chore(deps): update stereoscope to aa3a3ef4efe8d8759c9aa87261b405cc003bfc9a (#3472 )

Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: willmurphyscode <12529630+willmurphyscode@users.noreply.github.com>
chore(deps): bump github.com/charmbracelet/bubbletea from 1.2.2 to 1.2.3 (#3467 )
2026-10-30 05:52:25 +01:00 · 2024-11-21 14:28:51 +00:00 · 2024-11-20 08:32:30 -05:00 · 2024-11-19 14:56:53 -05:00 · 2024-11-19 15:34:58 +00:00 · 2024-11-19 15:00:59 +00:00
47 changed files with 1316 additions and 465 deletions
@@ -18,7 +18,7 @@ tools:
  # used to sign mac binaries at release
  - name: quill
    version:
-      want: v0.4.2
+      want: v0.5.0
    method: github-release
    with:
      repo: anchore/quill
@@ -26,7 +26,7 @@ tools:
  # used for linting
  - name: golangci-lint
    version:
-      want: v1.61.0
+      want: v1.62.0
    method: github-release
    with:
      repo: golangci/golangci-lint
@@ -58,7 +58,7 @@ tools:
  # used to release all artifacts
  - name: goreleaser
    version:
-      want: v2.3.2
+      want: v2.4.7
    method: github-release
    with:
      repo: goreleaser/goreleaser
@@ -103,7 +103,7 @@ tools:
  # used for running all local and CI tasks
  - name: task
    version:
-      want: v3.39.2
+      want: v3.40.0
    method: github-release
    with:
      repo: go-task/task
@@ -111,7 +111,7 @@ tools:
  # used for triggering a release
  - name: gh
    version:
-      want: v2.60.1
+      want: v2.62.0
    method: github-release
    with:
      repo: cli/cli
@@ -127,7 +127,7 @@ tools:
  # used to upload test fixture cache
  - name: yq
    version:
-      want: v4.44.3
+      want: v4.44.5
    method: github-release
    with:
      repo: mikefarah/yq
@@ -45,7 +45,7 @@ jobs:

    # Initializes the CodeQL tools for scanning.
    - name: Initialize CodeQL
-      uses: github/codeql-action/init@662472033e021d55d94146f66f6058822b0b39fd #v3.27.0
+      uses: github/codeql-action/init@ea9e4e37992a54ee68a9622e985e60c8e8f12d9f #v3.27.4
      with:
        languages: ${{ matrix.language }}
        # If you wish to specify custom queries, you can do so here or in a config file.
@@ -56,7 +56,7 @@ jobs:
    # Autobuild attempts to build any compiled languages  (C/C++, C#, or Java).
    # If this step fails, then you should remove it and run the build manually (see below)
    - name: Autobuild
-      uses: github/codeql-action/autobuild@662472033e021d55d94146f66f6058822b0b39fd #v3.27.0
+      uses: github/codeql-action/autobuild@ea9e4e37992a54ee68a9622e985e60c8e8f12d9f #v3.27.4

    # ℹ️ Command-line programs to run using the OS shell.
    # 📚 https://git.io/JvXDl
@@ -70,4 +70,4 @@ jobs:
    #   make release

    - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@662472033e021d55d94146f66f6058822b0b39fd #v3.27.0
+      uses: github/codeql-action/analyze@ea9e4e37992a54ee68a9622e985e60c8e8f12d9f #v3.27.4
@@ -148,9 +148,10 @@ jobs:
          # for updating brew formula in anchore/homebrew-syft
          GITHUB_BREW_TOKEN: ${{ secrets.ANCHOREOPS_GITHUB_OSS_WRITE_TOKEN }}

-      - uses: anchore/sbom-action@1ca97d9028b51809cf6d3c934c3e160716e1b605 #v0.17.5
+      - uses: anchore/sbom-action@fc46e51fd3cb168ffb36c6d1915723c47db58abb #v0.17.7
        continue-on-error: true
        with:
+          file: go.mod
          artifact-name: sbom.spdx.json

      - uses: 8398a7/action-slack@28ba43ae48961b90635b50953d216767a6bea486 #v3.16.2
@@ -179,3 +179,7 @@ The Syft Team hold regular community meetings online. All are welcome to join to
 - Check the [calendar](https://calendar.google.com/calendar/u/0/r?cid=Y182OTM4dGt0MjRtajI0NnNzOThiaGtnM29qNEBncm91cC5jYWxlbmRhci5nb29nbGUuY29t) for the next meeting date. 
 - Add items to the [agenda](https://docs.google.com/document/d/1ZtSAa6fj2a6KRWviTn3WoJm09edvrNUp4Iz_dOjjyY8/edit?usp=sharing) (join [this group](https://groups.google.com/g/anchore-oss-community) for write access to the [agenda](https://docs.google.com/document/d/1ZtSAa6fj2a6KRWviTn3WoJm09edvrNUp4Iz_dOjjyY8/edit?usp=sharing))
 - See you there!
+
+## Syft Logo
+
+<p xmlns:cc="http://creativecommons.org/ns#" xmlns:dct="http://purl.org/dc/terms/"><a property="dct:title" rel="cc:attributionURL" href="https://anchore.com/wp-content/uploads/2024/11/syft-logo.svg">Syft Logo</a> by <a rel="cc:attributionURL dct:creator" property="cc:attributionName" href="https://anchore.com/">Anchore</a> is licensed under <a href="https://creativecommons.org/licenses/by/4.0/" target="_blank" rel="license noopener noreferrer" style="display:inline-block;">CC BY 4.0<img style="height:22px!important;margin-left:3px;vertical-align:text-bottom;" src="https://mirrors.creativecommons.org/presskit/icons/cc.svg" alt=""><img style="height:22px!important;margin-left:3px;vertical-align:text-bottom;" src="https://mirrors.creativecommons.org/presskit/icons/by.svg" alt=""></a></p>
@@ -17,7 +17,7 @@ import (

 const (
 	convertExample = `  {{.appName}} {{.command}} img.syft.json -o spdx-json                      convert a syft SBOM to spdx-json, output goes to stdout
-  {{.appName}} {{.command}} img.syft.json -o cyclonedx-json=img.cdx.json    convert a syft SBOM to CycloneDX, output is written to the file "img.cdx.json""
+  {{.appName}} {{.command}} img.syft.json -o cyclonedx-json=img.cdx.json    convert a syft SBOM to CycloneDX, output is written to the file "img.cdx.json"
  {{.appName}} {{.command}} - -o spdx-json                                  convert an SBOM from STDIN to spdx-json
 `
 )
@@ -39,7 +39,7 @@ func Convert(app clio.Application) *cobra.Command {
 	return app.SetupCommand(&cobra.Command{
 		Use:   "convert [SOURCE-SBOM] -o [FORMAT]",
 		Short: "Convert between SBOM formats",
-		Long:  "[Experimental] Convert SBOM files to, and from, SPDX, CycloneDX and Syft's format. For more info about data loss between formats see https://github.com/anchore/syft#format-conversion-experimental",
+		Long:  "[Experimental] Convert SBOM files to, and from, SPDX, CycloneDX and Syft's format. For more info about data loss between formats see https://github.com/anchore/syft/wiki/format-conversion",
 		Example: internal.Tprintf(convertExample, map[string]interface{}{
 			"appName": id.Name,
 			"command": "convert",
@@ -156,13 +156,13 @@ func validateScanArgs(cmd *cobra.Command, args []string) error {
 	return validateArgs(cmd, args, "an image/directory argument is required")
 }

-func validateArgs(cmd *cobra.Command, args []string, error string) error {
+func validateArgs(cmd *cobra.Command, args []string, err string) error {
 	if len(args) == 0 {
 		// in the case that no arguments are given we want to show the help text and return with a non-0 return code.
 		if err := cmd.Help(); err != nil {
 			return fmt.Errorf("unable to display help: %w", err)
 		}
-		return fmt.Errorf("%v", error)
+		return fmt.Errorf("%v", err)
 	}

 	return cobra.MaximumNArgs(1)(cmd, args)
@@ -166,6 +166,7 @@ func (cfg Catalog) ToPackagesConfig() pkgcataloging.Config {
 					WithFromLDFlags(cfg.Golang.MainModuleVersion.FromLDFlags),
 			),
 		JavaScript: javascript.DefaultCatalogerConfig().
+			WithIncludeDevDependencies(*multiLevelOption(false, cfg.JavaScript.IncludeDevDependencies)).
 			WithSearchRemoteLicenses(*multiLevelOption(false, enrichmentEnabled(cfg.Enrich, task.JavaScript, task.Node, task.NPM), cfg.JavaScript.SearchRemoteLicenses)).
 			WithNpmBaseURL(cfg.JavaScript.NpmBaseURL),
 		LinuxKernel: kernel.LinuxKernelCatalogerConfig{
@@ -3,8 +3,9 @@ package options
 import "github.com/anchore/clio"

 type javaScriptConfig struct {
-	SearchRemoteLicenses *bool  `json:"search-remote-licenses" yaml:"search-remote-licenses" mapstructure:"search-remote-licenses"`
-	NpmBaseURL           string `json:"npm-base-url" yaml:"npm-base-url" mapstructure:"npm-base-url"`
+	SearchRemoteLicenses   *bool  `json:"search-remote-licenses" yaml:"search-remote-licenses" mapstructure:"search-remote-licenses"`
+	NpmBaseURL             string `json:"npm-base-url" yaml:"npm-base-url" mapstructure:"npm-base-url"`
+	IncludeDevDependencies *bool  `json:"include-dev-dependencies" yaml:"include-dev-dependencies" mapstructure:"include-dev-dependencies"`
 }

 var _ interface {
@@ -14,4 +15,5 @@ var _ interface {
 func (o *javaScriptConfig) DescribeFields(descriptions clio.FieldDescriptionSet) {
 	descriptions.Add(&o.SearchRemoteLicenses, `enables Syft to use the network to fill in more detailed license information`)
 	descriptions.Add(&o.NpmBaseURL, `base NPM url to use`)
+	descriptions.Add(&o.IncludeDevDependencies, `include development-scoped dependencies`)
 }
@@ -25,7 +25,7 @@ func TestNpmPackageLockDirectory(t *testing.T) {
 	}

 	// ensure that integration test commonTestCases stay in sync with the available catalogers
-	const expectedPackageCount = 6
+	const expectedPackageCount = 2
 	if foundPackages.Size() != expectedPackageCount {
 		t.Errorf("found the wrong set of npm package-lock.json packages (expected: %d, actual: %d)", expectedPackageCount, foundPackages.Size())
 	}
@@ -17,11 +17,11 @@ const defaultStdoutLogBufferSize = 1024
 //	restore := CaptureStdoutToTraceLog()
 //	// here, stdout will be captured and redirected to the provided writer
 //	restore() // block until the output has all been sent to the writer and restore the original stdout
-func CaptureStdoutToTraceLog() (close func()) {
+func CaptureStdoutToTraceLog() func() {
 	return capture(&os.Stdout, newLogWriter(), defaultStdoutLogBufferSize)
 }

-func capture(target **os.File, writer io.Writer, bufSize int) (close func()) {
+func capture(target **os.File, writer io.Writer, bufSize int) func() {
 	original := *target

 	r, w, _ := os.Pipe()
@@ -78,6 +78,13 @@ func (m *UI) Handle(e partybus.Event) error {
 }

 func (m *UI) Teardown(force bool) error {
+	defer func() {
+		// allow for traditional logging to resume now that the UI is shutting down
+		if logWrapper, ok := log.Get().(logger.Controller); ok {
+			logWrapper.SetOutput(m.err)
+		}
+	}()
+
 	if !force {
 		m.handler.Wait()
 		m.program.Quit()
@@ -1,6 +1,6 @@
 module github.com/anchore/syft

-go 1.22.8
+go 1.22.9

 require (
 	github.com/CycloneDX/cyclonedx-go v0.9.1
@@ -9,7 +9,7 @@ require (
 	github.com/acarl005/stripansi v0.0.0-20180116102854-5a71ef0e047d
 	github.com/acobaugh/osrelease v0.1.0
 	github.com/anchore/bubbly v0.0.0-20231115134915-def0aba654a9
-	github.com/anchore/clio v0.0.0-20241015191535-f538a9016e10
+	github.com/anchore/clio v0.0.0-20241115144204-29e89f9fa837
 	github.com/anchore/fangs v0.0.0-20241014201141-b6e4b3469f10
 	github.com/anchore/go-collections v0.0.0-20240216171411-9321230ce537
 	github.com/anchore/go-logger v0.0.0-20230725134548-c21dafa1ec5a
@@ -17,15 +17,15 @@ require (
 	github.com/anchore/go-testutils v0.0.0-20200925183923-d5f45b0d3c04
 	github.com/anchore/go-version v1.2.2-0.20200701162849-18adb9c92b9b
 	github.com/anchore/packageurl-go v0.1.1-0.20241018175412-5c22e6360c4f
-	github.com/anchore/stereoscope v0.0.5
+	github.com/anchore/stereoscope v0.0.9
 	github.com/anmitsu/go-shlex v0.0.0-20200514113438-38f4b401e2be
 	// we are hinting brotli to latest due to warning when installing archiver v3:
 	// go: warning: github.com/andybalholm/brotli@v1.0.1: retracted by module author: occasional panics and data corruption
 	github.com/aquasecurity/go-pep440-version v0.0.0-20210121094942-22b2f8951d46
 	github.com/bmatcuk/doublestar/v4 v4.7.1
 	github.com/charmbracelet/bubbles v0.20.0
-	github.com/charmbracelet/bubbletea v1.1.2
-	github.com/charmbracelet/lipgloss v0.13.1
+	github.com/charmbracelet/bubbletea v1.2.3
+	github.com/charmbracelet/lipgloss v1.0.0
 	github.com/dave/jennifer v1.7.1
 	github.com/deitch/magic v0.0.0-20230404182410-1ff89d7342da
 	github.com/distribution/reference v0.6.0
@@ -46,7 +46,7 @@ require (
 	github.com/hashicorp/go-multierror v1.1.1
 	github.com/iancoleman/strcase v0.3.0
 	github.com/invopop/jsonschema v0.7.0
-	github.com/jedib0t/go-pretty/v6 v6.6.1
+	github.com/jedib0t/go-pretty/v6 v6.6.2
 	github.com/jinzhu/copier v0.4.0
 	github.com/kastenhq/goversion v0.0.0-20230811215019-93b2f8823953
 	github.com/knqyf263/go-rpmdb v0.1.1
@@ -60,7 +60,7 @@ require (
 	github.com/opencontainers/go-digest v1.0.0
 	github.com/pelletier/go-toml v1.9.5
 	github.com/quasilyte/go-ruleguard/dsl v0.3.22
-	github.com/saferwall/pe v1.5.4
+	github.com/saferwall/pe v1.5.5
 	github.com/saintfish/chardet v0.0.0-20230101081208-5e3ef4b5456d
 	github.com/sanity-io/litter v1.5.5
 	github.com/sassoftware/go-rpmutils v0.4.0
@@ -78,10 +78,10 @@ require (
 	github.com/xeipuuv/gojsonschema v1.2.0
 	github.com/zyedidia/generic v1.2.2-0.20230320175451-4410d2372cb1
 	go.uber.org/goleak v1.3.0
-	golang.org/x/mod v0.21.0
-	golang.org/x/net v0.30.0
+	golang.org/x/mod v0.22.0
+	golang.org/x/net v0.31.0
 	gopkg.in/yaml.v3 v3.0.1
-	modernc.org/sqlite v1.33.1
+	modernc.org/sqlite v1.34.1
 )

 require google.golang.org/genproto v0.0.0-20240213162025-012b6fc9bca9 // indirect
@@ -89,7 +89,7 @@ require google.golang.org/genproto v0.0.0-20240213162025-012b6fc9bca9 // indirec
 require (
 	github.com/BurntSushi/toml v1.4.0
 	github.com/OneOfOne/xxhash v1.2.8
-	github.com/adrg/xdg v0.5.1
+	github.com/adrg/xdg v0.5.3
 	github.com/magiconair/properties v1.8.7
 	golang.org/x/exp v0.0.0-20240719175910-8a7402abbf56
 )
@@ -103,7 +103,7 @@ require (
 	github.com/Masterminds/semver/v3 v3.3.0 // indirect
 	github.com/Microsoft/go-winio v0.6.2 // indirect
 	github.com/Microsoft/hcsshim v0.11.7 // indirect
-	github.com/ProtonMail/go-crypto v1.0.0 // indirect
+	github.com/ProtonMail/go-crypto v1.1.2 // indirect
 	github.com/anchore/go-struct-converter v0.0.0-20221118182256-c68fdcfa2092 // indirect
 	github.com/andybalholm/brotli v1.0.4 // indirect
 	github.com/aquasecurity/go-version v0.0.0-20210121072130-637058cfe492 // indirect
@@ -111,8 +111,8 @@ require (
 	github.com/aymanbagabas/go-osc52/v2 v2.0.1 // indirect
 	github.com/becheran/wildmatch-go v1.0.0 // indirect
 	github.com/charmbracelet/harmonica v0.2.0 // indirect
-	github.com/charmbracelet/x/ansi v0.4.0 // indirect
-	github.com/charmbracelet/x/term v0.2.0 // indirect
+	github.com/charmbracelet/x/ansi v0.4.5 // indirect
+	github.com/charmbracelet/x/term v0.2.1 // indirect
 	github.com/cloudflare/circl v1.3.8 // indirect
 	github.com/containerd/cgroups v1.1.0 // indirect
 	github.com/containerd/containerd v1.7.23 // indirect
@@ -210,7 +210,7 @@ require (
 	github.com/spf13/pflag v1.0.5 // indirect
 	github.com/spf13/viper v1.19.0 // indirect
 	github.com/subosito/gotenv v1.6.0 // indirect
-	github.com/sylabs/sif/v2 v2.19.2 // indirect
+	github.com/sylabs/sif/v2 v2.20.0 // indirect
 	github.com/sylabs/squashfs v1.0.0 // indirect
 	github.com/therootcompany/xz v1.0.1 // indirect
 	github.com/tidwall/gjson v1.17.0 // indirect
@@ -231,11 +231,11 @@ require (
 	go.opentelemetry.io/otel/trace v1.24.0 // indirect
 	go.uber.org/atomic v1.9.0 // indirect
 	go.uber.org/multierr v1.9.0 // indirect
-	golang.org/x/crypto v0.28.0 // indirect
-	golang.org/x/sync v0.8.0 // indirect
-	golang.org/x/sys v0.26.0 // indirect
-	golang.org/x/term v0.25.0 // indirect
-	golang.org/x/text v0.19.0 // indirect
+	golang.org/x/crypto v0.29.0 // indirect
+	golang.org/x/sync v0.9.0 // indirect
+	golang.org/x/sys v0.27.0 // indirect
+	golang.org/x/term v0.26.0 // indirect
+	golang.org/x/text v0.20.0 // indirect
 	golang.org/x/xerrors v0.0.0-20220907171357-04be3eba64a2 // indirect
 	google.golang.org/genproto/googleapis/rpc v0.0.0-20240314234333-6e1732d8331c // indirect
 	google.golang.org/grpc v1.62.1 // indirect
@@ -81,14 +81,14 @@ github.com/Microsoft/hcsshim v0.11.7/go.mod h1:MV8xMfmECjl5HdO7U/3/hFVnkmSBjAjmA
 github.com/OneOfOne/xxhash v1.2.2/go.mod h1:HSdplMjZKSmBqAxg5vPj2TmRDmfkzw+cTzAElWljhcU=
 github.com/OneOfOne/xxhash v1.2.8 h1:31czK/TI9sNkxIKfaUfGlU47BAxQ0ztGgd9vPyqimf8=
 github.com/OneOfOne/xxhash v1.2.8/go.mod h1:eZbhyaAYD41SGSSsnmcpxVoRiQ/MPUTjUdIIOT9Um7Q=
-github.com/ProtonMail/go-crypto v1.0.0 h1:LRuvITjQWX+WIfr930YHG2HNfjR1uOfyf5vE0kC2U78=
-github.com/ProtonMail/go-crypto v1.0.0/go.mod h1:EjAoLdwvbIOoOQr3ihjnSoLZRtE8azugULFRteWMNc0=
+github.com/ProtonMail/go-crypto v1.1.2 h1:A7JbD57ThNqh7XjmHE+PXpQ3Dqt3BrSAC0AL0Go3KS0=
+github.com/ProtonMail/go-crypto v1.1.2/go.mod h1:rA3QumHc/FZ8pAHreoekgiAbzpNsfQAosU5td4SnOrE=
 github.com/acarl005/stripansi v0.0.0-20180116102854-5a71ef0e047d h1:licZJFw2RwpHMqeKTCYkitsPqHNxTmd4SNR5r94FGM8=
 github.com/acarl005/stripansi v0.0.0-20180116102854-5a71ef0e047d/go.mod h1:asat636LX7Bqt5lYEZ27JNDcqxfjdBQuJ/MM4CN/Lzo=
 github.com/acobaugh/osrelease v0.1.0 h1:Yb59HQDGGNhCj4suHaFQQfBps5wyoKLSSX/J/+UifRE=
 github.com/acobaugh/osrelease v0.1.0/go.mod h1:4bFEs0MtgHNHBrmHCt67gNisnabCRAlzdVasCEGHTWY=
-github.com/adrg/xdg v0.5.1 h1:Im8iDbEFARltY09yOJlSGu4Asjk2vF85+3Dyru8uJ0U=
-github.com/adrg/xdg v0.5.1/go.mod h1:nlTsY+NNiCBGCK2tpm09vRqfVzrc2fLmXGpBLF0zlTQ=
+github.com/adrg/xdg v0.5.3 h1:xRnxJXne7+oWDatRhR1JLnvuccuIeCoBu2rtuLqQB78=
+github.com/adrg/xdg v0.5.3/go.mod h1:nlTsY+NNiCBGCK2tpm09vRqfVzrc2fLmXGpBLF0zlTQ=
 github.com/alecthomas/template v0.0.0-20160405071501-a0175ee3bccc/go.mod h1:LOuyumcjzFXgccqObfd/Ljyb9UuFJ6TxHnclSeseNhc=
 github.com/alecthomas/template v0.0.0-20190718012654-fb15b899a751/go.mod h1:LOuyumcjzFXgccqObfd/Ljyb9UuFJ6TxHnclSeseNhc=
 github.com/alecthomas/units v0.0.0-20151022065526-2efee857e7cf/go.mod h1:ybxpYRFXyAe+OPACYpWeL0wqObRcbAqCMya13uyzqw0=
@@ -97,8 +97,8 @@ github.com/anchore/archiver/v3 v3.5.2 h1:Bjemm2NzuRhmHy3m0lRe5tNoClB9A4zYyDV58Pa
 github.com/anchore/archiver/v3 v3.5.2/go.mod h1:e3dqJ7H78uzsRSEACH1joayhuSyhnonssnDhppzS1L4=
 github.com/anchore/bubbly v0.0.0-20231115134915-def0aba654a9 h1:p0ZIe0htYOX284Y4axJaGBvXHU0VCCzLN5Wf5XbKStU=
 github.com/anchore/bubbly v0.0.0-20231115134915-def0aba654a9/go.mod h1:3ZsFB9tzW3vl4gEiUeuSOMDnwroWxIxJelOOHUp8dSw=
-github.com/anchore/clio v0.0.0-20241015191535-f538a9016e10 h1:3xmanFdoQEH0REvPA+gLm3Km0/981F4z2a/7ADTlv8k=
-github.com/anchore/clio v0.0.0-20241015191535-f538a9016e10/go.mod h1:h6Ly2hlKjQoPtI3rA8oB5afSmB/XimhcY55xbuW4Dwo=
+github.com/anchore/clio v0.0.0-20241115144204-29e89f9fa837 h1:bIG3WsfosZsJ5LMC7PB9J/ekFM3a0j0ZEDvN3ID6GTI=
+github.com/anchore/clio v0.0.0-20241115144204-29e89f9fa837/go.mod h1:tRQVKkjYeejrh9AdM0s1esbwtMU7rdHAHSQWkv4qskE=
 github.com/anchore/fangs v0.0.0-20241014201141-b6e4b3469f10 h1:w+HibE+e/heP6ysADh7sWxg5LhYdVqrpB1A4Hmgjyx8=
 github.com/anchore/fangs v0.0.0-20241014201141-b6e4b3469f10/go.mod h1:s0L1//Sxn6Rq0Dcxx+dmT/RRmD9HhsaJjJkPUJHLJLM=
 github.com/anchore/go-collections v0.0.0-20240216171411-9321230ce537 h1:GjNGuwK5jWjJMyVppBjYS54eOiiSNv4Ba869k4wh72Q=
@@ -115,8 +115,8 @@ github.com/anchore/go-version v1.2.2-0.20200701162849-18adb9c92b9b h1:e1bmaoJfZV
 github.com/anchore/go-version v1.2.2-0.20200701162849-18adb9c92b9b/go.mod h1:Bkc+JYWjMCF8OyZ340IMSIi2Ebf3uwByOk6ho4wne1E=
 github.com/anchore/packageurl-go v0.1.1-0.20241018175412-5c22e6360c4f h1:dAQPIrQ3a5PBqZeZ+B9NGZsGmodk4NO9OjDIsQmQyQM=
 github.com/anchore/packageurl-go v0.1.1-0.20241018175412-5c22e6360c4f/go.mod h1:KoYIv7tdP5+CC9VGkeZV4/vGCKsY55VvoG+5dadg4YI=
-github.com/anchore/stereoscope v0.0.5 h1:PILlvsQS3+dT5rNsDudRhi91jukR65y2itG1lQOLn0s=
-github.com/anchore/stereoscope v0.0.5/go.mod h1:jwK34VB049/iRE1DyWUv4ZWraOaFQ+FpurgvkWMGQzQ=
+github.com/anchore/stereoscope v0.0.9 h1:rLhYWe/CXhDq/UCUWQ3U5xtpGk4RFnssKaM0bHhs5us=
+github.com/anchore/stereoscope v0.0.9/go.mod h1:c2oGDU0R+llJObsatBSenjYPV1raKhMq9GEqe8J56EI=
 github.com/andreyvit/diff v0.0.0-20170406064948-c7f18ee00883/go.mod h1:rCTlJbsFo29Kk6CurOXKm700vrz8f0KW0JNfpkRJY/8=
 github.com/andybalholm/brotli v1.0.1/go.mod h1:loMXtMfwqflxFJPmdbJO0a3KNoPuLBgiu3qAvBg8x/Y=
 github.com/andybalholm/brotli v1.0.4 h1:V7DdXeJtZscaqfNuAdSRuRFzuiKlHSC/Zh3zl9qY3JY=
@@ -149,7 +149,6 @@ github.com/bmatcuk/doublestar/v4 v4.7.1 h1:fdDeAqgT47acgwd9bd9HxJRDmc9UAmPpc+2m0
 github.com/bmatcuk/doublestar/v4 v4.7.1/go.mod h1:xBQ8jztBU6kakFMg+8WGxn0c6z1fTSPVIjEY1Wr7jzc=
 github.com/bradleyjkemp/cupaloy/v2 v2.8.0 h1:any4BmKE+jGIaMpnU8YgH/I2LPiLBufr6oMMlVBbn9M=
 github.com/bradleyjkemp/cupaloy/v2 v2.8.0/go.mod h1:bm7JXdkRd4BHJk9HpwqAI8BoAY1lps46Enkdqw6aRX0=
-github.com/bwesterb/go-ristretto v1.2.3/go.mod h1:fUIoIZaG73pV5biE2Blr2xEzDoMj7NFEuV9ekS419A0=
 github.com/cenkalti/backoff/v4 v4.2.1 h1:y4OZtCnogmCPw98Zjyt5a6+QwPLGkiQsYW5oUqylYbM=
 github.com/cenkalti/backoff/v4 v4.2.1/go.mod h1:Y3VNntkOUPxTVeUxJ/G5vcM//AlwfmyYozVcomhLiZE=
 github.com/census-instrumentation/opencensus-proto v0.2.1/go.mod h1:f6KPmirojxKA12rnyqOA5BBL4O983OfeGPqjHWSTneU=
@@ -159,23 +158,22 @@ github.com/cespare/xxhash/v2 v2.1.1/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XL
 github.com/cespare/xxhash/v2 v2.1.2/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
 github.com/charmbracelet/bubbles v0.20.0 h1:jSZu6qD8cRQ6k9OMfR1WlM+ruM8fkPWkHvQWD9LIutE=
 github.com/charmbracelet/bubbles v0.20.0/go.mod h1:39slydyswPy+uVOHZ5x/GjwVAFkCsV8IIVy+4MhzwwU=
-github.com/charmbracelet/bubbletea v1.1.2 h1:naQXF2laRxyLyil/i7fxdpiz1/k06IKquhm4vBfHsIc=
-github.com/charmbracelet/bubbletea v1.1.2/go.mod h1:9HIU/hBV24qKjlehyj8z1r/tR9TYTQEag+cWZnuXo8E=
+github.com/charmbracelet/bubbletea v1.2.3 h1:d9MdMsANIYZB5pE1KkRqaUV6GfsiWm+/9z4fTuGVm9I=
+github.com/charmbracelet/bubbletea v1.2.3/go.mod h1:Qr6fVQw+wX7JkWWkVyXYk/ZUQ92a6XNekLXa3rR18MM=
 github.com/charmbracelet/harmonica v0.2.0 h1:8NxJWRWg/bzKqqEaaeFNipOu77YR5t8aSwG4pgaUBiQ=
 github.com/charmbracelet/harmonica v0.2.0/go.mod h1:KSri/1RMQOZLbw7AHqgcBycp8pgJnQMYYT8QZRqZ1Ao=
-github.com/charmbracelet/lipgloss v0.13.1 h1:Oik/oqDTMVA01GetT4JdEC033dNzWoQHdWnHnQmXE2A=
-github.com/charmbracelet/lipgloss v0.13.1/go.mod h1:zaYVJ2xKSKEnTEEbX6uAHabh2d975RJ+0yfkFpRBz5U=
-github.com/charmbracelet/x/ansi v0.4.0 h1:NqwHA4B23VwsDn4H3VcNX1W1tOmgnvY1NDx5tOXdnOU=
-github.com/charmbracelet/x/ansi v0.4.0/go.mod h1:dk73KoMTT5AX5BsX0KrqhsTqAnhZZoCBjs7dGWp4Ktw=
-github.com/charmbracelet/x/term v0.2.0 h1:cNB9Ot9q8I711MyZ7myUR5HFWL/lc3OpU8jZ4hwm0x0=
-github.com/charmbracelet/x/term v0.2.0/go.mod h1:GVxgxAbjUrmpvIINHIQnJJKpMlHiZ4cktEQCN6GWyF0=
+github.com/charmbracelet/lipgloss v1.0.0 h1:O7VkGDvqEdGi93X+DeqsQ7PKHDgtQfF8j8/O2qFMQNg=
+github.com/charmbracelet/lipgloss v1.0.0/go.mod h1:U5fy9Z+C38obMs+T+tJqst9VGzlOYGj4ri9reL3qUlo=
+github.com/charmbracelet/x/ansi v0.4.5 h1:LqK4vwBNaXw2AyGIICa5/29Sbdq58GbGdFngSexTdRM=
+github.com/charmbracelet/x/ansi v0.4.5/go.mod h1:dk73KoMTT5AX5BsX0KrqhsTqAnhZZoCBjs7dGWp4Ktw=
+github.com/charmbracelet/x/term v0.2.1 h1:AQeHeLZ1OqSXhrAWpYUtZyX1T3zVxfpZuEQMIQaGIAQ=
+github.com/charmbracelet/x/term v0.2.1/go.mod h1:oQ4enTYFV7QN4m0i9mzHrViD7TQKvNEEkHUMCmsxdUg=
 github.com/chzyer/logex v1.1.10/go.mod h1:+Ywpsq7O8HXn0nuIou7OrIPyXbp3wmkHB+jjWRnGsAI=
 github.com/chzyer/readline v0.0.0-20180603132655-2972be24d48e/go.mod h1:nSuG5e5PlCu98SY8svDHJxuZscDgtXS6KTTbou5AhLI=
 github.com/chzyer/test v0.0.0-20180213035817-a1ea475d72b1/go.mod h1:Q3SI9o4m/ZMnBNeIyt5eFwwo7qiLfzFZmjNmxjkiQlU=
 github.com/circonus-labs/circonus-gometrics v2.3.1+incompatible/go.mod h1:nmEj6Dob7S7YxXgwXpfOuvO54S+tGdZdw9fuRZt25Ag=
 github.com/circonus-labs/circonusllhist v0.1.3/go.mod h1:kMXHVDlOchFAehlya5ePtbp5jckzBHf4XRpQvBOLI+I=
 github.com/client9/misspell v0.3.4/go.mod h1:qj6jICC3Q7zFZvVWo7KLAzC3yx5G7kyvSDkc90ppPyw=
-github.com/cloudflare/circl v1.3.3/go.mod h1:5XYMA4rFBvNIrhs50XuiBJ15vF2pZn4nnUKZrLbUZFA=
 github.com/cloudflare/circl v1.3.8 h1:j+V8jJt09PoeMFIu2uh5JUyEaIHTXVOHslFoLNAKqwI=
 github.com/cloudflare/circl v1.3.8/go.mod h1:PDRU+oXvdD7KCtgKxW95M5Z8BpSCJXQORiZFnBQS5QU=
 github.com/cncf/udpa/go v0.0.0-20191209042840-269d4d468f6f/go.mod h1:M8M6+tZqaGXZJjfX53e64911xZQV5JYwmTeXPW+k8Sc=
@@ -483,8 +481,8 @@ github.com/invopop/jsonschema v0.7.0 h1:2vgQcBz1n256N+FpX3Jq7Y17AjYt46Ig3zIWyy77
 github.com/invopop/jsonschema v0.7.0/go.mod h1:O9uiLokuu0+MGFlyiaqtWxwqJm41/+8Nj0lD7A36YH0=
 github.com/jbenet/go-context v0.0.0-20150711004518-d14ea06fba99 h1:BQSFePA1RWJOlocH6Fxy8MmwDt+yVQYULKfN0RoTN8A=
 github.com/jbenet/go-context v0.0.0-20150711004518-d14ea06fba99/go.mod h1:1lJo3i6rXxKeerYnT8Nvf0QmHCRC1n8sfWVwXF2Frvo=
-github.com/jedib0t/go-pretty/v6 v6.6.1 h1:iJ65Xjb680rHcikRj6DSIbzCex2huitmc7bDtxYVWyc=
-github.com/jedib0t/go-pretty/v6 v6.6.1/go.mod h1:zbn98qrYlh95FIhwwsbIip0LYpwSG8SUOScs+v9/t0E=
+github.com/jedib0t/go-pretty/v6 v6.6.2 h1:27bLj3nRODzaiA7tPIxy9UVWHoPspFfME9XxgwiiNsM=
+github.com/jedib0t/go-pretty/v6 v6.6.2/go.mod h1:zbn98qrYlh95FIhwwsbIip0LYpwSG8SUOScs+v9/t0E=
 github.com/jinzhu/copier v0.4.0 h1:w3ciUoD19shMCRargcpm0cm91ytaBhDvuRpz1ODO/U8=
 github.com/jinzhu/copier v0.4.0/go.mod h1:DfbEm0FYsaqBcKcFuvmOZb218JkPGtvSHsKg8S8hyyg=
 github.com/json-iterator/go v1.1.6/go.mod h1:+SdeFBvtyEkXs7REEP0seUULqWtbJapLOCVDaaPEHmU=
@@ -680,8 +678,8 @@ github.com/rogpeppe/go-internal v1.12.0/go.mod h1:E+RYuTGaKKdloAfM02xzb0FW3Paa99
 github.com/russross/blackfriday/v2 v2.0.1/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
 github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
 github.com/ryanuber/columnize v0.0.0-20160712163229-9b3edd62028f/go.mod h1:sm1tb6uqfes/u+d4ooFouqFdy9/2g9QGwK3SQygK0Ts=
-github.com/saferwall/pe v1.5.4 h1:tLmMggEMUfeqrpJ25zS/okUQmyFdD5xWKL2+z9njCqg=
-github.com/saferwall/pe v1.5.4/go.mod h1:mJx+PuptmNpoPFBNhWs/uDMFL/kTHVZIkg0d4OUJFbQ=
+github.com/saferwall/pe v1.5.5 h1:GGbzKjXDm7i+1K6riOgtgblyTdRmTbr3r11IzjovAK8=
+github.com/saferwall/pe v1.5.5/go.mod h1:mJx+PuptmNpoPFBNhWs/uDMFL/kTHVZIkg0d4OUJFbQ=
 github.com/sagikazarmark/crypt v0.3.0/go.mod h1:uD/D+6UF4SrIR1uGEv7bBNkNqLGqUr43MRiaGWX1Nig=
 github.com/sagikazarmark/locafero v0.4.0 h1:HApY1R9zGo4DBgr7dqsTH/JJxLTTsOt7u6keLGt6kNQ=
 github.com/sagikazarmark/locafero v0.4.0/go.mod h1:Pe1W6UlPYUk/+wc/6KFhbORCfqzgYEpgQ3O5fPuL3H4=
@@ -762,8 +760,8 @@ github.com/stretchr/testify v1.9.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8
 github.com/subosito/gotenv v1.2.0/go.mod h1:N0PQaV/YGNqwC0u51sEeR/aUtSLEXKX9iv69rRypqCw=
 github.com/subosito/gotenv v1.6.0 h1:9NlTDc1FTs4qu0DDq7AEtTPNw6SVm7uBMsUCUjABIf8=
 github.com/subosito/gotenv v1.6.0/go.mod h1:Dk4QP5c2W3ibzajGcXpNraDfq2IrhjMIvMSWPKKo0FU=
-github.com/sylabs/sif/v2 v2.19.2 h1:KKcUKnbnT69rN1WWHRYoAVKFpqnXpNJ36kmQLpp86Uc=
-github.com/sylabs/sif/v2 v2.19.2/go.mod h1:nhX6D/CJntHDWspNLXLe+yct0cd5lm8HJ7VIW6hgKrw=
+github.com/sylabs/sif/v2 v2.20.0 h1:RfDHEltUrchZbp/XGcWaw3nRSbufoNWqvwmf91/Q2gI=
+github.com/sylabs/sif/v2 v2.20.0/go.mod h1:z6dq3B7QXK0pD71n15kAapven+gE+PZAIPOewBTNDpU=
 github.com/sylabs/squashfs v1.0.0 h1:xAyMS21ogglkuR5HaY55PCfqY3H32ma9GkasTYo28Zg=
 github.com/sylabs/squashfs v1.0.0/go.mod h1:rhWzvgefq1X+R+LZdts10hfMsTg3g74OfGunW8tvg/4=
 github.com/terminalstatic/go-xsd-validate v0.1.5 h1:RqpJnf6HGE2CB/lZB1A8BYguk8uRtcvYAPLCF15qguo=
@@ -868,10 +866,8 @@ golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPh
 golang.org/x/crypto v0.0.0-20210817164053-32db794688a5/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
 golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
 golang.org/x/crypto v0.0.0-20220622213112-05595931fe9d/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=
-golang.org/x/crypto v0.3.1-0.20221117191849-2c476679df9a/go.mod h1:hebNnKkNXi2UzZN1eVRvBB7co0a+JxK6XbPiWVs/3J4=
-golang.org/x/crypto v0.7.0/go.mod h1:pYwdfH91IfpZVANVyUOhSIPZaFoJGxTFbZhFTx+dXZU=
-golang.org/x/crypto v0.28.0 h1:GBDwsMXVQi34v5CCYUm2jkJvu4cbtru2U4TN2PSyQnw=
-golang.org/x/crypto v0.28.0/go.mod h1:rmgy+3RHxRZMyY0jjAJShp2zgEdOqj2AO7U0pYmeQ7U=
+golang.org/x/crypto v0.29.0 h1:L5SG1JTTXupVV3n6sUqMTeWbjAyfPwoda2DLX8J8FrQ=
+golang.org/x/crypto v0.29.0/go.mod h1:+F4F4N5hv6v38hfeYwTdx20oUvLLc+QfrE9Ax9HtgRg=
 golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
 golang.org/x/exp v0.0.0-20190306152737-a1d7652674e8/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
 golang.org/x/exp v0.0.0-20190510132918-efd6b22b2522/go.mod h1:ZjyILWgesfNpC6sMxTJOJm9Kp84zZh5NQWvqDGG3Qr8=
@@ -911,9 +907,8 @@ golang.org/x/mod v0.4.1/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.4.2/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.5.0/go.mod h1:5OXOZSfqPIIbmVBIIKWRFfZjPR0E5r58TLhUjH0a2Ro=
 golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4=
-golang.org/x/mod v0.8.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
-golang.org/x/mod v0.21.0 h1:vvrHzRwRfVKSiLrG+d4FMl/Qi4ukBCE6kZlTUkDYRT0=
-golang.org/x/mod v0.21.0/go.mod h1:6SkKJ3Xj0I0BrPOZoBy3bdMptDDU9oJrpohJ3eWZ1fY=
+golang.org/x/mod v0.22.0 h1:D4nJWe9zXqHOmWqj4VMOJhvzj7bEZg4wEYa759z1pH4=
+golang.org/x/mod v0.22.0/go.mod h1:6SkKJ3Xj0I0BrPOZoBy3bdMptDDU9oJrpohJ3eWZ1fY=
 golang.org/x/net v0.0.0-20180724234803-3673e40ba225/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20180826012351-8a410e7b638d/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20181023162649-9b4f9f5ad519/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
@@ -957,11 +952,8 @@ golang.org/x/net v0.0.0-20210503060351-7fd8e65b6420/go.mod h1:9nx3DQGgdP8bBQD5qx
 golang.org/x/net v0.0.0-20210813160813-60bc85c4be6d/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
 golang.org/x/net v0.0.0-20211112202133-69e39bad7dc2/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
 golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
-golang.org/x/net v0.2.0/go.mod h1:KqCZLdyyvdV855qA2rE3GC2aiw5xGR5TEjj8smXukLY=
-golang.org/x/net v0.6.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=
-golang.org/x/net v0.8.0/go.mod h1:QVkue5JL9kW//ek3r6jTKnTFis1tRmNAW2P1shuFdJc=
-golang.org/x/net v0.30.0 h1:AcW1SDZMkb8IpzCdQUaIq2sP4sZ4zw+55h6ynffypl4=
-golang.org/x/net v0.30.0/go.mod h1:2wGyMJ5iFasEhkwi13ChkO/t1ECNC4X4eBKkVFyYFlU=
+golang.org/x/net v0.31.0 h1:68CPQngjLL0r2AlUKiSxtQFKvzRVbnzLwMUn5SzcLHo=
+golang.org/x/net v0.31.0/go.mod h1:P4fl1q7dY2hnZFxEk4pPSkDHF+QqjitcnDjUQyMM+pM=
 golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
 golang.org/x/oauth2 v0.0.0-20190226205417-e64efc72b421/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
 golang.org/x/oauth2 v0.0.0-20190604053449-0f29369cfe45/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
@@ -991,9 +983,8 @@ golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJ
 golang.org/x/sync v0.0.0-20201207232520-09787c993a3a/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20210220032951-036812b2e83c/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.1.0/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.8.0 h1:3NFvSEYkUoMifnESzZl15y791HH1qU2xm6eCJU5ZPXQ=
-golang.org/x/sync v0.8.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
+golang.org/x/sync v0.9.0 h1:fEo0HyrW1GIgZdpbhCRO0PkJajUS5H9IFUztCgEo2jQ=
+golang.org/x/sync v0.9.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
 golang.org/x/sys v0.0.0-20180823144017-11551d06cbcc/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20180830151530-49385e6e1522/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20180905080454-ebe1bf3edb33/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
@@ -1068,19 +1059,13 @@ golang.org/x/sys v0.0.0-20220715151400-c0bba94af5f8/go.mod h1:oPkhp1MJrh7nUepCBc
 golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220811171246-fbc7d0a398ab/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220906165534-d0df966e6959/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.2.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.3.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.26.0 h1:KHjCJyddX0LoSTb3J+vWpupP9p0oznkqVk/IfjymZbo=
-golang.org/x/sys v0.26.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
+golang.org/x/sys v0.27.0 h1:wBqf8DvsY9Y/2P8gAfPDEYNuS30J4lPHJxXSb/nJZ+s=
+golang.org/x/sys v0.27.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
-golang.org/x/term v0.2.0/go.mod h1:TVmDHMZPmdnySmBfhjOoOdhjzdE1h4u1VwSiw2l1Nuc=
-golang.org/x/term v0.5.0/go.mod h1:jMB1sMXY+tzblOD4FWmEbocvup2/aLOaQEp7JmGp78k=
-golang.org/x/term v0.6.0/go.mod h1:m6U89DPEgQRMq3DNkDClhWw02AUbt2daBVO4cn4Hv9U=
-golang.org/x/term v0.25.0 h1:WtHI/ltw4NvSUig5KARz9h521QvRC8RmF/cuYqifU24=
-golang.org/x/term v0.25.0/go.mod h1:RPyXicDX+6vLxogjjRxjgD2TKtmAO6NZBsBRfrOLu7M=
+golang.org/x/term v0.26.0 h1:WEQa6V3Gja/BhNxg540hBip/kkaYtRg3cxg4oXSw4AU=
+golang.org/x/term v0.26.0/go.mod h1:Si5m1o57C5nBNQo5z1iq+XDijt21BDBDp2bK0QI8e3E=
 golang.org/x/text v0.0.0-20170915032832-14c0d48ead0c/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.1-0.20180807135948-17ff2d5776d2/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
@@ -1090,11 +1075,9 @@ golang.org/x/text v0.3.4/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.5/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
-golang.org/x/text v0.4.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
 golang.org/x/text v0.7.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
-golang.org/x/text v0.8.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8=
-golang.org/x/text v0.19.0 h1:kTxAhCbGbxhK0IwgSKiMO5awPoDQ0RpfiVYBfK860YM=
-golang.org/x/text v0.19.0/go.mod h1:BuEKDfySbSR4drPmRPG/7iBdf8hvFMuRexcpahXilzY=
+golang.org/x/text v0.20.0 h1:gK/Kv2otX8gz+wn7Rmb3vT96ZwuoxnQlY+HlJVj7Qug=
+golang.org/x/text v0.20.0/go.mod h1:D4IsuqiFMhST5bX19pQ9ikHC2GsaKyk/oF+pn3ducp4=
 golang.org/x/time v0.0.0-20181108054448-85acf8d2951c/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.0.0-20190308202827-9d24e82272b4/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.0.0-20191024005414-555d28b269f0/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
@@ -1155,7 +1138,6 @@ golang.org/x/tools v0.1.3/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk=
 golang.org/x/tools v0.1.4/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk=
 golang.org/x/tools v0.1.5/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk=
 golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc=
-golang.org/x/tools v0.6.0/go.mod h1:Xwgl3UAJ/d3gWutnCtw505GrjyAbvKui8lOU390QaIU=
 golang.org/x/tools v0.23.0 h1:SGsXPZ+2l4JsgaCKkx+FQ9YZ5XEtA1GZYuoDjenLjvg=
 golang.org/x/tools v0.23.0/go.mod h1:pnu6ufv6vQkll6szChhK3C3L/ruaIv5eBeztNG8wtsI=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
@@ -1369,8 +1351,8 @@ modernc.org/opt v0.1.3 h1:3XOZf2yznlhC+ibLltsDGzABUGVx8J6pnFMS3E4dcq4=
 modernc.org/opt v0.1.3/go.mod h1:WdSiB5evDcignE70guQKxYUl14mgWtbClRi5wmkkTX0=
 modernc.org/sortutil v1.2.0 h1:jQiD3PfS2REGJNzNCMMaLSp/wdMNieTbKX920Cqdgqc=
 modernc.org/sortutil v1.2.0/go.mod h1:TKU2s7kJMf1AE84OoiGppNHJwvB753OYfNl2WRb++Ss=
-modernc.org/sqlite v1.33.1 h1:trb6Z3YYoeM9eDL1O8do81kP+0ejv+YzgyFo+Gwy0nM=
-modernc.org/sqlite v1.33.1/go.mod h1:pXV2xHxhzXZsgT/RtTFAPY6JJDEvOTcTdwADQCCWD4k=
+modernc.org/sqlite v1.34.1 h1:u3Yi6M0N8t9yKRDwhXcyp1eS5/ErhPTBggxWFuR6Hfk=
+modernc.org/sqlite v1.34.1/go.mod h1:pXV2xHxhzXZsgT/RtTFAPY6JJDEvOTcTdwADQCCWD4k=
 modernc.org/strutil v1.2.0 h1:agBi9dp1I+eOnxXeiZawM8F4LawKv4NzGWSaLfyeNZA=
 modernc.org/strutil v1.2.0/go.mod h1:/mdcBmfOibveCTBxUl5B5l6W+TTH1FXPLHZE6bTosX0=
 modernc.org/token v1.1.0 h1:Xl7Ap9dKaEs5kLoOQeQmPWevfnk/DM5qcLcYlA8ys6Y=
@@ -4,6 +4,7 @@ import (
 	"context"
 	"fmt"
 	"runtime/debug"
+	"slices"
 	"sync"
 	"time"

@@ -57,14 +58,14 @@ func (p *Executor) Execute(ctx context.Context, resolver file.Resolver, s sbomsy
 				}

 				err := runTaskSafely(ctx, tsk, resolver, s)
-				unknowns, err := unknown.ExtractCoordinateErrors(err)
+				unknowns, remainingErrors := unknown.ExtractCoordinateErrors(err)
 				if len(unknowns) > 0 {
 					appendUnknowns(s, tsk.Name(), unknowns)
 				}
-				if err != nil {
+				if remainingErrors != nil {
 					withLock(func() {
-						errs = multierror.Append(errs, fmt.Errorf("failed to run task: %w", err))
-						prog.SetError(err)
+						errs = multierror.Append(errs, fmt.Errorf("failed to run task: %w", remainingErrors))
+						prog.SetError(remainingErrors)
 					})
 				}
 				prog.Increment()
@@ -84,7 +85,13 @@ func appendUnknowns(builder sbomsync.Builder, taskName string, unknowns []unknow
 				if sb.Artifacts.Unknowns == nil {
 					sb.Artifacts.Unknowns = map[file.Coordinates][]string{}
 				}
-				sb.Artifacts.Unknowns[u.Coordinates] = append(sb.Artifacts.Unknowns[u.Coordinates], formatUnknown(u.Reason.Error(), taskName))
+				unknownText := formatUnknown(u.Reason.Error(), taskName)
+				existing := sb.Artifacts.Unknowns[u.Coordinates]
+				// don't include duplicate unknowns
+				if slices.Contains(existing, unknownText) {
+					continue
+				}
+				sb.Artifacts.Unknowns[u.Coordinates] = append(existing, unknownText)
 			}
 		})
 	}
@@ -0,0 +1,33 @@
+package unknown
+
+import (
+	"regexp"
+
+	"github.com/anchore/syft/internal/log"
+	"github.com/anchore/syft/syft/file"
+)
+
+var pathErrorRegex = regexp.MustCompile(`.*path="([^"]+)".*`)
+
+// ProcessPathErrors replaces "path" errors returned from the file.Resolver into unknowns,
+// and warn logs non-unknown errors, returning only the unknown errors
+func ProcessPathErrors(err error) error {
+	if err == nil {
+		return nil
+	}
+	errText := err.Error()
+	if pathErrorRegex.MatchString(errText) {
+		foundPath := pathErrorRegex.ReplaceAllString(err.Error(), "$1")
+		if foundPath != "" {
+			return New(file.NewLocation(foundPath), err)
+		}
+	}
+	unknowns, remainingErrors := ExtractCoordinateErrors(err)
+	log.Warn(remainingErrors)
+
+	var out []error
+	for _, u := range unknowns {
+		out = append(out, &u)
+	}
+	return Join(out...)
+}
@@ -0,0 +1,56 @@
+package unknown
+
+import (
+	"fmt"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+
+	"github.com/anchore/syft/syft/file"
+)
+
+func Test_ProcessPathErrors(t *testing.T) {
+	tests := []struct {
+		errorText string
+		expected  error
+	}{
+		{
+			errorText: `prefix path="/var/lib/thing" suffix`,
+			expected: &CoordinateError{
+				Coordinates: file.Coordinates{
+					RealPath: "/var/lib/thing",
+				},
+				Reason: fmt.Errorf(`prefix path="/var/lib/thing" suffix`),
+			},
+		},
+		{
+			errorText: `prefix path="/var/lib/thing"`,
+			expected: &CoordinateError{
+				Coordinates: file.Coordinates{
+					RealPath: "/var/lib/thing",
+				},
+				Reason: fmt.Errorf(`prefix path="/var/lib/thing"`),
+			},
+		},
+		{
+			errorText: `path="/var/lib/thing" suffix`,
+			expected: &CoordinateError{
+				Coordinates: file.Coordinates{
+					RealPath: "/var/lib/thing",
+				},
+				Reason: fmt.Errorf(`path="/var/lib/thing" suffix`),
+			},
+		},
+		{
+			errorText: "all your base are belong to us",
+			expected:  nil,
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.errorText, func(t *testing.T) {
+			got := ProcessPathErrors(fmt.Errorf("%s", test.errorText))
+			require.Equal(t, test.expected, got)
+		})
+	}
+}
@@ -5,6 +5,7 @@ import (
 	"crypto/sha1"
 	"fmt"
 	"path"
+	"regexp"
 	"slices"
 	"sort"
 	"strings"
@@ -713,8 +714,8 @@ func toFileTypes(metadata *file.Metadata) (ty []string) {
 	return ty
 }

-// other licenses are for licenses from the pkg.Package that do not have an SPDXExpression
-// field. The spdxexpression field is only filled given a validated Value field.
+// other licenses are for licenses from the pkg.Package that do not have a valid SPDX Expression
+// OR are an expression that is a single `License-Ref-*`
 func toOtherLicenses(catalog *pkg.Collection) []*spdx.OtherLicense {
 	licenses := map[string]helpers.SPDXLicense{}

@@ -724,11 +725,17 @@ func toOtherLicenses(catalog *pkg.Collection) []*spdx.OtherLicense {
 			if l.Value != "" {
 				licenses[l.ID] = l
 			}
+			if l.ID != "" && isLicenseRef(l.ID) {
+				licenses[l.ID] = l
+			}
 		}
 		for _, l := range concludedLicenses {
 			if l.Value != "" {
 				licenses[l.ID] = l
 			}
+			if l.ID != "" && isLicenseRef(l.ID) {
+				licenses[l.ID] = l
+			}
 		}
 	}

@@ -742,14 +749,27 @@ func toOtherLicenses(catalog *pkg.Collection) []*spdx.OtherLicense {
 	slices.Sort(ids)
 	for _, id := range ids {
 		license := licenses[id]
+		value := license.Value
+		// handle cases where LicenseRef needs to be included in hasExtractedLicensingInfos
+		if license.Value == "" {
+			value, _ = strings.CutPrefix(license.ID, "LicenseRef-")
+		}
 		result = append(result, &spdx.OtherLicense{
 			LicenseIdentifier: license.ID,
-			ExtractedText:     license.Value,
+			ExtractedText:     value,
 		})
 	}
 	return result
 }

+var licenseRefRegEx = regexp.MustCompile(`^LicenseRef-[A-Za-z0-9_-]+$`)
+
+// isSingularLicenseRef checks if the string is a singular LicenseRef-* identifier
+func isLicenseRef(s string) bool {
+	// Match the input string against the regex
+	return licenseRefRegEx.MatchString(s)
+}
+
 // TODO: handle SPDX excludes file case
 // f file is an "excludes" file, skip it /* exclude SPDX analysis file(s) */
 // see: https://spdx.github.io/spdx-spec/v2.3/package-information/#79-package-verification-code-field
@@ -753,6 +753,29 @@ func Test_OtherLicenses(t *testing.T) {
 				},
 			},
 		},
+		{
+			name: "LicenseRef as a valid spdx expression",
+			pkg: pkg.Package{
+				Licenses: pkg.NewLicenseSet(
+					pkg.NewLicense("LicenseRef-Fedora-Public-Domain"),
+				),
+			},
+			expected: []*spdx.OtherLicense{
+				{
+					LicenseIdentifier: "LicenseRef-Fedora-Public-Domain",
+					ExtractedText:     "Fedora-Public-Domain",
+				},
+			},
+		},
+		{
+			name: "LicenseRef as a valid spdx expression does not otherize compound spdx expressions",
+			pkg: pkg.Package{
+				Licenses: pkg.NewLicenseSet(
+					pkg.NewLicense("(MIT AND LicenseRef-Fedora-Public-Domain)"),
+				),
+			},
+			expected: nil,
+		},
 	}

 	for _, test := range tests {
@@ -105,6 +105,7 @@ func catalog(resolver file.Resolver, cls Classifier) (packages []pkg.Package, er
 	var errs error
 	locations, err := resolver.FilesByGlob(cls.FileGlob)
 	if err != nil {
+		err = unknown.ProcessPathErrors(err) // convert any file.Resolver path errors to unknowns with locations
 		return nil, err
 	}
 	for _, location := range locations {
@@ -1668,7 +1668,7 @@ func Test_Cataloger_ResilientToErrors(t *testing.T) {

 	resolver := &panicyResolver{}
 	_, _, err := c.Catalog(context.Background(), resolver)
-	assert.Error(t, err)
+	assert.Nil(t, err) // non-coordinate-based FindBy* errors are now logged and not returned
 	assert.True(t, resolver.searchCalled)
 }

@@ -158,7 +158,7 @@ func DefaultClassifiers() []Classifier {
 				// [NUL]v0.12.18[NUL]
 				// [NUL]v4.9.1[NUL]
 				// node.js/v22.9.0
-				FileContentsVersionMatcher(`(?m)\x00(node )?v(?P<version>(0|4|5)\.[0-9]+\.[0-9]+)\x00`),
+				FileContentsVersionMatcher(`(?m)\x00(node )?v(?P<version>(0|4|5|6)\.[0-9]+\.[0-9]+)\x00`),
 				FileContentsVersionMatcher(`(?m)node\.js\/v(?P<version>[0-9]+\.[0-9]+\.[0-9]+)`),
 			),
 			Package: "node",
@@ -108,7 +108,7 @@ func newSpyReturningFileResolver(s *spyingIoReadCloser, paths ...string) file.Re
 }

 func (s *spyingIoReadCloser) Read(p []byte) (n int, err error) {
-	return s.Read(p)
+	return s.rc.Read(p)
 }

 func (s *spyingIoReadCloser) Close() error {
@@ -7046,6 +7046,9 @@
      "a2-optimized-wp": [
        "cpe:2.3:a:a2hosting:a2_optimized:*:*:*:*:*:wordpress:*:*"
      ],
+      "a4-barcode-generator": [
+        "cpe:2.3:a:ukrsolution:print_labels_with_barcodes:*:*:*:*:*:wordpress:*:*"
+      ],
      "aajoda-testimonials": [
        "cpe:2.3:a:aajoda:aajoda_testimonials:*:*:*:*:*:wordpress:*:*"
      ],
@@ -7527,6 +7530,9 @@
      "all-bootstrap-blocks": [
        "cpe:2.3:a:areoi:all_bootstrap_blocks:*:*:*:*:*:wordpress:*:*"
      ],
+      "all-contact-form-integration-for-elementor": [
+        "cpe:2.3:a:theinnovs:eleforms:*:*:*:*:*:wordpress:*:*"
+      ],
      "all-in-one-favicon": [
        "cpe:2.3:a:techotronic:all_in_one_favicon:*:*:*:*:*:wordpress:*:*"
      ],
@@ -7544,7 +7550,7 @@
        "cpe:2.3:a:plugins360:all-in-one_video_gallery:*:*:*:*:*:wordpress:*:*"
      ],
      "all-in-one-wp-migration": [
-        "cpe:2.3:a:servmask:all-in-one_wp_migration:*:*:*:*:*:wordpress:*:*"
+        "cpe:2.3:a:servmask:all-in-one_wp_migration:*:*:*:*:free:wordpress:*:*"
      ],
      "all-in-one-wp-security-and-firewall": [
        "cpe:2.3:a:tips_and_tricks_hq:all_in_one_wordpress_security_and_firewall:*:*:*:*:*:wordpress:*:*",
@@ -7555,6 +7561,9 @@
      "allow-php-in-posts-and-pages": [
        "cpe:2.3:a:hitreach:allow_php_in_posts_and_pages:*:*:*:*:*:wordpress:*:*"
      ],
+      "allpost-contactform": [
+        "cpe:2.3:a:rainbow-link:all_post_contact_form:*:*:*:*:*:wordpress:*:*"
+      ],
      "alma-gateway-for-woocommerce": [
        "cpe:2.3:a:almapay:alma:*:*:*:*:*:wordpress:*:*"
      ],
@@ -7649,6 +7658,9 @@
      "analytics-tracker": [
        "cpe:2.3:a:analytics_tracker_project:analytics_tracker:*:*:*:*:*:wordpress:*:*"
      ],
+      "anchor-episodes-index": [
+        "cpe:2.3:a:jesweb:anchor_episodes_index:*:*:*:*:*:wordpress:*:*"
+      ],
      "animate-it": [
        "cpe:2.3:a:eleopard:animate_it\\!:*:*:*:*:*:wordpress:*:*"
      ],
@@ -7740,6 +7752,9 @@
      "aprils-super-functions-pack": [
        "cpe:2.3:a:april\\'s_super_functions_pack_project:april\\'s_super_functions_pack:*:*:*:*:*:wordpress:*:*"
      ],
+      "ar-for-wordpress": [
+        "cpe:2.3:a:webandprint:ar:*:*:*:*:*:wordpress:*:*"
+      ],
      "archivist-custom-archive-templates": [
        "cpe:2.3:a:archivist_-_custom_archive_templates_project:archivist_-_custom_archive_templates:*:*:*:*:*:wordpress:*:*",
        "cpe:2.3:a:ericteubert:archivist_-_custom_archive_templates:*:*:*:*:*:wordpress:*:*"
@@ -8019,6 +8034,9 @@
      "baslider": [
        "cpe:2.3:a:nextcode:image_slider_by_nextcode:*:*:*:*:*:wordpress:*:*"
      ],
+      "basticom-framework": [
+        "cpe:2.3:a:basticom:framework:*:*:*:*:*:wordpress:*:*"
+      ],
      "batch-cat": [
        "cpe:2.3:a:batch_cat_project:batch_cat:*:*:*:*:*:wordpress:*:*"
      ],
@@ -8026,6 +8044,9 @@
        "cpe:2.3:a:brainstormforce:cards_for_beaver_builder:*:*:*:*:*:wordpress:*:*",
        "cpe:2.3:a:ultimateaddons:cards_for_beaver_builder:*:*:*:*:*:wordpress:*:*"
      ],
+      "bbp-core": [
+        "cpe:2.3:a:spider-themes:bbp_core:*:*:*:*:*:wordpress:*:*"
+      ],
      "bbp-move-topics": [
        "cpe:2.3:a:bbpress_move_topics_project:bbpress_move_topics:*:*:*:*:*:wordpress:*:*"
      ],
@@ -8054,6 +8075,9 @@
      "bdthemes-element-pack-lite#tags": [
        "cpe:2.3:a:bdthemes:element_pack:*:*:*:*:lite:wordpress:*:*"
      ],
+      "bdthemes-prime-slider-lite": [
+        "cpe:2.3:a:bdthemes:prime_slider:*:*:*:*:free:wordpress:*:*"
+      ],
      "bdvs-password-reset": [
        "cpe:2.3:a:bedevious:password_reset_with_code_for_wordpress_rest_api:*:*:*:*:*:wordpress:*:*"
      ],
@@ -8061,6 +8085,9 @@
        "cpe:2.3:a:web-x:be-popia-compliant:*:*:*:*:*:wordpress:*:*",
        "cpe:2.3:a:web-x:be_popia_compliant:*:*:*:*:*:wordpress:*:*"
      ],
+      "beam-me-up-scotty": [
+        "cpe:2.3:a:outtheboxthemes:beam_me_up_scotty:*:*:*:*:*:wordpress:*:*"
+      ],
      "beautiful-and-responsive-cookie-consent": [
        "cpe:2.3:a:beautiful-cookie-banner:beautiful_cookie_consent_banner:*:*:*:*:*:wordpress:*:*"
      ],
@@ -8107,7 +8134,7 @@
        "cpe:2.3:a:solidwp:solid_security:*:*:*:*:*:wordpress:*:*"
      ],
      "betterlinks": [
-        "cpe:2.3:a:wpdeveloper:betterlinks:*:*:*:*:*:wordpress:*:*"
+        "cpe:2.3:a:wpdeveloper:betterlinks:*:*:*:*:free:wordpress:*:*"
      ],
      "bft-autoresponder": [
        "cpe:2.3:a:kibokolabs:arigato_autoresponder_and_newsletter:*:*:*:*:*:wordpress:*:*"
@@ -8264,7 +8291,7 @@
        "cpe:2.3:a:bookingholdings:booking.com_product_helper:*:*:*:*:*:wordpress:*:*"
      ],
      "bookingpress-appointment-booking": [
-        "cpe:2.3:a:reputeinfosystems:bookingpress:*:*:*:*:*:wordpress:*:*"
+        "cpe:2.3:a:reputeinfosystems:bookingpress:*:*:*:*:free:wordpress:*:*"
      ],
      "bookit": [
        "cpe:2.3:a:stylemixthemes:bookit:*:*:*:*:*:wordpress:*:*"
@@ -8490,7 +8517,7 @@
      ],
      "cafe-lite": [
        "cpe:2.3:a:clever-soft:clever_addons_for_elementor:*:*:*:*:*:wordpress:*:*",
-        "cpe:2.3:a:cleversoft:clever_addons_for_elementor:*:*:*:*:*:wordpress:*:*",
+        "cpe:2.3:a:cleversoft:clever_addons_for_elementor:*:*:*:*:lite:wordpress:*:*",
        "cpe:2.3:a:download_clever_addons_for_elementor_project:download_clever_addons_for_elementor:*:*:*:*:*:wordpress:*:*"
      ],
      "calculated-fields-form": [
@@ -8768,6 +8795,9 @@
      "clerkio": [
        "cpe:2.3:a:clerk:clerk.io:*:*:*:*:*:wordpress:*:*"
      ],
+      "clever-fox": [
+        "cpe:2.3:a:nayrathemes:clever_fox:*:*:*:*:*:wordpress:*:*"
+      ],
      "click-datos-lopd": [
        "cpe:2.3:a:clickdatos:proteccion_de_datos_rgpd:*:*:*:*:*:wordpress:*:*"
      ],
@@ -9263,6 +9293,9 @@
        "cpe:2.3:a:codeless:cowidgets_-_elementor:*:*:*:*:*:wordpress:*:*",
        "cpe:2.3:a:codeless:cowidgets_elementor_addons:*:*:*:*:*:wordpress:*:*"
      ],
+      "cozy-addons": [
+        "cpe:2.3:a:cozythemes:cozy_blocks:*:*:*:*:*:wordpress:*:*"
+      ],
      "cp-appointment-calendar": [
        "cpe:2.3:a:codepeople:cp_appointment_calendar:*:*:*:*:*:wordpress:*:*"
      ],
@@ -9315,6 +9348,9 @@
      "crelly-slider": [
        "cpe:2.3:a:crelly_slider_project:crelly_slider:*:*:*:*:*:wordpress:*:*"
      ],
+      "cresta-addons-for-elementor": [
+        "cpe:2.3:a:crestaproject:cresta_addons_for_elementor:*:*:*:*:*:wordpress:*:*"
+      ],
      "crisp": [
        "cpe:2.3:a:crisp:live_chat:*:*:*:*:*:wordpress:*:*"
      ],
@@ -9389,6 +9425,9 @@
      "cube-slider": [
        "cpe:2.3:a:webpsilon:cube_slider:*:*:*:*:*:wordpress:*:*"
      ],
+      "cubewp-framework": [
+        "cpe:2.3:a:cubewp:cubewp:*:*:*:*:*:wordpress:*:*"
+      ],
      "curatorio": [
        "cpe:2.3:a:curator:curator.io:*:*:*:*:*:wordpress:*:*"
      ],
@@ -9956,6 +9995,7 @@
        "cpe:2.3:a:easysocialfeed:easy_social_feed:*:*:*:*:free:wordpress:*:*"
      ],
      "easy-fancybox": [
+        "cpe:2.3:a:firelightwp:firelight_lightbox:*:*:*:*:*:wordpress:*:*",
        "cpe:2.3:a:status301:easy_fancybox:*:*:*:*:*:wordpress:*:*"
      ],
      "easy-faq-with-expanding-text": [
@@ -9989,6 +10029,9 @@
      "easy-paypal-donation": [
        "cpe:2.3:a:wpplugin:accept_donations_with_paypal:*:*:*:*:*:wordpress:*:*"
      ],
+      "easy-paypal-events-tickets": [
+        "cpe:2.3:a:wpplugin:easy_paypal_events:*:*:*:*:*:wordpress:*:*"
+      ],
      "easy-pdf-restaurant-menu-upload": [
        "cpe:2.3:a:easy_pdf_restaurant_menu_upload_project:easy_pdf_restaurant_menu_upload:*:*:*:*:*:wordpress:*:*"
      ],
@@ -10263,6 +10306,9 @@
      "envira-gallery-lite": [
        "cpe:2.3:a:enviragallery:envira_gallery:*:*:*:*:lite:wordpress:*:*"
      ],
+      "envo-elementor-for-woocommerce": [
+        "cpe:2.3:a:envothemes:envo\\'s_elementor_templates_\\\u0026_widgets_for_woocommerce:*:*:*:*:*:wordpress:*:*"
+      ],
      "envo-extra": [
        "cpe:2.3:a:envothemes:envo_extra:*:*:*:*:*:wordpress:*:*"
      ],
@@ -10286,7 +10332,8 @@
        "cpe:2.3:a:eshop_project:eshop:*:*:*:*:*:wordpress:*:*"
      ],
      "essential-addons-for-elementor-lite": [
-        "cpe:2.3:a:wpdeveloper:essential_addons_for_elementor:*:*:*:*:*:wordpress:*:*"
+        "cpe:2.3:a:wpdeveloper:essential_addons_for_elementor:*:*:*:*:*:wordpress:*:*",
+        "cpe:2.3:a:wpdeveloper:essential_addons_for_elementor:*:*:*:*:lite:wordpress:*:*"
      ],
      "essential-blocks": [
        "cpe:2.3:a:wpdeveloper:essential_blocks:*:*:*:*:*:wordpress:*:*",
@@ -10689,9 +10736,16 @@
      "flexi-quote-rotator": [
        "cpe:2.3:a:flexi_quote_rotator_project:flexi_quote_rotator:*:*:*:*:*:wordpress:*:*"
      ],
+      "flexible-checkout-fields": [
+        "cpe:2.3:a:wpdesk:flexible_checkout_fields:*:*:*:*:free:wordpress:*:*"
+      ],
      "flexible-elementor-panel": [
        "cpe:2.3:a:webmat:flexible_elementor_panel:*:*:*:*:*:wordpress:*:*"
      ],
+      "flexible-shipping-ups": [
+        "cpe:2.3:a:octolize:woocommerce_ups_shipping:*:*:*:*:free:wordpress:*:*",
+        "cpe:2.3:a:octolize:woocommerce_ups_shipping:*:*:*:*:pro:wordpress:*:*"
+      ],
      "flickr-justified-gallery": [
        "cpe:2.3:a:flickr_justified_gallery_project:flickr_justified_gallery:*:*:*:*:*:wordpress:*:*"
      ],
@@ -11398,6 +11452,7 @@
        "cpe:2.3:a:handsome_testimonials_\\\u0026_reviews_project:handsome_testimonials_\\\u0026_reviews:*:*:*:*:*:wordpress:*:*"
      ],
      "happy-elementor-addons": [
+        "cpe:2.3:a:leevio:happy_addons_for_elementor:*:*:*:*:free:wordpress:*:*",
        "cpe:2.3:a:wedevs:happy_addons_for_elementor:*:*:*:*:*:wordpress:*:*",
        "cpe:2.3:a:wedevs:happy_addons_for_elementor:*:*:*:*:-:wordpress:*:*"
      ],
@@ -11426,7 +11481,8 @@
        "cpe:2.3:a:draftpress:header_footer_code_manager:*:*:*:*:*:wordpress:*:*"
      ],
      "header-footer-elementor": [
-        "cpe:2.3:a:brainstormforce:elementor_-_header\\,_footer_\\\u0026_blocks_template:*:*:*:*:*:wordpress:*:*"
+        "cpe:2.3:a:brainstormforce:elementor_-_header\\,_footer_\\\u0026_blocks_template:*:*:*:*:*:wordpress:*:*",
+        "cpe:2.3:a:brainstormforce:elementor_header_\\\u0026_footer_builder:*:*:*:*:*:wordpress:*:*"
      ],
      "heat-trackr": [
        "cpe:2.3:a:heat-trackr_project:heat-trackr:*:*:*:*:*:wordpress:*:*"
@@ -11926,6 +11982,9 @@
      "iq-block-country": [
        "cpe:2.3:a:webence:iq_block_country:*:*:*:*:*:wordpress:*:*"
      ],
+      "ithemelandco-woo-report": [
+        "cpe:2.3:a:ithemelandco:woocommerce_report:*:*:*:*:*:wordpress:*:*"
+      ],
      "iubenda-cookie-law-solution": [
        "cpe:2.3:a:iubenda:iubenda-cookie-law-solution:*:*:*:*:*:wordpress:*:*"
      ],
@@ -12088,6 +12147,9 @@
      "kangu": [
        "cpe:2.3:a:kangu:kangu:*:*:*:*:*:wordpress:*:*"
      ],
+      "kata-plus": [
+        "cpe:2.3:a:climaxthemes:kata_plus:*:*:*:*:*:wordpress:*:*"
+      ],
      "kau-boys-backend-localization": [
        "cpe:2.3:a:kau-boys:backend_localization:*:*:*:*:*:wordpress:*:*"
      ],
@@ -12127,6 +12189,9 @@
      "klaviyo": [
        "cpe:2.3:a:klaviyo:klavio:*:*:*:*:*:wordpress:*:*"
      ],
+      "knowledgebase": [
+        "cpe:2.3:a:webberzone:knowledge_base:*:*:*:*:*:wordpress:*:*"
+      ],
      "kodex-posts-likes": [
        "cpe:2.3:a:pierros:kodex_posts_likes:*:*:*:*:*:wordpress:*:*"
      ],
@@ -12384,6 +12449,9 @@
      "loco-translate": [
        "cpe:2.3:a:loco_translate_project:loco_translate:*:*:*:*:*:wordpress:*:*"
      ],
+      "loggedin": [
+        "cpe:2.3:a:duckdev:loggedin:*:*:*:*:*:wordpress:*:*"
+      ],
      "login-as-customer-or-user": [
        "cpe:2.3:a:wp-buy:login_as_user_or_customer_\\(user_switching\\):*:*:*:*:*:wordpress:*:*"
      ],
@@ -12610,6 +12678,9 @@
      "martins-link-network": [
        "cpe:2.3:a:martinstools:free_\\\u0026_easy_link_building:*:*:*:*:*:wordpress:*:*"
      ],
+      "mas-addons-for-elementor": [
+        "cpe:2.3:a:madrasthemes:mas_elementor:*:*:*:*:*:wordpress:*:*"
+      ],
      "mas-static-content": [
        "cpe:2.3:a:madrasthemes:mas_static_content:*:*:*:*:*:wordpress:*:*"
      ],
@@ -12716,12 +12787,18 @@
      "meks-audio-player": [
        "cpe:2.3:a:mekshq:meks_audio_player:*:*:*:*:*:wordpress:*:*"
      ],
+      "meks-easy-ads-widget": [
+        "cpe:2.3:a:mekshq:meks_easy_ads_widget:*:*:*:*:*:wordpress:*:*"
+      ],
      "meks-easy-instagram-widget": [
        "cpe:2.3:a:mekshq:meks_easy_photo_feed_widget:*:*:*:*:*:wordpress:*:*"
      ],
      "meks-flexible-shortcodes": [
        "cpe:2.3:a:mekshq:meks_flexible_shortcodes:*:*:*:*:*:wordpress:*:*"
      ],
+      "meks-smart-author-widget": [
+        "cpe:2.3:a:mekshq:meks_smart_author_widget:*:*:*:*:*:wordpress:*:*"
+      ],
      "meks-smart-social-widget": [
        "cpe:2.3:a:mekshq:meks_smart_social_widget:*:*:*:*:*:wordpress:*:*"
      ],
@@ -12858,6 +12935,9 @@
      "mobile-login-woocommerce": [
        "cpe:2.3:a:xootix:otp_login_woocommerce_\\\u0026_gravity_forms:*:*:*:*:*:wordpress:*:*"
      ],
+      "mobile-menu": [
+        "cpe:2.3:a:freshlightlab:wp_mobile_menu:*:*:*:*:*:wordpress:*:*"
+      ],
      "modal-dialog": [
        "cpe:2.3:a:modal_dialog_project:modal_dialog:*:*:*:*:*:wordpress:*:*"
      ],
@@ -13164,6 +13244,9 @@
      "news-announcement-scroll": [
        "cpe:2.3:a:storeapps:news_announcement_scroll:*:*:*:*:*:wordpress:*:*"
      ],
+      "news-kit-elementor-addons": [
+        "cpe:2.3:a:blazethemes:news_kit_elementor_addons:*:*:*:*:*:wordpress:*:*"
+      ],
      "newsletter": [
        "cpe:2.3:a:thenewsletterplugin:newsletter:*:*:*:*:*:wordpress:*:*"
      ],
@@ -13226,6 +13309,9 @@
        "cpe:2.3:a:ninjaforms:contact_form:*:*:*:*:*:wordpress:*:*",
        "cpe:2.3:a:ninjaforms:ninja_forms:*:*:*:*:*:wordpress:*:*"
      ],
+      "ninja-gdpr-compliance": [
+        "cpe:2.3:a:ninjateam:gdpr_ccpa_compliance_\\\u0026_cookie_consent_banner:*:*:*:*:*:wordpress:*:*"
+      ],
      "ninja-job-board": [
        "cpe:2.3:a:wpmanageninja:ninja_job_board:*:*:*:*:*:wordpress:*:*"
      ],
@@ -13338,6 +13424,9 @@
      "olive-one-click-demo-import": [
        "cpe:2.3:a:olivethemes:olive_one_click_demo_import:*:*:*:*:*:wordpress:*:*"
      ],
+      "olympus-google-fonts": [
+        "cpe:2.3:a:fontsplugin:fonts:*:*:*:*:*:wordpress:*:*"
+      ],
      "omnisend-connect": [
        "cpe:2.3:a:omnisend:email_marketing_for_woocommerce:*:*:*:*:*:wordpress:*:*"
      ],
@@ -13451,6 +13540,7 @@
        "cpe:2.3:a:webtoffee:order_export_\\\u0026_order_import_for_woocommerce:*:*:*:*:*:wordpress:*:*"
      ],
      "order-tracking": [
+        "cpe:2.3:a:etoilewebdesign:order_tracking:*:*:*:*:*:wordpress:*:*",
        "cpe:2.3:a:etoilewebdesign:order_tracking:*:*:*:*:pro:wordpress:*:*"
      ],
      "organization-chart": [
@@ -13614,6 +13704,9 @@
      "pdf-embedder": [
        "cpe:2.3:a:wp-pdf:pdf_embedder:*:*:*:*:*:wordpress:*:*"
      ],
+      "pdf-generator-addon-for-elementor-page-builder": [
+        "cpe:2.3:a:redefiningtheweb:pdf_generator_addon_for_elementor_page_builder:*:*:*:*:*:wordpress:*:*"
+      ],
      "pdf-generator-for-wp": [
        "cpe:2.3:a:wpswings:pdf_generator_for_wordpress:*:*:*:*:*:wordpress:*:*"
      ],
@@ -13791,6 +13884,9 @@
        "cpe:2.3:a:web-dorado:spidervplayer:*:*:*:*:*:wordpress:*:*",
        "cpe:2.3:a:web-dorado:web-dorado_spider_video_player:*:*:*:*:*:wordpress:*:*"
      ],
+      "plexx-elementor-extension": [
+        "cpe:2.3:a:themeworm:plexx_elementor_extension:*:*:*:*:*:wordpress:*:*"
+      ],
      "plugin-logic": [
        "cpe:2.3:a:plugin_logic_project:plugin_logic:*:*:*:*:*:wordpress:*:*"
      ],
@@ -14046,6 +14142,9 @@
        "cpe:2.3:a:leap13:premium_addons_for_elementor:*:*:*:*:*:wordpress:*:*",
        "cpe:2.3:a:leap13:premium_addons_for_elementor:*:*:*:*:pro:wordpress:*:*"
      ],
+      "premium-seo-pack": [
+        "cpe:2.3:a:squirrly:premium_seo_pack:*:*:*:*:*:wordpress:*:*"
+      ],
      "premmerce": [
        "cpe:2.3:a:premmerce:premmerce:*:*:*:*:*:wordpress:*:*"
      ],
@@ -14137,6 +14236,9 @@
        "cpe:2.3:a:awesometogi:product-category-tree:*:*:*:*:*:wordpress:*:*",
        "cpe:2.3:a:awesometogi:product_category_tree:*:*:*:*:*:wordpress:*:*"
      ],
+      "product-delivery-date-for-woocommerce-lite": [
+        "cpe:2.3:a:tychesoftwares:product_delivery_date_for_woocommerce:*:*:*:*:lite:wordpress:*:*"
+      ],
      "product-designer": [
        "cpe:2.3:a:pickplugins:product_designer:*:*:*:*:*:wordpress:*:*"
      ],
@@ -14165,6 +14267,9 @@
      "profilegrid-user-profiles-groups-and-communities": [
        "cpe:2.3:a:metagauss:profilegrid:*:*:*:*:*:wordpress:*:*"
      ],
+      "profilepress-pro": [
+        "cpe:2.3:a:properfraction:profilepress:*:*:*:*:pro:wordpress:*:*"
+      ],
      "profit-products-tables-for-woocommerce": [
        "cpe:2.3:a:pluginus:woot:*:*:*:*:*:wordpress:*:*"
      ],
@@ -14270,6 +14375,9 @@
      "querlo-chatbots": [
        "cpe:2.3:a:querlo:chatbot:*:*:*:*:*:wordpress:*:*"
      ],
+      "quick-adsense-reloaded": [
+        "cpe:2.3:a:wpquads:ads:*:*:*:*:*:wordpress:*:*"
+      ],
      "quick-chat": [
        "cpe:2.3:a:quick_chat_project:quick_chat:*:*:*:*:*:wordpress:*:*",
        "cpe:2.3:a:techytalk:quick_chat:*:*:*:*:*:wordpress:*:*"
@@ -14707,6 +14815,7 @@
        "cpe:2.3:a:coderevolution:echo_rss_feed_post_generator:*:*:*:*:*:wordpress:*:*"
      ],
      "rss-feed-widget": [
+        "cpe:2.3:a:fahadmahmood:rss_feed_widget:*:*:*:*:*:wordpress:*:*",
        "cpe:2.3:a:rss_feed_widget_project:rss_feed_widget:*:*:*:*:*:wordpress:*:*"
      ],
      "rss-for-yandex-turbo": [
@@ -15051,7 +15160,8 @@
        "cpe:2.3:a:bainternet:shortcodes_ui:*:*:*:*:*:wordpress:*:*"
      ],
      "shortcodes-ultimate": [
-        "cpe:2.3:a:getshortcodes:shortcodes_ultimate:*:*:*:*:*:wordpress:*:*"
+        "cpe:2.3:a:getshortcodes:shortcodes_ultimate:*:*:*:*:*:wordpress:*:*",
+        "cpe:2.3:a:getshortcodes:shortcodes_ultimate:*:*:*:*:-:wordpress:*:*"
      ],
      "shortcut-macros": [
        "cpe:2.3:a:shortcut_macros_project:shortcut_macros:*:*:*:*:*:wordpress:*:*"
@@ -15062,6 +15172,9 @@
      "shortpixel-adaptive-images": [
        "cpe:2.3:a:shortpixel:shortpixel_adaptive_images:*:*:*:*:*:wordpress:*:*"
      ],
+      "shortpixel-image-optimiser": [
+        "cpe:2.3:a:shortpixel:image_optimizer:*:*:*:*:*:wordpress:*:*"
+      ],
      "show-all-comments-in-one-page": [
        "cpe:2.3:a:appjetty:show_all_comments:*:*:*:*:*:wordpress:*:*"
      ],
@@ -15356,7 +15469,8 @@
        "cpe:2.3:a:simplygallery:simply_gallery_blocks_with_lightbox:*:*:*:*:*:wordpress:*:*"
      ],
      "simply-schedule-appointments": [
-        "cpe:2.3:a:nsqua:simply_schedule_appointments:*:*:*:*:*:wordpress:*:*"
+        "cpe:2.3:a:nsqua:simply_schedule_appointments:*:*:*:*:*:wordpress:*:*",
+        "cpe:2.3:a:nsquared:simply_schedule_appointments:*:*:*:*:*:wordpress:*:*"
      ],
      "sina-extension-for-elementor": [
        "cpe:2.3:a:shaosina:sina_extension_for_elementor:*:*:*:*:*:wordpress:*:*",
@@ -15846,7 +15960,7 @@
        "cpe:2.3:a:instawp:string_locator:*:*:*:*:*:wordpress:*:*"
      ],
      "strong-testimonials": [
-        "cpe:2.3:a:machothemes:strong_testimonials:*:*:*:*:*:wordpress:*:*"
+        "cpe:2.3:a:wpchill:strong_testimonials:*:*:*:*:*:wordpress:*:*"
      ],
      "structured-content": [
        "cpe:2.3:a:wpsc-plugin:structured_content:*:*:*:*:*:wordpress:*:*"
@@ -15867,7 +15981,7 @@
        "cpe:2.3:a:subscribe_to_category_project:subscribe_to_category:*:*:*:*:*:wordpress:*:*"
      ],
      "subscribe-to-comments": [
-        "cpe:2.3:a:subscribe_to_comments_project:subscribe_to_comments:*:*:*:*:*:wordpress:*:*"
+        "cpe:2.3:a:markjaquith:subscribe_to_comments:*:*:*:*:*:wordpress:*:*"
      ],
      "subscribe-to-comments-reloaded": [
        "cpe:2.3:a:wpkube:subscribe_to_comments_reloaded:*:*:*:*:*:wordpress:*:*"
@@ -16194,6 +16308,10 @@
      "tickera-event-ticketing-system": [
        "cpe:2.3:a:tickera:tickera:*:*:*:*:*:wordpress:*:*"
      ],
+      "time-clock": [
+        "cpe:2.3:a:wpplugin:time_clock:*:*:*:*:-:wordpress:*:*",
+        "cpe:2.3:a:wpplugin:time_clock:*:*:*:*:pro:wordpress:*:*"
+      ],
      "time-sheets": [
        "cpe:2.3:a:dcac:time_sheets:*:*:*:*:*:wordpress:*:*",
        "cpe:2.3:a:time_sheets_project:time_sheets:*:*:*:*:*:wordpress:*:*"
@@ -16210,6 +16328,9 @@
      "timesheet": [
        "cpe:2.3:a:bestwebsoft:timesheet:*:*:*:*:*:wordpress:*:*"
      ],
+      "timetics": [
+        "cpe:2.3:a:arraytics:wp_timetics:*:*:*:*:*:wordpress:*:*"
+      ],
      "timthumb-vulnerability-scanner": [
        "cpe:2.3:a:peterbutler:timthumb_vulnerability_scanner:*:*:*:*:*:wordpress:*:*"
      ],
@@ -16290,6 +16411,9 @@
      "transbank-webpay-plus-rest": [
        "cpe:2.3:a:transbank:transbank_webpay_rest:*:*:*:*:*:wordpress:*:*"
      ],
+      "transients-manager": [
+        "cpe:2.3:a:wpbeginner:transients_manager:*:*:*:*:*:wordpress:*:*"
+      ],
      "transition-slider-lite": [
        "cpe:2.3:a:creativeinteractivemedia:transition_slider:*:*:*:*:*:wordpress:*:*"
      ],
@@ -16326,6 +16450,9 @@
      "tubepress": [
        "cpe:2.3:a:tubepress:tubepress:*:*:*:*:*:wordpress:*:*"
      ],
+      "tumult-hype-animations": [
+        "cpe:2.3:a:tumult:tumult_hype_animations:*:*:*:*:*:wordpress:*:*"
+      ],
      "tune-library": [
        "cpe:2.3:a:tune_library_project:tune_library:*:*:*:*:*:wordpress:*:*"
      ],
@@ -16722,6 +16849,9 @@
      "video-thumbnails": [
        "cpe:2.3:a:video_thumbnails_project:video_thumbnails:*:*:*:*:*:wordpress:*:*"
      ],
+      "video-wc-gallery": [
+        "cpe:2.3:a:martinvalchev:video_gallery_for_woocommerce:*:*:*:*:*:wordpress:*:*"
+      ],
      "video-widget": [
        "cpe:2.3:a:nikodev:video_widget:*:*:*:*:*:wordpress:*:*"
      ],
@@ -16796,6 +16926,9 @@
      "vm-backups": [
        "cpe:2.3:a:vm_backups_project:vm_backups:*:*:*:*:*:wordpress:*:*"
      ],
+      "vod-infomaniak": [
+        "cpe:2.3:a:infomaniak:vod_infomaniak:*:*:*:*:*:wordpress:*:*"
+      ],
      "vospari-forms": [
        "cpe:2.3:a:vospari_forms_project:vospari_forms:*:*:*:*:*:wordpress:*:*"
      ],
@@ -16878,6 +17011,7 @@
        "cpe:2.3:a:ilghera:woocommerce_support_system:*:*:*:*:*:wordpress:*:*"
      ],
      "wc-vendors": [
+        "cpe:2.3:a:rymera:wc_vendors:*:*:*:*:free:wordpress:*:*",
        "cpe:2.3:a:wcvendors:woocommerce_multi-vendor\\,_woocommerce_marketplace\\,_product_vendors:*:*:*:*:*:wordpress:*:*"
      ],
      "wc4bp": [
@@ -17030,6 +17164,9 @@
      "whizz": [
        "cpe:2.3:a:browserweb:whizz:*:*:*:*:*:wordpress:*:*"
      ],
+      "whizzy": [
+        "cpe:2.3:a:upqode:whizzy:*:*:*:*:*:wordpress:*:*"
+      ],
      "wholesale-pricing-woocommerce": [
        "cpe:2.3:a:wpfactory:quantity_dynamic_pricing_\\\u0026_bulk_discounts_for_woocommerce:*:*:*:*:free:wordpress:*:*"
      ],
@@ -17155,6 +17292,9 @@
      "woo-esto": [
        "cpe:2.3:a:rebing:woocommerce_esto:*:*:*:*:*:wordpress:*:*"
      ],
+      "woo-floating-cart-lite": [
+        "cpe:2.3:a:xplodedthemes:xt_floating_cart_for_woocommerce:*:*:*:*:*:wordpress:*:*"
+      ],
      "woo-gift-cards-lite": [
        "cpe:2.3:a:wpswings:ultimate_gift_cards_for_woocommerce:*:*:*:*:*:wordpress:*:*"
      ],
@@ -17224,6 +17364,9 @@
      "woo-smart-wishlist": [
        "cpe:2.3:a:wpclever:wpc_smart_wishlist_for_woocommerce:*:*:*:*:*:wordpress:*:*"
      ],
+      "woo-social-login": [
+        "cpe:2.3:a:wpwebelite:woocommerce_social_login:*:*:*:*:*:wordpress:*:*"
+      ],
      "woo-stripe-payment": [
        "cpe:2.3:a:paymentplugins:stripe_for_woocommerce:*:*:*:*:*:wordpress:*:*"
      ],
@@ -17233,6 +17376,9 @@
      "woo-thank-you-page-nextmove-lite": [
        "cpe:2.3:a:xlplugins:nextmove:*:*:*:*:lite:wordpress:*:*"
      ],
+      "woo-tools": [
+        "cpe:2.3:a:themefarmer:woocommerce_tools:*:*:*:*:*:wordpress:*:*"
+      ],
      "woo-tranzila-gateway": [
        "cpe:2.3:a:antonbond:woocommerce_tranzila_payment_gateway:*:*:*:*:*:wordpress:*:*"
      ],
@@ -17255,6 +17401,9 @@
      "woo-zoho": [
        "cpe:2.3:a:crmperks:integration_for_woocommerce_and_zoho_crm\\,_books\\,_invoice\\,_inventory\\,_bigin:*:*:*:*:*:*:*:*"
      ],
+      "wooCommerce-order-proposal": [
+        "cpe:2.3:a:wpovernight:woocommerce_order_proposal:*:*:*:*:*:wordpress:*:*"
+      ],
      "woocommerce": [
        "cpe:2.3:a:woocommerce:woocommerce:*:*:*:*:*:wordpress:*:*",
        "cpe:2.3:a:woocommerce:woocommerce:*:*:*:*:free:wordpress:*:*",
@@ -17379,6 +17528,9 @@
      "woovirtualwallet": [
        "cpe:2.3:a:longwatchstudio:woovirtualwallet:*:*:*:*:*:wordpress:*:*"
      ],
+      "woozone": [
+        "cpe:2.3:a:aa-team:wzone:*:*:*:*:*:wordpress:*:*"
+      ],
      "word-balloon": [
        "cpe:2.3:a:back2nature:word_balloon:*:*:*:*:*:wordpress:*:*"
      ],
@@ -17463,6 +17615,9 @@
      "wp-404-auto-redirect-to-similar-post": [
        "cpe:2.3:a:hwk:wp_404_auto_redirect_to_similar_post:*:*:*:*:*:wordpress:*:*"
      ],
+      "wp-abstracts-manuscripts-manager": [
+        "cpe:2.3:a:kevonadonis:wp_abstracts:*:*:*:*:free:wordpress:*:*"
+      ],
      "wp-academic-people": [
        "cpe:2.3:a:wp_academic_people_list_project:wp_academic_people_list:*:*:*:*:*:wordpress:*:*"
      ],
@@ -17497,7 +17652,8 @@
        "cpe:2.3:a:wp-appbox_project:wp-appbox:*:*:*:*:*:wordpress:*:*"
      ],
      "wp-asset-clean-up": [
-        "cpe:2.3:a:asset_cleanup\\:_page_speed_booster_project:asset_cleanup\\:_page_speed_booster:*:*:*:*:*:wordpress:*:*"
+        "cpe:2.3:a:asset_cleanup\\:_page_speed_booster_project:asset_cleanup\\:_page_speed_booster:*:*:*:*:*:wordpress:*:*",
+        "cpe:2.3:a:gabelivan:asset_cleanup:*:*:*:*:*:wordpress:*:*"
      ],
      "wp-athletics": [
        "cpe:2.3:a:wp_athletics_project:wp_athletics:*:*:*:*:*:wordpress:*:*"
@@ -17728,6 +17884,9 @@
      "wp-database-backup": [
        "cpe:2.3:a:wpseeds:wp_database_backup:*:*:*:*:*:wordpress:*:*"
      ],
+      "wp-datepicker": [
+        "cpe:2.3:a:androidbubbles:wp_datepicker:*:*:*:*:*:wordpress:*:*"
+      ],
      "wp-db-backup": [
        "cpe:2.3:a:deliciousbrains:database_backup:*:*:*:*:*:wordpress:*:*",
        "cpe:2.3:a:wp-db-backup_project:wp-db-backup:*:*:*:*:*:wordpress:*:*"
@@ -17891,6 +18050,9 @@
      "wp-football": [
        "cpe:2.3:a:wp-football_project:wp-football:*:*:*:*:*:*:*:*"
      ],
+      "wp-force-ssl": [
+        "cpe:2.3:a:webfactoryltd:wp_force_ssl:*:*:*:*:free:wordpress:*:*"
+      ],
      "wp-forms-puzzle-captcha": [
        "cpe:2.3:a:nitinrathod:wp_forms_puzzle_captcha:*:*:*:*:*:wordpress:*:*"
      ],
@@ -18043,6 +18205,9 @@
      "wp-jobs": [
        "cpe:2.3:a:intensewp:wp_jobs:*:*:*:*:*:wordpress:*:*"
      ],
+      "wp-jquery-lightbox": [
+        "cpe:2.3:a:lightpress:lightbox:*:*:*:*:*:wordpress:*:*"
+      ],
      "wp-js": [
        "cpe:2.3:a:wp-js_project:wp-js:*:*:*:*:*:wordpress:*:*"
      ],
@@ -18150,7 +18315,7 @@
        "cpe:2.3:a:jeffrey-wp:media_library_categories:*:*:*:*:*:wordpress:*:*"
      ],
      "wp-members": [
-        "cpe:2.3:a:wp-members_project:wp-members:*:*:*:*:*:wordpress:*:*"
+        "cpe:2.3:a:butlerblog:wp-members:*:*:*:*:*:wordpress:*:*"
      ],
      "wp-memory": [
        "cpe:2.3:a:wp-memory_project:wp-memory:*:*:*:*:*:wordpress:*:*"
@@ -18311,6 +18476,9 @@
      "wp-product-gallery-lite": [
        "cpe:2.3:a:accesspressthemes:wp_product_gallery_lite:*:*:*:*:*:wordpress:*:*"
      ],
+      "wp-propagator": [
+        "cpe:2.3:a:widgilabs:plugin_propagator:*:*:*:*:*:wordpress:*:*"
+      ],
      "wp-publications": [
        "cpe:2.3:a:wp-publications_project:wp-publications:*:*:*:*:*:wordpress:*:*"
      ],
@@ -18326,6 +18494,9 @@
      "wp-recall": [
        "cpe:2.3:a:plechevandrey:wp-recall:*:*:*:*:*:wordpress:*:*"
      ],
+      "wp-recaptcha-integration": [
+        "cpe:2.3:a:wedevs:recaptcha_integration:*:*:*:*:*:wordpress:*:*"
+      ],
      "wp-recipe-maker": [
        "cpe:2.3:a:bootstrapped:wp_recipe_maker:*:*:*:*:*:wordpress:*:*"
      ],
@@ -18523,6 +18694,9 @@
      "wp-stripe-checkout": [
        "cpe:2.3:a:noorsplugin:wp_stripe_checkout:*:*:*:*:*:wordpress:*:*"
      ],
+      "wp-stripe-donation": [
+        "cpe:2.3:a:hmplugin:aidwp:*:*:*:*:*:wordpress:*:*"
+      ],
      "wp-structuring-markup": [
        "cpe:2.3:a:terakoya:markup_\\(json-ld\\)_structured_in_schema.org:*:*:*:*:*:wordpress:*:*"
      ],
@@ -18641,7 +18815,8 @@
      "wp-user-avatar": [
        "cpe:2.3:a:profilepress:profilepress:*:*:*:*:*:wordpress:*:*",
        "cpe:2.3:a:profilepress:user_registration\\,_login_form\\,_user_profile_\\\u0026_membership:*:*:*:*:*:wordpress:*:*",
-        "cpe:2.3:a:properfraction:profilepress:*:*:*:*:*:wordpress:*:*"
+        "cpe:2.3:a:properfraction:profilepress:*:*:*:*:*:wordpress:*:*",
+        "cpe:2.3:a:properfraction:profilepress:*:*:*:*:free:wordpress:*:*"
      ],
      "wp-user-frontend": [
        "cpe:2.3:a:wedevs:wp_user_frontend:*:*:*:*:*:wordpress:*:*"
@@ -18738,6 +18913,9 @@
      "wpbulky-wp-bulk-edit-post-types": [
        "cpe:2.3:a:villatheme:wpbulky:*:*:*:*:*:wordpress:*:*"
      ],
+      "wpc-shop-as-customer": [
+        "cpe:2.3:a:wpclever:wpc_shop_as_a_customer_for_woocommerce:*:*:*:*:*:wordpress:*:*"
+      ],
      "wpcalc": [
        "cpe:2.3:a:wow-company:wpcalc:*:*:*:*:*:wordpress:*:*"
      ],
@@ -18901,7 +19079,7 @@
        "cpe:2.3:a:wpvivid:migration\\,_backup\\,_staging:*:*:*:*:*:wordpress:*:*"
      ],
      "wpvr": [
-        "cpe:2.3:a:coderex:wp_vr:*:*:*:*:*:wordpress:*:*"
+        "cpe:2.3:a:rextheme:wp_vr:*:*:*:*:*:wordpress:*:*"
      ],
      "wpzoom-elementor-addons": [
        "cpe:2.3:a:wpzoom:wpzoom_elementor_addons:*:*:*:*:*:wordpress:*:*"
@@ -19016,6 +19194,10 @@
        "cpe:2.3:a:codeparrots:easy_forms_for_mailchimp:*:*:*:*:*:wordpress:*:*",
        "cpe:2.3:a:yikesinc:easy_forms_for_mailchimp:*:*:*:*:*:wordpress:*:*"
      ],
+      "yith-custom-login": [
+        "cpe:2.3:a:yithemes:yith_custom_login:*:*:*:*:*:wordpress:*:*",
+        "cpe:2.3:a:yithemes:yith_custom_login:*:*:*:*:wordpress:*:*:*"
+      ],
      "yith-desktop-notifications-for-woocommerce": [
        "cpe:2.3:a:yithemes:yith_desktop_notifications_for_woocommerce:*:*:*:*:*:wordpress:*:*"
      ],
@@ -19163,6 +19345,7 @@
        "cpe:2.3:a:zoho:salesiq:*:*:*:*:*:wordpress:*:*"
      ],
      "zotpress": [
+        "cpe:2.3:a:katieseaborn:zotpress:*:*:*:*:*:wordpress:*:*",
        "cpe:2.3:a:zotpress_project:zotpress:*:*:*:*:*:wordpress:*:*"
      ],
      "zx-csv-upload": [
@@ -19224,6 +19407,9 @@
      "bingle": [
        "cpe:2.3:a:accesspressthemes:bingle:*:*:*:*:*:wordpress:*:*"
      ],
+      "blockbooster": [
+        "cpe:2.3:a:cozythemes:blockbooster:*:*:*:*:*:wordpress:*:*"
+      ],
      "blocksy": [
        "cpe:2.3:a:creativethemes:blocksy:*:*:*:*:*:wordpress:*:*"
      ],
@@ -19298,6 +19484,12 @@
      "fluida": [
        "cpe:2.3:a:cryoutcreations:fluida:*:*:*:*:*:wordpress:*:*"
      ],
+      "formula": [
+        "cpe:2.3:a:awplife:formula:*:*:*:*:free:wordpress:*:*"
+      ],
+      "fotawp": [
+        "cpe:2.3:a:cozythemes:fotawp:*:*:*:*:*:wordpress:*:*"
+      ],
      "fullbase": [
        "cpe:2.3:a:marchettidesign:fullbase:*:*:*:*:*:wordpress:*:*"
      ],
@@ -19314,6 +19506,9 @@
      "grey-opaque": [
        "cpe:2.3:a:grey_opaque_project:grey_opaque:*:*:*:*:*:wordpress:*:*"
      ],
+      "hello-agency": [
+        "cpe:2.3:a:cozythemes:hello_agency:*:*:*:*:*:wordpress:*:*"
+      ],
      "hotel-galaxy": [
        "cpe:2.3:a:webdzier:hotel_galaxy:*:*:*:*:*:wordpress:*:*"
      ],
@@ -19400,12 +19595,18 @@
      "pixova-lite": [
        "cpe:2.3:a:colorlib:pixova_lite:*:*:*:*:*:wordpress:*:*"
      ],
+      "posterity": [
+        "cpe:2.3:a:sktthemes:posterity:*:*:*:*:*:wordpress:*:*"
+      ],
      "regina-lite": [
        "cpe:2.3:a:machothemes:regina_lite:*:*:*:*:*:wordpress:*:*"
      ],
      "responsive": [
        "cpe:2.3:a:cyberchimps:responsive:*:*:*:*:*:wordpress:*:*"
      ],
+      "revivenews": [
+        "cpe:2.3:a:cozythemes:revivenews:*:*:*:*:*:wordpress:*:*"
+      ],
      "rife-free": [
        "cpe:2.3:a:apollo13themes:rife_free:*:*:*:*:*:wordpress:*:*"
      ],
@@ -8,7 +8,6 @@ import (
 	"debug/macho"
 	"debug/pe"
 	"encoding/binary"
-	"encoding/json"
 	"errors"
 	"fmt"
 	"io"
@@ -18,34 +17,14 @@ import (
 	"github.com/anchore/syft/internal/log"
 	"github.com/anchore/syft/internal/mimetype"
 	"github.com/anchore/syft/syft/artifact"
-	"github.com/anchore/syft/syft/cpe"
 	"github.com/anchore/syft/syft/file"
+	"github.com/anchore/syft/syft/format/cyclonedxjson"
 	"github.com/anchore/syft/syft/internal/unionreader"
 	"github.com/anchore/syft/syft/pkg"
 )

-type nativeImageCycloneDX struct {
-	BomFormat   string                 `json:"bomFormat"`
-	SpecVersion string                 `json:"specVersion"`
-	Version     int                    `json:"version"`
-	Components  []nativeImageComponent `json:"components"`
-}
-
-type nativeImageComponent struct {
-	Type       string           `json:"type"`
-	Group      string           `json:"group"`
-	Name       string           `json:"name"`
-	Version    string           `json:"version"`
-	Properties []nativeImageCPE `json:"properties"`
-}
-
-type nativeImageCPE struct {
-	Name  string `json:"name"`
-	Value string `json:"value"`
-}
-
 type nativeImage interface {
-	fetchPkgs() ([]pkg.Package, error)
+	fetchPkgs() ([]pkg.Package, []artifact.Relationship, error)
 }

 type nativeImageElf struct {
@@ -113,40 +92,12 @@ func (c *nativeImageCataloger) Name() string {
 	return nativeImageCatalogerName
 }

-// getPackage returns the package given within a NativeImageComponent.
-func getPackage(component nativeImageComponent) pkg.Package {
-	var cpes []cpe.CPE
-	for _, property := range component.Properties {
-		c, err := cpe.New(property.Value, cpe.DeclaredSource)
-		if err != nil {
-			log.Debugf("unable to parse Attributes: %v", err)
-			continue
-		}
-		cpes = append(cpes, c)
-	}
-	return pkg.Package{
-		Name:     component.Name,
-		Version:  component.Version,
-		Language: pkg.Java,
-		Type:     pkg.GraalVMNativeImagePkg,
-		FoundBy:  nativeImageCatalogerName,
-		Metadata: pkg.JavaArchive{
-			PomProperties: &pkg.JavaPomProperties{
-				GroupID: component.Group,
-			},
-		},
-		CPEs: cpes,
-	}
-}
-
 // decompressSbom returns the packages given within a native image executable's SBOM.
-func decompressSbom(dataBuf []byte, sbomStart uint64, lengthStart uint64) ([]pkg.Package, error) {
-	var pkgs []pkg.Package
-
+func decompressSbom(dataBuf []byte, sbomStart uint64, lengthStart uint64) ([]pkg.Package, []artifact.Relationship, error) {
 	lengthEnd := lengthStart + 8
 	bufLen := len(dataBuf)
 	if lengthEnd > uint64(bufLen) {
-		return nil, errors.New("the 'sbom_length' symbol overflows the binary")
+		return nil, nil, errors.New("the 'sbom_length' symbol overflows the binary")
 	}

 	length := dataBuf[lengthStart:lengthEnd]
@@ -154,39 +105,31 @@ func decompressSbom(dataBuf []byte, sbomStart uint64, lengthStart uint64) ([]pkg
 	var storedLength uint64
 	err := binary.Read(p, binary.LittleEndian, &storedLength)
 	if err != nil {
-		return nil, fmt.Errorf("could not read from binary file: %w", err)
+		return nil, nil, fmt.Errorf("could not read from binary file: %w", err)
 	}

 	log.WithFields("len", storedLength).Trace("found java native-image SBOM")
 	sbomEnd := sbomStart + storedLength
 	if sbomEnd > uint64(bufLen) {
-		return nil, errors.New("the sbom symbol overflows the binary")
+		return nil, nil, errors.New("the sbom symbol overflows the binary")
 	}

 	sbomCompressed := dataBuf[sbomStart:sbomEnd]
 	p = bytes.NewBuffer(sbomCompressed)
 	gzreader, err := gzip.NewReader(p)
 	if err != nil {
-		return nil, fmt.Errorf("could not decompress the java native-image SBOM: %w", err)
+		return nil, nil, fmt.Errorf("could not decompress the java native-image SBOM: %w", err)
 	}

-	output, err := io.ReadAll(gzreader)
+	sbom, _, _, err := cyclonedxjson.NewFormatDecoder().Decode(gzreader)
 	if err != nil {
-		return nil, fmt.Errorf("could not read the java native-image SBOM: %w", err)
+		return nil, nil, fmt.Errorf("could not unmarshal the java native-image SBOM: %w", err)
 	}
-
-	var sbomContent nativeImageCycloneDX
-	err = json.Unmarshal(output, &sbomContent)
-	if err != nil {
-		return nil, fmt.Errorf("could not unmarshal the java native-image SBOM: %w", err)
-	}
-
-	for _, component := range sbomContent.Components {
-		p := getPackage(component)
+	var pkgs []pkg.Package
+	for p := range sbom.Artifacts.Packages.Enumerate() {
 		pkgs = append(pkgs, p)
 	}
-
-	return pkgs, nil
+	return pkgs, sbom.Relationships, nil
 }

 // fileError logs an error message when an executable cannot be read.
@@ -294,7 +237,7 @@ func newPE(filename string, r io.ReaderAt) (nativeImage, error) {
 }

 // fetchPkgs obtains the packages given in the binary.
-func (ni nativeImageElf) fetchPkgs() (pkgs []pkg.Package, retErr error) {
+func (ni nativeImageElf) fetchPkgs() (pkgs []pkg.Package, relationships []artifact.Relationship, retErr error) {
 	defer func() {
 		if r := recover(); r != nil {
 			// this can happen in cases where a malformed binary is passed in can be initially parsed, but not
@@ -310,10 +253,10 @@ func (ni nativeImageElf) fetchPkgs() (pkgs []pkg.Package, retErr error) {

 	si, err := bi.Symbols()
 	if err != nil {
-		return nil, fmt.Errorf("no symbols found in binary: %w", err)
+		return nil, nil, fmt.Errorf("no symbols found in binary: %w", err)
 	}
 	if si == nil {
-		return nil, errors.New(nativeImageMissingSymbolsError)
+		return nil, nil, errors.New(nativeImageMissingSymbolsError)
 	}
 	for _, s := range si {
 		switch s.Name {
@@ -326,16 +269,16 @@ func (ni nativeImageElf) fetchPkgs() (pkgs []pkg.Package, retErr error) {
 		}
 	}
 	if sbom.Value == 0 || sbomLength.Value == 0 || svmVersion.Value == 0 {
-		return nil, errors.New(nativeImageMissingSymbolsError)
+		return nil, nil, errors.New(nativeImageMissingSymbolsError)
 	}
 	dataSection := bi.Section(".data")
 	if dataSection == nil {
-		return nil, fmt.Errorf("no .data section found in binary: %w", err)
+		return nil, nil, fmt.Errorf("no .data section found in binary: %w", err)
 	}
 	dataSectionBase := dataSection.SectionHeader.Addr
 	data, err := dataSection.Data()
 	if err != nil {
-		return nil, fmt.Errorf("cannot read the .data section: %w", err)
+		return nil, nil, fmt.Errorf("cannot read the .data section: %w", err)
 	}
 	sbomLocation := sbom.Value - dataSectionBase
 	lengthLocation := sbomLength.Value - dataSectionBase
@@ -344,7 +287,7 @@ func (ni nativeImageElf) fetchPkgs() (pkgs []pkg.Package, retErr error) {
 }

 // fetchPkgs obtains the packages from a Native Image given as a Mach O file.
-func (ni nativeImageMachO) fetchPkgs() (pkgs []pkg.Package, retErr error) {
+func (ni nativeImageMachO) fetchPkgs() (pkgs []pkg.Package, relationships []artifact.Relationship, retErr error) {
 	defer func() {
 		if r := recover(); r != nil {
 			// this can happen in cases where a malformed binary is passed in can be initially parsed, but not
@@ -359,7 +302,7 @@ func (ni nativeImageMachO) fetchPkgs() (pkgs []pkg.Package, retErr error) {

 	bi := ni.file
 	if bi.Symtab == nil {
-		return nil, errors.New(nativeImageMissingSymbolsError)
+		return nil, nil, errors.New(nativeImageMissingSymbolsError)
 	}
 	for _, s := range bi.Symtab.Syms {
 		switch s.Name {
@@ -372,17 +315,17 @@ func (ni nativeImageMachO) fetchPkgs() (pkgs []pkg.Package, retErr error) {
 		}
 	}
 	if sbom.Value == 0 || sbomLength.Value == 0 || svmVersion.Value == 0 {
-		return nil, errors.New(nativeImageMissingSymbolsError)
+		return nil, nil, errors.New(nativeImageMissingSymbolsError)
 	}

 	dataSegment := bi.Segment("__DATA")
 	if dataSegment == nil {
-		return nil, nil
+		return nil, nil, nil
 	}
 	dataBuf, err := dataSegment.Data()
 	if err != nil {
 		log.Tracef("cannot obtain buffer from data segment")
-		return nil, nil
+		return nil, nil, nil
 	}
 	sbomLocation := sbom.Value - dataSegment.Addr
 	lengthLocation := sbomLength.Value - dataSegment.Addr
@@ -494,7 +437,7 @@ func (ni nativeImagePE) fetchSbomSymbols(content *exportContentPE) {
 }

 // fetchPkgs obtains the packages from a Native Image given as a PE file.
-func (ni nativeImagePE) fetchPkgs() (pkgs []pkg.Package, retErr error) {
+func (ni nativeImagePE) fetchPkgs() (pkgs []pkg.Package, relationships []artifact.Relationship, retErr error) {
 	defer func() {
 		if r := recover(); r != nil {
 			// this can happen in cases where a malformed binary is passed in can be initially parsed, but not
@@ -506,32 +449,32 @@ func (ni nativeImagePE) fetchPkgs() (pkgs []pkg.Package, retErr error) {
 	content, err := ni.fetchExportContent()
 	if err != nil {
 		log.Debugf("could not fetch the content of the export directory entry: %v", err)
-		return nil, err
+		return nil, nil, err
 	}
 	ni.fetchSbomSymbols(content)
 	if content.addressOfSbom == uint32(0) || content.addressOfSbomLength == uint32(0) || content.addressOfSvmVersion == uint32(0) {
-		return nil, errors.New(nativeImageMissingSymbolsError)
+		return nil, nil, errors.New(nativeImageMissingSymbolsError)
 	}
 	functionsBase := content.addressOfFunctions - ni.exportSymbols.VirtualAddress
 	sbomOffset := content.addressOfSbom
 	sbomAddress, err := ni.fetchExportFunctionPointer(functionsBase, sbomOffset)
 	if err != nil {
-		return nil, fmt.Errorf("could not fetch SBOM pointer from exported functions: %w", err)
+		return nil, nil, fmt.Errorf("could not fetch SBOM pointer from exported functions: %w", err)
 	}
 	sbomLengthOffset := content.addressOfSbomLength
 	sbomLengthAddress, err := ni.fetchExportFunctionPointer(functionsBase, sbomLengthOffset)
 	if err != nil {
-		return nil, fmt.Errorf("could not fetch SBOM length pointer from exported functions: %w", err)
+		return nil, nil, fmt.Errorf("could not fetch SBOM length pointer from exported functions: %w", err)
 	}
 	bi := ni.file
 	dataSection := bi.Section(".data")
 	if dataSection == nil {
-		return nil, nil
+		return nil, nil, nil
 	}
 	dataBuf, err := dataSection.Data()
 	if err != nil {
 		log.Tracef("cannot obtain buffer from the java native-image .data section")
-		return nil, nil
+		return nil, nil, nil
 	}
 	sbomLocation := sbomAddress - dataSection.VirtualAddress
 	lengthLocation := sbomLengthAddress - dataSection.VirtualAddress
@@ -540,8 +483,9 @@ func (ni nativeImagePE) fetchPkgs() (pkgs []pkg.Package, retErr error) {
 }

 // fetchPkgs provides the packages available in a UnionReader.
-func fetchPkgs(reader unionreader.UnionReader, filename string) []pkg.Package {
+func fetchPkgs(reader unionreader.UnionReader, filename string) ([]pkg.Package, []artifact.Relationship) {
 	var pkgs []pkg.Package
+	var relationships []artifact.Relationship
 	imageFormats := []func(string, io.ReaderAt) (nativeImage, error){newElf, newMachO, newPE}

 	// NOTE: multiple readers are returned to cover universal binaries, which are files
@@ -549,7 +493,7 @@ func fetchPkgs(reader unionreader.UnionReader, filename string) []pkg.Package {
 	readers, err := unionreader.GetReaders(reader)
 	if err != nil {
 		log.Debugf("failed to open the java native-image binary: %v", err)
-		return nil
+		return nil, nil
 	}
 	for _, r := range readers {
 		for _, makeNativeImage := range imageFormats {
@@ -560,47 +504,51 @@ func fetchPkgs(reader unionreader.UnionReader, filename string) []pkg.Package {
 			if ni == nil {
 				continue
 			}
-			newPkgs, err := ni.fetchPkgs()
+			newPkgs, newRelationships, err := ni.fetchPkgs()
 			if err != nil {
 				log.Tracef("unable to extract SBOM from possible java native-image %s: %v", filename, err)
 				continue
 			}
 			pkgs = append(pkgs, newPkgs...)
+			relationships = append(relationships, newRelationships...)
 		}
 	}
-	return pkgs
+	return pkgs, relationships
 }

 // Catalog attempts to find any native image executables reachable from a resolver.
 func (c *nativeImageCataloger) Catalog(_ context.Context, resolver file.Resolver) ([]pkg.Package, []artifact.Relationship, error) {
 	var pkgs []pkg.Package
+	var relationships []artifact.Relationship
 	fileMatches, err := resolver.FilesByMIMEType(mimetype.ExecutableMIMETypeSet.List()...)
 	if err != nil {
 		return pkgs, nil, fmt.Errorf("failed to find binaries by mime types: %w", err)
 	}

 	for _, location := range fileMatches {
-		newPkgs, err := processLocation(location, resolver)
+		newPkgs, newRelationships, err := processLocation(location, resolver)
 		if err != nil {
 			return nil, nil, err
 		}
 		pkgs = append(pkgs, newPkgs...)
+		relationships = append(relationships, newRelationships...)
 	}

-	return pkgs, nil, nil
+	return pkgs, relationships, nil
 }

-func processLocation(location file.Location, resolver file.Resolver) ([]pkg.Package, error) {
+func processLocation(location file.Location, resolver file.Resolver) ([]pkg.Package, []artifact.Relationship, error) {
 	readerCloser, err := resolver.FileContentsByLocation(location)
 	if err != nil {
 		log.Debugf("error opening file: %v", err)
-		return nil, nil
+		return nil, nil, nil
 	}
 	defer internal.CloseAndLogError(readerCloser, location.RealPath)

 	reader, err := unionreader.GetUnionReader(readerCloser)
 	if err != nil {
-		return nil, err
+		return nil, nil, err
 	}
-	return fetchPkgs(reader, location.RealPath), nil
+	pkgs, relationships := fetchPkgs(reader, location.RealPath)
+	return pkgs, relationships, nil
 }
@@ -5,6 +5,7 @@ import (
 	"bytes"
 	"compress/gzip"
 	"encoding/binary"
+	"fmt"
 	"io"
 	"os"
 	"path"
@@ -12,6 +13,7 @@ import (

 	"github.com/stretchr/testify/assert"

+	"github.com/anchore/syft/syft/artifact"
 	"github.com/anchore/syft/syft/cpe"
 	"github.com/anchore/syft/syft/internal/unionreader"
 	"github.com/anchore/syft/syft/pkg"
@@ -40,10 +42,11 @@ func TestParseNativeImage(t *testing.T) {
 			assert.NoError(t, err)
 			parsed := false
 			readers, err := unionreader.GetReaders(reader)
+			assert.NoError(t, err)
 			for _, r := range readers {
 				ni, err := test.newFn(test.fixture, r)
 				assert.NoError(t, err)
-				_, err = ni.fetchPkgs()
+				_, _, err = ni.fetchPkgs()
 				if err == nil {
 					t.Fatalf("should have failed to extract SBOM.")
 				}
@@ -60,77 +63,205 @@ func TestParseNativeImage(t *testing.T) {
 }

 func TestParseNativeImageSbom(t *testing.T) {
+	const (
+		nettyPurl     = "pkg:maven/io.netty/netty-codec-http2@4.1.104.Final"
+		micronautPurl = "pkg:maven/io.micronaut/core@4.2.3"
+		mainAppPurl   = "pkg:maven/com.oracle/main-test-app@1.0-SNAPSHOT"
+	)
+
+	mainAppPkg := makePackage("main-test-app", "1.0-SNAPSHOT", mainAppPurl, []cpe.CPE{
+		{
+			Attributes: cpe.Attributes{
+				Part:    "a",
+				Vendor:  "app",
+				Product: "main-test-app",
+				Version: "1.0-SNAPSHOT",
+			},
+			Source: "declared",
+		},
+	})
+
+	nettyPkg := makePackage("netty-codec-http2", "4.1.73.Final", nettyPurl, []cpe.CPE{
+		{
+			Attributes: cpe.Attributes{
+				Part:    "a",
+				Vendor:  "codec",
+				Product: "codec",
+				Version: "4.1.73.Final",
+			},
+			Source: "declared",
+		},
+		{
+			Attributes: cpe.Attributes{
+				Part:    "a",
+				Vendor:  "codec",
+				Product: "netty-codec-http2",
+				Version: "4.1.73.Final",
+			},
+			Source: "declared",
+		},
+		{
+			Attributes: cpe.Attributes{
+				Part:    "a",
+				Vendor:  "codec",
+				Product: "netty_codec_http2",
+				Version: "4.1.73.Final",
+			},
+			Source: "declared",
+		},
+	})
+
+	micronautPkg := makePackage("core", "4.2.3", micronautPurl, []cpe.CPE{
+		{
+			Attributes: cpe.Attributes{
+				Part:    "a",
+				Vendor:  "core",
+				Product: "core",
+				Version: "4.2.3",
+			},
+			Source: "declared",
+		},
+		{
+			Attributes: cpe.Attributes{
+				Part:    "a",
+				Vendor:  "micronaut",
+				Product: "core",
+				Version: "4.2.3",
+			},
+			Source: "declared",
+		},
+	})
+
+	basicPkg := makePackage("basic-lib", "1.0", "", nil)
+
 	tests := []struct {
-		fixture  string
-		expected []pkg.Package
+		fixture           string
+		expectedPackages  []pkg.Package
+		expectedRelations []artifact.Relationship
 	}{
 		{
-			fixture: "test-fixtures/graalvm-sbom/micronaut.json",
-			expected: []pkg.Package{
+			fixture:          "test-fixtures/graalvm-sbom/micronaut.json",
+			expectedPackages: []pkg.Package{nettyPkg, micronautPkg, basicPkg, mainAppPkg},
+			expectedRelations: []artifact.Relationship{
 				{
-					Name:     "netty-codec-http2",
-					Version:  "4.1.73.Final",
-					Language: pkg.Java,
-					Type:     pkg.GraalVMNativeImagePkg,
-					FoundBy:  nativeImageCatalogerName,
-					Metadata: pkg.JavaArchive{
-						PomProperties: &pkg.JavaPomProperties{
-							GroupID: "io.netty",
-						},
-					},
-					CPEs: []cpe.CPE{
-						{
-							Attributes: cpe.Attributes{
-								Part:    "a",
-								Vendor:  "codec",
-								Product: "codec",
-								Version: "4.1.73.Final",
-							},
-							Source: "declared",
-						},
-						{
-							Attributes: cpe.Attributes{
-								Part:    "a",
-								Vendor:  "codec",
-								Product: "netty-codec-http2",
-								Version: "4.1.73.Final",
-							},
-							Source: "declared",
-						},
-						{
-							Attributes: cpe.Attributes{
-								Part:    "a",
-								Vendor:  "codec",
-								Product: "netty_codec_http2",
-								Version: "4.1.73.Final",
-							},
-							Source: "declared",
-						},
-					},
+					From: nettyPkg,
+					To:   micronautPkg,
+					Type: artifact.DependencyOfRelationship,
 				},
 			},
 		},
 	}
+
 	for _, test := range tests {
 		t.Run(path.Base(test.fixture), func(t *testing.T) {
-			// Create a buffer to resemble a compressed SBOM in a native image.
-			sbom, err := os.ReadFile(test.fixture)
-			assert.NoError(t, err)
-			var b bytes.Buffer
-			writebytes := bufio.NewWriter(&b)
-			z := gzip.NewWriter(writebytes)
-			_, err = z.Write(sbom)
-			assert.NoError(t, err)
-			_ = z.Close()
-			_ = writebytes.Flush()
-			compressedsbom := b.Bytes()
-			sbomlength := uint64(len(compressedsbom))
-			_ = binary.Write(writebytes, binary.LittleEndian, sbomlength)
-			_ = writebytes.Flush()
-			compressedsbom = b.Bytes()
-			actual, err := decompressSbom(compressedsbom, 0, sbomlength)
-			assert.NoError(t, err)
-			assert.Equal(t, test.expected, actual)
+			compressed, length := createCompressedSbom(t, test.fixture)
+			actualPkgs, actualRels, err := decompressSbom(compressed, 0, length)
+			if err != nil {
+				t.Fatal(err)
+			}
+
+			verifyPackages(t, test.expectedPackages, actualPkgs)
+			verifyRelationships(t, test.expectedRelations, actualRels)
 		})
 	}
 }
+
+// makePackage makes a package using the data that we know must be in the parsed package
+func makePackage(name, version, purl string, cpes []cpe.CPE) pkg.Package {
+	p := pkg.Package{
+		Name:    name,
+		Version: version,
+		CPEs:    cpes,
+		PURL:    purl,
+	}
+	return p
+}
+
+// createCompressedSbom creates a compressed a buffer to resemble a compressed SBOM in a native image.
+func createCompressedSbom(t *testing.T, filename string) ([]byte, uint64) {
+	sbom, err := os.ReadFile(filename)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	var b bytes.Buffer
+	w := bufio.NewWriter(&b)
+	z := gzip.NewWriter(w)
+
+	if _, err := z.Write(sbom); err != nil {
+		t.Fatal(err)
+	}
+	z.Close()
+	w.Flush()
+
+	compressedSbom := b.Bytes()
+	sbomLength := uint64(len(compressedSbom))
+
+	if err := binary.Write(w, binary.LittleEndian, sbomLength); err != nil {
+		t.Fatal(err)
+	}
+	w.Flush()
+
+	return b.Bytes(), sbomLength
+}
+
+func verifyPackages(t *testing.T, expected, actual []pkg.Package) {
+	expectedPkgMap := buildPackageMap(expected)
+	actualPkgMap := buildPackageMap(actual)
+
+	for name, expectedPkg := range expectedPkgMap {
+		actualPkg, exists := actualPkgMap[name]
+		if !exists {
+			t.Errorf("Expected package %s not found in actual packages", name)
+			continue
+		}
+		verifyPackageFields(t, expectedPkg, actualPkg)
+	}
+}
+
+func buildPackageMap(packages []pkg.Package) map[string]pkg.Package {
+	pkgMap := make(map[string]pkg.Package)
+	for _, p := range packages {
+		pkgMap[p.Name] = p
+	}
+	return pkgMap
+}
+
+func verifyPackageFields(t *testing.T, expected, actual pkg.Package) {
+	assert.Equal(t, expected.Name, actual.Name)
+	assert.Equal(t, expected.Version, actual.Version)
+	assert.Equal(t, expected.FoundBy, actual.FoundBy)
+	assert.Equal(t, expected.PURL, actual.PURL)
+	assert.ElementsMatch(t, expected.CPEs, actual.CPEs)
+}
+
+func verifyRelationships(t *testing.T, expected, actual []artifact.Relationship) {
+	expectedRelMap := buildRelationshipMap(expected)
+	actualRelMap := buildRelationshipMap(actual)
+
+	for key, expectedRels := range expectedRelMap {
+		actualRels, exists := actualRelMap[key]
+		if !exists {
+			t.Errorf("Expected relationship %s not found in actual relationships", key)
+			continue
+		}
+		verifyRelationshipFields(t, expectedRels, actualRels)
+	}
+}
+
+func buildRelationshipMap(relationships []artifact.Relationship) map[string][]artifact.Relationship {
+	relMap := make(map[string][]artifact.Relationship)
+	for _, rel := range relationships {
+		// we cannot control the id, so use the names instead
+		key := fmt.Sprintf("%s->%s", rel.From.(pkg.Package).Name, rel.To.(pkg.Package).Name)
+		relMap[key] = append(relMap[key], rel)
+	}
+	return relMap
+}
+
+func verifyRelationshipFields(t *testing.T, expected, actual []artifact.Relationship) {
+	assert.Equal(t, len(expected), len(actual))
+	for i := range expected {
+		assert.Equal(t, expected[i].Type, actual[i].Type)
+	}
+}
@@ -135,9 +135,14 @@ func (r *Resolver) resolveProperty(ctx context.Context, resolutionContext []*Pro
 		return value, nil
 	}

+	var resolvingParents []*Project
 	for _, pom := range resolutionContext {
 		current := pom
 		for parentDepth := 0; current != nil; parentDepth++ {
+			if slices.Contains(resolvingParents, current) {
+				log.WithFields("property", propertyExpression, "mavenID", r.resolveID(ctx, resolvingProperties, resolvingParents...)).Error("got circular reference while resolving property")
+				break // some sort of circular reference -- we've already seen this project
+			}
 			if r.cfg.MaxParentRecursiveDepth > 0 && parentDepth > r.cfg.MaxParentRecursiveDepth {
 				return "", fmt.Errorf("maximum parent recursive depth (%v) reached resolving property: %v", r.cfg.MaxParentRecursiveDepth, propertyExpression)
 			}
@@ -146,6 +151,7 @@ func (r *Resolver) resolveProperty(ctx context.Context, resolutionContext []*Pro
 					return r.resolveExpression(ctx, resolutionContext, value, resolvingProperties) // property values can contain expressions
 				}
 			}
+			resolvingParents = append(resolvingParents, current)
 			current, err = r.resolveParent(ctx, current, resolvingProperties...)
 			if err != nil {
 				return "", err
@@ -271,13 +277,12 @@ func (r *Resolver) resolveID(ctx context.Context, resolvingProperties []string,
 	artifactID := r.resolvePropertyValue(ctx, pom.ArtifactID, resolvingProperties, resolutionContext...)
 	version := r.resolvePropertyValue(ctx, pom.Version, resolvingProperties, resolutionContext...)
 	if pom.Parent != nil {
-		if groupID == "" {
+		// groupId and version are able to be inherited from the parent, but importantly: not artifactId. see:
+		// https://maven.apache.org/guides/introduction/introduction-to-the-pom.html#the-solution
+		if groupID == "" && deref(pom.GroupID) == "" {
 			groupID = r.resolvePropertyValue(ctx, pom.Parent.GroupID, resolvingProperties, resolutionContext...)
 		}
-		if artifactID == "" {
-			artifactID = r.resolvePropertyValue(ctx, pom.Parent.ArtifactID, resolvingProperties, resolutionContext...)
-		}
-		if version == "" {
+		if version == "" && deref(pom.Version) == "" {
 			version = r.resolvePropertyValue(ctx, pom.Parent.Version, resolvingProperties, resolutionContext...)
 		}
 	}
@@ -243,6 +243,13 @@ func Test_mavenResolverRemote(t *testing.T) {
 			expression: "${project.one}",
 			expected:   "1",
 		},
+		{
+			groupID:    "my.org", // this particular package has a circular reference
+			artifactID: "circular",
+			version:    "1.2.3",
+			expression: "${unresolved}",
+			expected:   "",
+		},
 	}

 	for _, test := range tests {
@@ -312,6 +319,27 @@ func Test_relativePathParent(t *testing.T) {
 				require.Equal(t, "", id.Version)
 			},
 		},
+		{
+			name: "circular resolving ID variables",
+			pom:  "circular-1/pom.xml",
+			validate: func(t *testing.T, r *Resolver, pom *Project) {
+				require.NotNil(t, pom)
+				id := r.ResolveID(ctx, pom)
+				// version should be resolved, but not artifactId
+				require.Equal(t, "1.2.3", id.Version)
+				require.Equal(t, "", id.ArtifactID)
+			},
+		},
+		{
+			name: "circular parent only",
+			pom:  "circular-2/pom.xml",
+			validate: func(t *testing.T, r *Resolver, pom *Project) {
+				require.NotNil(t, pom)
+				id := r.ResolveID(ctx, pom)
+				require.Equal(t, "", id.Version)
+				require.Equal(t, "something", id.ArtifactID)
+			},
+		},
 	}

 	for _, test := range tests {
@@ -0,0 +1,13 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
+  <modelVersion>4.0.0</modelVersion>
+
+  <groupId>${groupId}</groupId>
+  <artifactId>${artifactId}</artifactId>
+
+  <parent>
+    <groupId>my.org</groupId>
+    <artifactId>circular</artifactId>
+    <version>1.2.3</version>
+  </parent>
+</project>
@@ -0,0 +1,13 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
+  <modelVersion>4.0.0</modelVersion>
+
+  <artifactId>something</artifactId>
+  <version>${unresolvable}</version>
+
+  <parent>
+    <groupId>my.org</groupId>
+    <artifactId>circular</artifactId>
+    <version>1.2.3</version>
+  </parent>
+</project>
@@ -0,0 +1,13 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
+  <modelVersion>4.0.0</modelVersion>
+
+  <artifactId>circular</artifactId>
+  <version>1.2.3</version>
+
+  <parent>
+    <groupId>my.org</groupId>
+    <artifactId>circular</artifactId>
+    <version>1.2.3</version>
+  </parent>
+</project>
@@ -1,13 +1,32 @@
 {
    "bomFormat": "CycloneDX",
-    "specVersion": "1.4",
+    "specVersion": "1.6",
    "version": 1,
+    "serialNumber": "urn:uuid:43538af4-f715-3d85-9629-336fdd3790ad",
+    "metadata": {
+        "component": {
+            "type": "library",
+            "group": "com.test",
+            "name": "main-test-app",
+            "version": "1.0-SNAPSHOT",
+            "purl": "pkg:maven/com.oracle/main-test-app@1.0-SNAPSHOT",
+            "bom-ref": "pkg:maven/com.oracle/main-test-app@1.0-SNAPSHOT",
+            "properties": [
+                {
+                    "name": "syft:cpe23",
+                    "value": "cpe:2.3:a:app:main-test-app:1.0-SNAPSHOT:*:*:*:*:*:*:*"
+                }
+            ]
+        }
+    },
    "components": [
        {
            "type": "library",
            "group": "io.netty",
            "name": "netty-codec-http2",
            "version": "4.1.73.Final",
+            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.104.Final",
+            "bom-ref": "pkg:maven/io.netty/netty-codec-http2@4.1.104.Final",
            "properties": [
                {
                    "name": "syft:cpe23",
@@ -22,7 +41,38 @@
                    "value": "cpe:2.3:a:codec:netty_codec_http2:4.1.73.Final:*:*:*:*:*:*:*"
                }
            ]
+        },
+        {
+            "type": "library",
+            "group": "io.micronaut",
+            "name": "core",
+            "version": "4.2.3",
+            "purl": "pkg:maven/io.micronaut/core@4.2.3",
+            "bom-ref": "pkg:maven/io.micronaut/core@4.2.3",
+            "properties": [
+                {
+                    "name": "syft:cpe23",
+                    "value": "cpe:2.3:a:core:core:4.2.3:*:*:*:*:*:*:*"
+                },
+                {
+                    "name": "syft:cpe23",
+                    "value": "cpe:2.3:a:micronaut:core:4.2.3:*:*:*:*:*:*:*"
+                }
+            ]
+        },
+        {
+            "type": "library",
+            "group": "org.example",
+            "name": "basic-lib",
+            "version": "1.0"
        }
    ],
-    "serialNumber": "urn:uuid:43538af4-f715-3d85-9629-336fdd3790ad"
-}
+    "dependencies": [
+        {
+            "ref": "pkg:maven/io.micronaut/core@4.2.3",
+            "dependsOn": [
+                "pkg:maven/io.netty/netty-codec-http2@4.1.104.Final"
+            ]
+        }
+    ]
+}
@@ -3,8 +3,9 @@ package javascript
 const npmBaseURL = "https://registry.npmjs.org"

 type CatalogerConfig struct {
-	SearchRemoteLicenses bool   `json:"search-remote-licenses" yaml:"search-remote-licenses" mapstructure:"search-remote-licenses"`
-	NPMBaseURL           string `json:"npm-base-url" yaml:"npm-base-url" mapstructure:"npm-base-url"`
+	SearchRemoteLicenses   bool   `json:"search-remote-licenses" yaml:"search-remote-licenses" mapstructure:"search-remote-licenses"`
+	NPMBaseURL             string `json:"npm-base-url" yaml:"npm-base-url" mapstructure:"npm-base-url"`
+	IncludeDevDependencies bool   `json:"include-dev-dependencies" yaml:"include-dev-dependencies" mapstructure:"include-dev-dependencies"`
 }

 func DefaultCatalogerConfig() CatalogerConfig {
@@ -25,3 +26,8 @@ func (j CatalogerConfig) WithNpmBaseURL(input string) CatalogerConfig {
 	}
 	return j
 }
+
+func (j CatalogerConfig) WithIncludeDevDependencies(input bool) CatalogerConfig {
+	j.IncludeDevDependencies = input
+	return j
+}
@@ -29,6 +29,7 @@ type lockDependency struct {
 	Version   string `json:"version"`
 	Resolved  string `json:"resolved"`
 	Integrity string `json:"integrity"`
+	Dev       bool   `json:"dev"`
 }

 type lockPackage struct {
@@ -37,6 +38,7 @@ type lockPackage struct {
 	Resolved  string             `json:"resolved"`
 	Integrity string             `json:"integrity"`
 	License   packageLockLicense `json:"license"`
+	Dev       bool               `json:"dev"`
 }

 // packageLockLicense
@@ -74,6 +76,11 @@ func (a genericPackageLockAdapter) parsePackageLock(_ context.Context, resolver

 	if lock.LockfileVersion == 1 {
 		for name, pkgMeta := range lock.Dependencies {
+			// skip packages that are only present as a dev dependency
+			if !a.cfg.IncludeDevDependencies && pkgMeta.Dev {
+				continue
+			}
+
 			pkgs = append(pkgs, newPackageLockV1Package(a.cfg, resolver, reader.Location, name, pkgMeta))
 		}
 	}
@@ -87,6 +94,11 @@ func (a genericPackageLockAdapter) parsePackageLock(_ context.Context, resolver
 				name = pkgMeta.Name
 			}

+			// skip packages that are only present as a dev dependency
+			if !a.cfg.IncludeDevDependencies && pkgMeta.Dev {
+				continue
+			}
+
 			// handles alias names
 			if pkgMeta.Name != "" {
 				name = pkgMeta.Name
@@ -9,6 +9,9 @@
            "version": "6.14.6",
            "dependencies": {
                "@types/react": "^18.0.9"
+            },
+            "devDependencies": {
+                "async": "^3.2.4"
            }
        },
        "node_modules/@types/prop-types": {
@@ -39,6 +42,12 @@
            "resolved": "https://registry.npmjs.org/csstype/-/csstype-3.1.0.tgz",
            "integrity": "sha1-TdysNxjXh8+d8NG30VAzklyPKfI=",
            "license": "MIT"
+        },
+        "node_modules/async": {
+            "version": "3.2.4",
+            "resolved": "https://registry.npmjs.org/async/-/async-3.2.4.tgz",
+            "integrity": "sha512-iAB+JbDEGXhyIUavoDl9WP/Jj106Kz9DEn1DPgYw5ruDn0e3Wgi3sKFm55sASdGBNOQB8F59d9qQ7deqrHA8wQ==",
+            "dev": true
        }
    },
    "dependencies": {
@@ -66,6 +75,12 @@
            "version": "3.1.0",
            "resolved": "https://registry.npmjs.org/csstype/-/csstype-3.1.0.tgz",
            "integrity": "sha1-TdysNxjXh8+d8NG30VAzklyPKfI="
+        },
+        "async": {
+            "version": "3.2.4",
+            "resolved": "https://registry.npmjs.org/async/-/async-3.2.4.tgz",
+            "integrity": "sha512-iAB+JbDEGXhyIUavoDl9WP/Jj106Kz9DEn1DPgYw5ruDn0e3Wgi3sKFm55sASdGBNOQB8F59d9qQ7deqrHA8wQ==",
+            "dev": true
        }
    }
 }
@@ -9,6 +9,9 @@
      "version": "1.0.0",
      "dependencies": {
        "@types/react": "^18.0.9"
+      },
+      "devDependencies": {
+        "async": "^3.2.4"
      }
    },
    "node_modules/@types/prop-types": {
@@ -35,6 +38,12 @@
      "version": "3.1.1",
      "resolved": "https://registry.npmjs.org/csstype/-/csstype-3.1.1.tgz",
      "integrity": "sha512-DJR/VvkAvSZW9bTouZue2sSxDwdTN92uHjqeKVm+0dAqdfNykRzQ95tay8aXMBAAPpUiq4Qcug2L7neoRh2Egw=="
+    },
+    "node_modules/async": {
+      "version": "3.2.4",
+      "resolved": "https://registry.npmjs.org/async/-/async-3.2.4.tgz",
+      "integrity": "sha512-iAB+JbDEGXhyIUavoDl9WP/Jj106Kz9DEn1DPgYw5ruDn0e3Wgi3sKFm55sASdGBNOQB8F59d9qQ7deqrHA8wQ==",
+      "dev": true
    }
  }
 }
@@ -76,6 +76,12 @@
      "version": "0.0.3",
      "resolved": "https://registry.npmjs.org/wordwrap/-/wordwrap-0.0.3.tgz",
      "integrity": "sha1-o9XabNXAvAAI03I0u68b7WMFkQc="
+    },
+    "node_modules/async": {
+      "version": "3.2.4",
+      "resolved": "https://registry.npmjs.org/async/-/async-3.2.4.tgz",
+      "integrity": "sha512-iAB+JbDEGXhyIUavoDl9WP/Jj106Kz9DEn1DPgYw5ruDn0e3Wgi3sKFm55sASdGBNOQB8F59d9qQ7deqrHA8wQ==",
+      "dev": true
    }
  }
 }
@@ -33,19 +33,50 @@ func parseCargoLock(_ context.Context, _ file.Resolver, _ *generic.Environment,
 	}

 	var pkgs []pkg.Package
+	pkgIndex := make(map[string]int)

 	for _, p := range m.Packages {
 		if p.Dependencies == nil {
 			p.Dependencies = make([]string, 0)
 		}
+		newPkg := newPackageFromCargoMetadata(
+			p,
+			reader.Location.WithAnnotation(pkg.EvidenceAnnotationKey, pkg.PrimaryEvidenceAnnotation),
+		)
 		pkgs = append(
 			pkgs,
-			newPackageFromCargoMetadata(
-				p,
-				reader.Location.WithAnnotation(pkg.EvidenceAnnotationKey, pkg.PrimaryEvidenceAnnotation),
-			),
+			newPkg,
 		)
+		newIx := len(pkgs) - 1
+		// Cargo.lock dependencies are strings that are the name of a package, if that
+		// is unambiguous, or a string like "name version" if the name alone is not
+		// ambiguous. Set both keys in the map, since we don't know which key is
+		// going to be used until we're trying to resolve dependencies. If the
+		// first key is overwritten, that means the package name was an ambiguous dependency
+		// and "name version" will be used as the key anyway.
+		keys := []string{
+			newPkg.Name,
+			fmt.Sprintf("%s %s", newPkg.Name, newPkg.Version),
+		}
+		for _, k := range keys {
+			pkgIndex[k] = newIx
+		}
+	}
+	var relationships []artifact.Relationship
+	for _, p := range pkgs {
+		meta := p.Metadata.(pkg.RustCargoLockEntry)
+		for _, d := range meta.Dependencies {
+			i, ok := pkgIndex[d]
+			if !ok {
+				continue
+			}
+			relationships = append(relationships, artifact.Relationship{
+				From: p,
+				To:   pkgs[i],
+				Type: artifact.DependencyOfRelationship,
+			})
+		}
 	}

-	return pkgs, nil, unknown.IfEmptyf(pkgs, "unable to determine packages")
+	return pkgs, relationships, unknown.IfEmptyf(pkgs, "unable to determine packages")
 }
@@ -12,184 +12,315 @@ import (
 func TestParseCargoLock(t *testing.T) {
 	fixture := "test-fixtures/Cargo.lock"
 	locations := file.NewLocationSet(file.NewLocation(fixture))
-	expectedPkgs := []pkg.Package{
-		{
-			Name:      "ansi_term",
-			Version:   "0.12.1",
-			PURL:      "pkg:cargo/ansi_term@0.12.1",
-			Locations: locations,
-			Language:  pkg.Rust,
-			Type:      pkg.RustPkg,
-			Licenses:  pkg.NewLicenseSet(),
-			Metadata: pkg.RustCargoLockEntry{
-				Name:     "ansi_term",
-				Version:  "0.12.1",
-				Source:   "registry+https://github.com/rust-lang/crates.io-index",
-				Checksum: "d52a9bb7ec0cf484c551830a7ce27bd20d67eac647e1befb56b0be4ee39a55d2",
-				Dependencies: []string{
-					"winapi",
-				},
+	ansiTerm := pkg.Package{
+		Name:      "ansi_term",
+		Version:   "0.12.1",
+		PURL:      "pkg:cargo/ansi_term@0.12.1",
+		Locations: locations,
+		Language:  pkg.Rust,
+		Type:      pkg.RustPkg,
+		Licenses:  pkg.NewLicenseSet(),
+		Metadata: pkg.RustCargoLockEntry{
+			Name:     "ansi_term",
+			Version:  "0.12.1",
+			Source:   "registry+https://github.com/rust-lang/crates.io-index",
+			Checksum: "d52a9bb7ec0cf484c551830a7ce27bd20d67eac647e1befb56b0be4ee39a55d2",
+			Dependencies: []string{
+				"winapi",
 			},
 		},
-		{
-			Name:      "matches",
-			Version:   "0.1.8",
-			PURL:      "pkg:cargo/matches@0.1.8",
-			Locations: locations,
-			Language:  pkg.Rust,
-			Type:      pkg.RustPkg,
-			Licenses:  pkg.NewLicenseSet(),
-			Metadata: pkg.RustCargoLockEntry{
-				Name:         "matches",
-				Version:      "0.1.8",
-				Source:       "registry+https://github.com/rust-lang/crates.io-index",
-				Checksum:     "7ffc5c5338469d4d3ea17d269fa8ea3512ad247247c30bd2df69e68309ed0a08",
-				Dependencies: []string{},
+	}
+	errno := pkg.Package{
+		Name:      "errno",
+		Version:   "0.3.9",
+		PURL:      "pkg:cargo/errno@0.3.9",
+		Locations: locations,
+		Language:  pkg.Rust,
+		Type:      pkg.RustPkg,
+		Licenses:  pkg.NewLicenseSet(),
+		Metadata: pkg.RustCargoLockEntry{
+			Name:     "errno",
+			Version:  "0.3.9",
+			Source:   "registry+https://github.com/rust-lang/crates.io-index",
+			Checksum: "534c5cf6194dfab3db3242765c03bbe257cf92f22b38f6bc0c58d59108a820ba",
+			Dependencies: []string{
+				"windows-sys 0.52.0",
 			},
 		},
-		{
-			Name:      "memchr",
-			Version:   "2.3.3",
-			PURL:      "pkg:cargo/memchr@2.3.3",
-			Locations: locations,
-			Language:  pkg.Rust,
-			Type:      pkg.RustPkg,
-			Licenses:  pkg.NewLicenseSet(),
-			Metadata: pkg.RustCargoLockEntry{
-				Name:         "memchr",
-				Version:      "2.3.3",
-				Source:       "registry+https://github.com/rust-lang/crates.io-index",
-				Checksum:     "3728d817d99e5ac407411fa471ff9800a778d88a24685968b36824eaf4bee400",
-				Dependencies: []string{},
+	}
+	matches := pkg.Package{
+		Name:      "matches",
+		Version:   "0.1.8",
+		PURL:      "pkg:cargo/matches@0.1.8",
+		Locations: locations,
+		Language:  pkg.Rust,
+		Type:      pkg.RustPkg,
+		Licenses:  pkg.NewLicenseSet(),
+		Metadata: pkg.RustCargoLockEntry{
+			Name:         "matches",
+			Version:      "0.1.8",
+			Source:       "registry+https://github.com/rust-lang/crates.io-index",
+			Checksum:     "7ffc5c5338469d4d3ea17d269fa8ea3512ad247247c30bd2df69e68309ed0a08",
+			Dependencies: []string{},
+		},
+	}
+	memchr := pkg.Package{
+		Name:      "memchr",
+		Version:   "2.3.3",
+		PURL:      "pkg:cargo/memchr@2.3.3",
+		Locations: locations,
+		Language:  pkg.Rust,
+		Type:      pkg.RustPkg,
+		Licenses:  pkg.NewLicenseSet(),
+		Metadata: pkg.RustCargoLockEntry{
+			Name:         "memchr",
+			Version:      "2.3.3",
+			Source:       "registry+https://github.com/rust-lang/crates.io-index",
+			Checksum:     "3728d817d99e5ac407411fa471ff9800a778d88a24685968b36824eaf4bee400",
+			Dependencies: []string{},
+		},
+	}
+
+	natord := pkg.Package{
+		Name:      "natord",
+		Version:   "1.0.9",
+		PURL:      "pkg:cargo/natord@1.0.9",
+		Locations: locations,
+		Language:  pkg.Rust,
+		Type:      pkg.RustPkg,
+		Licenses:  pkg.NewLicenseSet(),
+		Metadata: pkg.RustCargoLockEntry{
+			Name:         "natord",
+			Version:      "1.0.9",
+			Source:       "registry+https://github.com/rust-lang/crates.io-index",
+			Checksum:     "308d96db8debc727c3fd9744aac51751243420e46edf401010908da7f8d5e57c",
+			Dependencies: []string{},
+		},
+	}
+
+	nom := pkg.Package{
+		Name:      "nom",
+		Version:   "4.2.3",
+		PURL:      "pkg:cargo/nom@4.2.3",
+		Locations: locations,
+		Language:  pkg.Rust,
+		Type:      pkg.RustPkg,
+		Licenses:  pkg.NewLicenseSet(),
+		Metadata: pkg.RustCargoLockEntry{
+			Name:     "nom",
+			Version:  "4.2.3",
+			Source:   "registry+https://github.com/rust-lang/crates.io-index",
+			Checksum: "2ad2a91a8e869eeb30b9cb3119ae87773a8f4ae617f41b1eb9c154b2905f7bd6",
+			Dependencies: []string{
+				"memchr",
+				"version_check",
 			},
 		},
-		{
-			Name:      "natord",
-			Version:   "1.0.9",
-			PURL:      "pkg:cargo/natord@1.0.9",
-			Locations: locations,
-			Language:  pkg.Rust,
-			Type:      pkg.RustPkg,
-			Licenses:  pkg.NewLicenseSet(),
-			Metadata: pkg.RustCargoLockEntry{
-				Name:         "natord",
-				Version:      "1.0.9",
-				Source:       "registry+https://github.com/rust-lang/crates.io-index",
-				Checksum:     "308d96db8debc727c3fd9744aac51751243420e46edf401010908da7f8d5e57c",
-				Dependencies: []string{},
-			},
-		},
-		{
-			Name:      "nom",
-			Version:   "4.2.3",
-			PURL:      "pkg:cargo/nom@4.2.3",
-			Locations: locations,
-			Language:  pkg.Rust,
-			Type:      pkg.RustPkg,
-			Licenses:  pkg.NewLicenseSet(),
-			Metadata: pkg.RustCargoLockEntry{
-				Name:     "nom",
-				Version:  "4.2.3",
-				Source:   "registry+https://github.com/rust-lang/crates.io-index",
-				Checksum: "2ad2a91a8e869eeb30b9cb3119ae87773a8f4ae617f41b1eb9c154b2905f7bd6",
-				Dependencies: []string{
-					"memchr",
-					"version_check",
-				},
-			},
-		},
-		{
-			Name:      "unicode-bidi",
-			Version:   "0.3.4",
-			PURL:      "pkg:cargo/unicode-bidi@0.3.4",
-			Locations: locations,
-			Language:  pkg.Rust,
-			Type:      pkg.RustPkg,
-			Licenses:  pkg.NewLicenseSet(),
-			Metadata: pkg.RustCargoLockEntry{
-				Name:     "unicode-bidi",
-				Version:  "0.3.4",
-				Source:   "registry+https://github.com/rust-lang/crates.io-index",
-				Checksum: "49f2bd0c6468a8230e1db229cff8029217cf623c767ea5d60bfbd42729ea54d5",
-				Dependencies: []string{
-					"matches",
-				},
-			},
-		},
-		{
-			Name:      "version_check",
-			Version:   "0.1.5",
-			PURL:      "pkg:cargo/version_check@0.1.5",
-			Locations: locations,
-			Language:  pkg.Rust,
-			Type:      pkg.RustPkg,
-			Licenses:  pkg.NewLicenseSet(),
-			Metadata: pkg.RustCargoLockEntry{
-				Name:         "version_check",
-				Version:      "0.1.5",
-				Source:       "registry+https://github.com/rust-lang/crates.io-index",
-				Checksum:     "914b1a6776c4c929a602fafd8bc742e06365d4bcbe48c30f9cca5824f70dc9dd",
-				Dependencies: []string{},
-			},
-		},
-		{
-			Name:      "winapi",
-			Version:   "0.3.9",
-			PURL:      "pkg:cargo/winapi@0.3.9",
-			Locations: locations,
-			Language:  pkg.Rust,
-			Type:      pkg.RustPkg,
-			Licenses:  pkg.NewLicenseSet(),
-			Metadata: pkg.RustCargoLockEntry{
-				Name:     "winapi",
-				Version:  "0.3.9",
-				Source:   "registry+https://github.com/rust-lang/crates.io-index",
-				Checksum: "5c839a674fcd7a98952e593242ea400abe93992746761e38641405d28b00f419",
-				Dependencies: []string{
-					"winapi-i686-pc-windows-gnu",
-					"winapi-x86_64-pc-windows-gnu",
-				},
-			},
-		},
-		{
-			Name:      "winapi-i686-pc-windows-gnu",
-			Version:   "0.4.0",
-			PURL:      "pkg:cargo/winapi-i686-pc-windows-gnu@0.4.0",
-			Locations: locations,
-			Language:  pkg.Rust,
-			Type:      pkg.RustPkg,
-			Licenses:  pkg.NewLicenseSet(),
-			Metadata: pkg.RustCargoLockEntry{
-				Name:         "winapi-i686-pc-windows-gnu",
-				Version:      "0.4.0",
-				Source:       "registry+https://github.com/rust-lang/crates.io-index",
-				Checksum:     "ac3b87c63620426dd9b991e5ce0329eff545bccbbb34f3be09ff6fb6ab51b7b6",
-				Dependencies: []string{},
-			},
-		},
-		{
-			Name:      "winapi-x86_64-pc-windows-gnu",
-			Version:   "0.4.0",
-			PURL:      "pkg:cargo/winapi-x86_64-pc-windows-gnu@0.4.0",
-			Locations: locations,
-			Language:  pkg.Rust,
-			Type:      pkg.RustPkg,
-			Licenses:  pkg.NewLicenseSet(),
-			Metadata: pkg.RustCargoLockEntry{
-				Name:         "winapi-x86_64-pc-windows-gnu",
-				Version:      "0.4.0",
-				Source:       "registry+https://github.com/rust-lang/crates.io-index",
-				Checksum:     "712e227841d057c1ee1cd2fb22fa7e5a5461ae8e48fa2ca79ec42cfc1931183f",
-				Dependencies: []string{},
+	}
+	schannel := pkg.Package{
+		Name:      "schannel",
+		Version:   "0.1.26",
+		PURL:      "pkg:cargo/schannel@0.1.26",
+		Locations: locations,
+		Language:  pkg.Rust,
+		Type:      pkg.RustPkg,
+		Licenses:  pkg.NewLicenseSet(),
+		Metadata: pkg.RustCargoLockEntry{
+			Name:     "schannel",
+			Version:  "0.1.26",
+			Source:   "registry+https://github.com/rust-lang/crates.io-index",
+			Checksum: "01227be5826fa0690321a2ba6c5cd57a19cf3f6a09e76973b58e61de6ab9d1c1",
+			Dependencies: []string{
+				"windows-sys 0.59.0",
 			},
 		},
 	}

-	// TODO: no relationships are under test yet
-	var expectedRelationships []artifact.Relationship
+	unicodeBidi := pkg.Package{
+		Name:      "unicode-bidi",
+		Version:   "0.3.4",
+		PURL:      "pkg:cargo/unicode-bidi@0.3.4",
+		Locations: locations,
+		Language:  pkg.Rust,
+		Type:      pkg.RustPkg,
+		Licenses:  pkg.NewLicenseSet(),
+		Metadata: pkg.RustCargoLockEntry{
+			Name:     "unicode-bidi",
+			Version:  "0.3.4",
+			Source:   "registry+https://github.com/rust-lang/crates.io-index",
+			Checksum: "49f2bd0c6468a8230e1db229cff8029217cf623c767ea5d60bfbd42729ea54d5",
+			Dependencies: []string{
+				"matches",
+				"bogus", // a bad dependency to test error handling
+			},
+		},
+	}
+
+	versionCheck := pkg.Package{
+		Name:      "version_check",
+		Version:   "0.1.5",
+		PURL:      "pkg:cargo/version_check@0.1.5",
+		Locations: locations,
+		Language:  pkg.Rust,
+		Type:      pkg.RustPkg,
+		Licenses:  pkg.NewLicenseSet(),
+		Metadata: pkg.RustCargoLockEntry{
+			Name:         "version_check",
+			Version:      "0.1.5",
+			Source:       "registry+https://github.com/rust-lang/crates.io-index",
+			Checksum:     "914b1a6776c4c929a602fafd8bc742e06365d4bcbe48c30f9cca5824f70dc9dd",
+			Dependencies: []string{},
+		},
+	}
+
+	winapi := pkg.Package{
+		Name:      "winapi",
+		Version:   "0.3.9",
+		PURL:      "pkg:cargo/winapi@0.3.9",
+		Locations: locations,
+		Language:  pkg.Rust,
+		Type:      pkg.RustPkg,
+		Licenses:  pkg.NewLicenseSet(),
+		Metadata: pkg.RustCargoLockEntry{
+			Name:     "winapi",
+			Version:  "0.3.9",
+			Source:   "registry+https://github.com/rust-lang/crates.io-index",
+			Checksum: "5c839a674fcd7a98952e593242ea400abe93992746761e38641405d28b00f419",
+			Dependencies: []string{
+				"winapi-i686-pc-windows-gnu",
+				"winapi-x86_64-pc-windows-gnu",
+			},
+		},
+	}
+
+	winAPIi686PCWindowsGNU := pkg.Package{
+		Name:      "winapi-i686-pc-windows-gnu",
+		Version:   "0.4.0",
+		PURL:      "pkg:cargo/winapi-i686-pc-windows-gnu@0.4.0",
+		Locations: locations,
+		Language:  pkg.Rust,
+		Type:      pkg.RustPkg,
+		Licenses:  pkg.NewLicenseSet(),
+		Metadata: pkg.RustCargoLockEntry{
+			Name:         "winapi-i686-pc-windows-gnu",
+			Version:      "0.4.0",
+			Source:       "registry+https://github.com/rust-lang/crates.io-index",
+			Checksum:     "ac3b87c63620426dd9b991e5ce0329eff545bccbbb34f3be09ff6fb6ab51b7b6",
+			Dependencies: []string{},
+		},
+	}
+
+	winAPIx8664PCWindowsGNU := pkg.Package{
+		Name:      "winapi-x86_64-pc-windows-gnu",
+		Version:   "0.4.0",
+		PURL:      "pkg:cargo/winapi-x86_64-pc-windows-gnu@0.4.0",
+		Locations: locations,
+		Language:  pkg.Rust,
+		Type:      pkg.RustPkg,
+		Licenses:  pkg.NewLicenseSet(),
+		Metadata: pkg.RustCargoLockEntry{
+			Name:         "winapi-x86_64-pc-windows-gnu",
+			Version:      "0.4.0",
+			Source:       "registry+https://github.com/rust-lang/crates.io-index",
+			Checksum:     "712e227841d057c1ee1cd2fb22fa7e5a5461ae8e48fa2ca79ec42cfc1931183f",
+			Dependencies: []string{},
+		},
+	}
+
+	windowsSys52 := pkg.Package{
+		Name:      "windows-sys",
+		Version:   "0.52.0",
+		PURL:      "pkg:cargo/windows-sys@0.52.0",
+		Locations: locations,
+		Language:  pkg.Rust,
+		Type:      pkg.RustPkg,
+		Licenses:  pkg.NewLicenseSet(),
+		Metadata: pkg.RustCargoLockEntry{
+			Name:         "windows-sys",
+			Version:      "0.52.0",
+			Source:       "registry+https://github.com/rust-lang/crates.io-index",
+			Checksum:     "282be5f36a8ce781fad8c8ae18fa3f9beff57ec1b52cb3de0789201425d9a33d",
+			Dependencies: []string{},
+		},
+	}
+
+	windowsSys59 := pkg.Package{
+		Name:      "windows-sys",
+		Version:   "0.59.0",
+		PURL:      "pkg:cargo/windows-sys@0.59.0",
+		Locations: locations,
+		Language:  pkg.Rust,
+		Type:      pkg.RustPkg,
+		Licenses:  pkg.NewLicenseSet(),
+		Metadata: pkg.RustCargoLockEntry{
+			Name:         "windows-sys",
+			Version:      "0.59.0",
+			Source:       "registry+https://github.com/rust-lang/crates.io-index",
+			Checksum:     "1e38bc4d79ed67fd075bcc251a1c39b32a1776bbe92e5bef1f0bf1f8c531853b",
+			Dependencies: []string{},
+		},
+	}
+	expectedPkgs := []pkg.Package{
+		ansiTerm,
+		errno,
+		matches,
+		memchr,
+		natord,
+		nom,
+		schannel,
+		unicodeBidi,
+		versionCheck,
+		winapi,
+		winAPIi686PCWindowsGNU,
+		winAPIx8664PCWindowsGNU,
+		windowsSys52,
+		windowsSys59,
+	}
+
+	expectedRelationships := []artifact.Relationship{
+		{
+			From: ansiTerm,
+			To:   winapi,
+			Type: artifact.DependencyOfRelationship,
+		},
+		{
+			From: errno,
+			To:   windowsSys52,
+			Type: artifact.DependencyOfRelationship,
+		},
+		{
+			From: nom,
+			To:   memchr,
+			Type: artifact.DependencyOfRelationship,
+		},
+		{
+			From: nom,
+			To:   versionCheck,
+			Type: artifact.DependencyOfRelationship,
+		},
+		{
+			From: schannel,
+			To:   windowsSys59,
+			Type: artifact.DependencyOfRelationship,
+		},
+		{
+			From: unicodeBidi,
+			To:   matches,
+			Type: artifact.DependencyOfRelationship,
+		},
+		{
+			From: winapi,
+			To:   winAPIi686PCWindowsGNU,
+			Type: artifact.DependencyOfRelationship,
+		},
+		{
+			From: winapi,
+			To:   winAPIx8664PCWindowsGNU,
+			Type: artifact.DependencyOfRelationship,
+		},
+	}

 	pkgtest.TestFileParser(t, fixture, parseCargoLock, expectedPkgs, expectedRelationships)
-
 }

 func Test_corruptCargoLock(t *testing.T) {
@@ -9,6 +9,15 @@ dependencies = [
 "winapi",
 ]

+[[package]]
+name = "errno"
+version = "0.3.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "534c5cf6194dfab3db3242765c03bbe257cf92f22b38f6bc0c58d59108a820ba"
+dependencies = [
+ "windows-sys 0.52.0",
+]
+
 [[package]]
 name = "matches"
 version = "0.1.8"
@@ -37,6 +46,15 @@ dependencies = [
 "version_check",
 ]

+[[package]]
+name = "schannel"
+version = "0.1.26"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "01227be5826fa0690321a2ba6c5cd57a19cf3f6a09e76973b58e61de6ab9d1c1"
+dependencies = [
+ "windows-sys 0.59.0",
+]
+
 [[package]]
 name = "unicode-bidi"
 version = "0.3.4"
@@ -44,6 +62,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "49f2bd0c6468a8230e1db229cff8029217cf623c767ea5d60bfbd42729ea54d5"
 dependencies = [
 "matches",
+  "bogus", # not present in cargo.lock; test error handling
 ]

 [[package]]
@@ -74,3 +93,14 @@ version = "0.4.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "712e227841d057c1ee1cd2fb22fa7e5a5461ae8e48fa2ca79ec42cfc1931183f"

+[[package]]
+name = "windows-sys"
+version = "0.52.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "282be5f36a8ce781fad8c8ae18fa3f9beff57ec1b52cb3de0789201425d9a33d"
+
+[[package]]
+name = "windows-sys"
+version = "0.59.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1e38bc4d79ed67fd075bcc251a1c39b32a1776bbe92e5bef1f0bf1f8c531853b"
@@ -2,7 +2,9 @@ package pkg

 import (
 	"fmt"
+	"net/url"
 	"sort"
+	"strings"

 	"github.com/scylladb/go-set/strset"

@@ -112,7 +114,12 @@ func NewLicenseFromURLs(value string, urls ...string) License {
 	s := strset.New()
 	for _, url := range urls {
 		if url != "" {
-			s.Add(url)
+			sanitizedURL, err := stripUnwantedCharacters(url)
+			if err != nil {
+				log.Tracef("unable to sanitize url=%q: %s", url, err)
+				continue
+			}
+			s.Add(sanitizedURL)
 		}
 	}

@@ -122,13 +129,28 @@ func NewLicenseFromURLs(value string, urls ...string) License {
 	return l
 }

+func stripUnwantedCharacters(rawURL string) (string, error) {
+	cleanedURL := strings.TrimSpace(rawURL)
+	_, err := url.ParseRequestURI(cleanedURL)
+	if err != nil {
+		return "", fmt.Errorf("invalid URL: %w", err)
+	}
+
+	return cleanedURL, nil
+}
+
 func NewLicenseFromFields(value, url string, location *file.Location) License {
 	l := NewLicense(value)
 	if location != nil {
 		l.Locations.Add(*location)
 	}
 	if url != "" {
-		l.URLs = append(l.URLs, url)
+		sanitizedURL, err := stripUnwantedCharacters(url)
+		if err != nil {
+			log.Tracef("unable to sanitize url=%q: %s", url, err)
+		} else {
+			l.URLs = append(l.URLs, sanitizedURL)
+		}
 	}

 	return l
@@ -226,3 +226,39 @@ func TestLicense_Merge(t *testing.T) {
 		})
 	}
 }
+
+func TestLicenseConstructors(t *testing.T) {
+	type input struct {
+		value string
+		urls  []string
+	}
+	tests := []struct {
+		name     string
+		input    input
+		expected License
+	}{
+		{
+			name: "License URLs are stripped of newlines and tabs",
+			input: input{
+				value: "New BSD License",
+				urls: []string{
+					`
+						http://user-agent-utils.googlecode.com/svn/trunk/UserAgentUtils/LICENSE.txt
+									
+					`},
+			},
+			expected: License{
+				Value: "New BSD License",
+				Type:  license.Declared,
+				URLs:  []string{"http://user-agent-utils.googlecode.com/svn/trunk/UserAgentUtils/LICENSE.txt"},
+			},
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			got := NewLicenseFromURLs(test.input.value, test.input.urls...)
+			assert.Equal(t, test.expected, got)
+		})
+	}
+}
@@ -1,3 +1,5 @@
 FROM alpine@sha256:c5c5fda71656f28e49ac9c5416b3643eaa6a108a8093151d6d1afc9463be8e33
 RUN rm -rf /lib/apk/db/installed
 COPY . /home/files
+# add a circular reference that will result in a failure while executing FindByGlob:
+RUN mkdir -p /etc/alternatives && ln -s /etc/alternatives/java2 /etc/alternatives/java && ln -s /etc/alternatives/java /etc/alternatives/java2
@@ -22,6 +22,7 @@ func Test_Unknowns(t *testing.T) {
 				assertInOutput(`no package identified in executable file`),
 				assertInOutput(`unable to read files from java archive`),
 				assertInOutput(`no package identified in archive`),
+				assertInOutput(`cycle during symlink resolution`),
 				assertSuccessfulReturnCode,
 			},
 		},
@@ -61,6 +61,11 @@ test_negative_snapshot_download_asset() {
 }

 test_sboms_have_packages() {
+  if ! command -v jq &> /dev/null; then
+    echo "jq command not found. Please install jq or ensure it is in your PATH."
+    exit 1
+  fi
+
  find "$(snapshot_dir)/" -name "*.sbom" -print0 | while IFS= read -r -d '' file; do
      count=$(cat "$file" | jq ".artifacts | length")
      if [ "$count" -lt 80 ]; then
@@ -32,8 +32,14 @@ test_positive_snapshot_install_asset() {
 	  arch="amd64_v1"
  fi

+  # note: this is a change made in goreleaser v1.62.0
+  local_suffix=""
+  if [ "${arch}" == "arm64" ]; then
+    local_suffix="_v8.0"
+  fi
+
  assertFilesEqual \
-    "$(snapshot_dir)/${os}-build_${os}_${arch}/${binary}" \
+    "$(snapshot_dir)/${os}-build_${os}_${arch}${local_suffix}/${binary}" \
    "${expected_path}" \
    "unable to verify installation of os=${os} arch=${arch} format=${format}"

@@ -1,5 +1,5 @@
 FROM alpine:3.6
-RUN apk update && apk add python3 wget curl unzip make ca-certificates
+RUN apk update && apk add python3 wget curl unzip make ca-certificates jq
 RUN curl -O -L "https://github.com/sigstore/cosign/releases/latest/download/cosign-linux-amd64" && \
    mv cosign-linux-amd64 /usr/local/bin/cosign && \
    chmod +x /usr/local/bin/cosign
@@ -1,5 +1,5 @@
 FROM --platform=linux/amd64 ubuntu:20.04@sha256:33a5cc25d22c45900796a1aca487ad7a7cb09f09ea00b779e3b2026b4fc2faba
-RUN apt update -y && apt install make python3 curl unzip -y
+RUN apt update -y && apt install make python3 curl unzip jq -y
 RUN LATEST_VERSION=$(curl https://api.github.com/repos/sigstore/cosign/releases/latest | grep tag_name | cut -d : -f2 | tr -d "v\", ") && \
    curl -O -L "https://github.com/sigstore/cosign/releases/latest/download/cosign_${LATEST_VERSION}_amd64.deb" && \
    dpkg -i cosign_${LATEST_VERSION}_amd64.deb
Author	SHA1	Message	Date
anchore-actions-token-generator[bot]andwillmurphyscode	a8d4202d77	chore(deps): update stereoscope to aa3a3ef4efe8d8759c9aa87261b405cc003bfc9a (#3472 ) Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: willmurphyscode <12529630+willmurphyscode@users.noreply.github.com>	2024-11-21 14:28:51 +00:00
dependabot[bot]	19a30b9fd2	chore(deps): bump github.com/charmbracelet/bubbletea from 1.2.2 to 1.2.3 (#3467 ) Bumps [github.com/charmbracelet/bubbletea](https://github.com/charmbracelet/bubbletea) from 1.2.2 to 1.2.3. - [Release notes](https://github.com/charmbracelet/bubbletea/releases) - [Changelog](https://github.com/charmbracelet/bubbletea/blob/main/.goreleaser.yml) - [Commits](https://github.com/charmbracelet/bubbletea/compare/v1.2.2...v1.2.3) --- updated-dependencies: - dependency-name: github.com/charmbracelet/bubbletea dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2024-11-20 08:32:30 -05:00
William Murphy	e65fe243bf	fix: bump clio to pull in logging fix (#3466 ) Previously, if SYFT_LOG_FILE was not set, and no TTY was present, log.Warn messages were discarded instead of being sent to stderr. Signed-off-by: Will Murphy <willmurphyscode@users.noreply.github.com>	2024-11-19 14:56:53 -05:00
Christopher Angelo Phillips	f4cad63da1	3122 valid license url characters (#3449 ) * chore: strip unwanted characters from license URL --------- Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com>	2024-11-19 15:34:58 +00:00
Christopher Angelo Phillips	e7b65c2c58	3030 license declared spdx correction (#3461 ) * feat: update hasExtractedLicense field to include license-ref candidates --------- Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com>	2024-11-19 15:00:59 +00:00
anchore-actions-token-generator[bot]andspiffcs	8aef0c908a	chore(deps): update tools to latest versions (#3463 ) Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: spiffcs <32073428+spiffcs@users.noreply.github.com>	2024-11-19 09:36:46 -05:00
dependabot[bot]	35fa0cc454	chore(deps): bump github.com/jedib0t/go-pretty/v6 from 6.6.1 to 6.6.2 (#3465 ) Bumps [github.com/jedib0t/go-pretty/v6](https://github.com/jedib0t/go-pretty) from 6.6.1 to 6.6.2. - [Release notes](https://github.com/jedib0t/go-pretty/releases) - [Commits](https://github.com/jedib0t/go-pretty/compare/v6.6.1...v6.6.2) --- updated-dependencies: - dependency-name: github.com/jedib0t/go-pretty/v6 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2024-11-19 09:36:32 -05:00
dependabot[bot]	1c61e9cbff	chore(deps): bump modernc.org/sqlite from 1.33.1 to 1.34.1 (#3460 ) Bumps [modernc.org/sqlite](https://gitlab.com/cznic/sqlite) from 1.33.1 to 1.34.1. - [Commits](https://gitlab.com/cznic/sqlite/compare/v1.33.1...v1.34.1) --- updated-dependencies: - dependency-name: modernc.org/sqlite dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2024-11-18 09:33:08 -05:00
anchore-actions-token-generator[bot]andwagoodman	d91150edea	chore(deps): update CPE dictionary index (#3453 ) Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: wagoodman <590471+wagoodman@users.noreply.github.com>	2024-11-18 08:33:41 -05:00
anchore-actions-token-generator[bot]andspiffcs	215ae2bbb9	chore(deps): update tools to latest versions (#3454 ) Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: spiffcs <32073428+spiffcs@users.noreply.github.com>	2024-11-18 08:33:23 -05:00
anchore-actions-token-generator[bot]andspiffcs	93d90cb10a	chore(deps): update tools to latest versions (#3448 ) Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: spiffcs <32073428+spiffcs@users.noreply.github.com>	2024-11-17 12:32:11 -05:00
anchore-actions-token-generator[bot]andspiffcs	70ef3f25df	chore(deps): update tools to latest versions (#3444 ) Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: spiffcs <32073428+spiffcs@users.noreply.github.com>	2024-11-15 09:36:21 -05:00
dependabot[bot]	e41f8dfa04	chore(deps): bump github/codeql-action from 3.27.3 to 3.27.4 (#3446 ) Bumps [github/codeql-action](https://github.com/github/codeql-action) from 3.27.3 to 3.27.4. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/396bb3e45325a47dd9ef434068033c6d5bb0d11a...ea9e4e37992a54ee68a9622e985e60c8e8f12d9f) --- updated-dependencies: - dependency-name: github/codeql-action dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2024-11-15 09:35:59 -05:00
William Murphy	bc35345afb	feat: emit dependency relationships found in Cargo.lock (#3443 ) * feat: emit dependency relationships found in Cargo.lock Include updating test Cargo.lock to have dependencies on multiple versions of the same crate. Signed-off-by: Will Murphy <willmurphyscode@users.noreply.github.com>	2024-11-14 16:45:00 -05:00
anchore-actions-token-generator[bot]andkzantow	926486a7c3	chore(deps): update stereoscope to aa3a3ef4efe8d8759c9aa87261b405cc003bfc9a (#3442 ) Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: kzantow <3009477+kzantow@users.noreply.github.com>	2024-11-14 13:13:04 -05:00
dependabot[bot]	a15c5f61f4	chore(deps): bump github/codeql-action from 3.27.2 to 3.27.3 (#3438 ) Bumps [github/codeql-action](https://github.com/github/codeql-action) from 3.27.2 to 3.27.3. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/9278e421667d5d90a2839487a482448c4ec7df4d...396bb3e45325a47dd9ef434068033c6d5bb0d11a) --- updated-dependencies: - dependency-name: github/codeql-action dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2024-11-14 05:32:26 -05:00
dependabot[bot]	94dd634a97	chore(deps): bump github.com/charmbracelet/bubbletea from 1.2.1 to 1.2.2 (#3439 ) Bumps [github.com/charmbracelet/bubbletea](https://github.com/charmbracelet/bubbletea) from 1.2.1 to 1.2.2. - [Release notes](https://github.com/charmbracelet/bubbletea/releases) - [Changelog](https://github.com/charmbracelet/bubbletea/blob/main/.goreleaser.yml) - [Commits](https://github.com/charmbracelet/bubbletea/compare/v1.2.1...v1.2.2) --- updated-dependencies: - dependency-name: github.com/charmbracelet/bubbletea dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2024-11-14 05:31:39 -05:00
dependabot[bot]	5624d48e25	chore(deps): bump github.com/saferwall/pe from 1.5.4 to 1.5.5 (#3440 ) Bumps [github.com/saferwall/pe](https://github.com/saferwall/pe) from 1.5.4 to 1.5.5. - [Release notes](https://github.com/saferwall/pe/releases) - [Changelog](https://github.com/saferwall/pe/blob/main/CHANGELOG.md) - [Commits](https://github.com/saferwall/pe/compare/v1.5.4...v1.5.5) --- updated-dependencies: - dependency-name: github.com/saferwall/pe dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2024-11-14 05:31:21 -05:00
anchore-actions-token-generator[bot]spiffcs Alex Goodman	ac8be4ad41	chore(deps): update tools to latest versions (#3413 ) * chore(deps): update tools to latest versions Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> * fix linting Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> --------- Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> Co-authored-by: spiffcs <32073428+spiffcs@users.noreply.github.com> Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com>	2024-11-12 15:53:27 +00:00
dependabot[bot]	abd6abe186	chore(deps): bump github/codeql-action from 3.27.1 to 3.27.2 (#3436 ) Bumps [github/codeql-action](https://github.com/github/codeql-action) from 3.27.1 to 3.27.2. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/4f3212b61783c3c68e8309a0f18a699764811cda...9278e421667d5d90a2839487a482448c4ec7df4d) --- updated-dependencies: - dependency-name: github/codeql-action dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2024-11-12 13:50:25 +00:00
dependabot[bot]	51872403d1	chore(deps): bump golang.org/x/mod from 0.21.0 to 0.22.0 (#3426 ) Bumps [golang.org/x/mod](https://github.com/golang/mod) from 0.21.0 to 0.22.0. - [Commits](https://github.com/golang/mod/compare/v0.21.0...v0.22.0) --- updated-dependencies: - dependency-name: golang.org/x/mod dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2024-11-12 13:48:39 +00:00
witchcraze	066aadb4d1	update node classifier (#3419 ) Signed-off-by: witchcraze <witchcraze@gmail.com>	2024-11-12 08:38:43 -05:00
anchore-actions-token-generator[bot]andkzantow	e463206349	chore(deps): update stereoscope to 120d9ea511e2f7a9887b443c52e66cd19bb80b43 (#3424 ) Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: kzantow <3009477+kzantow@users.noreply.github.com>	2024-11-12 08:37:14 -05:00
anchore-actions-token-generator[bot]andwagoodman	7c6483f84a	chore(deps): update CPE dictionary index (#3429 ) Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: wagoodman <590471+wagoodman@users.noreply.github.com>	2024-11-12 08:36:41 -05:00
dependabot[bot]	013a2fe340	chore(deps): bump github/codeql-action from 3.27.0 to 3.27.1 (#3431 ) Bumps [github/codeql-action](https://github.com/github/codeql-action) from 3.27.0 to 3.27.1. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/662472033e021d55d94146f66f6058822b0b39fd...4f3212b61783c3c68e8309a0f18a699764811cda) --- updated-dependencies: - dependency-name: github/codeql-action dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2024-11-12 08:36:01 -05:00
dependabot[bot]	6e7c198ae7	chore(deps): bump golang.org/x/net from 0.30.0 to 0.31.0 (#3432 ) Bumps [golang.org/x/net](https://github.com/golang/net) from 0.30.0 to 0.31.0. - [Commits](https://github.com/golang/net/compare/v0.30.0...v0.31.0) --- updated-dependencies: - dependency-name: golang.org/x/net dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2024-11-12 08:35:41 -05:00
dependabot[bot]	8a7da599fc	chore(deps): bump github.com/charmbracelet/bubbletea from 1.1.2 to 1.2.1 (#3433 ) Bumps [github.com/charmbracelet/bubbletea](https://github.com/charmbracelet/bubbletea) from 1.1.2 to 1.2.1. - [Release notes](https://github.com/charmbracelet/bubbletea/releases) - [Changelog](https://github.com/charmbracelet/bubbletea/blob/main/.goreleaser.yml) - [Commits](https://github.com/charmbracelet/bubbletea/compare/v1.1.2...v1.2.1) --- updated-dependencies: - dependency-name: github.com/charmbracelet/bubbletea dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2024-11-12 08:35:15 -05:00
Alex Goodman	b0bffef1a2	restore log on ui teardown (#3427 ) Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>	2024-11-08 12:31:38 -05:00
Alan Pope	3c070e0ad9	doc: Add official Syft logo license information (#3421 ) This clarifies the license under which the Syft "owl" logo is released. This is necessary to enable us to share the logo in certain online communities. Signed-off-by: Alan Pope <alan.pope@anchore.com>	2024-11-07 14:23:57 +00:00
dependabot[bot]	defb08d120	chore(deps): bump anchore/sbom-action from 0.17.6 to 0.17.7 (#3418 ) Bumps [anchore/sbom-action](https://github.com/anchore/sbom-action) from 0.17.6 to 0.17.7. - [Release notes](https://github.com/anchore/sbom-action/releases) - [Changelog](https://github.com/anchore/sbom-action/blob/main/RELEASE.md) - [Commits](https://github.com/anchore/sbom-action/compare/251a468eed47e5082b105c3ba6ee500c0e65a764...fc46e51fd3cb168ffb36c6d1915723c47db58abb) --- updated-dependencies: - dependency-name: anchore/sbom-action dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2024-11-06 10:41:45 -05:00
Keith Zantow	16eedd81ec	chore: build release sbom from go.mod (#3417 ) Signed-off-by: Keith Zantow <kzantow@gmail.com>	2024-11-05 09:51:23 -05:00
Christopher Angelo PhillipsandKeith Zantow	8a41d77250	chore: prevent file resolver from bubbling errors in binary cataloger (#3410 ) Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com> Signed-off-by: Keith Zantow <kzantow@gmail.com> Co-authored-by: Keith Zantow <kzantow@gmail.com>	2024-11-04 20:23:27 +00:00
anchore-actions-token-generator[bot]andkzantow	eb56f2e4bb	chore(deps): update stereoscope to cbd43fb4e5d348fe680066ee6329385fd6a4f827 (#3411 ) Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: kzantow <3009477+kzantow@users.noreply.github.com>	2024-11-04 10:20:27 -05:00
anchore-actions-token-generator[bot]andwagoodman	849e325408	chore(deps): update CPE dictionary index (#3414 ) Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: wagoodman <590471+wagoodman@users.noreply.github.com>	2024-11-04 10:13:22 -05:00
dependabot[bot]	203df65a65	chore(deps): bump github.com/adrg/xdg from 0.5.2 to 0.5.3 (#3408 ) Bumps [github.com/adrg/xdg](https://github.com/adrg/xdg) from 0.5.2 to 0.5.3. - [Release notes](https://github.com/adrg/xdg/releases) - [Commits](https://github.com/adrg/xdg/compare/v0.5.2...v0.5.3) --- updated-dependencies: - dependency-name: github.com/adrg/xdg dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2024-11-01 11:43:54 -04:00
dependabot[bot]	2c70090d10	chore(deps): bump github.com/charmbracelet/lipgloss from 0.13.1 to 1.0.0 (#3409 ) Bumps [github.com/charmbracelet/lipgloss](https://github.com/charmbracelet/lipgloss) from 0.13.1 to 1.0.0. - [Release notes](https://github.com/charmbracelet/lipgloss/releases) - [Changelog](https://github.com/charmbracelet/lipgloss/blob/master/.goreleaser.yml) - [Commits](https://github.com/charmbracelet/lipgloss/compare/v0.13.1...v1.0.0) --- updated-dependencies: - dependency-name: github.com/charmbracelet/lipgloss dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2024-11-01 11:43:47 -04:00
anchore-actions-token-generator[bot]andkzantow	8f179e6961	chore(deps): update stereoscope to 2ce1e520983b1c21d5150d7fae2b39e8e5ab9063 (#3405 ) Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: kzantow <3009477+kzantow@users.noreply.github.com>	2024-11-01 11:43:39 -04:00
Artemii	6a1e3f32fe	Issue #3143 – fixed format conversion docs link (#3407 ) * chore: fixed format conversion docs link (#3143) Signed-off-by: Artemii Fedotov <artemii.fedotov@tutamail.com> * changed link to wiki docs Signed-off-by: Artemii Fedotov <artemii.fedotov@tutamail.com> --------- Signed-off-by: Artemii Fedotov <artemii.fedotov@tutamail.com>	2024-11-01 11:43:00 -04:00
Joel Rudsberg	fcf1350a0e	feat: support dependencies and purl for Native Image SBOMs (#3399 ) Signed-off-by: Joel Rudsberg <joel.rudsberg@oracle.com>	2024-10-31 12:12:54 -04:00
anchore-actions-token-generator[bot]andkzantow	9302e20d62	chore(deps): update stereoscope to 9c92fe30492ffeba14ed2e23ad1fd923341dda4f (#3398 ) Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: kzantow <3009477+kzantow@users.noreply.github.com>	2024-10-31 10:22:14 -04:00
Nathan VossandKeith Zantow	a55b71d4ef	feat: exclude devDependencies from package-lock.json parsing (#3371 ) Signed-off-by: Nathan Voss <njvoss299@gmail.com> Signed-off-by: Keith Zantow <kzantow@gmail.com> Co-authored-by: Keith Zantow <kzantow@gmail.com>	2024-10-30 12:02:27 -04:00
dependabot[bot]	df3998b4f1	chore(deps): bump github.com/adrg/xdg from 0.5.1 to 0.5.2 (#3394 )	2024-10-29 16:32:14 +00:00
dependabot[bot]	9dc9be645a	chore(deps): bump anchore/sbom-action from 0.17.5 to 0.17.6 (#3393 ) Bumps [anchore/sbom-action](https://github.com/anchore/sbom-action) from 0.17.5 to 0.17.6. - [Release notes](https://github.com/anchore/sbom-action/releases) - [Changelog](https://github.com/anchore/sbom-action/blob/main/RELEASE.md) - [Commits](https://github.com/anchore/sbom-action/compare/1ca97d9028b51809cf6d3c934c3e160716e1b605...251a468eed47e5082b105c3ba6ee500c0e65a764) --- updated-dependencies: - dependency-name: anchore/sbom-action dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2024-10-29 10:07:28 -04:00
Keith Zantow	798c18a698	fix: stack overflow in spyingIoReadCloser (#3392 ) Signed-off-by: Keith Zantow <kzantow@gmail.com>	2024-10-29 08:23:57 -04:00
Keith Zantow	1118ac4ace	fix: bad pom files may cause infinite loop (#3391 ) Signed-off-by: Keith Zantow <kzantow@gmail.com>	2024-10-28 18:09:04 -04:00