 require (
 	github.com/CycloneDX/cyclonedx-go v0.9.1
@@ -9,23 +9,23 @@ require (
 	github.com/acarl005/stripansi v0.0.0-20180116102854-5a71ef0e047d
 	github.com/acobaugh/osrelease v0.1.0
 	github.com/anchore/bubbly v0.0.0-20231115134915-def0aba654a9
-	github.com/anchore/clio v0.0.0-20240522144804-d81e109008aa
-	github.com/anchore/fangs v0.0.0-20240903175602-e716ef12c23d
+	github.com/anchore/clio v0.0.0-20241015191535-f538a9016e10
+	github.com/anchore/fangs v0.0.0-20241014201141-b6e4b3469f10
 	github.com/anchore/go-collections v0.0.0-20240216171411-9321230ce537
 	github.com/anchore/go-logger v0.0.0-20230725134548-c21dafa1ec5a
 	github.com/anchore/go-macholibre v0.0.0-20220308212642-53e6d0aaf6fb
 	github.com/anchore/go-testutils v0.0.0-20200925183923-d5f45b0d3c04
 	github.com/anchore/go-version v1.2.2-0.20200701162849-18adb9c92b9b
-	github.com/anchore/packageurl-go v0.1.1-0.20240507183024-848e011fc24f
-	github.com/anchore/stereoscope v0.0.4-0.20241005180410-efa76446cc1c
+	github.com/anchore/packageurl-go v0.1.1-0.20241018175412-5c22e6360c4f
+	github.com/anchore/stereoscope v0.0.9-0.20241113211114-aa3a3ef4efe8
 	github.com/anmitsu/go-shlex v0.0.0-20200514113438-38f4b401e2be
 	// we are hinting brotli to latest due to warning when installing archiver v3:
 	// go: warning: github.com/andybalholm/brotli@v1.0.1: retracted by module author: occasional panics and data corruption
 	github.com/aquasecurity/go-pep440-version v0.0.0-20210121094942-22b2f8951d46
-	github.com/bmatcuk/doublestar/v4 v4.6.1
+	github.com/bmatcuk/doublestar/v4 v4.7.1
 	github.com/charmbracelet/bubbles v0.20.0
-	github.com/charmbracelet/bubbletea v1.1.1
-	github.com/charmbracelet/lipgloss v0.13.0
+	github.com/charmbracelet/bubbletea v1.2.2
+	github.com/charmbracelet/lipgloss v1.0.0
 	github.com/dave/jennifer v1.7.1
 	github.com/deitch/magic v0.0.0-20230404182410-1ff89d7342da
 	github.com/distribution/reference v0.6.0
@@ -35,7 +35,7 @@ require (
 	github.com/facebookincubator/nvdtools v0.1.5
 	github.com/github/go-spdx/v2 v2.3.2
 	github.com/gkampitakis/go-snaps v0.5.7
-	github.com/go-git/go-billy/v5 v5.5.0
+	github.com/go-git/go-billy/v5 v5.6.0
 	github.com/go-git/go-git/v5 v5.12.0
 	github.com/go-test/deep v1.1.1
 	github.com/google/go-cmp v0.6.0
@@ -46,7 +46,7 @@ require (
 	github.com/hashicorp/go-multierror v1.1.1
 	github.com/iancoleman/strcase v0.3.0
 	github.com/invopop/jsonschema v0.7.0
-	github.com/jedib0t/go-pretty/v6 v6.6.0
+	github.com/jedib0t/go-pretty/v6 v6.6.1
 	github.com/jinzhu/copier v0.4.0
 	github.com/kastenhq/goversion v0.0.0-20230811215019-93b2f8823953
 	github.com/knqyf263/go-rpmdb v0.1.1
@@ -60,7 +60,7 @@ require (
 	github.com/opencontainers/go-digest v1.0.0
 	github.com/pelletier/go-toml v1.9.5
 	github.com/quasilyte/go-ruleguard/dsl v0.3.22
-	github.com/saferwall/pe v1.5.4
+	github.com/saferwall/pe v1.5.5
 	github.com/saintfish/chardet v0.0.0-20230101081208-5e3ef4b5456d
 	github.com/sanity-io/litter v1.5.5
 	github.com/sassoftware/go-rpmutils v0.4.0
@@ -78,8 +78,8 @@ require (
 	github.com/xeipuuv/gojsonschema v1.2.0
 	github.com/zyedidia/generic v1.2.2-0.20230320175451-4410d2372cb1
 	go.uber.org/goleak v1.3.0
-	golang.org/x/mod v0.21.0
-	golang.org/x/net v0.30.0
+	golang.org/x/mod v0.22.0
+	golang.org/x/net v0.31.0
 	gopkg.in/yaml.v3 v3.0.1
 	modernc.org/sqlite v1.33.1
 )
@@ -89,9 +89,9 @@ require google.golang.org/genproto v0.0.0-20240213162025-012b6fc9bca9 // indirec
 require (
 	github.com/BurntSushi/toml v1.4.0
 	github.com/OneOfOne/xxhash v1.2.8
-	github.com/adrg/xdg v0.5.0
+	github.com/adrg/xdg v0.5.3
 	github.com/magiconair/properties v1.8.7
-	golang.org/x/exp v0.0.0-20231108232855-2478ac86f678
+	golang.org/x/exp v0.0.0-20240719175910-8a7402abbf56
 )

 require (
@@ -101,9 +101,9 @@ require (
 	github.com/DataDog/zstd v1.5.5 // indirect
 	github.com/Masterminds/goutils v1.1.1 // indirect
 	github.com/Masterminds/semver/v3 v3.3.0 // indirect
-	github.com/Microsoft/go-winio v0.6.1 // indirect
-	github.com/Microsoft/hcsshim v0.11.4 // indirect
-	github.com/ProtonMail/go-crypto v1.0.0 // indirect
+	github.com/Microsoft/go-winio v0.6.2 // indirect
+	github.com/Microsoft/hcsshim v0.11.7 // indirect
+	github.com/ProtonMail/go-crypto v1.1.2 // indirect
 	github.com/anchore/go-struct-converter v0.0.0-20221118182256-c68fdcfa2092 // indirect
 	github.com/andybalholm/brotli v1.0.4 // indirect
 	github.com/aquasecurity/go-version v0.0.0-20210121072130-637058cfe492 // indirect
@@ -111,20 +111,23 @@ require (
 	github.com/aymanbagabas/go-osc52/v2 v2.0.1 // indirect
 	github.com/becheran/wildmatch-go v1.0.0 // indirect
 	github.com/charmbracelet/harmonica v0.2.0 // indirect
-	github.com/charmbracelet/x/ansi v0.2.3 // indirect
-	github.com/charmbracelet/x/term v0.2.0 // indirect
+	github.com/charmbracelet/x/ansi v0.4.5 // indirect
+	github.com/charmbracelet/x/term v0.2.1 // indirect
 	github.com/cloudflare/circl v1.3.8 // indirect
 	github.com/containerd/cgroups v1.1.0 // indirect
-	github.com/containerd/containerd v1.7.11 // indirect
+	github.com/containerd/containerd v1.7.23 // indirect
+	github.com/containerd/containerd/api v1.7.19 // indirect
 	github.com/containerd/continuity v0.4.2 // indirect
+	github.com/containerd/errdefs v0.3.0 // indirect
 	github.com/containerd/fifo v1.1.0 // indirect
 	github.com/containerd/log v0.1.0 // indirect
+	github.com/containerd/platforms v0.2.1 // indirect
 	github.com/containerd/stargz-snapshotter/estargz v0.14.3 // indirect
-	github.com/containerd/ttrpc v1.2.2 // indirect
+	github.com/containerd/ttrpc v1.2.5 // indirect
 	github.com/containerd/typeurl/v2 v2.1.1 // indirect
-	github.com/cyphar/filepath-securejoin v0.2.4 // indirect
+	github.com/cyphar/filepath-securejoin v0.2.5 // indirect
 	github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
-	github.com/docker/cli v27.1.1+incompatible // indirect
+	github.com/docker/cli v27.3.1+incompatible // indirect
 	github.com/docker/distribution v2.8.3+incompatible // indirect
 	github.com/docker/docker-credential-helpers v0.7.0 // indirect
 	github.com/docker/go-connections v0.4.0 // indirect
@@ -137,7 +140,7 @@ require (
 	github.com/felixge/fgprof v0.9.3 // indirect
 	github.com/felixge/httpsnoop v1.0.4 // indirect
 	github.com/fsnotify/fsnotify v1.7.0 // indirect
-	github.com/gabriel-vasile/mimetype v1.4.4 // indirect
+	github.com/gabriel-vasile/mimetype v1.4.6 // indirect
 	github.com/gkampitakis/ciinfo v0.3.0 // indirect
 	github.com/gkampitakis/go-diff v1.3.2 // indirect
 	github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376 // indirect
@@ -146,7 +149,7 @@ require (
 	github.com/go-restruct/restruct v1.2.0-alpha // indirect
 	github.com/gogo/protobuf v1.3.2 // indirect
 	github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da // indirect
-	github.com/golang/protobuf v1.5.3 // indirect
+	github.com/golang/protobuf v1.5.4 // indirect
 	github.com/golang/snappy v0.0.4 // indirect
 	github.com/google/pprof v0.0.0-20240409012703-83162a5b38cd // indirect
 	github.com/hashicorp/errwrap v1.1.0 // indirect
@@ -175,14 +178,15 @@ require (
 	github.com/moby/locker v1.0.1 // indirect
 	github.com/moby/sys/sequential v0.5.0 // indirect
 	github.com/moby/sys/signal v0.7.0 // indirect
+	github.com/moby/sys/user v0.3.0 // indirect
+	github.com/moby/sys/userns v0.1.0 // indirect
 	github.com/muesli/ansi v0.0.0-20230316100256-276c6243b2f6 // indirect
 	github.com/muesli/cancelreader v0.2.2 // indirect
 	github.com/muesli/termenv v0.15.2 // indirect
 	github.com/ncruces/go-strftime v0.1.9 // indirect
 	github.com/nwaples/rardecode v1.1.0 // indirect
 	github.com/opencontainers/image-spec v1.1.0 // indirect
-	github.com/opencontainers/runc v1.1.14 // indirect
-	github.com/opencontainers/runtime-spec v1.1.0-rc.1 // indirect
+	github.com/opencontainers/runtime-spec v1.1.0 // indirect
 	github.com/opencontainers/selinux v1.11.0 // indirect
 	github.com/pborman/indent v1.2.1 // indirect
 	github.com/pelletier/go-toml/v2 v2.2.2 // indirect
@@ -206,7 +210,7 @@ require (
 	github.com/spf13/pflag v1.0.5 // indirect
 	github.com/spf13/viper v1.19.0 // indirect
 	github.com/subosito/gotenv v1.6.0 // indirect
-	github.com/sylabs/sif/v2 v2.17.1 // indirect
+	github.com/sylabs/sif/v2 v2.20.0 // indirect
 	github.com/sylabs/squashfs v1.0.0 // indirect
 	github.com/therootcompany/xz v1.0.1 // indirect
 	github.com/tidwall/gjson v1.17.0 // indirect
@@ -227,16 +231,15 @@ require (
 	go.opentelemetry.io/otel/trace v1.24.0 // indirect
 	go.uber.org/atomic v1.9.0 // indirect
 	go.uber.org/multierr v1.9.0 // indirect
-	golang.org/x/crypto v0.28.0 // indirect
-	golang.org/x/sync v0.8.0 // indirect
-	golang.org/x/sys v0.26.0 // indirect
-	golang.org/x/term v0.25.0 // indirect
-	golang.org/x/text v0.19.0 // indirect
-	golang.org/x/tools v0.21.1-0.20240508182429-e35e4ccd0d2d // indirect
+	golang.org/x/crypto v0.29.0 // indirect
+	golang.org/x/sync v0.9.0 // indirect
+	golang.org/x/sys v0.27.0 // indirect
+	golang.org/x/term v0.26.0 // indirect
+	golang.org/x/text v0.20.0 // indirect
 	golang.org/x/xerrors v0.0.0-20220907171357-04be3eba64a2 // indirect
 	google.golang.org/genproto/googleapis/rpc v0.0.0-20240314234333-6e1732d8331c // indirect
 	google.golang.org/grpc v1.62.1 // indirect
-	google.golang.org/protobuf v1.33.0 // indirect
+	google.golang.org/protobuf v1.34.2 // indirect
 	gopkg.in/ini.v1 v1.67.0 // indirect
 	gopkg.in/warnings.v0 v0.1.2 // indirect
 	modernc.org/gc/v3 v3.0.0-20240107210532-573471604cb6 // indirect
@@ -74,21 +74,21 @@ github.com/Masterminds/semver/v3 v3.3.0/go.mod h1:4V+yj/TJE1HU9XfppCwVMZq3I84lpr
 github.com/Masterminds/sprig/v3 v3.3.0 h1:mQh0Yrg1XPo6vjYXgtf5OtijNAKJRNcTdOOGZe3tPhs=
 github.com/Masterminds/sprig/v3 v3.3.0/go.mod h1:Zy1iXRYNqNLUolqCpL4uhk6SHUMAOSCzdgBfDb35Lz0=
 github.com/Microsoft/go-winio v0.5.2/go.mod h1:WpS1mjBmmwHBEWmogvA2mj8546UReBk4v8QkMxJ6pZY=
-github.com/Microsoft/go-winio v0.6.1 h1:9/kr64B9VUZrLm5YYwbGtUJnMgqWVOdUAXu6Migciow=
-github.com/Microsoft/go-winio v0.6.1/go.mod h1:LRdKpFKfdobln8UmuiYcKPot9D2v6svN5+sAH+4kjUM=
-github.com/Microsoft/hcsshim v0.11.4 h1:68vKo2VN8DE9AdN4tnkWnmdhqdbpUFM8OF3Airm7fz8=
-github.com/Microsoft/hcsshim v0.11.4/go.mod h1:smjE4dvqPX9Zldna+t5FG3rnoHhaB7QYxPRqGcpAD9w=
+github.com/Microsoft/go-winio v0.6.2 h1:F2VQgta7ecxGYO8k3ZZz3RS8fVIXVxONVUPlNERoyfY=
+github.com/Microsoft/go-winio v0.6.2/go.mod h1:yd8OoFMLzJbo9gZq8j5qaps8bJ9aShtEA8Ipt1oGCvU=
+github.com/Microsoft/hcsshim v0.11.7 h1:vl/nj3Bar/CvJSYo7gIQPyRWc9f3c6IeSNavBTSZNZQ=
+github.com/Microsoft/hcsshim v0.11.7/go.mod h1:MV8xMfmECjl5HdO7U/3/hFVnkmSBjAjmA09d4bExKcU=
 github.com/OneOfOne/xxhash v1.2.2/go.mod h1:HSdplMjZKSmBqAxg5vPj2TmRDmfkzw+cTzAElWljhcU=
 github.com/OneOfOne/xxhash v1.2.8 h1:31czK/TI9sNkxIKfaUfGlU47BAxQ0ztGgd9vPyqimf8=
 github.com/OneOfOne/xxhash v1.2.8/go.mod h1:eZbhyaAYD41SGSSsnmcpxVoRiQ/MPUTjUdIIOT9Um7Q=
-github.com/ProtonMail/go-crypto v1.0.0 h1:LRuvITjQWX+WIfr930YHG2HNfjR1uOfyf5vE0kC2U78=
-github.com/ProtonMail/go-crypto v1.0.0/go.mod h1:EjAoLdwvbIOoOQr3ihjnSoLZRtE8azugULFRteWMNc0=
+github.com/ProtonMail/go-crypto v1.1.2 h1:A7JbD57ThNqh7XjmHE+PXpQ3Dqt3BrSAC0AL0Go3KS0=
+github.com/ProtonMail/go-crypto v1.1.2/go.mod h1:rA3QumHc/FZ8pAHreoekgiAbzpNsfQAosU5td4SnOrE=
 github.com/acarl005/stripansi v0.0.0-20180116102854-5a71ef0e047d h1:licZJFw2RwpHMqeKTCYkitsPqHNxTmd4SNR5r94FGM8=
 github.com/acarl005/stripansi v0.0.0-20180116102854-5a71ef0e047d/go.mod h1:asat636LX7Bqt5lYEZ27JNDcqxfjdBQuJ/MM4CN/Lzo=
 github.com/acobaugh/osrelease v0.1.0 h1:Yb59HQDGGNhCj4suHaFQQfBps5wyoKLSSX/J/+UifRE=
 github.com/acobaugh/osrelease v0.1.0/go.mod h1:4bFEs0MtgHNHBrmHCt67gNisnabCRAlzdVasCEGHTWY=
-github.com/adrg/xdg v0.5.0 h1:dDaZvhMXatArP1NPHhnfaQUqWBLBsmx1h1HXQdMoFCY=
-github.com/adrg/xdg v0.5.0/go.mod h1:dDdY4M4DF9Rjy4kHPeNL+ilVF+p2lK8IdM9/rTSGcI4=
+github.com/adrg/xdg v0.5.3 h1:xRnxJXne7+oWDatRhR1JLnvuccuIeCoBu2rtuLqQB78=
+github.com/adrg/xdg v0.5.3/go.mod h1:nlTsY+NNiCBGCK2tpm09vRqfVzrc2fLmXGpBLF0zlTQ=
 github.com/alecthomas/template v0.0.0-20160405071501-a0175ee3bccc/go.mod h1:LOuyumcjzFXgccqObfd/Ljyb9UuFJ6TxHnclSeseNhc=
 github.com/alecthomas/template v0.0.0-20190718012654-fb15b899a751/go.mod h1:LOuyumcjzFXgccqObfd/Ljyb9UuFJ6TxHnclSeseNhc=
 github.com/alecthomas/units v0.0.0-20151022065526-2efee857e7cf/go.mod h1:ybxpYRFXyAe+OPACYpWeL0wqObRcbAqCMya13uyzqw0=
@@ -97,10 +97,10 @@ github.com/anchore/archiver/v3 v3.5.2 h1:Bjemm2NzuRhmHy3m0lRe5tNoClB9A4zYyDV58Pa
 github.com/anchore/archiver/v3 v3.5.2/go.mod h1:e3dqJ7H78uzsRSEACH1joayhuSyhnonssnDhppzS1L4=
 github.com/anchore/bubbly v0.0.0-20231115134915-def0aba654a9 h1:p0ZIe0htYOX284Y4axJaGBvXHU0VCCzLN5Wf5XbKStU=
 github.com/anchore/bubbly v0.0.0-20231115134915-def0aba654a9/go.mod h1:3ZsFB9tzW3vl4gEiUeuSOMDnwroWxIxJelOOHUp8dSw=
-github.com/anchore/clio v0.0.0-20240522144804-d81e109008aa h1:pwlAn4O9SBUnlgfa69YcqIynbUyobLVFYu8HxSoCffA=
-github.com/anchore/clio v0.0.0-20240522144804-d81e109008aa/go.mod h1:nD3H5uIvjxlfmakOBgtyFQbk5Zjp3l538kxfpHPslzI=
-github.com/anchore/fangs v0.0.0-20240903175602-e716ef12c23d h1:ZD4wdCBgJJzJybjTUIEiiupLF7B9H3WLuBTjspBO2Mc=
-github.com/anchore/fangs v0.0.0-20240903175602-e716ef12c23d/go.mod h1:Xh4ObY3fmoMzOEVXwDtS1uK44JC7+nRD0n29/1KYFYg=
+github.com/anchore/clio v0.0.0-20241015191535-f538a9016e10 h1:3xmanFdoQEH0REvPA+gLm3Km0/981F4z2a/7ADTlv8k=
+github.com/anchore/clio v0.0.0-20241015191535-f538a9016e10/go.mod h1:h6Ly2hlKjQoPtI3rA8oB5afSmB/XimhcY55xbuW4Dwo=
+github.com/anchore/fangs v0.0.0-20241014201141-b6e4b3469f10 h1:w+HibE+e/heP6ysADh7sWxg5LhYdVqrpB1A4Hmgjyx8=
+github.com/anchore/fangs v0.0.0-20241014201141-b6e4b3469f10/go.mod h1:s0L1//Sxn6Rq0Dcxx+dmT/RRmD9HhsaJjJkPUJHLJLM=
 github.com/anchore/go-collections v0.0.0-20240216171411-9321230ce537 h1:GjNGuwK5jWjJMyVppBjYS54eOiiSNv4Ba869k4wh72Q=
 github.com/anchore/go-collections v0.0.0-20240216171411-9321230ce537/go.mod h1:1aiktV46ATCkuVg0O573ZrH56BUawTECPETbZyBcqT8=
 github.com/anchore/go-logger v0.0.0-20230725134548-c21dafa1ec5a h1:nJ2G8zWKASyVClGVgG7sfM5mwoZlZ2zYpIzN2OhjWkw=
@@ -113,10 +113,10 @@ github.com/anchore/go-testutils v0.0.0-20200925183923-d5f45b0d3c04 h1:VzprUTpc0v
 github.com/anchore/go-testutils v0.0.0-20200925183923-d5f45b0d3c04/go.mod h1:6dK64g27Qi1qGQZ67gFmBFvEHScy0/C8qhQhNe5B5pQ=
 github.com/anchore/go-version v1.2.2-0.20200701162849-18adb9c92b9b h1:e1bmaoJfZVsCYMrIZBpFxwV26CbsuoEh5muXD5I1Ods=
 github.com/anchore/go-version v1.2.2-0.20200701162849-18adb9c92b9b/go.mod h1:Bkc+JYWjMCF8OyZ340IMSIi2Ebf3uwByOk6ho4wne1E=
-github.com/anchore/packageurl-go v0.1.1-0.20240507183024-848e011fc24f h1:B/E9ixKNCasntpoch61NDaQyGPDXLEJlL+B9B/PbdbA=
-github.com/anchore/packageurl-go v0.1.1-0.20240507183024-848e011fc24f/go.mod h1:Blo6OgJNiYF41ufcgHKkbCKF2MDOMlrqhXv/ij6ocR4=
-github.com/anchore/stereoscope v0.0.4-0.20241005180410-efa76446cc1c h1:JXezMk8fF5ns4AgRGW49SGfoRgDjJHsDmcpNw272jkU=
-github.com/anchore/stereoscope v0.0.4-0.20241005180410-efa76446cc1c/go.mod h1:GMupz2FoBhy5RTTmawU06c2pZxgVTceahLWiwJef2uI=
+github.com/anchore/packageurl-go v0.1.1-0.20241018175412-5c22e6360c4f h1:dAQPIrQ3a5PBqZeZ+B9NGZsGmodk4NO9OjDIsQmQyQM=
+github.com/anchore/packageurl-go v0.1.1-0.20241018175412-5c22e6360c4f/go.mod h1:KoYIv7tdP5+CC9VGkeZV4/vGCKsY55VvoG+5dadg4YI=
+github.com/anchore/stereoscope v0.0.9-0.20241113211114-aa3a3ef4efe8 h1:gYed/fx5OeW+isRay2q60JGt8+ED/odEPiJ/SWlbw8s=
+github.com/anchore/stereoscope v0.0.9-0.20241113211114-aa3a3ef4efe8/go.mod h1:c2oGDU0R+llJObsatBSenjYPV1raKhMq9GEqe8J56EI=
 github.com/andreyvit/diff v0.0.0-20170406064948-c7f18ee00883/go.mod h1:rCTlJbsFo29Kk6CurOXKm700vrz8f0KW0JNfpkRJY/8=
 github.com/andybalholm/brotli v1.0.1/go.mod h1:loMXtMfwqflxFJPmdbJO0a3KNoPuLBgiu3qAvBg8x/Y=
 github.com/andybalholm/brotli v1.0.4 h1:V7DdXeJtZscaqfNuAdSRuRFzuiKlHSC/Zh3zl9qY3JY=
@@ -145,11 +145,10 @@ github.com/beorn7/perks v0.0.0-20180321164747-3a771d992973/go.mod h1:Dwedo/Wpr24
 github.com/beorn7/perks v1.0.0/go.mod h1:KWe93zE9D1o94FZ5RNwFwVgaQK1VOXiVxmqh+CedLV8=
 github.com/beorn7/perks v1.0.1/go.mod h1:G2ZrVWU2WbWT9wwq4/hrbKbnv/1ERSJQ0ibhJ6rlkpw=
 github.com/bgentry/speakeasy v0.1.0/go.mod h1:+zsyZBPWlz7T6j88CTgSN5bM796AkVf0kBD4zp0CCIs=
-github.com/bmatcuk/doublestar/v4 v4.6.1 h1:FH9SifrbvJhnlQpztAx++wlkk70QBf0iBWDwNy7PA4I=
-github.com/bmatcuk/doublestar/v4 v4.6.1/go.mod h1:xBQ8jztBU6kakFMg+8WGxn0c6z1fTSPVIjEY1Wr7jzc=
+github.com/bmatcuk/doublestar/v4 v4.7.1 h1:fdDeAqgT47acgwd9bd9HxJRDmc9UAmPpc+2m0CXv75Q=
+github.com/bmatcuk/doublestar/v4 v4.7.1/go.mod h1:xBQ8jztBU6kakFMg+8WGxn0c6z1fTSPVIjEY1Wr7jzc=
 github.com/bradleyjkemp/cupaloy/v2 v2.8.0 h1:any4BmKE+jGIaMpnU8YgH/I2LPiLBufr6oMMlVBbn9M=
 github.com/bradleyjkemp/cupaloy/v2 v2.8.0/go.mod h1:bm7JXdkRd4BHJk9HpwqAI8BoAY1lps46Enkdqw6aRX0=
-github.com/bwesterb/go-ristretto v1.2.3/go.mod h1:fUIoIZaG73pV5biE2Blr2xEzDoMj7NFEuV9ekS419A0=
 github.com/cenkalti/backoff/v4 v4.2.1 h1:y4OZtCnogmCPw98Zjyt5a6+QwPLGkiQsYW5oUqylYbM=
 github.com/cenkalti/backoff/v4 v4.2.1/go.mod h1:Y3VNntkOUPxTVeUxJ/G5vcM//AlwfmyYozVcomhLiZE=
 github.com/census-instrumentation/opencensus-proto v0.2.1/go.mod h1:f6KPmirojxKA12rnyqOA5BBL4O983OfeGPqjHWSTneU=
@@ -159,23 +158,22 @@ github.com/cespare/xxhash/v2 v2.1.1/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XL
 github.com/cespare/xxhash/v2 v2.1.2/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
 github.com/charmbracelet/bubbles v0.20.0 h1:jSZu6qD8cRQ6k9OMfR1WlM+ruM8fkPWkHvQWD9LIutE=
 github.com/charmbracelet/bubbles v0.20.0/go.mod h1:39slydyswPy+uVOHZ5x/GjwVAFkCsV8IIVy+4MhzwwU=
-github.com/charmbracelet/bubbletea v1.1.1 h1:KJ2/DnmpfqFtDNVTvYZ6zpPFL9iRCRr0qqKOCvppbPY=
-github.com/charmbracelet/bubbletea v1.1.1/go.mod h1:9Ogk0HrdbHolIKHdjfFpyXJmiCzGwy+FesYkZr7hYU4=
+github.com/charmbracelet/bubbletea v1.2.2 h1:EMz//Ky/aFS2uLcKqpCst5UOE6z5CFDGRsUpyXz0chs=
+github.com/charmbracelet/bubbletea v1.2.2/go.mod h1:Qr6fVQw+wX7JkWWkVyXYk/ZUQ92a6XNekLXa3rR18MM=
 github.com/charmbracelet/harmonica v0.2.0 h1:8NxJWRWg/bzKqqEaaeFNipOu77YR5t8aSwG4pgaUBiQ=
 github.com/charmbracelet/harmonica v0.2.0/go.mod h1:KSri/1RMQOZLbw7AHqgcBycp8pgJnQMYYT8QZRqZ1Ao=
-github.com/charmbracelet/lipgloss v0.13.0 h1:4X3PPeoWEDCMvzDvGmTajSyYPcZM4+y8sCA/SsA3cjw=
-github.com/charmbracelet/lipgloss v0.13.0/go.mod h1:nw4zy0SBX/F/eAO1cWdcvy6qnkDUxr8Lw7dvFrAIbbY=
-github.com/charmbracelet/x/ansi v0.2.3 h1:VfFN0NUpcjBRd4DnKfRaIRo53KRgey/nhOoEqosGDEY=
-github.com/charmbracelet/x/ansi v0.2.3/go.mod h1:dk73KoMTT5AX5BsX0KrqhsTqAnhZZoCBjs7dGWp4Ktw=
-github.com/charmbracelet/x/term v0.2.0 h1:cNB9Ot9q8I711MyZ7myUR5HFWL/lc3OpU8jZ4hwm0x0=
-github.com/charmbracelet/x/term v0.2.0/go.mod h1:GVxgxAbjUrmpvIINHIQnJJKpMlHiZ4cktEQCN6GWyF0=
+github.com/charmbracelet/lipgloss v1.0.0 h1:O7VkGDvqEdGi93X+DeqsQ7PKHDgtQfF8j8/O2qFMQNg=
+github.com/charmbracelet/lipgloss v1.0.0/go.mod h1:U5fy9Z+C38obMs+T+tJqst9VGzlOYGj4ri9reL3qUlo=
+github.com/charmbracelet/x/ansi v0.4.5 h1:LqK4vwBNaXw2AyGIICa5/29Sbdq58GbGdFngSexTdRM=
+github.com/charmbracelet/x/ansi v0.4.5/go.mod h1:dk73KoMTT5AX5BsX0KrqhsTqAnhZZoCBjs7dGWp4Ktw=
+github.com/charmbracelet/x/term v0.2.1 h1:AQeHeLZ1OqSXhrAWpYUtZyX1T3zVxfpZuEQMIQaGIAQ=
+github.com/charmbracelet/x/term v0.2.1/go.mod h1:oQ4enTYFV7QN4m0i9mzHrViD7TQKvNEEkHUMCmsxdUg=
 github.com/chzyer/logex v1.1.10/go.mod h1:+Ywpsq7O8HXn0nuIou7OrIPyXbp3wmkHB+jjWRnGsAI=
 github.com/chzyer/readline v0.0.0-20180603132655-2972be24d48e/go.mod h1:nSuG5e5PlCu98SY8svDHJxuZscDgtXS6KTTbou5AhLI=
 github.com/chzyer/test v0.0.0-20180213035817-a1ea475d72b1/go.mod h1:Q3SI9o4m/ZMnBNeIyt5eFwwo7qiLfzFZmjNmxjkiQlU=
 github.com/circonus-labs/circonus-gometrics v2.3.1+incompatible/go.mod h1:nmEj6Dob7S7YxXgwXpfOuvO54S+tGdZdw9fuRZt25Ag=
 github.com/circonus-labs/circonusllhist v0.1.3/go.mod h1:kMXHVDlOchFAehlya5ePtbp5jckzBHf4XRpQvBOLI+I=
 github.com/client9/misspell v0.3.4/go.mod h1:qj6jICC3Q7zFZvVWo7KLAzC3yx5G7kyvSDkc90ppPyw=
-github.com/cloudflare/circl v1.3.3/go.mod h1:5XYMA4rFBvNIrhs50XuiBJ15vF2pZn4nnUKZrLbUZFA=
 github.com/cloudflare/circl v1.3.8 h1:j+V8jJt09PoeMFIu2uh5JUyEaIHTXVOHslFoLNAKqwI=
 github.com/cloudflare/circl v1.3.8/go.mod h1:PDRU+oXvdD7KCtgKxW95M5Z8BpSCJXQORiZFnBQS5QU=
 github.com/cncf/udpa/go v0.0.0-20191209042840-269d4d468f6f/go.mod h1:M8M6+tZqaGXZJjfX53e64911xZQV5JYwmTeXPW+k8Sc=
@@ -190,18 +188,24 @@ github.com/cncf/xds/go v0.0.0-20211011173535-cb28da3451f1/go.mod h1:eXthEFrGJvWH
 github.com/cncf/xds/go v0.0.0-20211130200136-a8f946100490/go.mod h1:eXthEFrGJvWHgFFCl3hGmgk+/aYT6PnTQLykKQRLhEs=
 github.com/containerd/cgroups v1.1.0 h1:v8rEWFl6EoqHB+swVNjVoCJE8o3jX7e8nqBGPLaDFBM=
 github.com/containerd/cgroups v1.1.0/go.mod h1:6ppBcbh/NOOUU+dMKrykgaBnK9lCIBxHqJDGwsa1mIw=
-github.com/containerd/containerd v1.7.11 h1:lfGKw3eU35sjV0aG2eYZTiwFEY1pCzxdzicHP3SZILw=
-github.com/containerd/containerd v1.7.11/go.mod h1:5UluHxHTX2rdvYuZ5OJTC5m/KJNs0Zs9wVoJm9zf5ZE=
+github.com/containerd/containerd v1.7.23 h1:H2CClyUkmpKAGlhQp95g2WXHfLYc7whAuvZGBNYOOwQ=
+github.com/containerd/containerd v1.7.23/go.mod h1:7QUzfURqZWCZV7RLNEn1XjUCQLEf0bkaK4GjUaZehxw=
+github.com/containerd/containerd/api v1.7.19 h1:VWbJL+8Ap4Ju2mx9c9qS1uFSB1OVYr5JJrW2yT5vFoA=
+github.com/containerd/containerd/api v1.7.19/go.mod h1:fwGavl3LNwAV5ilJ0sbrABL44AQxmNjDRcwheXDb6Ig=
 github.com/containerd/continuity v0.4.2 h1:v3y/4Yz5jwnvqPKJJ+7Wf93fyWoCB3F5EclWG023MDM=
 github.com/containerd/continuity v0.4.2/go.mod h1:F6PTNCKepoxEaXLQp3wDAjygEnImnZ/7o4JzpodfroQ=
+github.com/containerd/errdefs v0.3.0 h1:FSZgGOeK4yuT/+DnF07/Olde/q4KBoMsaamhXxIMDp4=
+github.com/containerd/errdefs v0.3.0/go.mod h1:+YBYIdtsnF4Iw6nWZhJcqGSg/dwvV7tyJ/kCkyJ2k+M=
 github.com/containerd/fifo v1.1.0 h1:4I2mbh5stb1u6ycIABlBw9zgtlK8viPI9QkQNRQEEmY=
 github.com/containerd/fifo v1.1.0/go.mod h1:bmC4NWMbXlt2EZ0Hc7Fx7QzTFxgPID13eH0Qu+MAb2o=
 github.com/containerd/log v0.1.0 h1:TCJt7ioM2cr/tfR8GPbGf9/VRAX8D2B4PjzCpfX540I=
 github.com/containerd/log v0.1.0/go.mod h1:VRRf09a7mHDIRezVKTRCrOq78v577GXq3bSa3EhrzVo=
+github.com/containerd/platforms v0.2.1 h1:zvwtM3rz2YHPQsF2CHYM8+KtB5dvhISiXh5ZpSBQv6A=
+github.com/containerd/platforms v0.2.1/go.mod h1:XHCb+2/hzowdiut9rkudds9bE5yJ7npe7dG/wG+uFPw=
 github.com/containerd/stargz-snapshotter/estargz v0.14.3 h1:OqlDCK3ZVUO6C3B/5FSkDwbkEETK84kQgEeFwDC+62k=
 github.com/containerd/stargz-snapshotter/estargz v0.14.3/go.mod h1:KY//uOCIkSuNAHhJogcZtrNHdKrA99/FCCRjE3HD36o=
-github.com/containerd/ttrpc v1.2.2 h1:9vqZr0pxwOF5koz6N0N3kJ0zDHokrcPxIR/ZR2YFtOs=
-github.com/containerd/ttrpc v1.2.2/go.mod h1:sIT6l32Ph/H9cvnJsfXM5drIVzTr5A2flTf1G5tYZak=
+github.com/containerd/ttrpc v1.2.5 h1:IFckT1EFQoFBMG4c3sMdT8EP3/aKfumK1msY+Ze4oLU=
+github.com/containerd/ttrpc v1.2.5/go.mod h1:YCXHsb32f+Sq5/72xHubdiJRQY9inL4a4ZQrAbN1q9o=
 github.com/containerd/typeurl/v2 v2.1.1 h1:3Q4Pt7i8nYwy2KmQWIw2+1hTvwTE/6w9FqcttATPO/4=
 github.com/containerd/typeurl/v2 v2.1.1/go.mod h1:IDp2JFvbwZ31H8dQbEIY7sDl2L3o3HZj1hsSQlywkQ0=
 github.com/coreos/go-semver v0.3.0/go.mod h1:nnelYz7RCh+5ahJtPPxZlU+153eP4D4r3EedlOD2RNk=
@@ -211,8 +215,8 @@ github.com/cpuguy83/go-md2man/v2 v2.0.1/go.mod h1:tgQtvFlXSQOSOSIRvRPT7W67SCa46t
 github.com/cpuguy83/go-md2man/v2 v2.0.2/go.mod h1:tgQtvFlXSQOSOSIRvRPT7W67SCa46tRHOmNcaadrF8o=
 github.com/cpuguy83/go-md2man/v2 v2.0.4/go.mod h1:tgQtvFlXSQOSOSIRvRPT7W67SCa46tRHOmNcaadrF8o=
 github.com/creack/pty v1.1.9/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ33E=
-github.com/cyphar/filepath-securejoin v0.2.4 h1:Ugdm7cg7i6ZK6x3xDF1oEu1nfkyfH53EtKeQYTC3kyg=
-github.com/cyphar/filepath-securejoin v0.2.4/go.mod h1:aPGpWjXOXUn2NCNjFvBE6aRxGGx79pTxQpKOJNYHHl4=
+github.com/cyphar/filepath-securejoin v0.2.5 h1:6iR5tXJ/e6tJZzzdMc1km3Sa7RRIVBKAK32O2s7AYfo=
+github.com/cyphar/filepath-securejoin v0.2.5/go.mod h1:aPGpWjXOXUn2NCNjFvBE6aRxGGx79pTxQpKOJNYHHl4=
 github.com/dave/jennifer v1.7.1 h1:B4jJJDHelWcDhlRQxWeo0Npa/pYKBLrirAQoTN45txo=
 github.com/dave/jennifer v1.7.1/go.mod h1:nXbxhEmQfOZhWml3D1cDK5M1FLnMSozpbFN/m3RmGZc=
 github.com/davecgh/go-spew v0.0.0-20161028175848-04cdfd42973b/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
@@ -225,8 +229,8 @@ github.com/deitch/magic v0.0.0-20230404182410-1ff89d7342da/go.mod h1:B3tI9iGHi4i
 github.com/dgrijalva/jwt-go/v4 v4.0.0-preview1/go.mod h1:+hnT3ywWDTAFrW5aE+u2Sa/wT555ZqwoCS+pk3p6ry4=
 github.com/distribution/reference v0.6.0 h1:0IXCQ5g4/QMHHkarYzh5l+u8T3t73zM5QvfrDyIgxBk=
 github.com/distribution/reference v0.6.0/go.mod h1:BbU0aIcezP1/5jX/8MP0YiH4SdvB5Y4f/wlDRiLyi3E=
-github.com/docker/cli v27.1.1+incompatible h1:goaZxOqs4QKxznZjjBWKONQci/MywhtRv2oNn0GkeZE=
-github.com/docker/cli v27.1.1+incompatible/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8=
+github.com/docker/cli v27.3.1+incompatible h1:qEGdFBF3Xu6SCvCYhc7CzaQTlBmqDuzxPDpigSyeKQQ=
+github.com/docker/cli v27.3.1+incompatible/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8=
 github.com/docker/distribution v2.8.3+incompatible h1:AtKxIZ36LoNK51+Z6RpzLpddBirtxJnzDrHLEKxTAYk=
 github.com/docker/distribution v2.8.3+incompatible/go.mod h1:J2gT2udsDAN96Uj4KfcMRqY0/ypR+oyYUYmja8H+y+w=
 github.com/docker/docker v27.3.1+incompatible h1:KttF0XoteNTicmUtBO0L2tP+J7FGRFTjaEF4k6WdhfI=
@@ -282,8 +286,8 @@ github.com/frankban/quicktest v1.14.6/go.mod h1:4ptaffx2x8+WTWXmUCuVU6aPUX1/Mz7z
 github.com/fsnotify/fsnotify v1.5.1/go.mod h1:T3375wBYaZdLLcVNkcVbzGHY7f1l/uK5T5Ai1i3InKU=
 github.com/fsnotify/fsnotify v1.7.0 h1:8JEhPFa5W2WU7YfeZzPNqzMP6Lwt7L2715Ggo0nosvA=
 github.com/fsnotify/fsnotify v1.7.0/go.mod h1:40Bi/Hjc2AVfZrqy+aj+yEI+/bRxZnMJyTJwOpGvigM=
-github.com/gabriel-vasile/mimetype v1.4.4 h1:QjV6pZ7/XZ7ryI2KuyeEDE8wnh7fHP9YnQy+R0LnH8I=
-github.com/gabriel-vasile/mimetype v1.4.4/go.mod h1:JwLei5XPtWdGiMFB5Pjle1oEeoSeEuJfJE+TtfvdB/s=
+github.com/gabriel-vasile/mimetype v1.4.6 h1:3+PzJTKLkvgjeTbts6msPJt4DixhT4YtFNf1gtGe3zc=
+github.com/gabriel-vasile/mimetype v1.4.6/go.mod h1:JX1qVKqZd40hUPpAfiNTe0Sne7hdfKSbOqqmkq8GCXc=
 github.com/ghodss/yaml v1.0.0/go.mod h1:4dBDuWmgqj2HViK6kFavaiC9ZROes6MMH2rRYeMEF04=
 github.com/github/go-spdx/v2 v2.3.2 h1:IfdyNHTqzs4zAJjXdVQfRnxt1XMfycXoHBE2Vsm1bjs=
 github.com/github/go-spdx/v2 v2.3.2/go.mod h1:2ZxKsOhvBp+OYBDlsGnUMcchLeo2mrpEBn2L1C+U3IQ=
@@ -299,8 +303,8 @@ github.com/gliderlabs/ssh v0.3.7 h1:iV3Bqi942d9huXnzEF2Mt+CY9gLu8DNM4Obd+8bODRE=
 github.com/gliderlabs/ssh v0.3.7/go.mod h1:zpHEXBstFnQYtGnB8k8kQLol82umzn/2/snG7alWVD8=
 github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376 h1:+zs/tPmkDkHx3U66DAb0lQFJrpS6731Oaa12ikc+DiI=
 github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376/go.mod h1:an3vInlBmSxCcxctByoQdvwPiA7DTK7jaaFDBTtu0ic=
-github.com/go-git/go-billy/v5 v5.5.0 h1:yEY4yhzCDuMGSv83oGxiBotRzhwhNr8VZyphhiu+mTU=
-github.com/go-git/go-billy/v5 v5.5.0/go.mod h1:hmexnoNsr2SJU1Ju67OaNz5ASJY3+sHgFRpCtpDCKow=
+github.com/go-git/go-billy/v5 v5.6.0 h1:w2hPNtoehvJIxR00Vb4xX94qHQi/ApZfX+nBE2Cjio8=
+github.com/go-git/go-billy/v5 v5.6.0/go.mod h1:sFDq7xD3fn3E0GOwUSZqHo9lrkmx8xJhA0ZrfvjBRGM=
 github.com/go-git/go-git-fixtures/v4 v4.3.2-0.20231010084843-55a94097c399 h1:eMje31YglSBqCdIqdhKBW8lokaMrL3uTkpGYlE2OOT4=
 github.com/go-git/go-git-fixtures/v4 v4.3.2-0.20231010084843-55a94097c399/go.mod h1:1OCfN199q1Jm3HZlxleg+Dw/mwps2Wbk9frAWm+4FII=
 github.com/go-git/go-git/v5 v5.12.0 h1:7Md+ndsjrzZxbddRDZjF14qK+NN56sy6wkqaVrjZtys=
@@ -359,8 +363,8 @@ github.com/golang/protobuf v1.4.3/go.mod h1:oDoupMAO8OvCJWAcko0GGGIgR6R6ocIYbsSw
 github.com/golang/protobuf v1.5.0/go.mod h1:FsONVRAS9T7sI+LIUmWTfcYkHO4aIWwzhcaSAoJOfIk=
 github.com/golang/protobuf v1.5.1/go.mod h1:DopwsBzvsk0Fs44TXzsVbJyPhcCPeIwnvohx4u74HPM=
 github.com/golang/protobuf v1.5.2/go.mod h1:XVQd3VNwM+JqD3oG2Ue2ip4fOMUkwXdXDdiuN0vRsmY=
-github.com/golang/protobuf v1.5.3 h1:KhyjKVUg7Usr/dYsdSqoFveMYd5ko72D+zANwlG1mmg=
-github.com/golang/protobuf v1.5.3/go.mod h1:XVQd3VNwM+JqD3oG2Ue2ip4fOMUkwXdXDdiuN0vRsmY=
+github.com/golang/protobuf v1.5.4 h1:i7eJL8qZTpSEXOPTxNKhASYpMn+8e5Q6AdndVa1dWek=
+github.com/golang/protobuf v1.5.4/go.mod h1:lnTiLA8Wa4RWRcIUkrtSVa5nRhsEGBg48fD6rSs7xps=
 github.com/golang/snappy v0.0.2/go.mod h1:/XxbfmMg8lxefKM7IXC3fBNl/7bRcc72aCRzEWrmP2Q=
 github.com/golang/snappy v0.0.3/go.mod h1:/XxbfmMg8lxefKM7IXC3fBNl/7bRcc72aCRzEWrmP2Q=
 github.com/golang/snappy v0.0.4 h1:yAGX7huGHXlcLOEtBnF4w7FQwA26wojNCwOYAEhLjQM=
@@ -477,8 +481,8 @@ github.com/invopop/jsonschema v0.7.0 h1:2vgQcBz1n256N+FpX3Jq7Y17AjYt46Ig3zIWyy77
 github.com/invopop/jsonschema v0.7.0/go.mod h1:O9uiLokuu0+MGFlyiaqtWxwqJm41/+8Nj0lD7A36YH0=
 github.com/jbenet/go-context v0.0.0-20150711004518-d14ea06fba99 h1:BQSFePA1RWJOlocH6Fxy8MmwDt+yVQYULKfN0RoTN8A=
 github.com/jbenet/go-context v0.0.0-20150711004518-d14ea06fba99/go.mod h1:1lJo3i6rXxKeerYnT8Nvf0QmHCRC1n8sfWVwXF2Frvo=
-github.com/jedib0t/go-pretty/v6 v6.6.0 h1:wmZVuAcEkZRT+Aq1xXpE8IGat4vE5WXOMmBpbQqERXw=
-github.com/jedib0t/go-pretty/v6 v6.6.0/go.mod h1:zbn98qrYlh95FIhwwsbIip0LYpwSG8SUOScs+v9/t0E=
+github.com/jedib0t/go-pretty/v6 v6.6.1 h1:iJ65Xjb680rHcikRj6DSIbzCex2huitmc7bDtxYVWyc=
+github.com/jedib0t/go-pretty/v6 v6.6.1/go.mod h1:zbn98qrYlh95FIhwwsbIip0LYpwSG8SUOScs+v9/t0E=
 github.com/jinzhu/copier v0.4.0 h1:w3ciUoD19shMCRargcpm0cm91ytaBhDvuRpz1ODO/U8=
 github.com/jinzhu/copier v0.4.0/go.mod h1:DfbEm0FYsaqBcKcFuvmOZb218JkPGtvSHsKg8S8hyyg=
 github.com/json-iterator/go v1.1.6/go.mod h1:+SdeFBvtyEkXs7REEP0seUULqWtbJapLOCVDaaPEHmU=
@@ -581,6 +585,10 @@ github.com/moby/sys/sequential v0.5.0 h1:OPvI35Lzn9K04PBbCLW0g4LcFAJgHsvXsRyewg5
 github.com/moby/sys/sequential v0.5.0/go.mod h1:tH2cOOs5V9MlPiXcQzRC+eEyab644PWKGRYaaV5ZZlo=
 github.com/moby/sys/signal v0.7.0 h1:25RW3d5TnQEoKvRbEKUGay6DCQ46IxAVTT9CUMgmsSI=
 github.com/moby/sys/signal v0.7.0/go.mod h1:GQ6ObYZfqacOwTtlXvcmh9A26dVRul/hbOZn88Kg8Tg=
+github.com/moby/sys/user v0.3.0 h1:9ni5DlcW5an3SvRSx4MouotOygvzaXbaSrc/wGDFWPo=
+github.com/moby/sys/user v0.3.0/go.mod h1:bG+tYYYJgaMtRKgEmuueC0hJEAZWwtIbZTB+85uoHjs=
+github.com/moby/sys/userns v0.1.0 h1:tVLXkFOxVu9A64/yh59slHVv9ahO9UIev4JZusOLG/g=
+github.com/moby/sys/userns v0.1.0/go.mod h1:IHUYgu/kao6N8YZlp9Cf444ySSvCmDlmzUcYfDHOl28=
 github.com/moby/term v0.0.0-20221205130635-1aeaba878587 h1:HfkjXDfhgVaN5rmueG8cL8KKeFNecRCXFhaJ2qZ5SKA=
 github.com/moby/term v0.0.0-20221205130635-1aeaba878587/go.mod h1:8FzsFHVUBGZdbDsJw/ot+X+d5HLUbvklYLJ9uGfcI3Y=
 github.com/modern-go/concurrent v0.0.0-20180228061459-e0a39a4cb421/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
@@ -603,16 +611,14 @@ github.com/nwaples/rardecode v1.1.0 h1:vSxaY8vQhOcVr4mm5e8XllHWTiM4JF507A0Katqw7
 github.com/nwaples/rardecode v1.1.0/go.mod h1:5DzqNKiOdpKKBH87u8VlvAnPZMXcGRhxWkRpHbbfGS0=
 github.com/olekukonko/tablewriter v0.0.5 h1:P2Ga83D34wi1o9J6Wh1mRuqd4mF/x/lgBS7N7AbDhec=
 github.com/olekukonko/tablewriter v0.0.5/go.mod h1:hPp6KlRPjbx+hW8ykQs1w3UBbZlj6HuIJcUGPhkA7kY=
-github.com/onsi/gomega v1.27.10 h1:naR28SdDFlqrG6kScpT8VWpu1xWY5nJRCF3XaYyBjhI=
-github.com/onsi/gomega v1.27.10/go.mod h1:RsS8tutOdbdgzbPtzzATp12yT7kM5I5aElG3evPbQ0M=
+github.com/onsi/gomega v1.34.1 h1:EUMJIKUjM8sKjYbtxQI9A4z2o+rruxnzNvpknOXie6k=
+github.com/onsi/gomega v1.34.1/go.mod h1:kU1QgUvBDLXBJq618Xvm2LUX6rSAfRaFRTcdOeDLwwY=
 github.com/opencontainers/go-digest v1.0.0 h1:apOUWs51W5PlhuyGyz9FCeeBIOUDA/6nW8Oi/yOhh5U=
 github.com/opencontainers/go-digest v1.0.0/go.mod h1:0JzlMkj0TRzQZfJkVvzbP0HBR3IKzErnv2BNG4W4MAM=
 github.com/opencontainers/image-spec v1.1.0 h1:8SG7/vwALn54lVB/0yZ/MMwhFrPYtpEHQb2IpWsCzug=
 github.com/opencontainers/image-spec v1.1.0/go.mod h1:W4s4sFTMaBeK1BQLXbG4AdM2szdn85PY75RI83NrTrM=
-github.com/opencontainers/runc v1.1.14 h1:rgSuzbmgz5DUJjeSnw337TxDbRuqjs6iqQck/2weR6w=
-github.com/opencontainers/runc v1.1.14/go.mod h1:E4C2z+7BxR7GHXp0hAY53mek+x49X1LjPNeMTfRGvOA=
-github.com/opencontainers/runtime-spec v1.1.0-rc.1 h1:wHa9jroFfKGQqFHj0I1fMRKLl0pfj+ynAqBxo3v6u9w=
-github.com/opencontainers/runtime-spec v1.1.0-rc.1/go.mod h1:jwyrGlmzljRJv/Fgzds9SsS/C5hL+LL3ko9hs6T5lQ0=
+github.com/opencontainers/runtime-spec v1.1.0 h1:HHUyrt9mwHUjtasSbXSMvs4cyFxh+Bll4AjJ9odEGpg=
+github.com/opencontainers/runtime-spec v1.1.0/go.mod h1:jwyrGlmzljRJv/Fgzds9SsS/C5hL+LL3ko9hs6T5lQ0=
 github.com/opencontainers/selinux v1.11.0 h1:+5Zbo97w3Lbmb3PeqQtpmTkMwsW5nRI3YaLpt7tQ7oU=
 github.com/opencontainers/selinux v1.11.0/go.mod h1:E5dMC3VPuVvVHDYmi78qvhJp8+M586T4DlDRYpFkyec=
 github.com/pascaldekloe/goe v0.0.0-20180627143212-57f6aae5913c/go.mod h1:lzWF7FIEvWOWxwDKqyGYQf6ZUaNfKdP144TG7ZOy1lc=
@@ -655,7 +661,6 @@ github.com/prometheus/common v0.9.1/go.mod h1:yhUN8i9wzaXS3w1O07YhxHEBxD+W35wd8b
 github.com/prometheus/procfs v0.0.0-20181005140218-185b4288413d/go.mod h1:c3At6R/oaqEKCNdg8wHV1ftS6bRYblBhIjjI8uT2IGk=
 github.com/prometheus/procfs v0.0.2/go.mod h1:TjEm7ze935MbeOT/UhFTIMYKhuLP4wbCsTZCD3I8kEA=
 github.com/prometheus/procfs v0.0.8/go.mod h1:7Qr8sr6344vo1JqZ6HhLceV9o3AJ1Ff+GxbHq6oeK9A=
-github.com/prometheus/procfs v0.6.0/go.mod h1:cz+aTbrPOrUb4q7XlbU9ygM+/jj0fzG6c1xBZuNvfVA=
 github.com/prometheus/procfs v0.8.0 h1:ODq8ZFEaYeCaZOJlZZdJA2AbQR98dSHSM1KW/You5mo=
 github.com/prometheus/procfs v0.8.0/go.mod h1:z7EfXMXOkbkqb9IINtpCn86r/to3BnA0uaxHdg830/4=
 github.com/quasilyte/go-ruleguard/dsl v0.3.22 h1:wd8zkOhSNr+I+8Qeciml08ivDt1pSXe60+5DqOpCjPE=
@@ -673,8 +678,8 @@ github.com/rogpeppe/go-internal v1.12.0/go.mod h1:E+RYuTGaKKdloAfM02xzb0FW3Paa99
 github.com/russross/blackfriday/v2 v2.0.1/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
 github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
 github.com/ryanuber/columnize v0.0.0-20160712163229-9b3edd62028f/go.mod h1:sm1tb6uqfes/u+d4ooFouqFdy9/2g9QGwK3SQygK0Ts=
-github.com/saferwall/pe v1.5.4 h1:tLmMggEMUfeqrpJ25zS/okUQmyFdD5xWKL2+z9njCqg=
-github.com/saferwall/pe v1.5.4/go.mod h1:mJx+PuptmNpoPFBNhWs/uDMFL/kTHVZIkg0d4OUJFbQ=
+github.com/saferwall/pe v1.5.5 h1:GGbzKjXDm7i+1K6riOgtgblyTdRmTbr3r11IzjovAK8=
+github.com/saferwall/pe v1.5.5/go.mod h1:mJx+PuptmNpoPFBNhWs/uDMFL/kTHVZIkg0d4OUJFbQ=
 github.com/sagikazarmark/crypt v0.3.0/go.mod h1:uD/D+6UF4SrIR1uGEv7bBNkNqLGqUr43MRiaGWX1Nig=
 github.com/sagikazarmark/locafero v0.4.0 h1:HApY1R9zGo4DBgr7dqsTH/JJxLTTsOt7u6keLGt6kNQ=
 github.com/sagikazarmark/locafero v0.4.0/go.mod h1:Pe1W6UlPYUk/+wc/6KFhbORCfqzgYEpgQ3O5fPuL3H4=
@@ -691,8 +696,8 @@ github.com/sassoftware/go-rpmutils v0.4.0/go.mod h1:3goNWi7PGAT3/dlql2lv3+MSN5jN
 github.com/scylladb/go-set v1.0.3-0.20200225121959-cc7b2070d91e h1:7q6NSFZDeGfvvtIRwBrU/aegEYJYmvev0cHAwo17zZQ=
 github.com/scylladb/go-set v1.0.3-0.20200225121959-cc7b2070d91e/go.mod h1:DkpGd78rljTxKAnTDPFqXSGxvETQnJyuSOQwsHycqfs=
 github.com/sean-/seed v0.0.0-20170313163322-e2103e2c3529/go.mod h1:DxrIzT+xaE7yg65j358z/aeFdxmN0P9QXhEzd20vsDc=
-github.com/sebdah/goldie/v2 v2.5.3 h1:9ES/mNN+HNUbNWpVAlrzuZ7jE+Nrczbj8uFRjM7624Y=
-github.com/sebdah/goldie/v2 v2.5.3/go.mod h1:oZ9fp0+se1eapSRjfYbsV/0Hqhbuu3bJVvKI/NNtssI=
+github.com/sebdah/goldie/v2 v2.5.5 h1:rx1mwF95RxZ3/83sdS4Yp7t2C5TCokvWP4TBRbAyEWY=
+github.com/sebdah/goldie/v2 v2.5.5/go.mod h1:oZ9fp0+se1eapSRjfYbsV/0Hqhbuu3bJVvKI/NNtssI=
 github.com/secDre4mer/pkcs7 v0.0.0-20240322103146-665324a4461d h1:RQqyEogx5J6wPdoxqL132b100j8KjcVHO1c0KLRoIhc=
 github.com/secDre4mer/pkcs7 v0.0.0-20240322103146-665324a4461d/go.mod h1:PegD7EVqlN88z7TpCqH92hHP+GBpfomGCCnw1PFtNOA=
 github.com/sergi/go-diff v1.1.0/go.mod h1:STckp+ISIX8hZLjrqAeVduY0gWCT9IjLuqbuNXdaHfM=
@@ -705,7 +710,6 @@ github.com/shurcooL/sanitized_anchor_name v1.0.0/go.mod h1:1NzhyTcUVG4SuEtjjoZeV
 github.com/sirupsen/logrus v1.2.0/go.mod h1:LxeOpSwHxABJmUn/MG1IvRgCAasNZTLOkJPxbbu5VWo=
 github.com/sirupsen/logrus v1.4.2/go.mod h1:tLMulIdttU9McNUspp0xgXVQah82FyeX6MwdIuYE2rE=
 github.com/sirupsen/logrus v1.7.0/go.mod h1:yWOB1SBYBC5VeMP7gHvWumXLIWorT60ONWic61uBYv0=
-github.com/sirupsen/logrus v1.8.1/go.mod h1:yWOB1SBYBC5VeMP7gHvWumXLIWorT60ONWic61uBYv0=
 github.com/sirupsen/logrus v1.9.0/go.mod h1:naHLuLoDiP4jHNo9R0sCBMtWGeIprob74mVsIT4qYEQ=
 github.com/sirupsen/logrus v1.9.3 h1:dueUQJ1C2q9oE3F7wvmSGAaVtTmUizReu6fjN8uqzbQ=
 github.com/sirupsen/logrus v1.9.3/go.mod h1:naHLuLoDiP4jHNo9R0sCBMtWGeIprob74mVsIT4qYEQ=
@@ -756,8 +760,8 @@ github.com/stretchr/testify v1.9.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8
 github.com/subosito/gotenv v1.2.0/go.mod h1:N0PQaV/YGNqwC0u51sEeR/aUtSLEXKX9iv69rRypqCw=
 github.com/subosito/gotenv v1.6.0 h1:9NlTDc1FTs4qu0DDq7AEtTPNw6SVm7uBMsUCUjABIf8=
 github.com/subosito/gotenv v1.6.0/go.mod h1:Dk4QP5c2W3ibzajGcXpNraDfq2IrhjMIvMSWPKKo0FU=
-github.com/sylabs/sif/v2 v2.17.1 h1:p6Sl0LWyShXBj2SBsS1dMOMIMrZHe8pwBnBrYt6uo4M=
-github.com/sylabs/sif/v2 v2.17.1/go.mod h1:XUGB6AQUXGkms3qPOPdevctT3lBLRLWZNWHVnt5HMKE=
+github.com/sylabs/sif/v2 v2.20.0 h1:RfDHEltUrchZbp/XGcWaw3nRSbufoNWqvwmf91/Q2gI=
+github.com/sylabs/sif/v2 v2.20.0/go.mod h1:z6dq3B7QXK0pD71n15kAapven+gE+PZAIPOewBTNDpU=
 github.com/sylabs/squashfs v1.0.0 h1:xAyMS21ogglkuR5HaY55PCfqY3H32ma9GkasTYo28Zg=
 github.com/sylabs/squashfs v1.0.0/go.mod h1:rhWzvgefq1X+R+LZdts10hfMsTg3g74OfGunW8tvg/4=
 github.com/terminalstatic/go-xsd-validate v0.1.5 h1:RqpJnf6HGE2CB/lZB1A8BYguk8uRtcvYAPLCF15qguo=
@@ -834,8 +838,8 @@ go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.19.0 h1:IeMey
 go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.19.0/go.mod h1:oVdCUtjq9MK9BlS7TtucsQwUcXcymNiEDjgDD2jMtZU=
 go.opentelemetry.io/otel/metric v1.24.0 h1:6EhoGWWK28x1fbpA4tYTOWBkPefTDQnb8WSGXlc88kI=
 go.opentelemetry.io/otel/metric v1.24.0/go.mod h1:VYhLe1rFfxuTXLgj4CBiyz+9WYBA8pNGJgDcSFRKBco=
-go.opentelemetry.io/otel/sdk v1.19.0 h1:6USY6zH+L8uMH8L3t1enZPR3WFEmSTADlqldyHtJi3o=
-go.opentelemetry.io/otel/sdk v1.19.0/go.mod h1:NedEbbS4w3C6zElbLdPJKOpJQOrGUJ+GfzpjUvI0v1A=
+go.opentelemetry.io/otel/sdk v1.21.0 h1:FTt8qirL1EysG6sTQRZ5TokkU8d0ugCj8htOgThZXQ8=
+go.opentelemetry.io/otel/sdk v1.21.0/go.mod h1:Nna6Yv7PWTdgJHVRD9hIYywQBRx7pbox6nwBnZIxl/E=
 go.opentelemetry.io/otel/trace v1.24.0 h1:CsKnnL4dUAr/0llH9FKuc698G04IrpWV0MQA/Y1YELI=
 go.opentelemetry.io/otel/trace v1.24.0/go.mod h1:HPc3Xr/cOApsBI154IU0OI0HJexz+aw5uPdbs3UCjNU=
 go.opentelemetry.io/proto/otlp v0.7.0/go.mod h1:PqfVotwruBrMGOCsRd/89rSnXhoiJIqeYNgFYFoEGnI=
@@ -862,10 +866,8 @@ golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPh
 golang.org/x/crypto v0.0.0-20210817164053-32db794688a5/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
 golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
 golang.org/x/crypto v0.0.0-20220622213112-05595931fe9d/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=
-golang.org/x/crypto v0.3.1-0.20221117191849-2c476679df9a/go.mod h1:hebNnKkNXi2UzZN1eVRvBB7co0a+JxK6XbPiWVs/3J4=
-golang.org/x/crypto v0.7.0/go.mod h1:pYwdfH91IfpZVANVyUOhSIPZaFoJGxTFbZhFTx+dXZU=
-golang.org/x/crypto v0.28.0 h1:GBDwsMXVQi34v5CCYUm2jkJvu4cbtru2U4TN2PSyQnw=
-golang.org/x/crypto v0.28.0/go.mod h1:rmgy+3RHxRZMyY0jjAJShp2zgEdOqj2AO7U0pYmeQ7U=
+golang.org/x/crypto v0.29.0 h1:L5SG1JTTXupVV3n6sUqMTeWbjAyfPwoda2DLX8J8FrQ=
+golang.org/x/crypto v0.29.0/go.mod h1:+F4F4N5hv6v38hfeYwTdx20oUvLLc+QfrE9Ax9HtgRg=
 golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
 golang.org/x/exp v0.0.0-20190306152737-a1d7652674e8/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
 golang.org/x/exp v0.0.0-20190510132918-efd6b22b2522/go.mod h1:ZjyILWgesfNpC6sMxTJOJm9Kp84zZh5NQWvqDGG3Qr8=
@@ -876,8 +878,8 @@ golang.org/x/exp v0.0.0-20191227195350-da58074b4299/go.mod h1:2RIsYlXP63K8oxa1u0
 golang.org/x/exp v0.0.0-20200119233911-0405dc783f0a/go.mod h1:2RIsYlXP63K8oxa1u096TMicItID8zy7Y6sNkU49FU4=
 golang.org/x/exp v0.0.0-20200207192155-f17229e696bd/go.mod h1:J/WKrq2StrnmMY6+EHIKF9dgMWnmCNThgcyBT1FY9mM=
 golang.org/x/exp v0.0.0-20200224162631-6cc2880d07d6/go.mod h1:3jZMyOhIsHpP37uCMkUooju7aAi5cS1Q23tOzKc+0MU=
-golang.org/x/exp v0.0.0-20231108232855-2478ac86f678 h1:mchzmB1XO2pMaKFRqk/+MV3mgGG96aqaPXaMifQU47w=
-golang.org/x/exp v0.0.0-20231108232855-2478ac86f678/go.mod h1:zk2irFbV9DP96SEBUUAy67IdHUaZuSnrz1n472HUCLE=
+golang.org/x/exp v0.0.0-20240719175910-8a7402abbf56 h1:2dVuKD2vS7b0QIHQbpyTISPd0LeHDbnYEryqj5Q1ug8=
+golang.org/x/exp v0.0.0-20240719175910-8a7402abbf56/go.mod h1:M4RDyNAINzryxdtnbRXRL/OHtkFuWGRjvuhBJpk2IlY=
 golang.org/x/image v0.0.0-20190227222117-0694c2d4d067/go.mod h1:kZ7UVZpmo3dzQBMxlp+ypCbDeSB+sBbTgSJuh5dn5js=
 golang.org/x/image v0.0.0-20190802002840-cff245a6509b/go.mod h1:FeLwcggjj3mMvU+oOTbSwawSJRM1uh48EjtB4UJZlP0=
 golang.org/x/lint v0.0.0-20181026193005-c67002cb31c3/go.mod h1:UVdnD1Gm6xHRNCYTkRU2/jEulfH38KcIWyp/GAMgvoE=
@@ -905,9 +907,8 @@ golang.org/x/mod v0.4.1/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.4.2/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.5.0/go.mod h1:5OXOZSfqPIIbmVBIIKWRFfZjPR0E5r58TLhUjH0a2Ro=
 golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4=
-golang.org/x/mod v0.8.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
-golang.org/x/mod v0.21.0 h1:vvrHzRwRfVKSiLrG+d4FMl/Qi4ukBCE6kZlTUkDYRT0=
-golang.org/x/mod v0.21.0/go.mod h1:6SkKJ3Xj0I0BrPOZoBy3bdMptDDU9oJrpohJ3eWZ1fY=
+golang.org/x/mod v0.22.0 h1:D4nJWe9zXqHOmWqj4VMOJhvzj7bEZg4wEYa759z1pH4=
+golang.org/x/mod v0.22.0/go.mod h1:6SkKJ3Xj0I0BrPOZoBy3bdMptDDU9oJrpohJ3eWZ1fY=
 golang.org/x/net v0.0.0-20180724234803-3673e40ba225/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20180826012351-8a410e7b638d/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20181023162649-9b4f9f5ad519/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
@@ -951,11 +952,8 @@ golang.org/x/net v0.0.0-20210503060351-7fd8e65b6420/go.mod h1:9nx3DQGgdP8bBQD5qx
 golang.org/x/net v0.0.0-20210813160813-60bc85c4be6d/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
 golang.org/x/net v0.0.0-20211112202133-69e39bad7dc2/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
 golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
-golang.org/x/net v0.2.0/go.mod h1:KqCZLdyyvdV855qA2rE3GC2aiw5xGR5TEjj8smXukLY=
-golang.org/x/net v0.6.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=
-golang.org/x/net v0.8.0/go.mod h1:QVkue5JL9kW//ek3r6jTKnTFis1tRmNAW2P1shuFdJc=
-golang.org/x/net v0.30.0 h1:AcW1SDZMkb8IpzCdQUaIq2sP4sZ4zw+55h6ynffypl4=
-golang.org/x/net v0.30.0/go.mod h1:2wGyMJ5iFasEhkwi13ChkO/t1ECNC4X4eBKkVFyYFlU=
+golang.org/x/net v0.31.0 h1:68CPQngjLL0r2AlUKiSxtQFKvzRVbnzLwMUn5SzcLHo=
+golang.org/x/net v0.31.0/go.mod h1:P4fl1q7dY2hnZFxEk4pPSkDHF+QqjitcnDjUQyMM+pM=
 golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
 golang.org/x/oauth2 v0.0.0-20190226205417-e64efc72b421/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
 golang.org/x/oauth2 v0.0.0-20190604053449-0f29369cfe45/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
@@ -985,9 +983,8 @@ golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJ
 golang.org/x/sync v0.0.0-20201207232520-09787c993a3a/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20210220032951-036812b2e83c/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.1.0/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.8.0 h1:3NFvSEYkUoMifnESzZl15y791HH1qU2xm6eCJU5ZPXQ=
-golang.org/x/sync v0.8.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
+golang.org/x/sync v0.9.0 h1:fEo0HyrW1GIgZdpbhCRO0PkJajUS5H9IFUztCgEo2jQ=
+golang.org/x/sync v0.9.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
 golang.org/x/sys v0.0.0-20180823144017-11551d06cbcc/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20180830151530-49385e6e1522/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20180905080454-ebe1bf3edb33/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
@@ -1062,20 +1059,13 @@ golang.org/x/sys v0.0.0-20220715151400-c0bba94af5f8/go.mod h1:oPkhp1MJrh7nUepCBc
 golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220811171246-fbc7d0a398ab/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220906165534-d0df966e6959/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.1.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.2.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.3.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.26.0 h1:KHjCJyddX0LoSTb3J+vWpupP9p0oznkqVk/IfjymZbo=
-golang.org/x/sys v0.26.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
+golang.org/x/sys v0.27.0 h1:wBqf8DvsY9Y/2P8gAfPDEYNuS30J4lPHJxXSb/nJZ+s=
+golang.org/x/sys v0.27.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
-golang.org/x/term v0.2.0/go.mod h1:TVmDHMZPmdnySmBfhjOoOdhjzdE1h4u1VwSiw2l1Nuc=
-golang.org/x/term v0.5.0/go.mod h1:jMB1sMXY+tzblOD4FWmEbocvup2/aLOaQEp7JmGp78k=
-golang.org/x/term v0.6.0/go.mod h1:m6U89DPEgQRMq3DNkDClhWw02AUbt2daBVO4cn4Hv9U=
-golang.org/x/term v0.25.0 h1:WtHI/ltw4NvSUig5KARz9h521QvRC8RmF/cuYqifU24=
-golang.org/x/term v0.25.0/go.mod h1:RPyXicDX+6vLxogjjRxjgD2TKtmAO6NZBsBRfrOLu7M=
+golang.org/x/term v0.26.0 h1:WEQa6V3Gja/BhNxg540hBip/kkaYtRg3cxg4oXSw4AU=
+golang.org/x/term v0.26.0/go.mod h1:Si5m1o57C5nBNQo5z1iq+XDijt21BDBDp2bK0QI8e3E=
 golang.org/x/text v0.0.0-20170915032832-14c0d48ead0c/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.1-0.20180807135948-17ff2d5776d2/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
@@ -1085,11 +1075,9 @@ golang.org/x/text v0.3.4/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.5/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
-golang.org/x/text v0.4.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
 golang.org/x/text v0.7.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
-golang.org/x/text v0.8.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8=
-golang.org/x/text v0.19.0 h1:kTxAhCbGbxhK0IwgSKiMO5awPoDQ0RpfiVYBfK860YM=
-golang.org/x/text v0.19.0/go.mod h1:BuEKDfySbSR4drPmRPG/7iBdf8hvFMuRexcpahXilzY=
+golang.org/x/text v0.20.0 h1:gK/Kv2otX8gz+wn7Rmb3vT96ZwuoxnQlY+HlJVj7Qug=
+golang.org/x/text v0.20.0/go.mod h1:D4IsuqiFMhST5bX19pQ9ikHC2GsaKyk/oF+pn3ducp4=
 golang.org/x/time v0.0.0-20181108054448-85acf8d2951c/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.0.0-20190308202827-9d24e82272b4/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.0.0-20191024005414-555d28b269f0/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
@@ -1150,9 +1138,8 @@ golang.org/x/tools v0.1.3/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk=
 golang.org/x/tools v0.1.4/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk=
 golang.org/x/tools v0.1.5/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk=
 golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc=
-golang.org/x/tools v0.6.0/go.mod h1:Xwgl3UAJ/d3gWutnCtw505GrjyAbvKui8lOU390QaIU=
-golang.org/x/tools v0.21.1-0.20240508182429-e35e4ccd0d2d h1:vU5i/LfpvrRCpgM/VPfJLg5KjxD3E+hfT1SH+d9zLwg=
-golang.org/x/tools v0.21.1-0.20240508182429-e35e4ccd0d2d/go.mod h1:aiJjzUbINMkxbQROHiO6hDPo2LHcIPhhQsa9DLh0yGk=
+golang.org/x/tools v0.23.0 h1:SGsXPZ+2l4JsgaCKkx+FQ9YZ5XEtA1GZYuoDjenLjvg=
+golang.org/x/tools v0.23.0/go.mod h1:pnu6ufv6vQkll6szChhK3C3L/ruaIv5eBeztNG8wtsI=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
@@ -1310,8 +1297,8 @@ google.golang.org/protobuf v1.25.0/go.mod h1:9JNX74DMeImyA3h4bdi1ymwjUzf21/xIlba
 google.golang.org/protobuf v1.26.0-rc.1/go.mod h1:jlhhOSvTdKEhbULTjvd4ARK9grFBp09yW+WbY/TyQbw=
 google.golang.org/protobuf v1.26.0/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc=
 google.golang.org/protobuf v1.27.1/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc=
-google.golang.org/protobuf v1.33.0 h1:uNO2rsAINq/JlFpSdYEKIZ0uKD/R9cpdv0T+yoGwGmI=
-google.golang.org/protobuf v1.33.0/go.mod h1:c6P6GXX6sHbq/GpV6MGZEdwhWPcYBgnhAHhKbcUYpos=
+google.golang.org/protobuf v1.34.2 h1:6xV6lTsCfpGD21XK49h7MhtcApnLqkfYgPcdHftf6hg=
+google.golang.org/protobuf v1.34.2/go.mod h1:qYOHts0dSfpeUzUFpOMr/WGzszTmLH+DiWniOlNbLDw=
 gopkg.in/alecthomas/kingpin.v2 v2.2.6/go.mod h1:FMv+mEhP44yOT+4EoQTLFTRgOQ1FBLkstjWtayDeSgw=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20180628173108-788fd7840127/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
@@ -3,5 +3,5 @@ package internal
 const (
 	// JSONSchemaVersion is the current schema version output by the JSON encoder
 	// This is roughly following the "SchemaVer" guidelines for versioning the JSON schema. Please see schema/json/README.md for details on how to increment.
-	JSONSchemaVersion = "16.0.18"
+	JSONSchemaVersion = "16.0.19"
 )
@@ -0,0 +1,18 @@
+package licenses
+
+import (
+	"context"
+)
+
+type licenseScannerKey struct{}
+
+func SetContextLicenseScanner(ctx context.Context, s Scanner) context.Context {
+	return context.WithValue(ctx, licenseScannerKey{}, s)
+}
+
+func ContextLicenseScanner(ctx context.Context) Scanner {
+	if s, ok := ctx.Value(licenseScannerKey{}).(Scanner); ok {
+		return s
+	}
+	return NewDefaultScanner()
+}
@@ -1,45 +0,0 @@
-package licenses
-
-import (
-	"io"
-
-	"github.com/google/licensecheck"
-
-	"github.com/anchore/syft/syft/file"
-	"github.com/anchore/syft/syft/license"
-	"github.com/anchore/syft/syft/pkg"
-)
-
-const (
-	coverageThreshold  = 75
-	unknownLicenseType = "UNKNOWN"
-)
-
-// Parse scans the contents of a license file to attempt to determine the type of license it is
-func Parse(reader io.Reader, l file.Location) (licenses []pkg.License, err error) {
-	licenses = make([]pkg.License, 0)
-	contents, err := io.ReadAll(reader)
-	if err != nil {
-		return nil, err
-	}
-
-	scanner, err := licensecheck.NewScanner(licensecheck.BuiltinLicenses())
-	if err != nil {
-		return nil, err
-	}
-
-	cov := scanner.Scan(contents)
-	if cov.Percent < coverageThreshold {
-		// unknown or no licenses here?
-		return licenses, nil
-	}
-
-	for _, m := range cov.Match {
-		lic := pkg.NewLicenseFromLocations(m.ID, l)
-		lic.Type = license.Concluded
-
-		licenses = append(licenses, lic)
-	}
-
-	return licenses, nil
-}
@@ -0,0 +1,68 @@
+package licenses
+
+import (
+	"context"
+	"io"
+
+	"github.com/google/licensecheck"
+
+	"github.com/anchore/syft/internal/log"
+)
+
+const coverageThreshold = 75 // determined by experimentation
+
+type Scanner interface {
+	IdentifyLicenseIDs(context.Context, io.Reader) ([]string, error)
+}
+
+var _ Scanner = (*scanner)(nil)
+
+type scanner struct {
+	coverageThreshold float64 // between 0 and 100
+	scanner           func([]byte) licensecheck.Coverage
+}
+
+// NewDefaultScanner returns a scanner that uses a new instance of the default licensecheck package scanner.
+func NewDefaultScanner() Scanner {
+	s, err := licensecheck.NewScanner(licensecheck.BuiltinLicenses())
+	if err != nil {
+		log.WithFields("error", err).Trace("unable to create default license scanner")
+		s = nil
+	}
+	return &scanner{
+		coverageThreshold: coverageThreshold,
+		scanner:           s.Scan,
+	}
+}
+
+// TestingOnlyScanner returns a scanner that uses the built-in license scanner from the licensecheck package.
+// THIS IS ONLY MEANT FOR TEST CODE, NOT PRODUCTION CODE.
+func TestingOnlyScanner() Scanner {
+	return &scanner{
+		coverageThreshold: coverageThreshold,
+		scanner:           licensecheck.Scan,
+	}
+}
+
+func (s scanner) IdentifyLicenseIDs(_ context.Context, reader io.Reader) ([]string, error) {
+	if s.scanner == nil {
+		return nil, nil
+	}
+
+	content, err := io.ReadAll(reader)
+	if err != nil {
+		return nil, err
+	}
+
+	cov := s.scanner(content)
+	if cov.Percent < s.coverageThreshold {
+		// unknown or no licenses here?
+		return nil, nil
+	}
+
+	var ids []string
+	for _, m := range cov.Match {
+		ids = append(ids, m.ID)
+	}
+	return ids, nil
+}
@@ -0,0 +1,28 @@
+package licenses
+
+import (
+	"context"
+
+	"github.com/anchore/syft/syft/file"
+	"github.com/anchore/syft/syft/license"
+	"github.com/anchore/syft/syft/pkg"
+)
+
+// Search scans the contents of a license file to attempt to determine the type of license it is
+func Search(ctx context.Context, scanner Scanner, reader file.LocationReadCloser) (licenses []pkg.License, err error) {
+	licenses = make([]pkg.License, 0)
+
+	ids, err := scanner.IdentifyLicenseIDs(ctx, reader)
+	if err != nil {
+		return nil, err
+	}
+
+	for _, id := range ids {
+		lic := pkg.NewLicenseFromLocations(id, reader.Location)
+		lic.Type = license.Concluded
+
+		licenses = append(licenses, lic)
+	}
+
+	return licenses, nil
+}
@@ -4,6 +4,7 @@ import (
 	"context"
 	"fmt"
 	"runtime/debug"
+	"slices"
 	"sync"
 	"time"

@@ -57,14 +58,14 @@ func (p *Executor) Execute(ctx context.Context, resolver file.Resolver, s sbomsy
 				}

 				err := runTaskSafely(ctx, tsk, resolver, s)
-				unknowns, err := unknown.ExtractCoordinateErrors(err)
+				unknowns, remainingErrors := unknown.ExtractCoordinateErrors(err)
 				if len(unknowns) > 0 {
 					appendUnknowns(s, tsk.Name(), unknowns)
 				}
-				if err != nil {
+				if remainingErrors != nil {
 					withLock(func() {
-						errs = multierror.Append(errs, fmt.Errorf("failed to run task: %w", err))
-						prog.SetError(err)
+						errs = multierror.Append(errs, fmt.Errorf("failed to run task: %w", remainingErrors))
+						prog.SetError(remainingErrors)
 					})
 				}
 				prog.Increment()
@@ -84,7 +85,13 @@ func appendUnknowns(builder sbomsync.Builder, taskName string, unknowns []unknow
 				if sb.Artifacts.Unknowns == nil {
 					sb.Artifacts.Unknowns = map[file.Coordinates][]string{}
 				}
-				sb.Artifacts.Unknowns[u.Coordinates] = append(sb.Artifacts.Unknowns[u.Coordinates], formatUnknown(u.Reason.Error(), taskName))
+				unknownText := formatUnknown(u.Reason.Error(), taskName)
+				existing := sb.Artifacts.Unknowns[u.Coordinates]
+				// don't include duplicate unknowns
+				if slices.Contains(existing, unknownText) {
+					continue
+				}
+				sb.Artifacts.Unknowns[u.Coordinates] = append(existing, unknownText)
 			}
 		})
 	}
@@ -110,6 +110,8 @@ func NewPackageTask(cfg CatalogingFactoryConfig, c pkg.Cataloger, tags ...string

 		pkgs, relationships = applyCompliance(cfg.ComplianceConfig, pkgs, relationships)

+		finalizeDependencyCompleteness(pkgs)
+
 		sbom.AddPackages(pkgs...)
 		sbom.AddRelationships(relationships...)
 		t.Add(int64(len(pkgs)))
@@ -124,6 +126,13 @@ func NewPackageTask(cfg CatalogingFactoryConfig, c pkg.Cataloger, tags ...string
 	return NewTask(c.Name(), fn, tags...)
 }

+func finalizeDependencyCompleteness(pkgs []pkg.Package) {
+	// ensure that all packages have a non-empty dependency list
+	for i := range pkgs {
+		pkgs[i].Dependencies = pkg.ParseDependencyCompleteness(string(pkgs[i].Dependencies))
+	}
+}
+
 func finalizePkgCatalogerResults(cfg CatalogingFactoryConfig, resolver file.PathResolver, catalogerName string, pkgs []pkg.Package, relationships []artifact.Relationship) ([]pkg.Package, []artifact.Relationship) {
 	for i, p := range pkgs {
 		if p.FoundBy == "" {
@@ -68,7 +68,7 @@ func DefaultPackageTaskFactories() PackageTaskFactories {
 		newSimplePackageTaskFactory(php.NewComposerInstalledCataloger, pkgcataloging.InstalledTag, pkgcataloging.ImageTag, pkgcataloging.LanguageTag, "php", "composer"),
 		newSimplePackageTaskFactory(r.NewPackageCataloger, pkgcataloging.InstalledTag, pkgcataloging.ImageTag, pkgcataloging.LanguageTag, "r"),
 		newSimplePackageTaskFactory(ruby.NewInstalledGemSpecCataloger, pkgcataloging.InstalledTag, pkgcataloging.ImageTag, pkgcataloging.LanguageTag, "ruby", "gem", "gemspec"),
-		newSimplePackageTaskFactory(rust.NewAuditBinaryCataloger, pkgcataloging.InstalledTag, pkgcataloging.ImageTag, pkgcataloging.LanguageTag, "rust", "binary"),
+		newSimplePackageTaskFactory(rust.NewAuditBinaryCataloger, pkgcataloging.DirectoryTag, pkgcataloging.InstalledTag, pkgcataloging.ImageTag, pkgcataloging.LanguageTag, "rust", "binary"),

 		// language-specific package declared catalogers ///////////////////////////////////////////////////////////////////////////
 		newSimplePackageTaskFactory(cpp.NewConanCataloger, pkgcataloging.DeclaredTag, pkgcataloging.DirectoryTag, pkgcataloging.LanguageTag, "cpp", "conan"),
@@ -0,0 +1,33 @@
+package unknown
+
+import (
+	"regexp"
+
+	"github.com/anchore/syft/internal/log"
+	"github.com/anchore/syft/syft/file"
+)
+
+var pathErrorRegex = regexp.MustCompile(`.*path="([^"]+)".*`)
+
+// ProcessPathErrors replaces "path" errors returned from the file.Resolver into unknowns,
+// and warn logs non-unknown errors, returning only the unknown errors
+func ProcessPathErrors(err error) error {
+	if err == nil {
+		return nil
+	}
+	errText := err.Error()
+	if pathErrorRegex.MatchString(errText) {
+		foundPath := pathErrorRegex.ReplaceAllString(err.Error(), "$1")
+		if foundPath != "" {
+			return New(file.NewLocation(foundPath), err)
+		}
+	}
+	unknowns, remainingErrors := ExtractCoordinateErrors(err)
+	log.Warn(remainingErrors)
+
+	var out []error
+	for _, u := range unknowns {
+		out = append(out, &u)
+	}
+	return Join(out...)
+}
@@ -0,0 +1,56 @@
+package unknown
+
+import (
+	"fmt"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+
+	"github.com/anchore/syft/syft/file"
+)
+
+func Test_ProcessPathErrors(t *testing.T) {
+	tests := []struct {
+		errorText string
+		expected  error
+	}{
+		{
+			errorText: `prefix path="/var/lib/thing" suffix`,
+			expected: &CoordinateError{
+				Coordinates: file.Coordinates{
+					RealPath: "/var/lib/thing",
+				},
+				Reason: fmt.Errorf(`prefix path="/var/lib/thing" suffix`),
+			},
+		},
+		{
+			errorText: `prefix path="/var/lib/thing"`,
+			expected: &CoordinateError{
+				Coordinates: file.Coordinates{
+					RealPath: "/var/lib/thing",
+				},
+				Reason: fmt.Errorf(`prefix path="/var/lib/thing"`),
+			},
+		},
+		{
+			errorText: `path="/var/lib/thing" suffix`,
+			expected: &CoordinateError{
+				Coordinates: file.Coordinates{
+					RealPath: "/var/lib/thing",
+				},
+				Reason: fmt.Errorf(`path="/var/lib/thing" suffix`),
+			},
+		},
+		{
+			errorText: "all your base are belong to us",
+			expected:  nil,
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.errorText, func(t *testing.T) {
+			got := ProcessPathErrors(fmt.Errorf("%s", test.errorText))
+			require.Equal(t, test.expected, got)
+		})
+	}
+}
@@ -1,6 +1,6 @@
 {
  "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "$id": "anchore.io/schema/syft/json/16.0.18/document",
+  "$id": "anchore.io/schema/syft/json/16.0.19/document",
  "$ref": "#/$defs/Document",
  "$defs": {
    "AlpmDbEntry": {
@@ -1610,6 +1610,9 @@
        "purl": {
          "type": "string"
        },
+        "dependencies": {
+          "type": "string"
+        },
        "metadataType": {
          "type": "string"
        },
@@ -1773,7 +1776,8 @@
        "licenses",
        "language",
        "cpes",
-        "purl"
+        "purl",
+        "dependencies"
      ]
    },
    "PhpComposerAuthors": {
@@ -9,6 +9,7 @@ import (
 	"github.com/scylladb/go-set/strset"

 	"github.com/anchore/syft/internal/bus"
+	"github.com/anchore/syft/internal/licenses"
 	"github.com/anchore/syft/internal/sbomsync"
 	"github.com/anchore/syft/internal/task"
 	"github.com/anchore/syft/syft/artifact"
@@ -60,6 +61,9 @@ func CreateSBOM(ctx context.Context, src source.Source, cfg *CreateSBOMConfig) (
 		},
 	}

+	// inject a single license scanner for all package cataloging tasks into context
+	ctx = licenses.SetContextLicenseScanner(ctx, licenses.NewDefaultScanner())
+
 	catalogingProgress := monitorCatalogingTask(src.ID(), taskGroups)
 	packageCatalogingProgress := monitorPackageCatalogingTask()

@@ -121,7 +121,8 @@ func newDirectoryCatalog() *pkg.Collection {
 				},
 			},
 		},
-		PURL: "a-purl-2", // intentionally a bad pURL for test fixtures
+		PURL:         "a-purl-2", // intentionally a bad pURL for test fixtures
+		Dependencies: pkg.CompleteDependencies,
 		CPEs: []cpe.CPE{
 			cpe.Must("cpe:2.3:*:some:package:2:*:*:*:*:*:*:*", cpe.Source("")),
 		},
@@ -138,7 +139,8 @@ func newDirectoryCatalog() *pkg.Collection {
 			Package: "package-2",
 			Version: "2.0.1",
 		},
-		PURL: "pkg:deb/debian/package-2@2.0.1",
+		PURL:         "pkg:deb/debian/package-2@2.0.1",
+		Dependencies: pkg.CompleteDependencies,
 		CPEs: []cpe.CPE{
 			cpe.Must("cpe:2.3:*:some:package:2:*:*:*:*:*:*:*", cpe.Source("")),
 		},
@@ -163,6 +165,7 @@ func newDirectoryCatalogWithAuthorField() *pkg.Collection {
 		Licenses: pkg.NewLicenseSet(
 			pkg.NewLicense("MIT"),
 		),
+		Dependencies: pkg.CompleteDependencies,
 		Metadata: pkg.PythonPackage{
 			Name:    "package-1",
 			Version: "1.0.1",
@@ -190,7 +193,8 @@ func newDirectoryCatalogWithAuthorField() *pkg.Collection {
 			Package: "package-2",
 			Version: "2.0.1",
 		},
-		PURL: "pkg:deb/debian/package-2@2.0.1",
+		Dependencies: pkg.CompleteDependencies,
+		PURL:         "pkg:deb/debian/package-2@2.0.1",
 		CPEs: []cpe.CPE{
 			cpe.Must("cpe:2.3:*:some:package:2:*:*:*:*:*:*:*", "another-test-source"),
 		},
@@ -117,7 +117,8 @@ func populateImageCatalog(catalog *pkg.Collection, img *image.Image) {
 				Name:    "package-1",
 				Version: "1.0.1",
 			},
-			PURL: "a-purl-1", // intentionally a bad pURL for test fixtures
+			PURL:         "a-purl-1", // intentionally a bad pURL for test fixtures
+			Dependencies: pkg.CompleteDependencies,
 			CPEs: []cpe.CPE{
 				cpe.Must("cpe:2.3:*:some:package:1:*:*:*:*:*:*:*", cpe.GeneratedSource),
 			},
@@ -137,7 +138,8 @@ func populateImageCatalog(catalog *pkg.Collection, img *image.Image) {
 				Package: "package-2",
 				Version: "2.0.1",
 			},
-			PURL: "pkg:deb/debian/package-2@2.0.1",
+			PURL:         "pkg:deb/debian/package-2@2.0.1",
+			Dependencies: pkg.CompleteDependencies,
 			CPEs: []cpe.CPE{
 				cpe.Must("cpe:2.3:*:some:package:2:*:*:*:*:*:*:*", cpe.NVDDictionaryLookupSource),
 			},
@@ -141,10 +141,11 @@ func TestEncodeFullJSONDocument(t *testing.T) {
 				RealPath: "/a/place/a",
 			}),
 		),
-		Type:     pkg.PythonPkg,
-		FoundBy:  "the-cataloger-1",
-		Language: pkg.Python,
-		Licenses: pkg.NewLicenseSet(pkg.NewLicense("MIT")),
+		Type:         pkg.PythonPkg,
+		FoundBy:      "the-cataloger-1",
+		Language:     pkg.Python,
+		Licenses:     pkg.NewLicenseSet(pkg.NewLicense("MIT")),
+		Dependencies: pkg.CompleteDependencies,
 		Metadata: pkg.PythonPackage{
 			Name:    "package-1",
 			Version: "1.0.1",
@@ -164,8 +165,9 @@ func TestEncodeFullJSONDocument(t *testing.T) {
 				RealPath: "/b/place/b",
 			}),
 		),
-		Type:    pkg.DebPkg,
-		FoundBy: "the-cataloger-2",
+		Type:         pkg.DebPkg,
+		FoundBy:      "the-cataloger-2",
+		Dependencies: pkg.CompleteDependencies,
 		Metadata: pkg.DpkgDBEntry{
 			Package: "package-2",
 			Version: "2.0.1",
@@ -24,16 +24,17 @@ type Package struct {

 // PackageBasicData contains non-ambiguous values (type-wise) from pkg.Package.
 type PackageBasicData struct {
-	ID        string          `json:"id"`
-	Name      string          `json:"name"`
-	Version   string          `json:"version"`
-	Type      pkg.Type        `json:"type"`
-	FoundBy   string          `json:"foundBy"`
-	Locations []file.Location `json:"locations"`
-	Licenses  licenses        `json:"licenses"`
-	Language  pkg.Language    `json:"language"`
-	CPEs      cpes            `json:"cpes"`
-	PURL      string          `json:"purl"`
+	ID           string                     `json:"id"`
+	Name         string                     `json:"name"`
+	Version      string                     `json:"version"`
+	Type         pkg.Type                   `json:"type"`
+	FoundBy      string                     `json:"foundBy"`
+	Locations    []file.Location            `json:"locations"`
+	Licenses     licenses                   `json:"licenses"`
+	Language     pkg.Language               `json:"language"`
+	CPEs         cpes                       `json:"cpes"`
+	PURL         string                     `json:"purl"`
+	Dependencies pkg.DependencyCompleteness `json:"dependencies"`
 }

 type cpes []CPE
@@ -28,6 +28,7 @@
    }
   ],
   "purl": "a-purl-2",
+   "dependencies": "complete",
   "metadataType": "python-package",
   "metadata": {
    "name": "package-1",
@@ -63,6 +64,7 @@
    }
   ],
   "purl": "pkg:deb/debian/package-2@2.0.1",
+   "dependencies": "complete",
   "metadataType": "dpkg-db-entry",
   "metadata": {
    "package": "package-2",
@@ -29,6 +29,7 @@
    }
   ],
   "purl": "a-purl-1",
+   "dependencies": "complete",
   "metadataType": "python-package",
   "metadata": {
    "name": "package-1",
@@ -60,6 +61,7 @@
    }
   ],
   "purl": "a-purl-2",
+   "dependencies": "complete",
   "metadataType": "dpkg-db-entry",
   "metadata": {
    "package": "package-2",
@@ -30,6 +30,7 @@
    }
   ],
   "purl": "a-purl-1",
+   "dependencies": "complete",
   "metadataType": "python-package",
   "metadata": {
    "name": "package-1",
@@ -62,6 +63,7 @@
    }
   ],
   "purl": "pkg:deb/debian/package-2@2.0.1",
+   "dependencies": "complete",
   "metadataType": "dpkg-db-entry",
   "metadata": {
    "package": "package-2",
@@ -259,16 +259,17 @@ func toPackageModel(p pkg.Package, cfg EncoderConfig) model.Package {

 	return model.Package{
 		PackageBasicData: model.PackageBasicData{
-			ID:        string(p.ID()),
-			Name:      p.Name,
-			Version:   p.Version,
-			Type:      p.Type,
-			FoundBy:   p.FoundBy,
-			Locations: p.Locations.ToSlice(),
-			Licenses:  licenses,
-			Language:  p.Language,
-			CPEs:      cpes,
-			PURL:      p.PURL,
+			ID:           string(p.ID()),
+			Name:         p.Name,
+			Version:      p.Version,
+			Type:         p.Type,
+			FoundBy:      p.FoundBy,
+			Locations:    p.Locations.ToSlice(),
+			Licenses:     licenses,
+			Language:     p.Language,
+			CPEs:         cpes,
+			PURL:         p.PURL,
+			Dependencies: p.Dependencies,
 		},
 		PackageCustomData: model.PackageCustomData{
 			MetadataType: metadataType(p.Metadata, cfg.Legacy),
@@ -338,16 +338,17 @@ func toSyftPackage(p model.Package, idAliases map[string]string) pkg.Package {
 	}

 	out := pkg.Package{
-		Name:      p.Name,
-		Version:   p.Version,
-		FoundBy:   p.FoundBy,
-		Locations: file.NewLocationSet(p.Locations...),
-		Licenses:  pkg.NewLicenseSet(toSyftLicenses(p.Licenses)...),
-		Language:  p.Language,
-		Type:      p.Type,
-		CPEs:      cpes,
-		PURL:      p.PURL,
-		Metadata:  p.Metadata,
+		Name:         p.Name,
+		Version:      p.Version,
+		FoundBy:      p.FoundBy,
+		Locations:    file.NewLocationSet(p.Locations...),
+		Licenses:     pkg.NewLicenseSet(toSyftLicenses(p.Licenses)...),
+		Language:     p.Language,
+		Type:         p.Type,
+		CPEs:         cpes,
+		PURL:         p.PURL,
+		Dependencies: p.Dependencies,
+		Metadata:     p.Metadata,
 	}

 	// we don't know if this package ID is truly unique, however, we need to trust the user input in case there are
@@ -23,7 +23,8 @@ func TestApkDBCataloger(t *testing.T) {
 		Licenses: pkg.NewLicenseSet(
 			pkg.NewLicenseFromLocations("GPL-3.0-or-later", dbLocation),
 		),
-		Locations: file.NewLocationSet(dbLocation),
+		Locations:    file.NewLocationSet(dbLocation),
+		Dependencies: pkg.CompleteDependencies,
 		Metadata: pkg.ApkDBEntry{
 			Package:       "bash",
 			OriginPackage: "bash",
@@ -52,7 +53,8 @@ func TestApkDBCataloger(t *testing.T) {
 		Licenses: pkg.NewLicenseSet(
 			pkg.NewLicenseFromLocations("GPL-2.0-only", dbLocation),
 		),
-		Locations: file.NewLocationSet(dbLocation),
+		Locations:    file.NewLocationSet(dbLocation),
+		Dependencies: pkg.CompleteDependencies,
 		Metadata: pkg.ApkDBEntry{
 			Package:       "busybox-binsh",
 			OriginPackage: "busybox",
@@ -81,7 +83,8 @@ func TestApkDBCataloger(t *testing.T) {
 		Licenses: pkg.NewLicenseSet(
 			pkg.NewLicenseFromLocations("MIT", dbLocation),
 		),
-		Locations: file.NewLocationSet(dbLocation),
+		Locations:    file.NewLocationSet(dbLocation),
+		Dependencies: pkg.CompleteDependencies,
 		Metadata: pkg.ApkDBEntry{
 			Package:       "musl",
 			OriginPackage: "musl",
@@ -108,7 +111,8 @@ func TestApkDBCataloger(t *testing.T) {
 		Licenses: pkg.NewLicenseSet(
 			pkg.NewLicenseFromLocations("GPL-2.0-or-later", dbLocation),
 		),
-		Locations: file.NewLocationSet(dbLocation),
+		Locations:    file.NewLocationSet(dbLocation),
+		Dependencies: pkg.CompleteDependencies,
 		Metadata: pkg.ApkDBEntry{
 			Package:       "readline",
 			OriginPackage: "readline",
@@ -20,13 +20,14 @@ func newPackage(d parsedData, release *linux.Release, dbLocation file.Location)
 	}

 	p := pkg.Package{
-		Name:      d.Package,
-		Version:   d.Version,
-		Locations: file.NewLocationSet(dbLocation.WithAnnotation(pkg.EvidenceAnnotationKey, pkg.PrimaryEvidenceAnnotation)),
-		Licenses:  pkg.NewLicenseSet(pkg.NewLicensesFromLocation(dbLocation, licenseStrings...)...),
-		PURL:      packageURL(d.ApkDBEntry, release),
-		Type:      pkg.ApkPkg,
-		Metadata:  d.ApkDBEntry,
+		Name:         d.Package,
+		Version:      d.Version,
+		Locations:    file.NewLocationSet(dbLocation.WithAnnotation(pkg.EvidenceAnnotationKey, pkg.PrimaryEvidenceAnnotation)),
+		Licenses:     pkg.NewLicenseSet(pkg.NewLicensesFromLocation(dbLocation, licenseStrings...)...),
+		PURL:         packageURL(d.ApkDBEntry, release),
+		Type:         pkg.ApkPkg,
+		Dependencies: pkg.CompleteDependencies,
+		Metadata:     d.ApkDBEntry,
 	}

 	p.SetID()
@@ -112,7 +112,7 @@ func Test_PackageURL(t *testing.T) {
 				ID:        "alpine",
 				VersionID: "3.4.6",
 			},
-			expected: "pkg:apk/alpine/p@v?arch=a&upstream=origin&distro=alpine-3.4.6",
+			expected: "pkg:apk/alpine/p@v?arch=a&distro=alpine-3.4.6&upstream=origin",
 		},
 		{
 			name: "wolfi distro",
@@ -90,7 +90,8 @@ func TestSinglePackageDetails(t *testing.T) {
 					pkg.NewLicense("BSD"),
 					pkg.NewLicense("GPL2+"),
 				),
-				Type: pkg.ApkPkg,
+				Type:         pkg.ApkPkg,
+				Dependencies: pkg.CompleteDependencies,
 				Metadata: pkg.ApkDBEntry{
 					Package:       "musl-utils",
 					OriginPackage: "musl",
@@ -177,7 +178,8 @@ func TestSinglePackageDetails(t *testing.T) {
 				Licenses: pkg.NewLicenseSet(
 					pkg.NewLicense("GPL-2.0-only"),
 				),
-				Type: pkg.ApkPkg,
+				Type:         pkg.ApkPkg,
+				Dependencies: pkg.CompleteDependencies,
 				Metadata: pkg.ApkDBEntry{
 					Package:       "alpine-baselayout-data",
 					OriginPackage: "alpine-baselayout",
@@ -221,8 +223,8 @@ func TestSinglePackageDetails(t *testing.T) {
 				Licenses: pkg.NewLicenseSet(
 					pkg.NewLicense("GPL-2.0-only"),
 				),
-				Type: pkg.ApkPkg,
-				PURL: "",
+				Type:         pkg.ApkPkg,
+				Dependencies: pkg.CompleteDependencies,
 				Metadata: pkg.ApkDBEntry{
 					Package:       "alpine-baselayout",
 					OriginPackage: "alpine-baselayout",
@@ -34,7 +34,8 @@ func TestAlpmCataloger(t *testing.T) {
 		Licenses: pkg.NewLicenseSet(
 			pkg.NewLicenseFromLocations("MIT", treeSitterDbLocation),
 		),
-		Locations: file.NewLocationSet(treeSitterDbLocation),
+		Locations:    file.NewLocationSet(treeSitterDbLocation),
+		Dependencies: pkg.CompleteDependencies,
 		Metadata: pkg.AlpmDBEntry{
 			BasePackage:  "tree-sitter",
 			Package:      "tree-sitter",
@@ -60,7 +61,8 @@ func TestAlpmCataloger(t *testing.T) {
 		Licenses: pkg.NewLicenseSet(
 			pkg.NewLicenseFromLocations("GPL3", emacsDbLocation),
 		),
-		Locations: file.NewLocationSet(emacsDbLocation),
+		Locations:    file.NewLocationSet(emacsDbLocation),
+		Dependencies: pkg.CompleteDependencies,
 		Metadata: pkg.AlpmDBEntry{
 			BasePackage:  "emacs",
 			Package:      "emacs",
@@ -86,6 +88,7 @@ func TestAlpmCataloger(t *testing.T) {
 			fuzzyDbLocation,
 			file.NewLocation("var/lib/pacman/local/fuzzy-1.2-3/files"),
 		),
+		Dependencies: pkg.CompleteDependencies,
 		Metadata: pkg.AlpmDBEntry{
 			Package: "fuzzy",
 			Version: "1.2-3",
@@ -103,11 +106,12 @@ func TestAlpmCataloger(t *testing.T) {
 	}

 	madeupPkg := pkg.Package{
-		Name:      "madeup",
-		Version:   "20.30-4",
-		Type:      pkg.AlpmPkg,
-		FoundBy:   "alpm-db-cataloger",
-		Locations: file.NewLocationSet(madeupDbLocation),
+		Name:         "madeup",
+		Version:      "20.30-4",
+		Type:         pkg.AlpmPkg,
+		FoundBy:      "alpm-db-cataloger",
+		Locations:    file.NewLocationSet(madeupDbLocation),
+		Dependencies: pkg.CompleteDependencies,
 		Metadata: pkg.AlpmDBEntry{
 			Package: "madeup",
 			Version: "20.30-4",
@@ -131,6 +135,7 @@ func TestAlpmCataloger(t *testing.T) {
 			file.NewLocation("var/lib/pacman/local/gmp-6.2.1-2/files"),
 			file.NewLocation("var/lib/pacman/local/gmp-6.2.1-2/mtree"),
 		),
+		Dependencies: pkg.CompleteDependencies,
 		Metadata: pkg.AlpmDBEntry{
 			BasePackage:  "gmp",
 			Package:      "gmp",
@@ -16,13 +16,14 @@ func newPackage(m *parsedData, release *linux.Release, dbLocation file.Location,
 	locs.Add(otherLocations...)

 	p := pkg.Package{
-		Name:      m.Package,
-		Version:   m.Version,
-		Locations: locs,
-		Licenses:  pkg.NewLicenseSet(pkg.NewLicensesFromLocation(dbLocation.WithoutAnnotations(), licenseCandidates...)...),
-		Type:      pkg.AlpmPkg,
-		PURL:      packageURL(m, release),
-		Metadata:  m.AlpmDBEntry,
+		Name:         m.Package,
+		Version:      m.Version,
+		Locations:    locs,
+		Licenses:     pkg.NewLicenseSet(pkg.NewLicensesFromLocation(dbLocation.WithoutAnnotations(), licenseCandidates...)...),
+		Type:         pkg.AlpmPkg,
+		PURL:         packageURL(m, release),
+		Dependencies: pkg.CompleteDependencies,
+		Metadata:     m.AlpmDBEntry,
 	}
 	p.SetID()

@@ -108,7 +108,7 @@ func Test_PackageURL(t *testing.T) {
 				ID:      "arch",
 				BuildID: "rolling",
 			},
-			expected: "pkg:alpm/arch/p@v?arch=a&upstream=origin&distro=arch-rolling",
+			expected: "pkg:alpm/arch/p@v?arch=a&distro=arch-rolling&upstream=origin",
 		},
 	}

@@ -105,6 +105,7 @@ func catalog(resolver file.Resolver, cls Classifier) (packages []pkg.Package, er
 	var errs error
 	locations, err := resolver.FilesByGlob(cls.FileGlob)
 	if err != nil {
+		err = unknown.ProcessPathErrors(err) // convert any file.Resolver path errors to unknowns with locations
 		return nil, err
 	}
 	for _, location := range locations {
@@ -1668,7 +1668,7 @@ func Test_Cataloger_ResilientToErrors(t *testing.T) {

 	resolver := &panicyResolver{}
 	_, _, err := c.Catalog(context.Background(), resolver)
-	assert.Error(t, err)
+	assert.Nil(t, err) // non-coordinate-based FindBy* errors are now logged and not returned
 	assert.True(t, resolver.searchCalled)
 }

@@ -35,6 +35,9 @@ func newClassifierPackage(classifier Classifier, location file.Location, matchMe
 		Type:    pkg.BinaryPkg,
 		CPEs:    cpes,
 		FoundBy: catalogerName,
+		// classifiers are limited to identifying package identities, but have no information about dependencies.
+		// Furthermore, we have no understanding about the mechanisms for dependency resolution for these packages.
+		Dependencies: pkg.UnknownDependencyCompleteness,
 		Metadata: pkg.BinarySignature{
 			Matches: []pkg.ClassifierMatch{
 				{
@@ -158,7 +158,7 @@ func DefaultClassifiers() []Classifier {
 				// [NUL]v0.12.18[NUL]
 				// [NUL]v4.9.1[NUL]
 				// node.js/v22.9.0
-				FileContentsVersionMatcher(`(?m)\x00(node )?v(?P<version>(0|4|5)\.[0-9]+\.[0-9]+)\x00`),
+				FileContentsVersionMatcher(`(?m)\x00(node )?v(?P<version>(0|4|5|6)\.[0-9]+\.[0-9]+)\x00`),
 				FileContentsVersionMatcher(`(?m)node\.js\/v(?P<version>[0-9]+\.[0-9]+\.[0-9]+)`),
 			),
 			Package: "node",
@@ -351,7 +351,7 @@ func DefaultClassifiers() []Classifier {
 		},
 		{
 			Class:    "mariadb-binary",
-			FileGlob: "**/mariadb",
+			FileGlob: "**/{mariadb,mysql}",
 			EvidenceMatcher: FileContentsVersionMatcher(
 				// 10.6.15-MariaDB
 				`(?m)(?P<version>[0-9]+(\.[0-9]+)?(\.[0-9]+)?(alpha[0-9]|beta[0-9]|rc[0-9])?)-MariaDB`),
@@ -16,7 +16,10 @@ func newELFPackage(metadata elfBinaryPackageNotes, locations file.LocationSet) p
 		PURL:      packageURL(metadata),
 		Type:      pkgType(metadata.Type),
 		Locations: locations,
-		Metadata:  metadata.ELFBinaryPackageNoteJSONPayload,
+		// though we can look for shared libs, we cannot see static dependencies nor dynamic dependencies using dlopen.
+		// this means that, even in cases where the dep info is actually complete, we can't programmatically determine that.
+		Dependencies: pkg.UnknownDependencyCompleteness,
+		Metadata:     metadata.ELFBinaryPackageNoteJSONPayload,
 	}

 	p.SetID()
@@ -27,19 +30,7 @@ func newELFPackage(metadata elfBinaryPackageNotes, locations file.LocationSet) p
 func packageURL(metadata elfBinaryPackageNotes) string {
 	var qualifiers []packageurl.Qualifier

-	os := metadata.OS
-	osVersion := metadata.OSVersion
-
-	var atts cpe.Attributes
-	atts, err := cpe.NewAttributes(metadata.OSCPE)
-	if err != nil {
-		log.WithFields("error", err).Warn("unable to parse cpe attributes for elf binary package")
-	}
-	// only "upgrade" the OS information if there is something more specific to use in it's place
-	if os == "" && osVersion == "" || os == "" && atts.Version != "" || atts.Product != "" && osVersion == "" {
-		os = atts.Product
-		osVersion = atts.Version
-	}
+	os, osVersion := osNameAndVersionFromMetadata(metadata)

 	if os != "" {
 		osQualifier := os
@@ -70,6 +61,26 @@ func packageURL(metadata elfBinaryPackageNotes) string {
 	).ToString()
 }

+func osNameAndVersionFromMetadata(metadata elfBinaryPackageNotes) (string, string) {
+	os := metadata.OS
+	osVersion := metadata.OSVersion
+
+	if os != "" && osVersion != "" {
+		return os, osVersion
+	}
+
+	if metadata.OSCPE == "" {
+		return "", ""
+	}
+
+	attrs, err := cpe.NewAttributes(metadata.OSCPE)
+	if err != nil {
+		log.WithFields("error", err).Trace("unable to parse cpe attributes for elf binary package")
+		return "", ""
+	}
+	return attrs.Product, attrs.Version
+}
+
 const alpmType = "alpm"

 func purlDistroType(ty string) string {
@@ -35,7 +35,8 @@ func Test_ELF_Package_Cataloger(t *testing.T) {
 						pkg.License{Value: "MIT", SPDXExpression: "MIT", Type: "declared"},
 					),

-					Type: pkg.BinaryPkg,
+					Type:         pkg.BinaryPkg,
+					Dependencies: pkg.UnknownDependencyCompleteness,
 					Metadata: pkg.ELFBinaryPackageNoteJSONPayload{
 						Type:       "testfixture",
 						Vendor:     "syft",
@@ -56,7 +57,8 @@ func Test_ELF_Package_Cataloger(t *testing.T) {
 					Licenses: pkg.NewLicenseSet(
 						pkg.License{Value: "MIT", SPDXExpression: "MIT", Type: "declared"},
 					),
-					Type: pkg.BinaryPkg,
+					Type:         pkg.BinaryPkg,
+					Dependencies: pkg.UnknownDependencyCompleteness,
 					Metadata: pkg.ELFBinaryPackageNoteJSONPayload{
 						Type:       "testfixture",
 						Vendor:     "syft",
@@ -80,8 +82,9 @@ func Test_ELF_Package_Cataloger(t *testing.T) {
 						file.NewLocation("/sha256sum").WithAnnotation(pkg.EvidenceAnnotationKey, pkg.PrimaryEvidenceAnnotation),
 						file.NewLocation("/sha1sum").WithAnnotation(pkg.EvidenceAnnotationKey, pkg.PrimaryEvidenceAnnotation),
 					),
-					Licenses: pkg.NewLicenseSet(),
-					Type:     pkg.RpmPkg,
+					Licenses:     pkg.NewLicenseSet(),
+					Type:         pkg.RpmPkg,
+					Dependencies: pkg.UnknownDependencyCompleteness,
 					Metadata: pkg.ELFBinaryPackageNoteJSONPayload{
 						Type:         "rpm",
 						Architecture: "x86_64",
@@ -102,8 +105,9 @@ func Test_ELF_Package_Cataloger(t *testing.T) {
 						file.NewLocation("/sha256sum").WithAnnotation(pkg.EvidenceAnnotationKey, pkg.PrimaryEvidenceAnnotation),
 						file.NewLocation("/sha1sum").WithAnnotation(pkg.EvidenceAnnotationKey, pkg.PrimaryEvidenceAnnotation),
 					),
-					Licenses: pkg.NewLicenseSet(),
-					Type:     pkg.RpmPkg,
+					Licenses:     pkg.NewLicenseSet(),
+					Type:         pkg.RpmPkg,
+					Dependencies: pkg.UnknownDependencyCompleteness,
 					Metadata: pkg.ELFBinaryPackageNoteJSONPayload{
 						Type:         "rpm",
 						Architecture: "arm",
@@ -154,10 +154,11 @@ func Test_newELFPackage(t *testing.T) {
 			},

 			expected: pkg.Package{
-				Name:    "syfttestfixture",
-				Version: "0.01",
-				Type:    "binary",
-				PURL:    "pkg:generic/syftsys/syfttestfixture@0.01",
+				Name:         "syfttestfixture",
+				Version:      "0.01",
+				Type:         "binary",
+				PURL:         "pkg:generic/syftsys/syfttestfixture@0.01",
+				Dependencies: pkg.UnknownDependencyCompleteness,
 				Metadata: pkg.ELFBinaryPackageNoteJSONPayload{
 					Type:   "binary",
 					System: "syftsys",
@@ -67,35 +67,43 @@ func splitConanRef(ref string) *conanRef {
 }

 func newConanfilePackage(m pkg.ConanfileEntry, locations ...file.Location) *pkg.Package {
-	return newConanPackage(m.Ref, m, locations...)
+	// though a conanfile is a listing of direct dependencies, we are not capturing these today, so are forced to answer unknown
+	return newConanPackage(m.Ref, m, pkg.UnknownDependencyCompleteness, locations...)
 }

-func newConanlockPackage(m pkg.ConanV1LockEntry, locations ...file.Location) *pkg.Package {
-	return newConanPackage(m.Ref, m, locations...)
+func newConanlockV1Package(m pkg.ConanV1LockEntry, locations ...file.Location) *pkg.Package {
+	// conan.lock is primarily used to lock the dependency graph at specific versions to ensure consistent builds,
+	// and the dependency tree can be inferred from the contents (distinguishing between direct and transitive dependencies)
+	return newConanPackage(m.Ref, m, pkg.CompleteDependencies, locations...)
 }

-func newConanReferencePackage(m pkg.ConanV2LockEntry, locations ...file.Location) *pkg.Package {
-	return newConanPackage(m.Ref, m, locations...)
+func newConanLockv2Package(m pkg.ConanV2LockEntry, locations ...file.Location) *pkg.Package {
+	// conan.lock is primarily used to lock the dependency graph at specific versions to ensure consistent builds,
+	// and the dependency tree can be inferred from the contents (distinguishing between direct and transitive dependencies)
+	return newConanPackage(m.Ref, m, pkg.CompleteDependencies, locations...)
 }

 func newConaninfoPackage(m pkg.ConaninfoEntry, locations ...file.Location) *pkg.Package {
-	return newConanPackage(m.Ref, m, locations...)
+	// conaninfo.txt is generated during the build and contains detailed information about the entire dependency tree,
+	// and today the codebase does infer direct dependencies from this source
+	return newConanPackage(m.Ref, m, pkg.CompleteDependencies, locations...)
 }

-func newConanPackage(refStr string, metadata any, locations ...file.Location) *pkg.Package {
+func newConanPackage(refStr string, metadata any, dep pkg.DependencyCompleteness, locations ...file.Location) *pkg.Package {
 	ref := splitConanRef(refStr)
 	if ref == nil {
 		return nil
 	}

 	p := pkg.Package{
-		Name:      ref.Name,
-		Version:   ref.Version,
-		Locations: file.NewLocationSet(locations...),
-		PURL:      packageURL(ref),
-		Language:  pkg.CPP,
-		Type:      pkg.ConanPkg,
-		Metadata:  metadata,
+		Name:         ref.Name,
+		Version:      ref.Version,
+		Locations:    file.NewLocationSet(locations...),
+		PURL:         packageURL(ref),
+		Language:     pkg.CPP,
+		Type:         pkg.ConanPkg,
+		Dependencies: dep,
+		Metadata:     metadata,
 	}

 	p.SetID()
@@ -22,11 +22,12 @@ func parseConanfile(_ context.Context, _ file.Resolver, _ *generic.Environment,
 	r := bufio.NewReader(reader)
 	inRequirements := false
 	var pkgs []pkg.Package
+loop:
 	for {
 		line, err := r.ReadString('\n')
 		switch {
 		case errors.Is(err, io.EOF):
-			return pkgs, nil, unknown.IfEmptyf(pkgs, "unable to determine packages")
+			break loop
 		case err != nil:
 			return nil, nil, fmt.Errorf("failed to parse conanfile.txt file: %w", err)
 		}
@@ -56,4 +57,5 @@ func parseConanfile(_ context.Context, _ file.Resolver, _ *generic.Environment,

 		pkgs = append(pkgs, *p)
 	}
+	return pkgs, nil, unknown.IfEmptyf(pkgs, "unable to determine packages")
 }
@@ -14,67 +14,73 @@ func TestParseConanfile(t *testing.T) {
 	fixtureLocationSet := file.NewLocationSet(file.NewLocation(fixture))
 	expected := []pkg.Package{
 		{
-			Name:      "catch2",
-			Version:   "2.13.8",
-			PURL:      "pkg:conan/catch2@2.13.8",
-			Locations: fixtureLocationSet,
-			Language:  pkg.CPP,
-			Type:      pkg.ConanPkg,
+			Name:         "catch2",
+			Version:      "2.13.8",
+			PURL:         "pkg:conan/catch2@2.13.8",
+			Locations:    fixtureLocationSet,
+			Language:     pkg.CPP,
+			Type:         pkg.ConanPkg,
+			Dependencies: pkg.UnknownDependencyCompleteness,
 			Metadata: pkg.ConanfileEntry{
 				Ref: "catch2/2.13.8",
 			},
 		},
 		{
-			Name:      "docopt.cpp",
-			Version:   "0.6.3",
-			PURL:      "pkg:conan/docopt.cpp@0.6.3",
-			Locations: fixtureLocationSet,
-			Language:  pkg.CPP,
-			Type:      pkg.ConanPkg,
+			Name:         "docopt.cpp",
+			Version:      "0.6.3",
+			PURL:         "pkg:conan/docopt.cpp@0.6.3",
+			Locations:    fixtureLocationSet,
+			Language:     pkg.CPP,
+			Type:         pkg.ConanPkg,
+			Dependencies: pkg.UnknownDependencyCompleteness,
 			Metadata: pkg.ConanfileEntry{
 				Ref: "docopt.cpp/0.6.3",
 			},
 		},
 		{
-			Name:      "fmt",
-			Version:   "8.1.1",
-			PURL:      "pkg:conan/fmt@8.1.1",
-			Locations: fixtureLocationSet,
-			Language:  pkg.CPP,
-			Type:      pkg.ConanPkg,
+			Name:         "fmt",
+			Version:      "8.1.1",
+			PURL:         "pkg:conan/fmt@8.1.1",
+			Locations:    fixtureLocationSet,
+			Language:     pkg.CPP,
+			Type:         pkg.ConanPkg,
+			Dependencies: pkg.UnknownDependencyCompleteness,
 			Metadata: pkg.ConanfileEntry{
 				Ref: "fmt/8.1.1",
 			},
 		},
 		{
-			Name:      "spdlog",
-			Version:   "1.9.2",
-			PURL:      "pkg:conan/my_user/spdlog@1.9.2?channel=my_channel",
-			Locations: fixtureLocationSet,
-			Language:  pkg.CPP,
-			Type:      pkg.ConanPkg,
+			Name:         "spdlog",
+			Version:      "1.9.2",
+			PURL:         "pkg:conan/my_user/spdlog@1.9.2?channel=my_channel",
+			Locations:    fixtureLocationSet,
+			Language:     pkg.CPP,
+			Type:         pkg.ConanPkg,
+			Dependencies: pkg.UnknownDependencyCompleteness,
 			Metadata: pkg.ConanfileEntry{
 				Ref: "spdlog/1.9.2@my_user/my_channel#1234567%%987654",
 			},
 		},
 		{
-			Name:      "sdl",
-			Version:   "2.0.20",
-			PURL:      "pkg:conan/sdl@2.0.20",
-			Locations: fixtureLocationSet,
-			Language:  pkg.CPP,
-			Type:      pkg.ConanPkg,
+			Name:         "sdl",
+			Version:      "2.0.20",
+			PURL:         "pkg:conan/sdl@2.0.20",
+			Locations:    fixtureLocationSet,
+			Language:     pkg.CPP,
+			Type:         pkg.ConanPkg,
+			Dependencies: pkg.UnknownDependencyCompleteness,
 			Metadata: pkg.ConanfileEntry{
 				Ref: "sdl/2.0.20#1234567%%987654",
 			},
 		},
 		{
-			Name:      "fltk",
-			Version:   "1.3.8",
-			PURL:      "pkg:conan/my_user/fltk@1.3.8?channel=my_channel",
-			Locations: fixtureLocationSet,
-			Language:  pkg.CPP,
-			Type:      pkg.ConanPkg,
+			Name:         "fltk",
+			Version:      "1.3.8",
+			PURL:         "pkg:conan/my_user/fltk@1.3.8?channel=my_channel",
+			Locations:    fixtureLocationSet,
+			Language:     pkg.CPP,
+			Type:         pkg.ConanPkg,
+			Dependencies: pkg.UnknownDependencyCompleteness,
 			Metadata: pkg.ConanfileEntry{
 				Ref: "fltk/1.3.8@my_user/my_channel",
 			},
@@ -13,72 +13,78 @@ func TestParseConaninfo(t *testing.T) {
 	fixture := "test-fixtures/conaninfo/mfast/1.2.2/my_user/my_channel/package/9d1f076b471417647c2022a78d5e2c1f834289ac/conaninfo.txt"
 	expected := []pkg.Package{
 		{
-			Name:      "mfast",
-			Version:   "1.2.2",
-			PURL:      "pkg:conan/my_user/mfast@1.2.2?channel=my_channel",
-			Locations: file.NewLocationSet(file.NewLocation(fixture)),
-			Language:  pkg.CPP,
-			Type:      pkg.ConanPkg,
+			Name:         "mfast",
+			Version:      "1.2.2",
+			PURL:         "pkg:conan/my_user/mfast@1.2.2?channel=my_channel",
+			Locations:    file.NewLocationSet(file.NewLocation(fixture)),
+			Language:     pkg.CPP,
+			Type:         pkg.ConanPkg,
+			Dependencies: pkg.CompleteDependencies,
 			Metadata: pkg.ConaninfoEntry{
 				Ref:       "mfast/1.2.2@my_user/my_channel#c6f6387c9b99780f0ee05e25f99d0f39",
 				PackageID: "9d1f076b471417647c2022a78d5e2c1f834289ac",
 			},
 		},
 		{
-			Name:      "boost",
-			Version:   "1.75.0",
-			PURL:      "pkg:conan/boost@1.75.0",
-			Locations: file.NewLocationSet(file.NewLocation(fixture)),
-			Language:  pkg.CPP,
-			Type:      pkg.ConanPkg,
+			Name:         "boost",
+			Version:      "1.75.0",
+			PURL:         "pkg:conan/boost@1.75.0",
+			Locations:    file.NewLocationSet(file.NewLocation(fixture)),
+			Language:     pkg.CPP,
+			Type:         pkg.ConanPkg,
+			Dependencies: pkg.CompleteDependencies,
 			Metadata: pkg.ConaninfoEntry{
 				Ref:       "boost/1.75.0:dc8aedd23a0f0a773a5fcdcfe1ae3e89c4205978",
 				PackageID: "dc8aedd23a0f0a773a5fcdcfe1ae3e89c4205978",
 			},
 		},
 		{
-			Name:      "zlib",
-			Version:   "1.2.13",
-			PURL:      "pkg:conan/zlib@1.2.13",
-			Locations: file.NewLocationSet(file.NewLocation(fixture)),
-			Language:  pkg.CPP,
-			Type:      pkg.ConanPkg,
+			Name:         "zlib",
+			Version:      "1.2.13",
+			PURL:         "pkg:conan/zlib@1.2.13",
+			Locations:    file.NewLocationSet(file.NewLocation(fixture)),
+			Language:     pkg.CPP,
+			Type:         pkg.ConanPkg,
+			Dependencies: pkg.CompleteDependencies,
 			Metadata: pkg.ConaninfoEntry{
 				Ref:       "zlib/1.2.13:dfbe50feef7f3c6223a476cd5aeadb687084a646",
 				PackageID: "dfbe50feef7f3c6223a476cd5aeadb687084a646",
 			},
 		},
 		{
-			Name:      "bzip2",
-			Version:   "1.0.8",
-			PURL:      "pkg:conan/bzip2@1.0.8",
-			Locations: file.NewLocationSet(file.NewLocation(fixture)),
-			Language:  pkg.CPP,
-			Type:      pkg.ConanPkg,
+			Name:         "bzip2",
+			Version:      "1.0.8",
+			PURL:         "pkg:conan/bzip2@1.0.8",
+			Locations:    file.NewLocationSet(file.NewLocation(fixture)),
+			Language:     pkg.CPP,
+			Type:         pkg.ConanPkg,
+			Dependencies: pkg.CompleteDependencies,
 			Metadata: pkg.ConaninfoEntry{
 				Ref:       "bzip2/1.0.8:c32092bf4d4bb47cf962af898e02823f499b017e",
 				PackageID: "c32092bf4d4bb47cf962af898e02823f499b017e",
 			},
 		},
 		{
-			Name:      "libbacktrace",
-			Version:   "cci.20210118",
-			PURL:      "pkg:conan/libbacktrace@cci.20210118",
-			Locations: file.NewLocationSet(file.NewLocation(fixture)),
-			Language:  pkg.CPP,
-			Type:      pkg.ConanPkg,
+			Name:         "libbacktrace",
+			Version:      "cci.20210118",
+			PURL:         "pkg:conan/libbacktrace@cci.20210118",
+			Locations:    file.NewLocationSet(file.NewLocation(fixture)),
+			Language:     pkg.CPP,
+			Type:         pkg.ConanPkg,
+			Dependencies: pkg.CompleteDependencies,
 			Metadata: pkg.ConaninfoEntry{
 				Ref:       "libbacktrace/cci.20210118:dfbe50feef7f3c6223a476cd5aeadb687084a646",
 				PackageID: "dfbe50feef7f3c6223a476cd5aeadb687084a646",
 			},
 		},
 		{
-			Name:      "tinyxml2",
-			Version:   "9.0.0",
-			PURL:      "pkg:conan/tinyxml2@9.0.0",
-			Locations: file.NewLocationSet(file.NewLocation(fixture)),
-			Language:  pkg.CPP,
-			Type:      pkg.ConanPkg,
+			Name:         "tinyxml2",
+			Version:      "9.0.0",
+			PURL:         "pkg:conan/tinyxml2@9.0.0",
+			Locations:    file.NewLocationSet(file.NewLocation(fixture)),
+			Language:     pkg.CPP,
+			Type:         pkg.ConanPkg,
+			Dependencies: pkg.CompleteDependencies,
 			Metadata: pkg.ConaninfoEntry{
 				Ref:       "tinyxml2/9.0.0:6557f18ca99c0b6a233f43db00e30efaa525e27e",
 				PackageID: "6557f18ca99c0b6a233f43db00e30efaa525e27e",
@@ -89,7 +89,7 @@ func handleConanLockV1(cl conanLock, reader file.LocationReadCloser, parsedPkgRe
 			Prev:      node.Prev,
 		}

-		p := newConanlockPackage(
+		p := newConanlockV1Package(
 			metadata,
 			reader.Location.WithAnnotation(pkg.EvidenceAnnotationKey, pkg.PrimaryEvidenceAnnotation),
 		)
@@ -113,7 +113,7 @@ func handleConanLockV2(cl conanLock, reader file.LocationReadCloser, indexToPkgM
 			continue
 		}

-		p := newConanReferencePackage(
+		p := newConanLockv2Package(
 			reference,
 			reader.Location.WithAnnotation(pkg.EvidenceAnnotationKey, pkg.PrimaryEvidenceAnnotation),
 		)
@@ -13,12 +13,13 @@ func TestParseConanLock(t *testing.T) {
 	fixture := "test-fixtures/conan.lock"
 	expected := []pkg.Package{
 		{
-			Name:      "mfast",
-			Version:   "1.2.2",
-			PURL:      "pkg:conan/my_user/mfast@1.2.2?channel=my_channel",
-			Locations: file.NewLocationSet(file.NewLocation(fixture)),
-			Language:  pkg.CPP,
-			Type:      pkg.ConanPkg,
+			Name:         "mfast",
+			Version:      "1.2.2",
+			PURL:         "pkg:conan/my_user/mfast@1.2.2?channel=my_channel",
+			Locations:    file.NewLocationSet(file.NewLocation(fixture)),
+			Language:     pkg.CPP,
+			Type:         pkg.ConanPkg,
+			Dependencies: pkg.CompleteDependencies,
 			Metadata: pkg.ConanV1LockEntry{
 				Ref: "mfast/1.2.2@my_user/my_channel#c6f6387c9b99780f0ee05e25f99d0f39",
 				Options: pkg.KeyValues{
@@ -104,12 +105,13 @@ func TestParseConanLock(t *testing.T) {
 			},
 		},
 		{
-			Name:      "boost",
-			Version:   "1.75.0",
-			PURL:      "pkg:conan/boost@1.75.0",
-			Locations: file.NewLocationSet(file.NewLocation(fixture)),
-			Language:  pkg.CPP,
-			Type:      pkg.ConanPkg,
+			Name:         "boost",
+			Version:      "1.75.0",
+			PURL:         "pkg:conan/boost@1.75.0",
+			Locations:    file.NewLocationSet(file.NewLocation(fixture)),
+			Language:     pkg.CPP,
+			Type:         pkg.ConanPkg,
+			Dependencies: pkg.CompleteDependencies,
 			Metadata: pkg.ConanV1LockEntry{
 				Ref: "boost/1.75.0#a9c318f067216f900900e044e7af4ab1",
 				Options: pkg.KeyValues{
@@ -190,12 +192,13 @@ func TestParseConanLock(t *testing.T) {
 			},
 		},
 		{
-			Name:      "zlib",
-			Version:   "1.2.12",
-			PURL:      "pkg:conan/zlib@1.2.12",
-			Locations: file.NewLocationSet(file.NewLocation(fixture)),
-			Language:  pkg.CPP,
-			Type:      pkg.ConanPkg,
+			Name:         "zlib",
+			Version:      "1.2.12",
+			PURL:         "pkg:conan/zlib@1.2.12",
+			Locations:    file.NewLocationSet(file.NewLocation(fixture)),
+			Language:     pkg.CPP,
+			Type:         pkg.ConanPkg,
+			Dependencies: pkg.CompleteDependencies,
 			Metadata: pkg.ConanV1LockEntry{
 				Ref: "zlib/1.2.12#c67ce17f2e96b972d42393ce50a76a1a",
 				Options: pkg.KeyValues{
@@ -214,12 +217,13 @@ func TestParseConanLock(t *testing.T) {
 			},
 		},
 		{
-			Name:      "bzip2",
-			Version:   "1.0.8",
-			PURL:      "pkg:conan/bzip2@1.0.8",
-			Locations: file.NewLocationSet(file.NewLocation(fixture)),
-			Language:  pkg.CPP,
-			Type:      pkg.ConanPkg,
+			Name:         "bzip2",
+			Version:      "1.0.8",
+			PURL:         "pkg:conan/bzip2@1.0.8",
+			Locations:    file.NewLocationSet(file.NewLocation(fixture)),
+			Language:     pkg.CPP,
+			Type:         pkg.ConanPkg,
+			Dependencies: pkg.CompleteDependencies,
 			Metadata: pkg.ConanV1LockEntry{
 				Ref: "bzip2/1.0.8#62a8031289639043797cf53fa876d0ef",
 				Options: []pkg.KeyValue{
@@ -242,12 +246,13 @@ func TestParseConanLock(t *testing.T) {
 			},
 		},
 		{
-			Name:      "libbacktrace",
-			Version:   "cci.20210118",
-			PURL:      "pkg:conan/libbacktrace@cci.20210118",
-			Locations: file.NewLocationSet(file.NewLocation(fixture)),
-			Language:  pkg.CPP,
-			Type:      pkg.ConanPkg,
+			Name:         "libbacktrace",
+			Version:      "cci.20210118",
+			PURL:         "pkg:conan/libbacktrace@cci.20210118",
+			Locations:    file.NewLocationSet(file.NewLocation(fixture)),
+			Language:     pkg.CPP,
+			Type:         pkg.ConanPkg,
+			Dependencies: pkg.CompleteDependencies,
 			Metadata: pkg.ConanV1LockEntry{
 				Ref: "libbacktrace/cci.20210118#76e40b760e0bcd602d46db56b22820ab",
 				Options: []pkg.KeyValue{
@@ -266,12 +271,13 @@ func TestParseConanLock(t *testing.T) {
 			},
 		},
 		{
-			Name:      "tinyxml2",
-			Version:   "9.0.0",
-			PURL:      "pkg:conan/tinyxml2@9.0.0",
-			Locations: file.NewLocationSet(file.NewLocation(fixture)),
-			Language:  pkg.CPP,
-			Type:      pkg.ConanPkg,
+			Name:         "tinyxml2",
+			Version:      "9.0.0",
+			PURL:         "pkg:conan/tinyxml2@9.0.0",
+			Locations:    file.NewLocationSet(file.NewLocation(fixture)),
+			Language:     pkg.CPP,
+			Type:         pkg.ConanPkg,
+			Dependencies: pkg.CompleteDependencies,
 			Metadata: pkg.ConanV1LockEntry{
 				Ref: "tinyxml2/9.0.0#9f13a36ebfc222cd55fe531a0a8d94d1",
 				Options: []pkg.KeyValue{
@@ -337,12 +343,13 @@ func TestParseConanLockV2(t *testing.T) {
 	fixture := "test-fixtures/conanlock-v2/conan.lock"
 	expected := []pkg.Package{
 		{
-			Name:      "matrix",
-			Version:   "1.1",
-			PURL:      "pkg:conan/matrix@1.1",
-			Locations: file.NewLocationSet(file.NewLocation(fixture)),
-			Language:  pkg.CPP,
-			Type:      pkg.ConanPkg,
+			Name:         "matrix",
+			Version:      "1.1",
+			PURL:         "pkg:conan/matrix@1.1",
+			Locations:    file.NewLocationSet(file.NewLocation(fixture)),
+			Language:     pkg.CPP,
+			Type:         pkg.ConanPkg,
+			Dependencies: pkg.CompleteDependencies,
 			Metadata: pkg.ConanV2LockEntry{
 				Ref:            "matrix/1.1#905c3f0babc520684c84127378fefdd0%1675278901.7527816",
 				RecipeRevision: "905c3f0babc520684c84127378fefdd0",
@@ -350,12 +357,13 @@ func TestParseConanLockV2(t *testing.T) {
 			},
 		},
 		{
-			Name:      "sound32",
-			Version:   "1.0",
-			PURL:      "pkg:conan/sound32@1.0",
-			Locations: file.NewLocationSet(file.NewLocation(fixture)),
-			Language:  pkg.CPP,
-			Type:      pkg.ConanPkg,
+			Name:         "sound32",
+			Version:      "1.0",
+			PURL:         "pkg:conan/sound32@1.0",
+			Locations:    file.NewLocationSet(file.NewLocation(fixture)),
+			Language:     pkg.CPP,
+			Type:         pkg.ConanPkg,
+			Dependencies: pkg.CompleteDependencies,
 			Metadata: pkg.ConanV2LockEntry{
 				Ref:            "sound32/1.0#83d4b7bf607b3b60a6546f8b58b5cdd7%1675278904.0791488",
 				RecipeRevision: "83d4b7bf607b3b60a6546f8b58b5cdd7",
@@ -21,7 +21,9 @@ func newPubspecLockPackage(name string, raw pubspecLockPackage, locations ...fil
 		PURL:      packageURL(metadata),
 		Language:  pkg.Dart,
 		Type:      pkg.DartPubPkg,
-		Metadata:  metadata,
+		// since we capture no dependencies today we know that the dep info is unknown
+		Dependencies: pkg.UnknownDependencyCompleteness,
+		Metadata:     metadata,
 	}

 	p.SetID()
@@ -14,12 +14,13 @@ func TestParsePubspecLock(t *testing.T) {
 	fixtureLocationSet := file.NewLocationSet(file.NewLocation(fixture))
 	expected := []pkg.Package{
 		{
-			Name:      "ale",
-			Version:   "3.3.0",
-			PURL:      "pkg:pub/ale@3.3.0?hosted_url=pub.hosted.org",
-			Locations: fixtureLocationSet,
-			Language:  pkg.Dart,
-			Type:      pkg.DartPubPkg,
+			Name:         "ale",
+			Version:      "3.3.0",
+			PURL:         "pkg:pub/ale@3.3.0?hosted_url=pub.hosted.org",
+			Locations:    fixtureLocationSet,
+			Language:     pkg.Dart,
+			Type:         pkg.DartPubPkg,
+			Dependencies: pkg.UnknownDependencyCompleteness,
 			Metadata: pkg.DartPubspecLockEntry{
 				Name:      "ale",
 				Version:   "3.3.0",
@@ -27,72 +28,78 @@ func TestParsePubspecLock(t *testing.T) {
 			},
 		},
 		{
-			Name:      "analyzer",
-			Version:   "0.40.7",
-			PURL:      "pkg:pub/analyzer@0.40.7",
-			Locations: fixtureLocationSet,
-			Language:  pkg.Dart,
-			Type:      pkg.DartPubPkg,
+			Name:         "analyzer",
+			Version:      "0.40.7",
+			PURL:         "pkg:pub/analyzer@0.40.7",
+			Locations:    fixtureLocationSet,
+			Language:     pkg.Dart,
+			Type:         pkg.DartPubPkg,
+			Dependencies: pkg.UnknownDependencyCompleteness,
 			Metadata: pkg.DartPubspecLockEntry{
 				Name:    "analyzer",
 				Version: "0.40.7",
 			},
 		},
 		{
-			Name:      "ansicolor",
-			Version:   "1.1.1",
-			PURL:      "pkg:pub/ansicolor@1.1.1",
-			Locations: fixtureLocationSet,
-			Language:  pkg.Dart,
-			Type:      pkg.DartPubPkg,
+			Name:         "ansicolor",
+			Version:      "1.1.1",
+			PURL:         "pkg:pub/ansicolor@1.1.1",
+			Locations:    fixtureLocationSet,
+			Language:     pkg.Dart,
+			Type:         pkg.DartPubPkg,
+			Dependencies: pkg.UnknownDependencyCompleteness,
 			Metadata: pkg.DartPubspecLockEntry{
 				Name:    "ansicolor",
 				Version: "1.1.1",
 			},
 		},
 		{
-			Name:      "archive",
-			Version:   "2.0.13",
-			PURL:      "pkg:pub/archive@2.0.13",
-			Locations: fixtureLocationSet,
-			Language:  pkg.Dart,
-			Type:      pkg.DartPubPkg,
+			Name:         "archive",
+			Version:      "2.0.13",
+			PURL:         "pkg:pub/archive@2.0.13",
+			Locations:    fixtureLocationSet,
+			Language:     pkg.Dart,
+			Type:         pkg.DartPubPkg,
+			Dependencies: pkg.UnknownDependencyCompleteness,
 			Metadata: pkg.DartPubspecLockEntry{
 				Name:    "archive",
 				Version: "2.0.13",
 			},
 		},
 		{
-			Name:      "args",
-			Version:   "1.6.0",
-			PURL:      "pkg:pub/args@1.6.0",
-			Locations: fixtureLocationSet,
-			Language:  pkg.Dart,
-			Type:      pkg.DartPubPkg,
+			Name:         "args",
+			Version:      "1.6.0",
+			PURL:         "pkg:pub/args@1.6.0",
+			Locations:    fixtureLocationSet,
+			Language:     pkg.Dart,
+			Type:         pkg.DartPubPkg,
+			Dependencies: pkg.UnknownDependencyCompleteness,
 			Metadata: pkg.DartPubspecLockEntry{
 				Name:    "args",
 				Version: "1.6.0",
 			},
 		},
 		{
-			Name:      "flutter",
-			Version:   "0.0.0",
-			PURL:      "pkg:pub/flutter@0.0.0",
-			Locations: fixtureLocationSet,
-			Language:  pkg.Dart,
-			Type:      pkg.DartPubPkg,
+			Name:         "flutter",
+			Version:      "0.0.0",
+			PURL:         "pkg:pub/flutter@0.0.0",
+			Locations:    fixtureLocationSet,
+			Language:     pkg.Dart,
+			Type:         pkg.DartPubPkg,
+			Dependencies: pkg.UnknownDependencyCompleteness,
 			Metadata: pkg.DartPubspecLockEntry{
 				Name:    "flutter",
 				Version: "0.0.0",
 			},
 		},
 		{
-			Name:      "key_binder",
-			Version:   "1.11.20",
-			PURL:      "pkg:pub/key_binder@1.11.20?vcs_url=git%40github.com:Workiva/key_binder.git%403f7b3a6350e73c7dcac45301c0e18fbd42af02f7",
-			Locations: fixtureLocationSet,
-			Language:  pkg.Dart,
-			Type:      pkg.DartPubPkg,
+			Name:         "key_binder",
+			Version:      "1.11.20",
+			PURL:         "pkg:pub/key_binder@1.11.20?vcs_url=git%40github.com:Workiva/key_binder.git%403f7b3a6350e73c7dcac45301c0e18fbd42af02f7",
+			Locations:    fixtureLocationSet,
+			Language:     pkg.Dart,
+			Type:         pkg.DartPubPkg,
+			Dependencies: pkg.UnknownDependencyCompleteness,
 			Metadata: pkg.DartPubspecLockEntry{
 				Name:    "key_binder",
 				Version: "1.11.20",
@@ -14,6 +14,6 @@ func NewDBCataloger() pkg.Cataloger {
 	return generic.NewCataloger("dpkg-db-cataloger").
 		// note: these globs have been intentionally split up in order to improve search performance,
 		// please do NOT combine into: "**/var/lib/dpkg/{status,status.d/*}"
-		WithParserByGlobs(parseDpkgDB, "**/var/lib/dpkg/status", "**/var/lib/dpkg/status.d/*", "**/lib/opkg/info/*.control", "**/lib/opkg/status").
+		WithParserByGlobs(parseDpkgDB, "**/lib/dpkg/status", "**/lib/dpkg/status.d/*", "**/lib/opkg/info/*.control", "**/lib/opkg/status").
 		WithProcessors(dependency.Processor(dbEntryDependencySpecifier))
 }
@@ -36,7 +36,8 @@ func TestDpkgCataloger(t *testing.T) {
 						file.NewLocation("/var/lib/dpkg/info/libpam-runtime.conffiles"),
 						file.NewLocation("/usr/share/doc/libpam-runtime/copyright"),
 					),
-					Type: pkg.DebPkg,
+					Type:         pkg.DebPkg,
+					Dependencies: pkg.CompleteDependencies,
 					Metadata: pkg.DpkgDBEntry{
 						Package:       "libpam-runtime",
 						Source:        "pam",
@@ -109,7 +110,8 @@ func TestDpkgCataloger(t *testing.T) {
 						file.NewLocation("/var/lib/dpkg/status.d/libsqlite3-0.preinst"),
 						file.NewLocation("/usr/share/doc/libsqlite3-0/copyright"),
 					),
-					Type: pkg.DebPkg,
+					Type:         pkg.DebPkg,
+					Dependencies: pkg.CompleteDependencies,
 					Metadata: pkg.DpkgDBEntry{
 						Package:       "libsqlite3-0",
 						Source:        "sqlite3",
@@ -234,10 +236,12 @@ func TestCataloger_Globs(t *testing.T) {
 			name:    "obtain db status files",
 			fixture: "test-fixtures/glob-paths",
 			expected: []string{
+				"usr/lib/dpkg/status",
 				"var/lib/dpkg/status",
+				"usr/lib/dpkg/status.d/pkg-1.0",
 				"var/lib/dpkg/status.d/pkg-1.0",
-				"usr/lib/opkg/status",
 				"usr/lib/opkg/info/pkg-1.0.control",
+				"usr/lib/opkg/status",
 			},
 		},
 	}
@@ -30,13 +30,14 @@ func newDpkgPackage(d pkg.DpkgDBEntry, dbLocation file.Location, resolver file.R
 	locations.Add(evidence...)

 	p := pkg.Package{
-		Name:      d.Package,
-		Version:   d.Version,
-		Licenses:  pkg.NewLicenseSet(licenses...),
-		Locations: locations,
-		PURL:      packageURL(d, release),
-		Type:      pkg.DebPkg,
-		Metadata:  d,
+		Name:         d.Package,
+		Version:      d.Version,
+		Licenses:     pkg.NewLicenseSet(licenses...),
+		Locations:    locations,
+		PURL:         packageURL(d, release),
+		Type:         pkg.DebPkg,
+		Dependencies: pkg.CompleteDependencies,
+		Metadata:     d,
 	}

 	if resolver != nil {
@@ -81,7 +81,7 @@ func Test_packageURL(t *testing.T) {
 				Source:  "s",
 				Version: "v",
 			},
-			expected: "pkg:deb/debian/p@v?upstream=s&distro=debian-11",
+			expected: "pkg:deb/debian/p@v?distro=debian-11&upstream=s",
 		},
 		{
 			name: "with upstream qualifier with source pkg name and version info",
@@ -98,7 +98,7 @@ func Test_packageURL(t *testing.T) {
 				Version:       "v",
 				SourceVersion: "2.3",
 			},
-			expected: "pkg:deb/debian/p@v?upstream=s%402.3&distro=debian-11",
+			expected: "pkg:deb/debian/p@v?distro=debian-11&upstream=s%402.3",
 		},
 	}

@@ -349,11 +349,12 @@ Installed-Size: 10kib
 `,
 			want: []pkg.Package{
 				{
-					Name:      "apt",
-					Type:      "deb",
-					PURL:      "pkg:deb/debian/apt?distro=debian-10",
-					Licenses:  pkg.NewLicenseSet(),
-					Locations: file.NewLocationSet(file.NewLocation("place")),
+					Name:         "apt",
+					Type:         "deb",
+					PURL:         "pkg:deb/debian/apt?distro=debian-10",
+					Licenses:     pkg.NewLicenseSet(),
+					Locations:    file.NewLocationSet(file.NewLocation("place")),
+					Dependencies: pkg.CompleteDependencies,
 					Metadata: pkg.DpkgDBEntry{
 						Package:       "apt",
 						InstalledSize: 10240,
@@ -0,0 +1 @@
+bogus status
@@ -0,0 +1 @@
+bogus package
@@ -22,13 +22,14 @@ func newDotnetDepsPackage(nameVersion string, lib dotnetDepsLibrary, locations .
 	}

 	p := &pkg.Package{
-		Name:      name,
-		Version:   version,
-		Locations: file.NewLocationSet(locations...),
-		PURL:      packageURL(m),
-		Language:  pkg.Dotnet,
-		Type:      pkg.DotnetPkg,
-		Metadata:  m,
+		Name:         name,
+		Version:      version,
+		Locations:    file.NewLocationSet(locations...),
+		PURL:         packageURL(m),
+		Language:     pkg.Dotnet,
+		Type:         pkg.DotnetPkg,
+		Dependencies: pkg.CompleteDependencies,
+		Metadata:     m,
 	}

 	p.SetID()
@@ -20,36 +20,39 @@ func TestParseDotnetDeps(t *testing.T) {
 	fixture := "test-fixtures/TestLibrary.deps.json"
 	fixtureLocationSet := file.NewLocationSet(file.NewLocation(fixture))
 	rootPkg := pkg.Package{
-		Name:      "TestLibrary",
-		Version:   "1.0.0",
-		PURL:      "pkg:nuget/TestLibrary@1.0.0",
-		Locations: fixtureLocationSet,
-		Language:  pkg.Dotnet,
-		Type:      pkg.DotnetPkg,
+		Name:         "TestLibrary",
+		Version:      "1.0.0",
+		PURL:         "pkg:nuget/TestLibrary@1.0.0",
+		Locations:    fixtureLocationSet,
+		Language:     pkg.Dotnet,
+		Type:         pkg.DotnetPkg,
+		Dependencies: pkg.CompleteDependencies,
 		Metadata: pkg.DotnetDepsEntry{
 			Name:    "TestLibrary",
 			Version: "1.0.0",
 		},
 	}
 	testCommon := pkg.Package{
-		Name:      "TestCommon",
-		Version:   "1.0.0",
-		PURL:      "pkg:nuget/TestCommon@1.0.0",
-		Locations: fixtureLocationSet,
-		Language:  pkg.Dotnet,
-		Type:      pkg.DotnetPkg,
+		Name:         "TestCommon",
+		Version:      "1.0.0",
+		PURL:         "pkg:nuget/TestCommon@1.0.0",
+		Locations:    fixtureLocationSet,
+		Language:     pkg.Dotnet,
+		Type:         pkg.DotnetPkg,
+		Dependencies: pkg.CompleteDependencies,
 		Metadata: pkg.DotnetDepsEntry{
 			Name:    "TestCommon",
 			Version: "1.0.0",
 		},
 	}
 	awssdkcore := pkg.Package{
-		Name:      "AWSSDK.Core",
-		Version:   "3.7.10.6",
-		PURL:      "pkg:nuget/AWSSDK.Core@3.7.10.6",
-		Locations: fixtureLocationSet,
-		Language:  pkg.Dotnet,
-		Type:      pkg.DotnetPkg,
+		Name:         "AWSSDK.Core",
+		Version:      "3.7.10.6",
+		PURL:         "pkg:nuget/AWSSDK.Core@3.7.10.6",
+		Locations:    fixtureLocationSet,
+		Language:     pkg.Dotnet,
+		Type:         pkg.DotnetPkg,
+		Dependencies: pkg.CompleteDependencies,
 		Metadata: pkg.DotnetDepsEntry{
 			Name:     "AWSSDK.Core",
 			Version:  "3.7.10.6",
@@ -59,12 +62,13 @@ func TestParseDotnetDeps(t *testing.T) {
 		},
 	}
 	msftDependencyInjectionAbstractions := pkg.Package{
-		Name:      "Microsoft.Extensions.DependencyInjection.Abstractions",
-		Version:   "6.0.0",
-		PURL:      "pkg:nuget/Microsoft.Extensions.DependencyInjection.Abstractions@6.0.0",
-		Locations: fixtureLocationSet,
-		Language:  pkg.Dotnet,
-		Type:      pkg.DotnetPkg,
+		Name:         "Microsoft.Extensions.DependencyInjection.Abstractions",
+		Version:      "6.0.0",
+		PURL:         "pkg:nuget/Microsoft.Extensions.DependencyInjection.Abstractions@6.0.0",
+		Locations:    fixtureLocationSet,
+		Language:     pkg.Dotnet,
+		Type:         pkg.DotnetPkg,
+		Dependencies: pkg.CompleteDependencies,
 		Metadata: pkg.DotnetDepsEntry{
 			Name:     "Microsoft.Extensions.DependencyInjection.Abstractions",
 			Version:  "6.0.0",
@@ -74,12 +78,13 @@ func TestParseDotnetDeps(t *testing.T) {
 		},
 	}
 	msftDependencyInjection := pkg.Package{
-		Name:      "Microsoft.Extensions.DependencyInjection",
-		Version:   "6.0.0",
-		PURL:      "pkg:nuget/Microsoft.Extensions.DependencyInjection@6.0.0",
-		Locations: fixtureLocationSet,
-		Language:  pkg.Dotnet,
-		Type:      pkg.DotnetPkg,
+		Name:         "Microsoft.Extensions.DependencyInjection",
+		Version:      "6.0.0",
+		PURL:         "pkg:nuget/Microsoft.Extensions.DependencyInjection@6.0.0",
+		Locations:    fixtureLocationSet,
+		Language:     pkg.Dotnet,
+		Type:         pkg.DotnetPkg,
+		Dependencies: pkg.CompleteDependencies,
 		Metadata: pkg.DotnetDepsEntry{
 			Name:     "Microsoft.Extensions.DependencyInjection",
 			Version:  "6.0.0",
@@ -89,12 +94,13 @@ func TestParseDotnetDeps(t *testing.T) {
 		},
 	}
 	msftLoggingAbstractions := pkg.Package{
-		Name:      "Microsoft.Extensions.Logging.Abstractions",
-		Version:   "6.0.0",
-		PURL:      "pkg:nuget/Microsoft.Extensions.Logging.Abstractions@6.0.0",
-		Locations: fixtureLocationSet,
-		Language:  pkg.Dotnet,
-		Type:      pkg.DotnetPkg,
+		Name:         "Microsoft.Extensions.Logging.Abstractions",
+		Version:      "6.0.0",
+		PURL:         "pkg:nuget/Microsoft.Extensions.Logging.Abstractions@6.0.0",
+		Locations:    fixtureLocationSet,
+		Language:     pkg.Dotnet,
+		Type:         pkg.DotnetPkg,
+		Dependencies: pkg.CompleteDependencies,
 		Metadata: pkg.DotnetDepsEntry{
 			Name:     "Microsoft.Extensions.Logging.Abstractions",
 			Version:  "6.0.0",
@@ -104,12 +110,13 @@ func TestParseDotnetDeps(t *testing.T) {
 		},
 	}
 	msftExtensionsLogging := pkg.Package{
-		Name:      "Microsoft.Extensions.Logging",
-		Version:   "6.0.0",
-		PURL:      "pkg:nuget/Microsoft.Extensions.Logging@6.0.0",
-		Locations: fixtureLocationSet,
-		Language:  pkg.Dotnet,
-		Type:      pkg.DotnetPkg,
+		Name:         "Microsoft.Extensions.Logging",
+		Version:      "6.0.0",
+		PURL:         "pkg:nuget/Microsoft.Extensions.Logging@6.0.0",
+		Locations:    fixtureLocationSet,
+		Language:     pkg.Dotnet,
+		Type:         pkg.DotnetPkg,
+		Dependencies: pkg.CompleteDependencies,
 		Metadata: pkg.DotnetDepsEntry{
 			Name:     "Microsoft.Extensions.Logging",
 			Version:  "6.0.0",
@@ -119,12 +126,13 @@ func TestParseDotnetDeps(t *testing.T) {
 		},
 	}
 	msftExtensionsOptions := pkg.Package{
-		Name:      "Microsoft.Extensions.Options",
-		Version:   "6.0.0",
-		PURL:      "pkg:nuget/Microsoft.Extensions.Options@6.0.0",
-		Locations: fixtureLocationSet,
-		Language:  pkg.Dotnet,
-		Type:      pkg.DotnetPkg,
+		Name:         "Microsoft.Extensions.Options",
+		Version:      "6.0.0",
+		PURL:         "pkg:nuget/Microsoft.Extensions.Options@6.0.0",
+		Locations:    fixtureLocationSet,
+		Language:     pkg.Dotnet,
+		Type:         pkg.DotnetPkg,
+		Dependencies: pkg.CompleteDependencies,
 		Metadata: pkg.DotnetDepsEntry{
 			Name:     "Microsoft.Extensions.Options",
 			Version:  "6.0.0",
@@ -134,12 +142,13 @@ func TestParseDotnetDeps(t *testing.T) {
 		},
 	}
 	msftExtensionsPrimitives := pkg.Package{
-		Name:      "Microsoft.Extensions.Primitives",
-		Version:   "6.0.0",
-		PURL:      "pkg:nuget/Microsoft.Extensions.Primitives@6.0.0",
-		Locations: fixtureLocationSet,
-		Language:  pkg.Dotnet,
-		Type:      pkg.DotnetPkg,
+		Name:         "Microsoft.Extensions.Primitives",
+		Version:      "6.0.0",
+		PURL:         "pkg:nuget/Microsoft.Extensions.Primitives@6.0.0",
+		Locations:    fixtureLocationSet,
+		Language:     pkg.Dotnet,
+		Type:         pkg.DotnetPkg,
+		Dependencies: pkg.CompleteDependencies,
 		Metadata: pkg.DotnetDepsEntry{
 			Name:     "Microsoft.Extensions.Primitives",
 			Version:  "6.0.0",
@@ -149,12 +158,13 @@ func TestParseDotnetDeps(t *testing.T) {
 		},
 	}
 	newtonsoftJson := pkg.Package{
-		Name:      "Newtonsoft.Json",
-		Version:   "13.0.1",
-		PURL:      "pkg:nuget/Newtonsoft.Json@13.0.1",
-		Locations: fixtureLocationSet,
-		Language:  pkg.Dotnet,
-		Type:      pkg.DotnetPkg,
+		Name:         "Newtonsoft.Json",
+		Version:      "13.0.1",
+		PURL:         "pkg:nuget/Newtonsoft.Json@13.0.1",
+		Locations:    fixtureLocationSet,
+		Language:     pkg.Dotnet,
+		Type:         pkg.DotnetPkg,
+		Dependencies: pkg.CompleteDependencies,
 		Metadata: pkg.DotnetDepsEntry{
 			Name:     "Newtonsoft.Json",
 			Version:  "13.0.1",
@@ -164,12 +174,13 @@ func TestParseDotnetDeps(t *testing.T) {
 		},
 	}
 	serilogSinksConsole := pkg.Package{
-		Name:      "Serilog.Sinks.Console",
-		Version:   "4.0.1",
-		PURL:      "pkg:nuget/Serilog.Sinks.Console@4.0.1",
-		Locations: fixtureLocationSet,
-		Language:  pkg.Dotnet,
-		Type:      pkg.DotnetPkg,
+		Name:         "Serilog.Sinks.Console",
+		Version:      "4.0.1",
+		PURL:         "pkg:nuget/Serilog.Sinks.Console@4.0.1",
+		Locations:    fixtureLocationSet,
+		Language:     pkg.Dotnet,
+		Type:         pkg.DotnetPkg,
+		Dependencies: pkg.CompleteDependencies,
 		Metadata: pkg.DotnetDepsEntry{
 			Name:     "Serilog.Sinks.Console",
 			Version:  "4.0.1",
@@ -179,12 +190,13 @@ func TestParseDotnetDeps(t *testing.T) {
 		},
 	}
 	serilog := pkg.Package{
-		Name:      "Serilog",
-		Version:   "2.10.0",
-		PURL:      "pkg:nuget/Serilog@2.10.0",
-		Locations: fixtureLocationSet,
-		Language:  pkg.Dotnet,
-		Type:      pkg.DotnetPkg,
+		Name:         "Serilog",
+		Version:      "2.10.0",
+		PURL:         "pkg:nuget/Serilog@2.10.0",
+		Locations:    fixtureLocationSet,
+		Language:     pkg.Dotnet,
+		Type:         pkg.DotnetPkg,
+		Dependencies: pkg.CompleteDependencies,
 		Metadata: pkg.DotnetDepsEntry{
 			Name:     "Serilog",
 			Version:  "2.10.0",
@@ -194,12 +206,13 @@ func TestParseDotnetDeps(t *testing.T) {
 		},
 	}
 	systemDiagnosticsDiagnosticsource := pkg.Package{
-		Name:      "System.Diagnostics.DiagnosticSource",
-		Version:   "6.0.0",
-		PURL:      "pkg:nuget/System.Diagnostics.DiagnosticSource@6.0.0",
-		Locations: fixtureLocationSet,
-		Language:  pkg.Dotnet,
-		Type:      pkg.DotnetPkg,
+		Name:         "System.Diagnostics.DiagnosticSource",
+		Version:      "6.0.0",
+		PURL:         "pkg:nuget/System.Diagnostics.DiagnosticSource@6.0.0",
+		Locations:    fixtureLocationSet,
+		Language:     pkg.Dotnet,
+		Type:         pkg.DotnetPkg,
+		Dependencies: pkg.CompleteDependencies,
 		Metadata: pkg.DotnetDepsEntry{
 			Name:     "System.Diagnostics.DiagnosticSource",
 			Version:  "6.0.0",
@@ -209,12 +222,13 @@ func TestParseDotnetDeps(t *testing.T) {
 		},
 	}
 	systemRuntimeCompilerServicesUnsafe := pkg.Package{
-		Name:      "System.Runtime.CompilerServices.Unsafe",
-		Version:   "6.0.0",
-		PURL:      "pkg:nuget/System.Runtime.CompilerServices.Unsafe@6.0.0",
-		Locations: fixtureLocationSet,
-		Language:  pkg.Dotnet,
-		Type:      pkg.DotnetPkg,
+		Name:         "System.Runtime.CompilerServices.Unsafe",
+		Version:      "6.0.0",
+		PURL:         "pkg:nuget/System.Runtime.CompilerServices.Unsafe@6.0.0",
+		Locations:    fixtureLocationSet,
+		Language:     pkg.Dotnet,
+		Type:         pkg.DotnetPkg,
+		Dependencies: pkg.CompleteDependencies,
 		Metadata: pkg.DotnetDepsEntry{
 			Name:     "System.Runtime.CompilerServices.Unsafe",
 			Version:  "6.0.0",
@@ -9,7 +9,7 @@ import (

 	"github.com/saferwall/pe"

-	version "github.com/anchore/go-version"
+	"github.com/anchore/go-version"
 	"github.com/anchore/packageurl-go"
 	"github.com/anchore/syft/internal/log"
 	"github.com/anchore/syft/syft/artifact"
@@ -44,7 +44,7 @@ func parseDotnetPortableExecutable(_ context.Context, _ file.Resolver, _ *generi
 		return nil, nil, fmt.Errorf("unable to parse version resources in PE file: %w", err)
 	}

-	dotNetPkg, err := buildDotNetPackage(versionResources, f)
+	dotNetPkg, err := buildDotNetPEPackage(versionResources, f)
 	if err != nil {
 		log.Tracef("unable to build dotnet package for: %v %v", f.RealPath, err)
 		return nil, nil, err
@@ -53,14 +53,14 @@ func parseDotnetPortableExecutable(_ context.Context, _ file.Resolver, _ *generi
 	return []pkg.Package{dotNetPkg}, nil, nil
 }

-func buildDotNetPackage(versionResources map[string]string, f file.LocationReadCloser) (dnpkg pkg.Package, err error) {
+func buildDotNetPEPackage(versionResources map[string]string, f file.LocationReadCloser) (dnpkg pkg.Package, err error) {
 	name := findName(versionResources)
 	if name == "" {
 		return dnpkg, fmt.Errorf("unable to find PE name in file")
 	}

-	version := findVersion(versionResources)
-	if version == "" {
+	ver := findVersion(versionResources)
+	if ver == "" {
 		return dnpkg, fmt.Errorf("unable to find PE version in file")
 	}

@@ -76,12 +76,14 @@ func buildDotNetPackage(versionResources map[string]string, f file.LocationReadC

 	dnpkg = pkg.Package{
 		Name:      name,
-		Version:   version,
+		Version:   ver,
 		Locations: file.NewLocationSet(f.Location.WithAnnotation(pkg.EvidenceAnnotationKey, pkg.PrimaryEvidenceAnnotation)),
 		Type:      pkg.DotnetPkg,
 		Language:  pkg.Dotnet,
-		PURL:      portableExecutablePackageURL(name, version),
-		Metadata:  metadata,
+		PURL:      portableExecutablePackageURL(name, ver),
+		// by nature PE file metadata does not have any dependency information, thus we are forced to claim unknown completeness
+		Dependencies: pkg.UnknownDependencyCompleteness,
+		Metadata:     metadata,
 	}

 	dnpkg.SetID()
@@ -32,8 +32,9 @@ func TestParseDotnetPortableExecutable(t *testing.T) {
 				"Assembly Version": "3.14.2.11",
 			},
 			expectedPackage: pkg.Package{
-				Name:    "Active Directory Authentication Library",
-				Version: "3.14.40721.0918",
+				Name:         "Active Directory Authentication Library",
+				Version:      "3.14.40721.0918",
+				Dependencies: pkg.UnknownDependencyCompleteness,
 				Metadata: pkg.DotnetPortableExecutableEntry{
 					AssemblyVersion: "3.14.2.11",
 					LegalCopyright:  "Copyright (c) Microsoft Corporation. All rights reserved.",
@@ -57,9 +58,10 @@ func TestParseDotnetPortableExecutable(t *testing.T) {
 				"ProductVersion":   "4.6.25512.01 built by: dlab-DDVSOWINAGE016. Commit Hash: d0d5c7b49271cadb6d97de26d8e623e98abdc8db",
 			},
 			expectedPackage: pkg.Package{
-				Name:    "äbFileVersi on",
-				Version: "4.6.25512.01",
-				PURL:    "pkg:nuget/%C3%A4bFileVersi%20on@4.6.25512.01",
+				Name:         "äbFileVersi on",
+				Version:      "4.6.25512.01",
+				PURL:         "pkg:nuget/%C3%A4bFileVersi%20on@4.6.25512.01",
+				Dependencies: pkg.UnknownDependencyCompleteness,
 				Metadata: pkg.DotnetPortableExecutableEntry{
 					LegalCopyright: "© Microsoft Corporation.  All rights reserved.",
 					InternalName:   "äb\x01FileVersion",
@@ -82,8 +84,9 @@ func TestParseDotnetPortableExecutable(t *testing.T) {
 				"ProductVersion":   "4.7.3190.0",
 			},
 			expectedPackage: pkg.Package{
-				Name:    "System.Data.Linq.dll",
-				Version: "4.7.3190.0",
+				Name:         "System.Data.Linq.dll",
+				Version:      "4.7.3190.0",
+				Dependencies: pkg.UnknownDependencyCompleteness,
 			},
 		},
 		{
@@ -99,8 +102,9 @@ func TestParseDotnetPortableExecutable(t *testing.T) {
 				"ProductVersion":   "8.4.0",
 			},
 			expectedPackage: pkg.Package{
-				Name:    "The curl executable",
-				Version: "8.4.0",
+				Name:         "The curl executable",
+				Version:      "8.4.0",
+				Dependencies: pkg.UnknownDependencyCompleteness,
 			},
 		},
 		{
@@ -116,8 +120,9 @@ func TestParseDotnetPortableExecutable(t *testing.T) {
 				"ProductVersion":   "8.0.1",
 			},
 			expectedPackage: pkg.Package{
-				Name:    "Prometheus.AspNetCore.dll",
-				Version: "8.0.1",
+				Name:         "Prometheus.AspNetCore.dll",
+				Version:      "8.0.1",
+				Dependencies: pkg.UnknownDependencyCompleteness,
 			},
 		},
 		{
@@ -132,8 +137,9 @@ func TestParseDotnetPortableExecutable(t *testing.T) {
 				"ProductVersion":   "1, 0, 0, 0",
 			},
 			expectedPackage: pkg.Package{
-				Name:    "Hidden Input",
-				Version: "1, 0, 0, 0",
+				Name:         "Hidden Input",
+				Version:      "1, 0, 0, 0",
+				Dependencies: pkg.UnknownDependencyCompleteness,
 			},
 		},
 		{
@@ -148,8 +154,9 @@ func TestParseDotnetPortableExecutable(t *testing.T) {
 				"ProductVersion":  "3.23.2",
 			},
 			expectedPackage: pkg.Package{
-				Name:    "SQLite",
-				Version: "3.23.2",
+				Name:         "SQLite",
+				Version:      "3.23.2",
+				Dependencies: pkg.UnknownDependencyCompleteness,
 			},
 		},
 		{
@@ -165,8 +172,9 @@ func TestParseDotnetPortableExecutable(t *testing.T) {
 				"ProductVersion":   "80.1.7.92",
 			},
 			expectedPackage: pkg.Package{
-				Name:    "Brave Browser",
-				Version: "80.1.7.92",
+				Name:         "Brave Browser",
+				Version:      "80.1.7.92",
+				Dependencies: pkg.UnknownDependencyCompleteness,
 			},
 		},
 		{
@@ -177,8 +185,9 @@ func TestParseDotnetPortableExecutable(t *testing.T) {
 				"ProductVersion":  "80.1.7.92",
 			},
 			expectedPackage: pkg.Package{
-				Name:    "Better version",
-				Version: "80.1.7.92",
+				Name:         "Better version",
+				Version:      "80.1.7.92",
+				Dependencies: pkg.UnknownDependencyCompleteness,
 			},
 		},
 		{
@@ -189,8 +198,9 @@ func TestParseDotnetPortableExecutable(t *testing.T) {
 				"ProductVersion":  "80.1.7",
 			},
 			expectedPackage: pkg.Package{
-				Name:    "Better version",
-				Version: "80.1.7.92",
+				Name:         "Better version",
+				Version:      "80.1.7.92",
+				Dependencies: pkg.UnknownDependencyCompleteness,
 			},
 		},
 		{
@@ -201,8 +211,9 @@ func TestParseDotnetPortableExecutable(t *testing.T) {
 				"ProductVersion":  "3.0.1+b86b61bf676163639795b163d8d753b20aad6207",
 			},
 			expectedPackage: pkg.Package{
-				Name:    "Higher semantic version Product Version",
-				Version: "3.0.1+b86b61bf676163639795b163d8d753b20aad6207",
+				Name:         "Higher semantic version Product Version",
+				Version:      "3.0.1+b86b61bf676163639795b163d8d753b20aad6207",
+				Dependencies: pkg.UnknownDependencyCompleteness,
 			},
 		},
 		{
@@ -213,8 +224,9 @@ func TestParseDotnetPortableExecutable(t *testing.T) {
 				"ProductVersion":  "3.0.0",
 			},
 			expectedPackage: pkg.Package{
-				Name:    "Higher semantic version File Version",
-				Version: "3.0.1+b86b61bf676163639795b163d8d753b20aad6207",
+				Name:         "Higher semantic version File Version",
+				Version:      "3.0.1+b86b61bf676163639795b163d8d753b20aad6207",
+				Dependencies: pkg.UnknownDependencyCompleteness,
 			},
 		},
 		{
@@ -225,8 +237,9 @@ func TestParseDotnetPortableExecutable(t *testing.T) {
 				"ProductVersion":  "3.0.1+b86b61bf676163639795b163d8d753b20aad6207",
 			},
 			expectedPackage: pkg.Package{
-				Name:    "Invalid semantic version File Version",
-				Version: "3.0.1+b86b61bf676163639795b163d8d753b20aad6207",
+				Name:         "Invalid semantic version File Version",
+				Version:      "3.0.1+b86b61bf676163639795b163d8d753b20aad6207",
+				Dependencies: pkg.UnknownDependencyCompleteness,
 			},
 		},
 		{
@@ -237,8 +250,9 @@ func TestParseDotnetPortableExecutable(t *testing.T) {
 				"ProductVersion":  "3.0.1+b86b61bf676163639795b163d8d753b20aad6207",
 			},
 			expectedPackage: pkg.Package{
-				Name:    "Invalid semantic version File Version",
-				Version: "3.0.1+b86b61bf676163639795b163d8d753b20aad6207",
+				Name:         "Invalid semantic version File Version",
+				Version:      "3.0.1+b86b61bf676163639795b163d8d753b20aad6207",
+				Dependencies: pkg.UnknownDependencyCompleteness,
 			},
 		},
 		{
@@ -249,8 +263,9 @@ func TestParseDotnetPortableExecutable(t *testing.T) {
 				"ProductVersion":  "A",
 			},
 			expectedPackage: pkg.Package{
-				Name:    "Invalid semantic version Product Version",
-				Version: "3.0.1+b86b61bf676163639795b163d8d753b20aad6207",
+				Name:         "Invalid semantic version Product Version",
+				Version:      "3.0.1+b86b61bf676163639795b163d8d753b20aad6207",
+				Dependencies: pkg.UnknownDependencyCompleteness,
 			},
 		},
 		{
@@ -261,8 +276,9 @@ func TestParseDotnetPortableExecutable(t *testing.T) {
 				"ProductVersion":  "3.0.0",
 			},
 			expectedPackage: pkg.Package{
-				Name:    "Semantically equal falls through, chooses File Version with more components",
-				Version: "3.0.0.0",
+				Name:         "Semantically equal falls through, chooses File Version with more components",
+				Version:      "3.0.0.0",
+				Dependencies: pkg.UnknownDependencyCompleteness,
 			},
 		},
 	}
@@ -273,7 +289,7 @@ func TestParseDotnetPortableExecutable(t *testing.T) {
 			f := file.LocationReadCloser{
 				Location: location,
 			}
-			got, err := buildDotNetPackage(tc.versionResources, f)
+			got, err := buildDotNetPEPackage(tc.versionResources, f)
 			assert.NoErrorf(t, err, "failed to build package from version resources: %+v", tc.versionResources)

 			// ignore certain metadata
@@ -14,7 +14,9 @@ func newPackage(d pkg.ElixirMixLockEntry, locations ...file.Location) pkg.Packag
 		Locations: file.NewLocationSet(locations...),
 		PURL:      packageURL(d),
 		Type:      pkg.HexPkg,
-		Metadata:  d,
+		// we do not attempt to parse dependencies from the mix.lock file
+		Dependencies: pkg.UnknownDependencyCompleteness,
+		Metadata:     d,
 	}

 	p.SetID()
@@ -13,12 +13,13 @@ func TestParseMixLock(t *testing.T) {
 	locations := file.NewLocationSet(file.NewLocation("test-fixtures/mix.lock"))
 	expected := []pkg.Package{
 		{
-			Name:      "castore",
-			Version:   "0.1.17",
-			Language:  pkg.Elixir,
-			Type:      pkg.HexPkg,
-			Locations: locations,
-			PURL:      "pkg:hex/castore@0.1.17",
+			Name:         "castore",
+			Version:      "0.1.17",
+			Language:     pkg.Elixir,
+			Type:         pkg.HexPkg,
+			Locations:    locations,
+			PURL:         "pkg:hex/castore@0.1.17",
+			Dependencies: pkg.UnknownDependencyCompleteness,
 			Metadata: pkg.ElixirMixLockEntry{
 				Name:       "castore",
 				Version:    "0.1.17",
@@ -27,12 +28,13 @@ func TestParseMixLock(t *testing.T) {
 			},
 		},
 		{
-			Name:      "connection",
-			Version:   "1.1.0",
-			Language:  pkg.Elixir,
-			Type:      pkg.HexPkg,
-			Locations: locations,
-			PURL:      "pkg:hex/connection@1.1.0",
+			Name:         "connection",
+			Version:      "1.1.0",
+			Language:     pkg.Elixir,
+			Type:         pkg.HexPkg,
+			Locations:    locations,
+			PURL:         "pkg:hex/connection@1.1.0",
+			Dependencies: pkg.UnknownDependencyCompleteness,
 			Metadata: pkg.ElixirMixLockEntry{
 				Name:       "connection",
 				Version:    "1.1.0",
@@ -41,12 +43,13 @@ func TestParseMixLock(t *testing.T) {
 			},
 		},
 		{
-			Name:      "cowboy",
-			Version:   "2.9.0",
-			Language:  pkg.Elixir,
-			Type:      pkg.HexPkg,
-			Locations: locations,
-			PURL:      "pkg:hex/cowboy@2.9.0",
+			Name:         "cowboy",
+			Version:      "2.9.0",
+			Language:     pkg.Elixir,
+			Type:         pkg.HexPkg,
+			Locations:    locations,
+			PURL:         "pkg:hex/cowboy@2.9.0",
+			Dependencies: pkg.UnknownDependencyCompleteness,
 			Metadata: pkg.ElixirMixLockEntry{
 				Name:       "cowboy",
 				Version:    "2.9.0",
@@ -55,12 +58,13 @@ func TestParseMixLock(t *testing.T) {
 			},
 		},
 		{
-			Name:      "cowboy_telemetry",
-			Version:   "0.4.0",
-			Language:  pkg.Elixir,
-			Type:      pkg.HexPkg,
-			Locations: locations,
-			PURL:      "pkg:hex/cowboy_telemetry@0.4.0",
+			Name:         "cowboy_telemetry",
+			Version:      "0.4.0",
+			Language:     pkg.Elixir,
+			Type:         pkg.HexPkg,
+			Locations:    locations,
+			PURL:         "pkg:hex/cowboy_telemetry@0.4.0",
+			Dependencies: pkg.UnknownDependencyCompleteness,
 			Metadata: pkg.ElixirMixLockEntry{
 				Name:       "cowboy_telemetry",
 				Version:    "0.4.0",
@@ -69,12 +73,13 @@ func TestParseMixLock(t *testing.T) {
 			},
 		},
 		{
-			Name:      "cowlib",
-			Version:   "2.11.0",
-			Language:  pkg.Elixir,
-			Type:      pkg.HexPkg,
-			Locations: locations,
-			PURL:      "pkg:hex/cowlib@2.11.0",
+			Name:         "cowlib",
+			Version:      "2.11.0",
+			Language:     pkg.Elixir,
+			Type:         pkg.HexPkg,
+			Locations:    locations,
+			PURL:         "pkg:hex/cowlib@2.11.0",
+			Dependencies: pkg.UnknownDependencyCompleteness,
 			Metadata: pkg.ElixirMixLockEntry{
 				Name:       "cowlib",
 				Version:    "2.11.0",
@@ -83,12 +88,13 @@ func TestParseMixLock(t *testing.T) {
 			},
 		},
 		{
-			Name:      "db_connection",
-			Version:   "2.4.2",
-			Language:  pkg.Elixir,
-			Type:      pkg.HexPkg,
-			Locations: locations,
-			PURL:      "pkg:hex/db_connection@2.4.2",
+			Name:         "db_connection",
+			Version:      "2.4.2",
+			Language:     pkg.Elixir,
+			Type:         pkg.HexPkg,
+			Locations:    locations,
+			PURL:         "pkg:hex/db_connection@2.4.2",
+			Dependencies: pkg.UnknownDependencyCompleteness,
 			Metadata: pkg.ElixirMixLockEntry{
 				Name:       "db_connection",
 				Version:    "2.4.2",
@@ -97,12 +103,13 @@ func TestParseMixLock(t *testing.T) {
 			},
 		},
 		{
-			Name:      "decimal",
-			Version:   "2.0.0",
-			Language:  pkg.Elixir,
-			Type:      pkg.HexPkg,
-			Locations: locations,
-			PURL:      "pkg:hex/decimal@2.0.0",
+			Name:         "decimal",
+			Version:      "2.0.0",
+			Language:     pkg.Elixir,
+			Type:         pkg.HexPkg,
+			Locations:    locations,
+			PURL:         "pkg:hex/decimal@2.0.0",
+			Dependencies: pkg.UnknownDependencyCompleteness,
 			Metadata: pkg.ElixirMixLockEntry{
 				Name:       "decimal",
 				Version:    "2.0.0",
@@ -111,12 +118,13 @@ func TestParseMixLock(t *testing.T) {
 			},
 		},
 		{
-			Name:      "earmark_parser",
-			Version:   "1.4.25",
-			Language:  pkg.Elixir,
-			Type:      pkg.HexPkg,
-			Locations: locations,
-			PURL:      "pkg:hex/earmark_parser@1.4.25",
+			Name:         "earmark_parser",
+			Version:      "1.4.25",
+			Language:     pkg.Elixir,
+			Type:         pkg.HexPkg,
+			Locations:    locations,
+			PURL:         "pkg:hex/earmark_parser@1.4.25",
+			Dependencies: pkg.UnknownDependencyCompleteness,
 			Metadata: pkg.ElixirMixLockEntry{
 				Name:       "earmark_parser",
 				Version:    "1.4.25",
@@ -125,12 +133,13 @@ func TestParseMixLock(t *testing.T) {
 			},
 		},
 		{
-			Name:      "ecto",
-			Version:   "3.8.1",
-			Language:  pkg.Elixir,
-			Type:      pkg.HexPkg,
-			Locations: locations,
-			PURL:      "pkg:hex/ecto@3.8.1",
+			Name:         "ecto",
+			Version:      "3.8.1",
+			Language:     pkg.Elixir,
+			Type:         pkg.HexPkg,
+			Locations:    locations,
+			PURL:         "pkg:hex/ecto@3.8.1",
+			Dependencies: pkg.UnknownDependencyCompleteness,
 			Metadata: pkg.ElixirMixLockEntry{
 				Name:       "ecto",
 				Version:    "3.8.1",
@@ -139,12 +148,13 @@ func TestParseMixLock(t *testing.T) {
 			},
 		},
 		{
-			Name:      "ecto_sql",
-			Version:   "3.8.1",
-			Language:  pkg.Elixir,
-			Type:      pkg.HexPkg,
-			Locations: locations,
-			PURL:      "pkg:hex/ecto_sql@3.8.1",
+			Name:         "ecto_sql",
+			Version:      "3.8.1",
+			Language:     pkg.Elixir,
+			Type:         pkg.HexPkg,
+			Locations:    locations,
+			PURL:         "pkg:hex/ecto_sql@3.8.1",
+			Dependencies: pkg.UnknownDependencyCompleteness,
 			Metadata: pkg.ElixirMixLockEntry{
 				Name:       "ecto_sql",
 				Version:    "3.8.1",
@@ -153,12 +163,13 @@ func TestParseMixLock(t *testing.T) {
 			},
 		},
 		{
-			Name:      "esbuild",
-			Version:   "0.5.0",
-			Language:  pkg.Elixir,
-			Type:      pkg.HexPkg,
-			Locations: locations,
-			PURL:      "pkg:hex/esbuild@0.5.0",
+			Name:         "esbuild",
+			Version:      "0.5.0",
+			Language:     pkg.Elixir,
+			Type:         pkg.HexPkg,
+			Locations:    locations,
+			PURL:         "pkg:hex/esbuild@0.5.0",
+			Dependencies: pkg.UnknownDependencyCompleteness,
 			Metadata: pkg.ElixirMixLockEntry{
 				Name:       "esbuild",
 				Version:    "0.5.0",
@@ -167,12 +178,13 @@ func TestParseMixLock(t *testing.T) {
 			},
 		},
 		{
-			Name:      "ex_doc",
-			Version:   "0.28.4",
-			Language:  pkg.Elixir,
-			Type:      pkg.HexPkg,
-			Locations: locations,
-			PURL:      "pkg:hex/ex_doc@0.28.4",
+			Name:         "ex_doc",
+			Version:      "0.28.4",
+			Language:     pkg.Elixir,
+			Type:         pkg.HexPkg,
+			Locations:    locations,
+			PURL:         "pkg:hex/ex_doc@0.28.4",
+			Dependencies: pkg.UnknownDependencyCompleteness,
 			Metadata: pkg.ElixirMixLockEntry{
 				Name:       "ex_doc",
 				Version:    "0.28.4",
@@ -181,12 +193,13 @@ func TestParseMixLock(t *testing.T) {
 			},
 		},
 		{
-			Name:      "gettext",
-			Version:   "0.19.1",
-			Language:  pkg.Elixir,
-			Type:      pkg.HexPkg,
-			Locations: locations,
-			PURL:      "pkg:hex/gettext@0.19.1",
+			Name:         "gettext",
+			Version:      "0.19.1",
+			Language:     pkg.Elixir,
+			Type:         pkg.HexPkg,
+			Locations:    locations,
+			PURL:         "pkg:hex/gettext@0.19.1",
+			Dependencies: pkg.UnknownDependencyCompleteness,
 			Metadata: pkg.ElixirMixLockEntry{
 				Name:       "gettext",
 				Version:    "0.19.1",
@@ -195,12 +208,13 @@ func TestParseMixLock(t *testing.T) {
 			},
 		},
 		{
-			Name:      "hpax",
-			Version:   "0.1.1",
-			Language:  pkg.Elixir,
-			Type:      pkg.HexPkg,
-			Locations: locations,
-			PURL:      "pkg:hex/hpax@0.1.1",
+			Name:         "hpax",
+			Version:      "0.1.1",
+			Language:     pkg.Elixir,
+			Type:         pkg.HexPkg,
+			Locations:    locations,
+			PURL:         "pkg:hex/hpax@0.1.1",
+			Dependencies: pkg.UnknownDependencyCompleteness,
 			Metadata: pkg.ElixirMixLockEntry{
 				Name:       "hpax",
 				Version:    "0.1.1",
@@ -209,12 +223,13 @@ func TestParseMixLock(t *testing.T) {
 			},
 		},
 		{
-			Name:      "jason",
-			Version:   "1.3.0",
-			Language:  pkg.Elixir,
-			Type:      pkg.HexPkg,
-			Locations: locations,
-			PURL:      "pkg:hex/jason@1.3.0",
+			Name:         "jason",
+			Version:      "1.3.0",
+			Language:     pkg.Elixir,
+			Type:         pkg.HexPkg,
+			Locations:    locations,
+			PURL:         "pkg:hex/jason@1.3.0",
+			Dependencies: pkg.UnknownDependencyCompleteness,
 			Metadata: pkg.ElixirMixLockEntry{
 				Name:       "jason",
 				Version:    "1.3.0",
@@ -14,7 +14,9 @@ func newPackageFromRebar(d pkg.ErlangRebarLockEntry, locations ...file.Location)
 		Locations: file.NewLocationSet(locations...),
 		PURL:      packageURLFromRebar(d),
 		Type:      pkg.HexPkg,
-		Metadata:  d,
+		// we do not attempt to parse dependencies from the rebar.lock file
+		Dependencies: pkg.UnknownDependencyCompleteness,
+		Metadata:     d,
 	}

 	p.SetID()
@@ -42,7 +44,9 @@ func newPackageFromOTP(name, version string, locations ...file.Location) pkg.Pac
 		Language:  pkg.Erlang,
 		Locations: file.NewLocationSet(locations...),
 		PURL:      packageURLFromOTP(name, version),
-		Type:      pkg.ErlangOTPPkg,
+		// we do not attempt to parse dependencies from app files
+		Dependencies: pkg.UnknownDependencyCompleteness,
+		Type:         pkg.ErlangOTPPkg,
 	}

 	p.SetID()
@@ -18,11 +18,12 @@ func TestParseOTPApplication(t *testing.T) {
 			fixture: "test-fixtures/rabbitmq.app",
 			expected: []pkg.Package{
 				{
-					Name:     "rabbit",
-					Version:  "3.12.10",
-					Language: pkg.Erlang,
-					Type:     pkg.ErlangOTPPkg,
-					PURL:     "pkg:otp/rabbit@3.12.10",
+					Name:         "rabbit",
+					Version:      "3.12.10",
+					Language:     pkg.Erlang,
+					Type:         pkg.ErlangOTPPkg,
+					PURL:         "pkg:otp/rabbit@3.12.10",
+					Dependencies: pkg.UnknownDependencyCompleteness,
 				},
 			},
 		},
@@ -18,11 +18,12 @@ func TestParseRebarLock(t *testing.T) {
 			fixture: "test-fixtures/rebar.lock",
 			expected: []pkg.Package{
 				{
-					Name:     "certifi",
-					Version:  "2.9.0",
-					Language: pkg.Erlang,
-					Type:     pkg.HexPkg,
-					PURL:     "pkg:hex/certifi@2.9.0",
+					Name:         "certifi",
+					Version:      "2.9.0",
+					Language:     pkg.Erlang,
+					Type:         pkg.HexPkg,
+					PURL:         "pkg:hex/certifi@2.9.0",
+					Dependencies: pkg.UnknownDependencyCompleteness,
 					Metadata: pkg.ErlangRebarLockEntry{
 						Name:       "certifi",
 						Version:    "2.9.0",
@@ -31,11 +32,12 @@ func TestParseRebarLock(t *testing.T) {
 					},
 				},
 				{
-					Name:     "idna",
-					Version:  "6.1.1",
-					Language: pkg.Erlang,
-					Type:     pkg.HexPkg,
-					PURL:     "pkg:hex/idna@6.1.1",
+					Name:         "idna",
+					Version:      "6.1.1",
+					Language:     pkg.Erlang,
+					Type:         pkg.HexPkg,
+					PURL:         "pkg:hex/idna@6.1.1",
+					Dependencies: pkg.UnknownDependencyCompleteness,
 					Metadata: pkg.ErlangRebarLockEntry{
 						Name:       "idna",
 						Version:    "6.1.1",
@@ -44,11 +46,12 @@ func TestParseRebarLock(t *testing.T) {
 					},
 				},
 				{
-					Name:     "metrics",
-					Version:  "1.0.1",
-					Language: pkg.Erlang,
-					Type:     pkg.HexPkg,
-					PURL:     "pkg:hex/metrics@1.0.1",
+					Name:         "metrics",
+					Version:      "1.0.1",
+					Language:     pkg.Erlang,
+					Type:         pkg.HexPkg,
+					PURL:         "pkg:hex/metrics@1.0.1",
+					Dependencies: pkg.UnknownDependencyCompleteness,
 					Metadata: pkg.ErlangRebarLockEntry{
 						Name:       "metrics",
 						Version:    "1.0.1",
@@ -57,11 +60,12 @@ func TestParseRebarLock(t *testing.T) {
 					},
 				},
 				{
-					Name:     "mimerl",
-					Version:  "1.2.0",
-					Language: pkg.Erlang,
-					Type:     pkg.HexPkg,
-					PURL:     "pkg:hex/mimerl@1.2.0",
+					Name:         "mimerl",
+					Version:      "1.2.0",
+					Language:     pkg.Erlang,
+					Type:         pkg.HexPkg,
+					PURL:         "pkg:hex/mimerl@1.2.0",
+					Dependencies: pkg.UnknownDependencyCompleteness,
 					Metadata: pkg.ErlangRebarLockEntry{
 						Name:       "mimerl",
 						Version:    "1.2.0",
@@ -70,11 +74,12 @@ func TestParseRebarLock(t *testing.T) {
 					},
 				},
 				{
-					Name:     "parse_trans",
-					Version:  "3.3.1",
-					Language: pkg.Erlang,
-					Type:     pkg.HexPkg,
-					PURL:     "pkg:hex/parse_trans@3.3.1",
+					Name:         "parse_trans",
+					Version:      "3.3.1",
+					Language:     pkg.Erlang,
+					Type:         pkg.HexPkg,
+					PURL:         "pkg:hex/parse_trans@3.3.1",
+					Dependencies: pkg.UnknownDependencyCompleteness,
 					Metadata: pkg.ErlangRebarLockEntry{
 						Name:       "parse_trans",
 						Version:    "3.3.1",
@@ -83,11 +88,12 @@ func TestParseRebarLock(t *testing.T) {
 					},
 				},
 				{
-					Name:     "ssl_verify_fun",
-					Version:  "1.1.6",
-					Language: pkg.Erlang,
-					Type:     pkg.HexPkg,
-					PURL:     "pkg:hex/ssl_verify_fun@1.1.6",
+					Name:         "ssl_verify_fun",
+					Version:      "1.1.6",
+					Language:     pkg.Erlang,
+					Type:         pkg.HexPkg,
+					PURL:         "pkg:hex/ssl_verify_fun@1.1.6",
+					Dependencies: pkg.UnknownDependencyCompleteness,
 					Metadata: pkg.ErlangRebarLockEntry{
 						Name:       "ssl_verify_fun",
 						Version:    "1.1.6",
@@ -96,11 +102,12 @@ func TestParseRebarLock(t *testing.T) {
 					},
 				},
 				{
-					Name:     "unicode_util_compat",
-					Version:  "0.7.0",
-					Language: pkg.Erlang,
-					Type:     pkg.HexPkg,
-					PURL:     "pkg:hex/unicode_util_compat@0.7.0",
+					Name:         "unicode_util_compat",
+					Version:      "0.7.0",
+					Language:     pkg.Erlang,
+					Type:         pkg.HexPkg,
+					PURL:         "pkg:hex/unicode_util_compat@0.7.0",
+					Dependencies: pkg.UnknownDependencyCompleteness,
 					Metadata: pkg.ErlangRebarLockEntry{
 						Name:       "unicode_util_compat",
 						Version:    "0.7.0",
@@ -117,11 +124,12 @@ func TestParseRebarLock(t *testing.T) {
 				// {<<"bcrypt">>, <<"A6763BD4E1AF46D34776F85B7995E63A02978DE110C077E9570ED17006E03386">>},
 				// {<<"bcrypt">>, <<"3418821BC17CE6E96A4A77D1A88D7485BF783E212069FACFC79510AFBFF95352">>},
 				{
-					Name:     "bcrypt",
-					Version:  "1.1.5",
-					Language: pkg.Erlang,
-					Type:     pkg.HexPkg,
-					PURL:     "pkg:hex/bcrypt@1.1.5",
+					Name:         "bcrypt",
+					Version:      "1.1.5",
+					Language:     pkg.Erlang,
+					Type:         pkg.HexPkg,
+					PURL:         "pkg:hex/bcrypt@1.1.5",
+					Dependencies: pkg.UnknownDependencyCompleteness,
 					Metadata: pkg.ErlangRebarLockEntry{
 						Name:       "bcrypt",
 						Version:    "1.1.5",
@@ -134,11 +142,12 @@ func TestParseRebarLock(t *testing.T) {
 				//       {ref,"14308ab927cfa69324742c3de720578094e0bb19"}},
 				//  1},
 				{
-					Name:     "bson",
-					Version:  "14308ab927cfa69324742c3de720578094e0bb19",
-					Language: pkg.Erlang,
-					Type:     pkg.HexPkg,
-					PURL:     "pkg:hex/bson@14308ab927cfa69324742c3de720578094e0bb19",
+					Name:         "bson",
+					Version:      "14308ab927cfa69324742c3de720578094e0bb19",
+					Language:     pkg.Erlang,
+					Type:         pkg.HexPkg,
+					PURL:         "pkg:hex/bson@14308ab927cfa69324742c3de720578094e0bb19",
+					Dependencies: pkg.UnknownDependencyCompleteness,
 					Metadata: pkg.ErlangRebarLockEntry{
 						Name:    "bson",
 						Version: "14308ab927cfa69324742c3de720578094e0bb19",
@@ -148,11 +157,12 @@ func TestParseRebarLock(t *testing.T) {
 				// {<<"certifi">>, <<"6F2A475689DD47F19FB74334859D460A2DC4E3252A3324BD2111B8F0429E7E21">>}, {<<"stdout_formatter">>, <<"EC24868D8619757A68F0798357C7190807A1CFC42CE90C18C23760E59249A21A">>},
 				// {<<"certifi">>, <<"266DA46BDB06D6C6D35FDE799BCB28D36D985D424AD7C08B5BB48F5B5CDD4641">>},
 				{
-					Name:     "certifi",
-					Version:  "2.9.0",
-					Language: pkg.Erlang,
-					Type:     pkg.HexPkg,
-					PURL:     "pkg:hex/certifi@2.9.0",
+					Name:         "certifi",
+					Version:      "2.9.0",
+					Language:     pkg.Erlang,
+					Type:         pkg.HexPkg,
+					PURL:         "pkg:hex/certifi@2.9.0",
+					Dependencies: pkg.UnknownDependencyCompleteness,
 					Metadata: pkg.ErlangRebarLockEntry{
 						Name:       "certifi",
 						Version:    "2.9.0",
@@ -164,11 +174,12 @@ func TestParseRebarLock(t *testing.T) {
 				// {<<"stdout_formatter">>, <<"EC24868D8619757A68F0798357C7190807A1CFC42CE90C18C23760E59249A21A">>},
 				// {<<"stdout_formatter">>, <<"6B9CAAD8930006F9BB35680C5D3311917AC67690C3AF1BA018623324C015ABE5">>},
 				{
-					Name:     "stdout_formatter",
-					Version:  "0.2.3",
-					Language: pkg.Erlang,
-					Type:     pkg.HexPkg,
-					PURL:     "pkg:hex/stdout_formatter@0.2.3",
+					Name:         "stdout_formatter",
+					Version:      "0.2.3",
+					Language:     pkg.Erlang,
+					Type:         pkg.HexPkg,
+					PURL:         "pkg:hex/stdout_formatter@0.2.3",
+					Dependencies: pkg.UnknownDependencyCompleteness,
 					Metadata: pkg.ErlangRebarLockEntry{
 						Name:       "stdout_formatter",
 						Version:    "0.2.3",
@@ -181,11 +192,12 @@ func TestParseRebarLock(t *testing.T) {
 				//       {ref,"4835239dca5a5f4ac7202dd94d7effcaa617d575"}},
 				//  0},
 				{
-					Name:     "swc",
-					Version:  "4835239dca5a5f4ac7202dd94d7effcaa617d575",
-					Language: pkg.Erlang,
-					Type:     pkg.HexPkg,
-					PURL:     "pkg:hex/swc@4835239dca5a5f4ac7202dd94d7effcaa617d575",
+					Name:         "swc",
+					Version:      "4835239dca5a5f4ac7202dd94d7effcaa617d575",
+					Language:     pkg.Erlang,
+					Type:         pkg.HexPkg,
+					PURL:         "pkg:hex/swc@4835239dca5a5f4ac7202dd94d7effcaa617d575",
+					Dependencies: pkg.UnknownDependencyCompleteness,
 					Metadata: pkg.ErlangRebarLockEntry{
 						Name:    "swc",
 						Version: "4835239dca5a5f4ac7202dd94d7effcaa617d575",
@@ -195,11 +207,12 @@ func TestParseRebarLock(t *testing.T) {
 				// {<<"syslog">>, <<"6419A232BEA84F07B56DC575225007FFE34D9FDC91ABE6F1B2F254FD71D8EFC2">>},
 				// {<<"syslog">>, <<"4C6A41373C7E20587BE33EF841D3DE6F3BEBA08519809329ECC4D27B15B659E1">>},
 				{
-					Name:     "syslog",
-					Version:  "1.1.0",
-					Language: pkg.Erlang,
-					Type:     pkg.HexPkg,
-					PURL:     "pkg:hex/syslog@1.1.0",
+					Name:         "syslog",
+					Version:      "1.1.0",
+					Language:     pkg.Erlang,
+					Type:         pkg.HexPkg,
+					PURL:         "pkg:hex/syslog@1.1.0",
+					Dependencies: pkg.UnknownDependencyCompleteness,
 					Metadata: pkg.ErlangRebarLockEntry{
 						Name:       "syslog",
 						Version:    "1.1.0",
@@ -211,11 +224,12 @@ func TestParseRebarLock(t *testing.T) {
 				// {<<"unicode_util_compat">>, <<"BC84380C9AB48177092F43AC89E4DFA2C6D62B40B8BD132B1059ECC7232F9A78">>}]},
 				// {<<"unicode_util_compat">>, <<"25EEE6D67DF61960CF6A794239566599B09E17E668D3700247BC498638152521">>}]}
 				{
-					Name:     "unicode_util_compat",
-					Version:  "0.7.0",
-					Language: pkg.Erlang,
-					Type:     pkg.HexPkg,
-					PURL:     "pkg:hex/unicode_util_compat@0.7.0",
+					Name:         "unicode_util_compat",
+					Version:      "0.7.0",
+					Language:     pkg.Erlang,
+					Type:         pkg.HexPkg,
+					PURL:         "pkg:hex/unicode_util_compat@0.7.0",
+					Dependencies: pkg.UnknownDependencyCompleteness,
 					Metadata: pkg.ErlangRebarLockEntry{
 						Name:       "unicode_util_compat",
 						Version:    "0.7.0",
@@ -228,11 +242,12 @@ func TestParseRebarLock(t *testing.T) {
 				//       {ref,"6d622aa8c901ae7777433aef2bd049e380c474a6"}},
 				//  0}]}.
 				{
-					Name:     "vernemq_dev",
-					Version:  "6d622aa8c901ae7777433aef2bd049e380c474a6",
-					Language: pkg.Erlang,
-					Type:     pkg.HexPkg,
-					PURL:     "pkg:hex/vernemq_dev@6d622aa8c901ae7777433aef2bd049e380c474a6",
+					Name:         "vernemq_dev",
+					Version:      "6d622aa8c901ae7777433aef2bd049e380c474a6",
+					Language:     pkg.Erlang,
+					Type:         pkg.HexPkg,
+					PURL:         "pkg:hex/vernemq_dev@6d622aa8c901ae7777433aef2bd049e380c474a6",
+					Dependencies: pkg.UnknownDependencyCompleteness,
 					Metadata: pkg.ErlangRebarLockEntry{
 						Name:    "vernemq_dev",
 						Version: "6d622aa8c901ae7777433aef2bd049e380c474a6",
@@ -154,7 +154,7 @@ func (c *Cataloger) Catalog(ctx context.Context, resolver file.Resolver) ([]pkg.
 	var relationships []artifact.Relationship
 	var errs error

-	logger := log.Nested("cataloger", c.upstreamCataloger)
+	lgr := log.Nested("cataloger", c.upstreamCataloger)

 	env := Environment{
 		// TODO: consider passing into the cataloger, this would affect the cataloger interface (and all implementations). This can be deferred until later.
@@ -166,7 +166,7 @@ func (c *Cataloger) Catalog(ctx context.Context, resolver file.Resolver) ([]pkg.

 		log.WithFields("path", location.RealPath).Trace("parsing file contents")

-		discoveredPackages, discoveredRelationships, err := invokeParser(ctx, resolver, location, logger, parser, &env)
+		discoveredPackages, discoveredRelationships, err := invokeParser(ctx, resolver, location, lgr, parser, &env)
 		if err != nil {
 			// parsers may return errors and valid packages / relationships
 			errs = unknown.Append(errs, location, err)
@@ -108,7 +108,7 @@ func newSpyReturningFileResolver(s *spyingIoReadCloser, paths ...string) file.Re
 }

 func (s *spyingIoReadCloser) Read(p []byte) (n int, err error) {
-	return s.Read(p)
+	return s.rc.Read(p)
 }

 func (s *spyingIoReadCloser) Close() error {
@@ -22,8 +22,9 @@ func TestPortageCataloger(t *testing.T) {
 				file.NewLocation("var/db/pkg/app-containers/skopeo-1.5.1/SIZE"),
 				expectedLicenseLocation,
 			),
-			Licenses: pkg.NewLicenseSet(pkg.NewLicensesFromLocation(expectedLicenseLocation, "Apache-2.0", "BSD", "BSD-2", "CC-BY-SA-4.0", "ISC", "MIT")...),
-			Type:     pkg.PortagePkg,
+			Licenses:     pkg.NewLicenseSet(pkg.NewLicensesFromLocation(expectedLicenseLocation, "Apache-2.0", "BSD", "BSD-2", "CC-BY-SA-4.0", "ISC", "MIT")...),
+			Type:         pkg.PortagePkg,
+			Dependencies: pkg.UnknownDependencyCompleteness,
 			Metadata: pkg.PortageEntry{
 				InstalledSize: 27937835,
 				Files: []pkg.PortageFileRecord{
@@ -45,7 +45,8 @@ func parsePortageContents(_ context.Context, resolver file.Resolver, _ *generic.
 		Locations: file.NewLocationSet(
 			reader.Location.WithAnnotation(pkg.EvidenceAnnotationKey, pkg.PrimaryEvidenceAnnotation),
 		),
-		Type: pkg.PortagePkg,
+		Dependencies: pkg.UnknownDependencyCompleteness,
+		Type:         pkg.PortagePkg,
 		Metadata: pkg.PortageEntry{
 			// ensure the default value for a collection is never nil since this may be shown as JSON
 			Files: make([]pkg.PortageFileRecord, 0),
@@ -31,7 +31,9 @@ func newGithubActionWorkflowPackageUsage(name, version string, workflowLocation
 		Version:   version,
 		Locations: file.NewLocationSet(workflowLocation.WithAnnotation(pkg.EvidenceAnnotationKey, pkg.PrimaryEvidenceAnnotation)),
 		PURL:      packageURL(name, version),
-		Type:      pkg.GithubActionWorkflowPkg,
+		// we have full visibility into the dependencies of a workflow file except for when using shared workflows
+		Dependencies: pkg.CompleteDependencies,
+		Type:         pkg.GithubActionWorkflowPkg,
 	}

 	p.SetID()
@@ -45,7 +47,9 @@ func newGithubActionPackageUsage(name, version string, workflowLocation file.Loc
 		Version:   version,
 		Locations: file.NewLocationSet(workflowLocation.WithAnnotation(pkg.EvidenceAnnotationKey, pkg.PrimaryEvidenceAnnotation)),
 		PURL:      packageURL(name, version),
-		Type:      pkg.GithubActionPkg,
+		// we cannot see what the dependencies are for a github action are locally from workflow yaml files
+		Dependencies: pkg.UnknownDependencyCompleteness,
+		Type:         pkg.GithubActionPkg,
 	}

 	p.SetID()
@@ -15,18 +15,20 @@ func Test_parseCompositeActionForActionUsage(t *testing.T) {

 	expected := []pkg.Package{
 		{
-			Name:      "actions/setup-go",
-			Version:   "v4",
-			Type:      pkg.GithubActionPkg,
-			Locations: fixtureLocationSet,
-			PURL:      "pkg:github/actions/setup-go@v4",
+			Name:         "actions/setup-go",
+			Version:      "v4",
+			Type:         pkg.GithubActionPkg,
+			Locations:    fixtureLocationSet,
+			PURL:         "pkg:github/actions/setup-go@v4",
+			Dependencies: pkg.UnknownDependencyCompleteness,
 		},
 		{
-			Name:      "actions/cache",
-			Version:   "v3",
-			Type:      pkg.GithubActionPkg,
-			Locations: fixtureLocationSet,
-			PURL:      "pkg:github/actions/cache@v3",
+			Name:         "actions/cache",
+			Version:      "v3",
+			Type:         pkg.GithubActionPkg,
+			Locations:    fixtureLocationSet,
+			PURL:         "pkg:github/actions/cache@v3",
+			Dependencies: pkg.UnknownDependencyCompleteness,
 		},
 	}

@@ -15,39 +15,44 @@ func Test_parseWorkflowForActionUsage(t *testing.T) {

 	expected := []pkg.Package{
 		{
-			Name:      "./.github/actions/bootstrap",
-			Version:   "",
-			Type:      pkg.GithubActionPkg,
-			Locations: fixtureLocationSet,
-			PURL:      "", // don't have enough context without parsing the git origin, which still may not be accurate
+			Name:         "./.github/actions/bootstrap",
+			Version:      "",
+			Type:         pkg.GithubActionPkg,
+			Locations:    fixtureLocationSet,
+			PURL:         "", // don't have enough context without parsing the git origin, which still may not be accurate
+			Dependencies: pkg.UnknownDependencyCompleteness,
 		},
 		{
-			Name:      "actions/cache",
-			Version:   "v3",
-			Type:      pkg.GithubActionPkg,
-			Locations: fixtureLocationSet,
-			PURL:      "pkg:github/actions/cache@v3",
+			Name:         "actions/cache",
+			Version:      "v3",
+			Type:         pkg.GithubActionPkg,
+			Locations:    fixtureLocationSet,
+			PURL:         "pkg:github/actions/cache@v3",
+			Dependencies: pkg.UnknownDependencyCompleteness,
 		},
 		{
-			Name:      "actions/cache/restore",
-			Version:   "v3",
-			Type:      pkg.GithubActionPkg,
-			Locations: fixtureLocationSet,
-			PURL:      "pkg:github/actions/cache@v3#restore",
+			Name:         "actions/cache/restore",
+			Version:      "v3",
+			Type:         pkg.GithubActionPkg,
+			Locations:    fixtureLocationSet,
+			PURL:         "pkg:github/actions/cache@v3#restore",
+			Dependencies: pkg.UnknownDependencyCompleteness,
 		},
 		{
-			Name:      "actions/cache/save",
-			Version:   "v3",
-			Type:      pkg.GithubActionPkg,
-			Locations: fixtureLocationSet,
-			PURL:      "pkg:github/actions/cache@v3#save",
+			Name:         "actions/cache/save",
+			Version:      "v3",
+			Type:         pkg.GithubActionPkg,
+			Locations:    fixtureLocationSet,
+			PURL:         "pkg:github/actions/cache@v3#save",
+			Dependencies: pkg.UnknownDependencyCompleteness,
 		},
 		{
-			Name:      "actions/checkout",
-			Version:   "v4",
-			Type:      pkg.GithubActionPkg,
-			Locations: fixtureLocationSet,
-			PURL:      "pkg:github/actions/checkout@v4",
+			Name:         "actions/checkout",
+			Version:      "v4",
+			Type:         pkg.GithubActionPkg,
+			Locations:    fixtureLocationSet,
+			PURL:         "pkg:github/actions/checkout@v4",
+			Dependencies: pkg.UnknownDependencyCompleteness,
 		},
 	}

@@ -61,25 +66,28 @@ func Test_parseWorkflowForWorkflowUsage(t *testing.T) {

 	expected := []pkg.Package{
 		{
-			Name:      "octo-org/this-repo/.github/workflows/workflow-1.yml",
-			Version:   "172239021f7ba04fe7327647b213799853a9eb89",
-			Type:      pkg.GithubActionWorkflowPkg,
-			Locations: fixtureLocationSet,
-			PURL:      "pkg:github/octo-org/this-repo@172239021f7ba04fe7327647b213799853a9eb89#.github/workflows/workflow-1.yml",
+			Name:         "octo-org/this-repo/.github/workflows/workflow-1.yml",
+			Version:      "172239021f7ba04fe7327647b213799853a9eb89",
+			Type:         pkg.GithubActionWorkflowPkg,
+			Locations:    fixtureLocationSet,
+			PURL:         "pkg:github/octo-org/this-repo@172239021f7ba04fe7327647b213799853a9eb89#.github/workflows/workflow-1.yml",
+			Dependencies: pkg.CompleteDependencies,
 		},
 		{
-			Name:      "./.github/workflows/workflow-2.yml",
-			Version:   "",
-			Type:      pkg.GithubActionWorkflowPkg,
-			Locations: fixtureLocationSet,
-			PURL:      "", // don't have enough context without parsing the git origin, which still may not be accurate
+			Name:         "./.github/workflows/workflow-2.yml",
+			Version:      "",
+			Type:         pkg.GithubActionWorkflowPkg,
+			Locations:    fixtureLocationSet,
+			PURL:         "", // don't have enough context without parsing the git origin, which still may not be accurate
+			Dependencies: pkg.CompleteDependencies,
 		},
 		{
-			Name:      "octo-org/another-repo/.github/workflows/workflow.yml",
-			Version:   "v1",
-			Type:      pkg.GithubActionWorkflowPkg,
-			Locations: fixtureLocationSet,
-			PURL:      "pkg:github/octo-org/another-repo@v1#.github/workflows/workflow.yml",
+			Name:         "octo-org/another-repo/.github/workflows/workflow.yml",
+			Version:      "v1",
+			Type:         pkg.GithubActionWorkflowPkg,
+			Locations:    fixtureLocationSet,
+			PURL:         "pkg:github/octo-org/another-repo@v1#.github/workflows/workflow.yml",
+			Dependencies: pkg.CompleteDependencies,
 		},
 	}

@@ -3,6 +3,7 @@ package golang
 import (
 	"archive/zip"
 	"bytes"
+	"context"
 	"fmt"
 	"io"
 	"io/fs"
@@ -79,9 +80,9 @@ func remotesForModule(proxies []string, noProxy []string, module string) []strin
 	return proxies
 }

-func (c *goLicenseResolver) getLicenses(resolver file.Resolver, moduleName, moduleVersion string) ([]pkg.License, error) {
+func (c *goLicenseResolver) getLicenses(ctx context.Context, scanner licenses.Scanner, resolver file.Resolver, moduleName, moduleVersion string) ([]pkg.License, error) {
 	// search the scan target first, ignoring local and remote sources
-	goLicenses, err := c.findLicensesInSource(resolver,
+	goLicenses, err := c.findLicensesInSource(ctx, scanner, resolver,
 		fmt.Sprintf(`**/go/pkg/mod/%s@%s/*`, processCaps(moduleName), moduleVersion),
 	)
 	if err != nil || len(goLicenses) > 0 {
@@ -90,7 +91,7 @@ func (c *goLicenseResolver) getLicenses(resolver file.Resolver, moduleName, modu

 	// look in the local host mod directory...
 	if c.opts.SearchLocalModCacheLicenses {
-		goLicenses, err = c.getLicensesFromLocal(moduleName, moduleVersion)
+		goLicenses, err = c.getLicensesFromLocal(ctx, scanner, moduleName, moduleVersion)
 		if err != nil || len(goLicenses) > 0 {
 			return toPkgLicenses(goLicenses), err
 		}
@@ -98,13 +99,13 @@ func (c *goLicenseResolver) getLicenses(resolver file.Resolver, moduleName, modu

 	// download from remote sources
 	if c.opts.SearchRemoteLicenses {
-		goLicenses, err = c.getLicensesFromRemote(moduleName, moduleVersion)
+		goLicenses, err = c.getLicensesFromRemote(ctx, scanner, moduleName, moduleVersion)
 	}

 	return toPkgLicenses(goLicenses), err
 }

-func (c *goLicenseResolver) getLicensesFromLocal(moduleName, moduleVersion string) ([]goLicense, error) {
+func (c *goLicenseResolver) getLicensesFromLocal(ctx context.Context, scanner licenses.Scanner, moduleName, moduleVersion string) ([]goLicense, error) {
 	if c.localModCacheDir == nil {
 		return nil, nil
 	}
@@ -120,10 +121,10 @@ func (c *goLicenseResolver) getLicensesFromLocal(moduleName, moduleVersion strin
 	// if we're running against a directory on the filesystem, it may not include the
 	// user's homedir / GOPATH, so we defer to using the localModCacheResolver
 	// we use $GOPATH/pkg/mod to avoid leaking information about the user's system
-	return c.findLicensesInFS("file://$GOPATH/pkg/mod/"+subdir+"/", dir)
+	return c.findLicensesInFS(ctx, scanner, "file://$GOPATH/pkg/mod/"+subdir+"/", dir)
 }

-func (c *goLicenseResolver) getLicensesFromRemote(moduleName, moduleVersion string) ([]goLicense, error) {
+func (c *goLicenseResolver) getLicensesFromRemote(ctx context.Context, scanner licenses.Scanner, moduleName, moduleVersion string) ([]goLicense, error) {
 	return c.licenseCache.Resolve(fmt.Sprintf("%s/%s", moduleName, moduleVersion), func() ([]goLicense, error) {
 		proxies := remotesForModule(c.opts.Proxies, c.opts.NoProxy, moduleName)

@@ -132,11 +133,11 @@ func (c *goLicenseResolver) getLicensesFromRemote(moduleName, moduleVersion stri
 			return nil, err
 		}

-		return c.findLicensesInFS(urlPrefix, fsys)
+		return c.findLicensesInFS(ctx, scanner, urlPrefix, fsys)
 	})
 }

-func (c *goLicenseResolver) findLicensesInFS(urlPrefix string, fsys fs.FS) ([]goLicense, error) {
+func (c *goLicenseResolver) findLicensesInFS(ctx context.Context, scanner licenses.Scanner, urlPrefix string, fsys fs.FS) ([]goLicense, error) {
 	var out []goLicense
 	err := fs.WalkDir(fsys, ".", func(filePath string, d fs.DirEntry, err error) error {
 		if err != nil {
@@ -156,7 +157,8 @@ func (c *goLicenseResolver) findLicensesInFS(urlPrefix string, fsys fs.FS) ([]go
 			return nil
 		}
 		defer internal.CloseAndLogError(rdr, filePath)
-		parsed, err := licenses.Parse(rdr, file.NewLocation(filePath))
+
+		parsed, err := licenses.Search(ctx, scanner, file.NewLocationReadCloser(file.NewLocation(filePath), rdr))
 		if err != nil {
 			log.Debugf("error parsing license file %s: %v", filePath, err)
 			return nil
@@ -174,7 +176,7 @@ func (c *goLicenseResolver) findLicensesInFS(urlPrefix string, fsys fs.FS) ([]go
 	return out, err
 }

-func (c *goLicenseResolver) findLicensesInSource(resolver file.Resolver, globMatch string) ([]goLicense, error) {
+func (c *goLicenseResolver) findLicensesInSource(ctx context.Context, scanner licenses.Scanner, resolver file.Resolver, globMatch string) ([]goLicense, error) {
 	var out []goLicense
 	locations, err := resolver.FilesByGlob(globMatch)
 	if err != nil {
@@ -182,7 +184,7 @@ func (c *goLicenseResolver) findLicensesInSource(resolver file.Resolver, globMat
 	}

 	for _, l := range locations {
-		parsed, err := c.parseLicenseFromLocation(l, resolver)
+		parsed, err := c.parseLicenseFromLocation(ctx, scanner, l, resolver)
 		if err != nil {
 			return nil, err
 		}
@@ -200,7 +202,7 @@ func (c *goLicenseResolver) findLicensesInSource(resolver file.Resolver, globMat
 	return out, nil
 }

-func (c *goLicenseResolver) parseLicenseFromLocation(l file.Location, resolver file.Resolver) ([]goLicense, error) {
+func (c *goLicenseResolver) parseLicenseFromLocation(ctx context.Context, scanner licenses.Scanner, l file.Location, resolver file.Resolver) ([]goLicense, error) {
 	var out []goLicense
 	fileName := path.Base(l.RealPath)
 	if c.lowerLicenseFileNames.Has(strings.ToLower(fileName)) {
@@ -209,7 +211,7 @@ func (c *goLicenseResolver) parseLicenseFromLocation(l file.Location, resolver f
 			return nil, err
 		}
 		defer internal.CloseAndLogError(contents, l.RealPath)
-		parsed, err := licenses.Parse(contents, l)
+		parsed, err := licenses.Search(ctx, scanner, file.NewLocationReadCloser(l, contents))
 		if err != nil {
 			return nil, err
 		}
@@ -3,6 +3,7 @@ package golang
 import (
 	"archive/zip"
 	"bytes"
+	"context"
 	"fmt"
 	"io/fs"
 	"net/http"
@@ -15,6 +16,7 @@ import (

 	"github.com/stretchr/testify/require"

+	"github.com/anchore/syft/internal/licenses"
 	"github.com/anchore/syft/syft/file"
 	"github.com/anchore/syft/syft/internal/fileresolver"
 	"github.com/anchore/syft/syft/license"
@@ -26,6 +28,8 @@ func Test_LocalLicenseSearch(t *testing.T) {
 	loc2 := file.NewLocation("github.com/!cap!o!r!g/!cap!project@v4.111.5/LICENSE.txt")
 	loc3 := file.NewLocation("github.com/someorg/strangelicense@v1.2.3/LiCeNsE.tXt")

+	licenseScanner := licenses.TestingOnlyScanner()
+
 	tests := []struct {
 		name     string
 		version  string
@@ -78,12 +82,12 @@ func Test_LocalLicenseSearch(t *testing.T) {
 					LocalModCacheDir:            filepath.Join(wd, "test-fixtures", "licenses", "pkg", "mod"),
 				},
 			)
-			licenses, err := l.getLicenses(fileresolver.Empty{}, test.name, test.version)
+			lics, err := l.getLicenses(context.Background(), licenseScanner, fileresolver.Empty{}, test.name, test.version)
 			require.NoError(t, err)

-			require.Len(t, licenses, 1)
+			require.Len(t, lics, 1)

-			require.Equal(t, test.expected, licenses[0])
+			require.Equal(t, test.expected, lics[0])
 		})
 	}
 }
@@ -92,6 +96,8 @@ func Test_RemoteProxyLicenseSearch(t *testing.T) {
 	loc1 := file.NewLocation("github.com/someorg/somename@v0.3.2/LICENSE")
 	loc2 := file.NewLocation("github.com/!cap!o!r!g/!cap!project@v4.111.5/LICENSE.txt")

+	licenseScanner := licenses.TestingOnlyScanner()
+
 	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		buf := &bytes.Buffer{}
 		uri := strings.TrimPrefix(strings.TrimSuffix(r.RequestURI, ".zip"), "/")
@@ -169,12 +175,12 @@ func Test_RemoteProxyLicenseSearch(t *testing.T) {
 				},
 			)

-			licenses, err := l.getLicenses(fileresolver.Empty{}, test.name, test.version)
+			lics, err := l.getLicenses(context.Background(), licenseScanner, fileresolver.Empty{}, test.name, test.version)
 			require.NoError(t, err)

-			require.Len(t, licenses, 1)
+			require.Len(t, lics, 1)

-			require.Equal(t, test.expected, licenses[0])
+			require.Equal(t, test.expected, lics[0])
 		})
 	}
 }
@@ -248,7 +254,7 @@ func Test_findVersionPath(t *testing.T) {

 func Test_walkDirErrors(t *testing.T) {
 	resolver := newGoLicenseResolver("", CatalogerConfig{})
-	_, err := resolver.findLicensesInFS("somewhere", badFS{})
+	_, err := resolver.findLicensesInFS(context.Background(), licenses.TestingOnlyScanner(), "somewhere", badFS{})
 	require.Error(t, err)
 }

@@ -266,6 +272,8 @@ func Test_noLocalGoModDir(t *testing.T) {
 	validTmp := t.TempDir()
 	require.NoError(t, os.MkdirAll(filepath.Join(validTmp, "mod@ver"), 0700|os.ModeDir))

+	licenseScanner := licenses.TestingOnlyScanner()
+
 	tests := []struct {
 		name    string
 		dir     string
@@ -299,7 +307,7 @@ func Test_noLocalGoModDir(t *testing.T) {
 				SearchLocalModCacheLicenses: true,
 				LocalModCacheDir:            test.dir,
 			})
-			_, err := resolver.getLicensesFromLocal("mod", "ver")
+			_, err := resolver.getLicensesFromLocal(context.Background(), licenseScanner, "mod", "ver")
 			test.wantErr(t, err)
 		})
 	}
@@ -5,29 +5,24 @@ import (
 	"strings"

 	"github.com/anchore/packageurl-go"
-	"github.com/anchore/syft/internal/log"
 	"github.com/anchore/syft/syft/file"
 	"github.com/anchore/syft/syft/pkg"
 )

-func (c *goBinaryCataloger) newGoBinaryPackage(resolver file.Resolver, dep *debug.Module, mainModule, goVersion, architecture string, buildSettings pkg.KeyValues, cryptoSettings, experiments []string, locations ...file.Location) pkg.Package {
+func (c *goBinaryCataloger) newGoBinaryPackage(dep *debug.Module, mainModule, goVersion, architecture string, buildSettings pkg.KeyValues, cryptoSettings, experiments []string, licenses []pkg.License, dependencies pkg.DependencyCompleteness, locations ...file.Location) pkg.Package {
 	if dep.Replace != nil {
 		dep = dep.Replace
 	}

-	licenses, err := c.licenseResolver.getLicenses(resolver, dep.Path, dep.Version)
-	if err != nil {
-		log.Tracef("error getting licenses for golang package: %s %v", dep.Path, err)
-	}
-
 	p := pkg.Package{
-		Name:      dep.Path,
-		Version:   dep.Version,
-		Licenses:  pkg.NewLicenseSet(licenses...),
-		PURL:      packageURL(dep.Path, dep.Version),
-		Language:  pkg.Go,
-		Type:      pkg.GoModulePkg,
-		Locations: file.NewLocationSet(locations...),
+		Name:         dep.Path,
+		Version:      dep.Version,
+		Licenses:     pkg.NewLicenseSet(licenses...),
+		PURL:         packageURL(dep.Path, dep.Version),
+		Language:     pkg.Go,
+		Type:         pkg.GoModulePkg,
+		Locations:    file.NewLocationSet(locations...),
+		Dependencies: dependencies,
 		Metadata: pkg.GolangBinaryBuildinfoEntry{
 			GoCompiledVersion: goVersion,
 			H1Digest:          dep.Sum,
@@ -18,6 +18,7 @@ import (
 	"golang.org/x/mod/module"

 	"github.com/anchore/syft/internal"
+	"github.com/anchore/syft/internal/licenses"
 	"github.com/anchore/syft/internal/log"
 	"github.com/anchore/syft/syft/artifact"
 	"github.com/anchore/syft/syft/file"
@@ -59,9 +60,11 @@ func newGoBinaryCataloger(opts CatalogerConfig) *goBinaryCataloger {
 }

 // parseGoBinary catalogs packages found in the "buildinfo" section of a binary built by the go compiler.
-func (c *goBinaryCataloger) parseGoBinary(_ context.Context, resolver file.Resolver, _ *generic.Environment, reader file.LocationReadCloser) ([]pkg.Package, []artifact.Relationship, error) {
+func (c *goBinaryCataloger) parseGoBinary(ctx context.Context, resolver file.Resolver, _ *generic.Environment, reader file.LocationReadCloser) ([]pkg.Package, []artifact.Relationship, error) {
 	var pkgs []pkg.Package

+	licenseScanner := licenses.ContextLicenseScanner(ctx)
+
 	unionReader, err := unionreader.GetUnionReader(reader.ReadCloser)
 	if err != nil {
 		return nil, nil, err
@@ -73,7 +76,7 @@ func (c *goBinaryCataloger) parseGoBinary(_ context.Context, resolver file.Resol
 	var rels []artifact.Relationship
 	for _, mod := range mods {
 		var depPkgs []pkg.Package
-		mainPkg, depPkgs := c.buildGoPkgInfo(resolver, reader.Location, mod, mod.arch, unionReader)
+		mainPkg, depPkgs := c.buildGoPkgInfo(ctx, licenseScanner, resolver, reader.Location, mod, mod.arch, unionReader)
 		if mainPkg != nil {
 			rels = createModuleRelationships(*mainPkg, depPkgs)
 			pkgs = append(pkgs, *mainPkg)
@@ -101,7 +104,7 @@ func createModuleRelationships(main pkg.Package, deps []pkg.Package) []artifact.
 var emptyModule debug.Module
 var moduleFromPartialPackageBuild = debug.Module{Path: "command-line-arguments"}

-func (c *goBinaryCataloger) buildGoPkgInfo(resolver file.Resolver, location file.Location, mod *extendedBuildInfo, arch string, reader io.ReadSeekCloser) (*pkg.Package, []pkg.Package) {
+func (c *goBinaryCataloger) buildGoPkgInfo(ctx context.Context, licenseScanner licenses.Scanner, resolver file.Resolver, location file.Location, mod *extendedBuildInfo, arch string, reader io.ReadSeekCloser) (*pkg.Package, []pkg.Package) {
 	if mod == nil {
 		return nil, nil
 	}
@@ -116,9 +119,13 @@ func (c *goBinaryCataloger) buildGoPkgInfo(resolver file.Resolver, location file
 			continue
 		}

+		lics, err := c.licenseResolver.getLicenses(ctx, licenseScanner, resolver, dep.Path, dep.Version)
+		if err != nil {
+			log.Tracef("error getting licenses for golang package: %s %v", dep.Path, err)
+		}
+
 		gover, experiments := getExperimentsFromVersion(mod.GoVersion)
 		p := c.newGoBinaryPackage(
-			resolver,
 			dep,
 			mod.Main.Path,
 			gover,
@@ -126,6 +133,11 @@ func (c *goBinaryCataloger) buildGoPkgInfo(resolver file.Resolver, location file
 			nil,
 			mod.cryptoSettings,
 			experiments,
+			lics,
+			// the buildinfo section is a flat list of dependencies missing all edge information. So all direct and indirect
+			// dependencies are related directly to the main module. This means that we don't have any way to discover
+			// the completeness of the dependency's dependencies, thus they are unknown.
+			pkg.UnknownDependencyCompleteness,
 			location.WithAnnotation(pkg.EvidenceAnnotationKey, pkg.PrimaryEvidenceAnnotation),
 		)
 		if pkg.IsValid(&p) {
@@ -137,7 +149,7 @@ func (c *goBinaryCataloger) buildGoPkgInfo(resolver file.Resolver, location file
 		return nil, pkgs
 	}

-	main := c.makeGoMainPackage(resolver, mod, arch, location, reader)
+	main := c.makeGoMainPackage(ctx, licenseScanner, resolver, mod, arch, location, reader)

 	return &main, pkgs
 }
@@ -152,11 +164,16 @@ func missingMainModule(mod *extendedBuildInfo) bool {
 	return mod.Main == moduleFromPartialPackageBuild
 }

-func (c *goBinaryCataloger) makeGoMainPackage(resolver file.Resolver, mod *extendedBuildInfo, arch string, location file.Location, reader io.ReadSeekCloser) pkg.Package {
+func (c *goBinaryCataloger) makeGoMainPackage(ctx context.Context, licenseScanner licenses.Scanner, resolver file.Resolver, mod *extendedBuildInfo, arch string, location file.Location, reader io.ReadSeekCloser) pkg.Package {
 	gbs := getBuildSettings(mod.Settings)
+
+	lics, err := c.licenseResolver.getLicenses(ctx, licenseScanner, resolver, mod.Main.Path, mod.Main.Version)
+	if err != nil {
+		log.Tracef("error getting licenses for golang package: %s %v", mod.Main.Path, err)
+	}
+
 	gover, experiments := getExperimentsFromVersion(mod.GoVersion)
 	main := c.newGoBinaryPackage(
-		resolver,
 		&mod.Main,
 		mod.Main.Path,
 		gover,
@@ -164,6 +181,12 @@ func (c *goBinaryCataloger) makeGoMainPackage(resolver file.Resolver, mod *exten
 		gbs,
 		mod.cryptoSettings,
 		experiments,
+		lics,
+		// the buildinfo section is a flat list of dependencies missing all edge information. So all direct and indirect
+		// dependencies are related directly to the main module. Also, we don't have a way to express on a package or
+		// relationship the nature of "//indirect" markings on dependencies so though the dependencies are complete
+		// and separable with the raw data, the data in the SBOM is not separable.
+		pkg.CompleteWithIndirectDependencies,
 		location.WithAnnotation(pkg.EvidenceAnnotationKey, pkg.PrimaryEvidenceAnnotation),
 	)

@@ -196,7 +219,7 @@ func (c *goBinaryCataloger) makeGoMainPackage(resolver file.Resolver, mod *exten
 // this is checking for (.L)? because at least one binary seems to have \xA0L preceding the version string, but for some reason
 // this is unable to be matched by the regex here as \x00\xA0L;
 // the only thing that seems to work is to just look for version strings following both \x00 and \x00.L for now
-var semverPattern = regexp.MustCompile(`\x00(.L)?(?P<version>v?(\d+\.\d+\.\d+[-\w]*[+\w]*))\x00`)
+var semverPattern = regexp.MustCompile(`(\x00|\x{FFFD})(.L)?(?P<version>v?(\d+\.\d+\.\d+[-\w]*[+\w]*))\x00`)

 func (c *goBinaryCataloger) findMainModuleVersion(metadata *pkg.GolangBinaryBuildinfoEntry, gbs pkg.KeyValues, reader io.ReadSeekCloser) string {
 	vcsVersion, hasVersion := gbs.Get("vcs.revision")
@@ -3,6 +3,7 @@ package golang
 import (
 	"bufio"
 	"bytes"
+	"context"
 	"errors"
 	"io"
 	"os"
@@ -17,6 +18,7 @@ import (
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"

+	"github.com/anchore/syft/internal/licenses"
 	"github.com/anchore/syft/syft/file"
 	"github.com/anchore/syft/syft/internal/fileresolver"
 	"github.com/anchore/syft/syft/internal/unionreader"
@@ -159,6 +161,7 @@ func TestBuildGoPkgInfo(t *testing.T) {
 				},
 			).WithAnnotation(pkg.EvidenceAnnotationKey, pkg.PrimaryEvidenceAnnotation),
 		),
+		Dependencies: pkg.CompleteWithIndirectDependencies,
 		Metadata: pkg.GolangBinaryBuildinfoEntry{
 			GoCompiledVersion: goCompiledVersion,
 			Architecture:      archDetails,
@@ -167,6 +170,8 @@ func TestBuildGoPkgInfo(t *testing.T) {
 		},
 	}

+	licenseScanner := licenses.TestingOnlyScanner()
+
 	tests := []struct {
 		name          string
 		mod           *extendedBuildInfo
@@ -204,7 +209,8 @@ func TestBuildGoPkgInfo(t *testing.T) {
 							},
 						).WithAnnotation(pkg.EvidenceAnnotationKey, pkg.PrimaryEvidenceAnnotation),
 					),
-					Metadata: pkg.GolangBinaryBuildinfoEntry{},
+					Dependencies: pkg.UnknownDependencyCompleteness,
+					Metadata:     pkg.GolangBinaryBuildinfoEntry{},
 				},
 			},
 		},
@@ -249,6 +255,7 @@ func TestBuildGoPkgInfo(t *testing.T) {
 							},
 						).WithAnnotation(pkg.EvidenceAnnotationKey, pkg.PrimaryEvidenceAnnotation),
 					),
+					Dependencies: pkg.UnknownDependencyCompleteness,
 					Metadata: pkg.GolangBinaryBuildinfoEntry{
 						GoCompiledVersion: goCompiledVersion,
 						Architecture:      archDetails,
@@ -287,6 +294,7 @@ func TestBuildGoPkgInfo(t *testing.T) {
 							},
 						).WithAnnotation(pkg.EvidenceAnnotationKey, pkg.PrimaryEvidenceAnnotation),
 					),
+					Dependencies: pkg.CompleteWithIndirectDependencies,
 					Metadata: pkg.GolangBinaryBuildinfoEntry{
 						GoCompiledVersion: goCompiledVersion,
 						Architecture:      archDetails,
@@ -361,6 +369,7 @@ func TestBuildGoPkgInfo(t *testing.T) {
 							},
 						).WithAnnotation(pkg.EvidenceAnnotationKey, pkg.PrimaryEvidenceAnnotation),
 					),
+					Dependencies: pkg.CompleteWithIndirectDependencies,
 					Metadata: pkg.GolangBinaryBuildinfoEntry{
 						GoCompiledVersion: goCompiledVersion,
 						Architecture:      archDetails,
@@ -428,6 +437,7 @@ func TestBuildGoPkgInfo(t *testing.T) {
 							},
 						).WithAnnotation(pkg.EvidenceAnnotationKey, pkg.PrimaryEvidenceAnnotation),
 					),
+					Dependencies: pkg.CompleteWithIndirectDependencies,
 					Metadata: pkg.GolangBinaryBuildinfoEntry{
 						GoCompiledVersion: goCompiledVersion,
 						Architecture:      archDetails,
@@ -493,6 +503,7 @@ func TestBuildGoPkgInfo(t *testing.T) {
 							},
 						).WithAnnotation(pkg.EvidenceAnnotationKey, pkg.PrimaryEvidenceAnnotation),
 					),
+					Dependencies: pkg.CompleteWithIndirectDependencies,
 					Metadata: pkg.GolangBinaryBuildinfoEntry{
 						GoCompiledVersion: goCompiledVersion,
 						Architecture:      archDetails,
@@ -550,6 +561,7 @@ func TestBuildGoPkgInfo(t *testing.T) {
 							},
 						).WithAnnotation(pkg.EvidenceAnnotationKey, pkg.PrimaryEvidenceAnnotation),
 					),
+					Dependencies: pkg.CompleteWithIndirectDependencies,
 					Metadata: pkg.GolangBinaryBuildinfoEntry{
 						GoCompiledVersion: goCompiledVersion,
 						Architecture:      archDetails,
@@ -607,6 +619,7 @@ func TestBuildGoPkgInfo(t *testing.T) {
 							},
 						).WithAnnotation(pkg.EvidenceAnnotationKey, pkg.PrimaryEvidenceAnnotation),
 					),
+					Dependencies: pkg.CompleteWithIndirectDependencies,
 					Metadata: pkg.GolangBinaryBuildinfoEntry{
 						GoCompiledVersion: goCompiledVersion,
 						Architecture:      archDetails,
@@ -665,6 +678,7 @@ func TestBuildGoPkgInfo(t *testing.T) {
 							},
 						).WithAnnotation(pkg.EvidenceAnnotationKey, pkg.PrimaryEvidenceAnnotation),
 					),
+					Dependencies: pkg.CompleteWithIndirectDependencies,
 					Metadata: pkg.GolangBinaryBuildinfoEntry{
 						GoCompiledVersion: goCompiledVersion,
 						Architecture:      archDetails,
@@ -737,6 +751,7 @@ func TestBuildGoPkgInfo(t *testing.T) {
 							},
 						).WithAnnotation(pkg.EvidenceAnnotationKey, pkg.PrimaryEvidenceAnnotation),
 					),
+					Dependencies: pkg.UnknownDependencyCompleteness,
 					Metadata: pkg.GolangBinaryBuildinfoEntry{
 						GoCompiledVersion: goCompiledVersion,
 						Architecture:      archDetails,
@@ -758,6 +773,7 @@ func TestBuildGoPkgInfo(t *testing.T) {
 							},
 						).WithAnnotation(pkg.EvidenceAnnotationKey, pkg.PrimaryEvidenceAnnotation),
 					),
+					Dependencies: pkg.UnknownDependencyCompleteness,
 					Metadata: pkg.GolangBinaryBuildinfoEntry{
 						GoCompiledVersion: goCompiledVersion,
 						Architecture:      archDetails,
@@ -815,12 +831,14 @@ func TestBuildGoPkgInfo(t *testing.T) {
 							},
 						).WithAnnotation(pkg.EvidenceAnnotationKey, pkg.PrimaryEvidenceAnnotation),
 					),
+					Dependencies: pkg.UnknownDependencyCompleteness,
 					Metadata: pkg.GolangBinaryBuildinfoEntry{
 						GoCompiledVersion: goCompiledVersion,
 						Architecture:      archDetails,
 						H1Digest:          "h1:PjhxBct4MZii8FFR8+oeS7QOvxKOTZXgk63EU2XpfJE=",
 						MainModule:        "github.com/anchore/syft",
-					}},
+					},
+				},
 				{
 					Name:     "golang.org/x/term",
 					Version:  "v0.0.0-20210916214954-140adaaadfaf",
@@ -835,6 +853,7 @@ func TestBuildGoPkgInfo(t *testing.T) {
 							},
 						).WithAnnotation(pkg.EvidenceAnnotationKey, pkg.PrimaryEvidenceAnnotation),
 					),
+					Dependencies: pkg.UnknownDependencyCompleteness,
 					Metadata: pkg.GolangBinaryBuildinfoEntry{
 						GoCompiledVersion: goCompiledVersion,
 						Architecture:      archDetails,
@@ -878,6 +897,7 @@ func TestBuildGoPkgInfo(t *testing.T) {
 							},
 						).WithAnnotation(pkg.EvidenceAnnotationKey, pkg.PrimaryEvidenceAnnotation),
 					),
+					Dependencies: pkg.CompleteWithIndirectDependencies,
 					Metadata: pkg.GolangBinaryBuildinfoEntry{
 						GoCompiledVersion: goCompiledVersion,
 						Architecture:      archDetails,
@@ -937,6 +957,7 @@ func TestBuildGoPkgInfo(t *testing.T) {
 						},
 					).WithAnnotation(pkg.EvidenceAnnotationKey, pkg.PrimaryEvidenceAnnotation),
 				),
+				Dependencies: pkg.CompleteWithIndirectDependencies,
 				Metadata: pkg.GolangBinaryBuildinfoEntry{
 					GoCompiledVersion: "go1.22.2",
 					Architecture:      archDetails,
@@ -989,6 +1010,7 @@ func TestBuildGoPkgInfo(t *testing.T) {
 							},
 						).WithAnnotation(pkg.EvidenceAnnotationKey, pkg.PrimaryEvidenceAnnotation),
 					),
+					Dependencies: pkg.UnknownDependencyCompleteness,
 					Metadata: pkg.GolangBinaryBuildinfoEntry{
 						GoCompiledVersion: "go1.22.2",
 						Architecture:      archDetails,
@@ -1009,6 +1031,7 @@ func TestBuildGoPkgInfo(t *testing.T) {
 							},
 						).WithAnnotation(pkg.EvidenceAnnotationKey, pkg.PrimaryEvidenceAnnotation),
 					),
+					Dependencies: pkg.CompleteWithIndirectDependencies,
 					Metadata: pkg.GolangBinaryBuildinfoEntry{
 						GoCompiledVersion: "go1.22.2",
 						BuildSettings: []pkg.KeyValue{
@@ -1053,7 +1076,7 @@ func TestBuildGoPkgInfo(t *testing.T) {
 			c := newGoBinaryCataloger(DefaultCatalogerConfig())
 			reader, err := unionreader.GetUnionReader(io.NopCloser(strings.NewReader(test.binaryContent)))
 			require.NoError(t, err)
-			mainPkg, pkgs := c.buildGoPkgInfo(fileresolver.Empty{}, location, test.mod, test.mod.arch, reader)
+			mainPkg, pkgs := c.buildGoPkgInfo(context.Background(), licenseScanner, fileresolver.Empty{}, location, test.mod, test.mod.arch, reader)
 			if mainPkg != nil {
 				pkgs = append(pkgs, *mainPkg)
 			}
@@ -1305,6 +1328,14 @@ func Test_extractVersionFromContents(t *testing.T) {
 			contents: strings.NewReader("\x0e\x74\x5a\x3b\x00\x00\xa0\x4cv1.9.5\x00\x00"),
 			want:     "v1.9.5",
 		},
+		{
+			// 06168a34: f98f b0be 332e 312e 3200 0000 636f 6d74  ....3.1.2...comt from /usr/local/bin/traefik
+			// in traefik:v3.1.2@sha256:3f92eba47bd4bfda91d47b72d16fef2d7ae15db61a92b2057cf0cb389f8938f6
+			// TODO: eventually use something for managing snippets, similar to what's used with binary classifier tests
+			name:     "parse traefik version",
+			contents: strings.NewReader("\xf9\x8f\xb0\xbe\x33\x2e\x31\x2e\x32\x00\x00\x00\x63\x6f\x6d\x74"),
+			want:     "3.1.2",
+		},
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
@@ -11,6 +11,7 @@ import (
 	"golang.org/x/mod/modfile"

 	"github.com/anchore/syft/internal"
+	"github.com/anchore/syft/internal/licenses"
 	"github.com/anchore/syft/internal/log"
 	"github.com/anchore/syft/syft/artifact"
 	"github.com/anchore/syft/syft/file"
@@ -31,9 +32,11 @@ func newGoModCataloger(opts CatalogerConfig) *goModCataloger {
 // parseGoModFile takes a go.mod and lists all packages discovered.
 //
 //nolint:funlen
-func (c *goModCataloger) parseGoModFile(_ context.Context, resolver file.Resolver, _ *generic.Environment, reader file.LocationReadCloser) ([]pkg.Package, []artifact.Relationship, error) {
+func (c *goModCataloger) parseGoModFile(ctx context.Context, resolver file.Resolver, _ *generic.Environment, reader file.LocationReadCloser) ([]pkg.Package, []artifact.Relationship, error) {
 	packages := make(map[string]pkg.Package)

+	licenseScanner := licenses.ContextLicenseScanner(ctx)
+
 	contents, err := io.ReadAll(reader)
 	if err != nil {
 		return nil, nil, fmt.Errorf("failed to read go module: %w", err)
@@ -50,7 +53,7 @@ func (c *goModCataloger) parseGoModFile(_ context.Context, resolver file.Resolve
 	}

 	for _, m := range f.Require {
-		licenses, err := c.licenseResolver.getLicenses(resolver, m.Mod.Path, m.Mod.Version)
+		lics, err := c.licenseResolver.getLicenses(ctx, licenseScanner, resolver, m.Mod.Path, m.Mod.Version)
 		if err != nil {
 			log.Tracef("error getting licenses for package: %s %v", m.Mod.Path, err)
 		}
@@ -58,11 +61,14 @@ func (c *goModCataloger) parseGoModFile(_ context.Context, resolver file.Resolve
 		packages[m.Mod.Path] = pkg.Package{
 			Name:      m.Mod.Path,
 			Version:   m.Mod.Version,
-			Licenses:  pkg.NewLicenseSet(licenses...),
+			Licenses:  pkg.NewLicenseSet(lics...),
 			Locations: file.NewLocationSet(reader.Location.WithAnnotation(pkg.EvidenceAnnotationKey, pkg.PrimaryEvidenceAnnotation)),
 			PURL:      packageURL(m.Mod.Path, m.Mod.Version),
 			Language:  pkg.Go,
 			Type:      pkg.GoModulePkg,
+			// we don't have a way to express on a package or relationship the nature of "//indirect" markings on dependencies
+			// so though the dependencies are complete and separable with the raw data, the data in the SBOM is not separable.
+			Dependencies: pkg.UnknownDependencyCompleteness,
 			Metadata: pkg.GolangModuleEntry{
 				H1Digest: digests[fmt.Sprintf("%s %s", m.Mod.Path, m.Mod.Version)],
 			},
@@ -71,7 +77,7 @@ func (c *goModCataloger) parseGoModFile(_ context.Context, resolver file.Resolve

 	// remove any old packages and replace with new ones...
 	for _, m := range f.Replace {
-		licenses, err := c.licenseResolver.getLicenses(resolver, m.New.Path, m.New.Version)
+		lics, err := c.licenseResolver.getLicenses(ctx, licenseScanner, resolver, m.New.Path, m.New.Version)
 		if err != nil {
 			log.Tracef("error getting licenses for package: %s %v", m.New.Path, err)
 		}
@@ -83,11 +89,14 @@ func (c *goModCataloger) parseGoModFile(_ context.Context, resolver file.Resolve
 		packages[m.New.Path] = pkg.Package{
 			Name:      m.New.Path,
 			Version:   m.New.Version,
-			Licenses:  pkg.NewLicenseSet(licenses...),
+			Licenses:  pkg.NewLicenseSet(lics...),
 			Locations: file.NewLocationSet(reader.Location.WithAnnotation(pkg.EvidenceAnnotationKey, pkg.PrimaryEvidenceAnnotation)),
 			PURL:      packageURL(m.New.Path, m.New.Version),
 			Language:  pkg.Go,
 			Type:      pkg.GoModulePkg,
+			// we don't have a way to express on a package or relationship the nature of "//indirect" markings on dependencies
+			// so though the dependencies are complete and separable with the raw data, the data in the SBOM is not separable.
+			Dependencies: pkg.UnknownDependencyCompleteness,
 			Metadata: pkg.GolangModuleEntry{
 				H1Digest: digests[fmt.Sprintf("%s %s", m.New.Path, m.New.Version)],
 			},
--- a/Show More
+++ b/Show More