chore(deps): update anchore dependencies (#3727 )

Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: wagoodman <590471+wagoodman@users.noreply.github.com>
chore(deps): update CPE dictionary index (#3735 )
2026-10-30 05:52:25 +01:00 · 2025-03-17 15:59:13 +00:00 · 2025-03-17 10:22:53 -04:00 · 2025-03-17 10:22:21 -04:00 · 2025-03-17 10:22:10 -04:00 · 2025-03-17 10:22:02 -04:00
58 changed files with 1541 additions and 414 deletions
@@ -2,7 +2,7 @@ tools:
  # we want to use a pinned version of binny to manage the toolchain (so binny manages itself!)
  - name: binny
    version:
-      want: v0.8.0
+      want: v0.9.0
    method: github-release
    with:
      repo: anchore/binny
@@ -26,7 +26,7 @@ tools:
  # used for linting
  - name: golangci-lint
    version:
-      want: v1.64.5
+      want: v1.64.7
    method: github-release
    with:
      repo: golangci/golangci-lint
@@ -34,7 +34,7 @@ tools:
  # used for showing the changelog at release
  - name: glow
    version:
-      want: v2.0.0
+      want: v2.1.0
    method: github-release
    with:
      repo: charmbracelet/glow
@@ -58,7 +58,7 @@ tools:
  # used to release all artifacts
  - name: goreleaser
    version:
-      want: v2.7.0
+      want: v2.8.1
    method: github-release
    with:
      repo: goreleaser/goreleaser
@@ -103,7 +103,7 @@ tools:
  # used for running all local and CI tasks
  - name: task
    version:
-      want: v3.41.0
+      want: v3.42.1
    method: github-release
    with:
      repo: go-task/task
@@ -111,7 +111,7 @@ tools:
  # used for triggering a release
  - name: gh
    version:
-      want: v2.67.0
+      want: v2.68.1
    method: github-release
    with:
      repo: cli/cli
@@ -37,7 +37,7 @@ runs:
    - name: Restore tool cache
      if: inputs.tools == 'true'
      id: tool-cache
-      uses: actions/cache@0c907a75c2c80ebcb7f088228285e798b750cf8f # v4.2.1
+      uses: actions/cache@d4323d4df104b026a6aa633fdb11d772146be0bf # v4.2.2
      with:
        path: ${{ github.workspace }}/.tool
        key: ${{ inputs.cache-key-prefix }}-${{ runner.os }}-tool-${{ hashFiles('.binny.yaml') }}
@@ -60,7 +60,7 @@ runs:

    - name: Restore ORAS cache from github actions
      if: inputs.download-test-fixture-cache == 'true'
-      uses: actions/cache@0c907a75c2c80ebcb7f088228285e798b750cf8f # v4.2.1
+      uses: actions/cache@d4323d4df104b026a6aa633fdb11d772146be0bf # v4.2.2
      with:
        path: ${{ github.workspace }}/.tmp/oras-cache
        key: ${{ inputs.cache-key-prefix }}-oras-cache
@@ -23,7 +23,7 @@ jobs:
        uses: ./.github/actions/bootstrap

      - name: Restore base benchmark result
-        uses: actions/cache@0c907a75c2c80ebcb7f088228285e798b750cf8f #v4.2.1
+        uses: actions/cache@d4323d4df104b026a6aa633fdb11d772146be0bf #v4.2.2
        with:
          path: test/results/benchmark-main.txt
          # use base sha for PR or new commit hash for main push in benchmark result key
@@ -39,7 +39,7 @@ jobs:
          OUTPUT="${OUTPUT//$'\r'/'%0D'}" # URL encode all '\r' characters
          echo "result=$OUTPUT" >> $GITHUB_OUTPUT

-      - uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 # v4.6.0
+      - uses: actions/upload-artifact@4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1 # v4.6.1
        with:
          name: benchmark-test-results
          path: test/results/**/*
@@ -21,7 +21,7 @@ jobs:
  analyze:
    name: Analyze
    runs-on: ubuntu-22.04-4core-16gb
-
+    if: github.repository == 'anchore/syft' # only run for main repo
    permissions:
      security-events: write

@@ -45,7 +45,7 @@ jobs:

    # Initializes the CodeQL tools for scanning.
    - name: Initialize CodeQL
-      uses: github/codeql-action/init@9e8d0789d4a0fa9ceb6b1738f7e269594bdd67f0 #v3.28.9
+      uses: github/codeql-action/init@6bb031afdd8eb862ea3fc1848194185e076637e5 #v3.28.11
      with:
        languages: ${{ matrix.language }}
        # If you wish to specify custom queries, you can do so here or in a config file.
@@ -56,7 +56,7 @@ jobs:
    # Autobuild attempts to build any compiled languages  (C/C++, C#, or Java).
    # If this step fails, then you should remove it and run the build manually (see below)
    - name: Autobuild
-      uses: github/codeql-action/autobuild@9e8d0789d4a0fa9ceb6b1738f7e269594bdd67f0 #v3.28.9
+      uses: github/codeql-action/autobuild@6bb031afdd8eb862ea3fc1848194185e076637e5 #v3.28.11

    # ℹ️ Command-line programs to run using the OS shell.
    # 📚 https://git.io/JvXDl
@@ -70,4 +70,4 @@ jobs:
    #   make release

    - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@9e8d0789d4a0fa9ceb6b1738f7e269594bdd67f0 #v3.28.9
+      uses: github/codeql-action/analyze@6bb031afdd8eb862ea3fc1848194185e076637e5 #v3.28.11
@@ -113,13 +113,13 @@ jobs:
        uses: ./.github/actions/bootstrap

      - name: Login to Docker Hub
-        uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567  #v3.3.0
+        uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772  #v3.4.0
        with:
          username: ${{ secrets.ANCHOREOSSWRITE_DH_USERNAME }}
          password: ${{ secrets.ANCHOREOSSWRITE_DH_PAT }}

      - name: Login to GitHub Container Registry
-        uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567  #v3.3.0
+        uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772  #v3.4.0
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
@@ -15,6 +15,7 @@ jobs:
    name: "Publish test fixture image cache"
    # we use this runner to get enough storage space for docker images and fixture cache
    runs-on: ubuntu-22.04-4core-16gb
+    if: github.repository == 'anchore/syft' # only run for main repo
    permissions:
      packages: write
    steps:
@@ -35,7 +35,7 @@ jobs:
          app_id: ${{ secrets.TOKEN_APP_ID }}
          private_key: ${{ secrets.TOKEN_APP_PRIVATE_KEY }}

-      - uses: peter-evans/create-pull-request@67ccf781d68cd99b580ae25a5c18a1cc84ffff1f #v7.0.6
+      - uses: peter-evans/create-pull-request@271a8d0340265f705b14b6d32b9829c1cb33d45e #v7.0.8
        with:
          signoff: true
          delete-branch: true
@@ -49,7 +49,7 @@ jobs:
          app_id: ${{ secrets.TOKEN_APP_ID }}
          private_key: ${{ secrets.TOKEN_APP_PRIVATE_KEY }}

-      - uses: peter-evans/create-pull-request@67ccf781d68cd99b580ae25a5c18a1cc84ffff1f #v7.0.6
+      - uses: peter-evans/create-pull-request@271a8d0340265f705b14b6d32b9829c1cb33d45e #v7.0.8
        with:
          signoff: true
          delete-branch: true
@@ -33,7 +33,7 @@ jobs:
          app_id: ${{ secrets.TOKEN_APP_ID }}
          private_key: ${{ secrets.TOKEN_APP_PRIVATE_KEY }}

-      - uses: peter-evans/create-pull-request@67ccf781d68cd99b580ae25a5c18a1cc84ffff1f #v7.0.6
+      - uses: peter-evans/create-pull-request@271a8d0340265f705b14b6d32b9829c1cb33d45e #v7.0.8
        with:
          signoff: true
          delete-branch: true
@@ -78,7 +78,7 @@ jobs:
      # why not use actions/upload-artifact? It is very slow (3 minutes to upload ~600MB of data, vs 10 seconds with this approach).
      # see https://github.com/actions/upload-artifact/issues/199 for more info
      - name: Upload snapshot artifacts
-        uses: actions/cache/save@0c907a75c2c80ebcb7f088228285e798b750cf8f #v4.2.1
+        uses: actions/cache/save@d4323d4df104b026a6aa633fdb11d772146be0bf #v4.2.2
        with:
          # we need to preserve the snapshot data itself as well as the task data that confirms if the
          # snapshot build is stale or not. Otherwise the downstream jobs will attempt to rebuild the snapshot
@@ -89,6 +89,61 @@ jobs:
          key: snapshot-build-${{ github.run_id }}


+  Upload-Snapshot-Artifacts:
+    # Note: changing this job name requires making the same update in the .github/workflows/release.yaml pipeline
+    name: "Upload snapshot artifacts"
+    needs: [Build-Snapshot-Artifacts]
+    runs-on: ubuntu-24.04
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 #v4.2.2
+
+      - name: Bootstrap environment
+        uses: ./.github/actions/bootstrap
+        with:
+          download-test-fixture-cache: true
+
+      - name: Download snapshot build
+        id: snapshot-cache
+        uses: actions/cache/restore@d4323d4df104b026a6aa633fdb11d772146be0bf #v4.2.2
+        with:
+          path: |
+            snapshot
+            .task
+          fail-on-cache-miss: true
+          key: snapshot-build-${{ github.run_id }}
+
+      # workaround for https://github.com/actions/cache/issues/1265
+      - name: (cache-miss) Snapshot build missing
+        if: steps.snapshot-cache.outputs.cache-hit != 'true'
+        run: echo "unable to download snapshots from previous job" && false
+
+      - run: npm install @actions/artifact@2.2.2
+
+      - uses: actions/github-script@v7
+        with:
+          script: |
+            const { readdirSync } = require('fs')
+            const { DefaultArtifactClient } = require('@actions/artifact')
+            const artifact = new DefaultArtifactClient()
+            const ls = d => readdirSync(d, { withFileTypes: true })
+            const baseDir = "./snapshot"
+            const dirs = ls(baseDir).filter(f => f.isDirectory()).map(f => f.name)
+            const uploads = []
+            for (const dir of dirs) {
+              // uploadArtifact returns Promise<{id, size}>
+              uploads.push(artifact.uploadArtifact(
+                // name of the archive:
+                `${dir}`,
+                // array of all files to include:
+                ls(`${baseDir}/${dir}`).map(f => `${baseDir}/${dir}/${f.name}`),
+                // base directory to trim from entries:
+                `${baseDir}/${dir}`,
+                { retentionDays: 30 }
+              ))
+            }
+            // wait for all uploads to finish
+            Promise.all(uploads)
+
  Acceptance-Linux:
    # Note: changing this job name requires making the same update in the .github/workflows/release.yaml pipeline
    name: "Acceptance tests (Linux)"
@@ -104,7 +159,7 @@ jobs:

      - name: Download snapshot build
        id: snapshot-cache
-        uses: actions/cache/restore@0c907a75c2c80ebcb7f088228285e798b750cf8f #v4.2.1
+        uses: actions/cache/restore@d4323d4df104b026a6aa633fdb11d772146be0bf #v4.2.2
        with:
          path: |
            snapshot
@@ -139,7 +194,7 @@ jobs:
    runs-on: macos-latest
    steps:
      - name: Install Cosign
-        uses: sigstore/cosign-installer@v3.8.0
+        uses: sigstore/cosign-installer@v3.8.1

      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 #v4.2.2

@@ -152,7 +207,7 @@ jobs:

      - name: Download snapshot build
        id: snapshot-cache
-        uses: actions/cache/restore@0c907a75c2c80ebcb7f088228285e798b750cf8f #v4.2.1
+        uses: actions/cache/restore@d4323d4df104b026a6aa633fdb11d772146be0bf #v4.2.2
        with:
          path: |
            snapshot
@@ -187,7 +242,7 @@ jobs:

      - name: Download snapshot build
        id: snapshot-cache
-        uses: actions/cache/restore@0c907a75c2c80ebcb7f088228285e798b750cf8f #v4.2.1
+        uses: actions/cache/restore@d4323d4df104b026a6aa633fdb11d772146be0bf #v4.2.2
        with:
          path: |
            snapshot
@@ -214,6 +269,7 @@ jobs:
      - Acceptance-Linux
      - Acceptance-Mac
      - Cli-Linux
+      - Upload-Snapshot-Artifacts
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 #v4.2.2

@@ -61,6 +61,7 @@ linters-settings:
  gosec:
    excludes:
      - G115
+
 run:
  timeout: 10m
  tests: false
@@ -581,7 +581,7 @@ tasks:
      - "{{ .NEXT_VERSION }}"
    cmds:
      - "{{ .TOOL_DIR }}/chronicle -vv -n --version-file {{ .NEXT_VERSION }} > {{ .CHANGELOG }}"
-      - "{{ .TOOL_DIR }}/glow {{ .CHANGELOG }}"
+      - "{{ .TOOL_DIR }}/glow -w 0 {{ .CHANGELOG }}"


  ## Release targets #################################
@@ -1,6 +1,6 @@

 [TestHandler_handleAttestationStarted/attesting_in_progress/task_line - 1]
- ⠋ Creating a thing                                                                running a thing
+ ⠋ Creating a thing                                                               running a thing 
 ---

 [TestHandler_handleAttestationStarted/attesting_in_progress/log - 1]
@@ -11,7 +11,7 @@
 ---

 [TestHandler_handleAttestationStarted/attesting_complete/task_line - 1]
- ✔ Created a thing                                                                 running a thing
+ ✔ Created a thing                                                                running a thing 
 ---

 [TestHandler_handleAttestationStarted/attesting_complete/log - 1]
@@ -1,8 +1,8 @@

 [TestHandler_handleFetchImage/fetch_image_in_progress - 1]
- ⠋ Loading image                   ━━━━━━━━━━━━━━━━━━━━  [current]                       the-image
+ ⠋ Loading image                   ━━━━━━━━━━━━━━━━━━━━  [current]                      the-image 
 ---

 [TestHandler_handleFetchImage/fetch_image_complete - 1]
- ✔ Loaded image                                                                          the-image
+ ✔ Loaded image                                                                         the-image 
 ---
@@ -1,8 +1,8 @@

 [TestHandler_handleFileIndexingStarted/cataloging_in_progress - 1]
- ⠋ Indexing file system            ━━━━━━━━━━━━━━━━━━━━  [current]                      /some/path
+ ⠋ Indexing file system            ━━━━━━━━━━━━━━━━━━━━  [current]                     /some/path 
 ---

 [TestHandler_handleFileIndexingStarted/cataloging_complete - 1]
- ✔ Indexed file system                                                                  /some/path
+ ✔ Indexed file system                                                                 /some/path 
 ---
@@ -1,8 +1,8 @@

 [TestHandler_handleReadImage/read_image_in_progress - 1]
- ⠋ Parsing image                   ━━━━━━━━━━━━━━━━━━━━                                         id
+ ⠋ Parsing image                   ━━━━━━━━━━━━━━━━━━━━                                        id 
 ---

 [TestHandler_handleReadImage/read_image_complete - 1]
- ✔ Parsed image                                                                                 id
+ ✔ Parsed image                                                                                id 
 ---
@@ -1,13 +1,17 @@
 module github.com/anchore/syft

-go 1.24.0
+go 1.24.1

 require (
+	github.com/BurntSushi/toml v1.4.0
 	github.com/CycloneDX/cyclonedx-go v0.9.2
 	github.com/Masterminds/semver v1.5.0
 	github.com/Masterminds/sprig/v3 v3.3.0
+	github.com/OneOfOne/xxhash v1.2.8
 	github.com/acarl005/stripansi v0.0.0-20180116102854-5a71ef0e047d
 	github.com/acobaugh/osrelease v0.1.0
+	github.com/adrg/xdg v0.5.3
+	github.com/anchore/archiver/v3 v3.5.3-0.20241210171143-5b1d8d1c7c51
 	github.com/anchore/bubbly v0.0.0-20231115134915-def0aba654a9
 	github.com/anchore/clio v0.0.0-20241115144204-29e89f9fa837
 	github.com/anchore/fangs v0.0.0-20241014201141-b6e4b3469f10
@@ -17,40 +21,42 @@ require (
 	github.com/anchore/go-testutils v0.0.0-20200925183923-d5f45b0d3c04
 	github.com/anchore/go-version v1.2.2-0.20200701162849-18adb9c92b9b
 	github.com/anchore/packageurl-go v0.1.1-0.20250220190351-d62adb6e1115
-	github.com/anchore/stereoscope v0.0.13
+	github.com/anchore/stereoscope v0.1.0
 	github.com/anmitsu/go-shlex v0.0.0-20200514113438-38f4b401e2be
 	// we are hinting brotli to latest due to warning when installing archiver v3:
 	// go: warning: github.com/andybalholm/brotli@v1.0.1: retracted by module author: occasional panics and data corruption
 	github.com/aquasecurity/go-pep440-version v0.0.1
+	github.com/bitnami/go-version v0.0.0-20250131085805-b1f57a8634ef
 	github.com/bmatcuk/doublestar/v4 v4.8.1
 	github.com/charmbracelet/bubbles v0.20.0
-	github.com/charmbracelet/bubbletea v1.2.4
-	github.com/charmbracelet/lipgloss v1.0.0
+	github.com/charmbracelet/bubbletea v1.3.4
+	github.com/charmbracelet/lipgloss v1.1.0
 	github.com/dave/jennifer v1.7.1
 	github.com/deitch/magic v0.0.0-20230404182410-1ff89d7342da
 	github.com/distribution/reference v0.6.0
-	github.com/docker/docker v28.0.0+incompatible
+	github.com/docker/docker v28.0.1+incompatible
 	github.com/dustin/go-humanize v1.0.1
 	github.com/elliotchance/phpserialize v1.4.0
 	github.com/facebookincubator/nvdtools v0.1.5
 	github.com/github/go-spdx/v2 v2.3.2
 	github.com/gkampitakis/go-snaps v0.5.11
 	github.com/go-git/go-billy/v5 v5.6.2
-	github.com/go-git/go-git/v5 v5.13.2
+	github.com/go-git/go-git/v5 v5.14.0
 	github.com/go-test/deep v1.1.1
-	github.com/google/go-cmp v0.6.0
+	github.com/google/go-cmp v0.7.0
 	github.com/google/go-containerregistry v0.20.3
 	github.com/google/licensecheck v0.3.1
 	github.com/google/uuid v1.6.0
 	github.com/gookit/color v1.5.4
 	github.com/hashicorp/go-multierror v1.1.1
+	github.com/hashicorp/hcl/v2 v2.23.0
 	github.com/iancoleman/strcase v0.3.0
 	github.com/invopop/jsonschema v0.7.0
-	github.com/jedib0t/go-pretty/v6 v6.6.6
+	github.com/jedib0t/go-pretty/v6 v6.6.7
 	github.com/jinzhu/copier v0.4.0
 	github.com/kastenhq/goversion v0.0.0-20230811215019-93b2f8823953
 	github.com/knqyf263/go-rpmdb v0.1.1
-	github.com/microsoft/go-rustaudit v0.0.0-20220730194248-4b17361d90a5
+	github.com/magiconair/properties v1.8.9
 	github.com/mitchellh/go-homedir v1.1.0
 	github.com/mitchellh/hashstructure/v2 v2.0.2
 	github.com/mitchellh/mapstructure v1.5.0
@@ -59,6 +65,7 @@ require (
 	github.com/opencontainers/go-digest v1.0.0
 	github.com/pelletier/go-toml v1.9.5
 	github.com/quasilyte/go-ruleguard/dsl v0.3.22
+	github.com/rust-secure-code/go-rustaudit v0.0.0-20250226111315-e20ec32e963c
 	github.com/saferwall/pe v1.5.6
 	github.com/saintfish/chardet v0.0.0-20230101081208-5e3ef4b5456d
 	github.com/sanity-io/litter v1.5.8
@@ -66,8 +73,9 @@ require (
 	// pinned to pull in 386 arch fix: https://github.com/scylladb/go-set/commit/cc7b2070d91ebf40d233207b633e28f5bd8f03a5
 	github.com/scylladb/go-set v1.0.3-0.20200225121959-cc7b2070d91e
 	github.com/sergi/go-diff v1.3.2-0.20230802210424-5b0b94c5c0d3
+	github.com/spdx/gordf v0.0.0-20201111095634-7098f93598fb
 	github.com/spdx/tools-golang v0.5.5
-	github.com/spf13/afero v1.12.0
+	github.com/spf13/afero v1.14.0
 	github.com/spf13/cobra v1.9.1
 	github.com/stretchr/testify v1.10.0
 	github.com/vbatts/go-mtree v0.5.4
@@ -77,23 +85,11 @@ require (
 	github.com/xeipuuv/gojsonschema v1.2.0
 	github.com/zyedidia/generic v1.2.2-0.20230320175451-4410d2372cb1
 	go.uber.org/goleak v1.3.0
-	golang.org/x/mod v0.23.0
-	golang.org/x/net v0.35.0
-	gopkg.in/yaml.v3 v3.0.1
-	modernc.org/sqlite v1.35.0
-)
-
-require google.golang.org/genproto v0.0.0-20241118233622-e639e219e697 // indirect
-
-require (
-	github.com/BurntSushi/toml v1.4.0
-	github.com/OneOfOne/xxhash v1.2.8
-	github.com/adrg/xdg v0.5.3
-	github.com/anchore/archiver/v3 v3.5.3-0.20241210171143-5b1d8d1c7c51
-	github.com/bitnami/go-version v0.0.0-20250131085805-b1f57a8634ef
-	github.com/hashicorp/hcl/v2 v2.23.0
-	github.com/magiconair/properties v1.8.9
 	golang.org/x/exp v0.0.0-20240719175910-8a7402abbf56
+	golang.org/x/mod v0.24.0
+	golang.org/x/net v0.37.0
+	gopkg.in/yaml.v3 v3.0.1
+	modernc.org/sqlite v1.36.1
 )

 require (
@@ -116,23 +112,23 @@ require (
 	github.com/aymanbagabas/go-osc52/v2 v2.0.1 // indirect
 	github.com/becheran/wildmatch-go v1.0.0 // indirect
 	github.com/charmbracelet/harmonica v0.2.0 // indirect
-	github.com/charmbracelet/x/ansi v0.4.5 // indirect
+	github.com/charmbracelet/x/ansi v0.8.0 // indirect
 	github.com/charmbracelet/x/term v0.2.1 // indirect
-	github.com/cloudflare/circl v1.3.8 // indirect
+	github.com/cloudflare/circl v1.6.0 // indirect
 	github.com/containerd/cgroups v1.1.0 // indirect
-	github.com/containerd/containerd v1.7.24 // indirect
-	github.com/containerd/containerd/api v1.7.19 // indirect
-	github.com/containerd/continuity v0.4.2 // indirect
+	github.com/containerd/containerd v1.7.26 // indirect
+	github.com/containerd/containerd/api v1.8.0 // indirect
+	github.com/containerd/continuity v0.4.4 // indirect
 	github.com/containerd/errdefs v0.3.0 // indirect
 	github.com/containerd/fifo v1.1.0 // indirect
 	github.com/containerd/log v0.1.0 // indirect
 	github.com/containerd/platforms v0.2.1 // indirect
 	github.com/containerd/stargz-snapshotter/estargz v0.16.3 // indirect
-	github.com/containerd/ttrpc v1.2.5 // indirect
+	github.com/containerd/ttrpc v1.2.7 // indirect
 	github.com/containerd/typeurl/v2 v2.1.1 // indirect
-	github.com/cyphar/filepath-securejoin v0.3.6 // indirect
+	github.com/cyphar/filepath-securejoin v0.4.1 // indirect
 	github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
-	github.com/docker/cli v27.5.0+incompatible // indirect
+	github.com/docker/cli v28.0.1+incompatible // indirect
 	github.com/docker/distribution v2.8.3+incompatible // indirect
 	github.com/docker/docker-credential-helpers v0.8.2 // indirect
 	github.com/docker/go-connections v0.5.0 // indirect
@@ -154,7 +150,7 @@ require (
 	github.com/go-restruct/restruct v1.2.0-alpha // indirect
 	github.com/goccy/go-yaml v1.15.13 // indirect
 	github.com/gogo/protobuf v1.3.2 // indirect
-	github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da // indirect
+	github.com/golang/groupcache v0.0.0-20241129210726-2c02b8208cf8 // indirect
 	github.com/golang/snappy v0.0.4 // indirect
 	github.com/google/pprof v0.0.0-20240409012703-83162a5b38cd // indirect
 	github.com/hashicorp/errwrap v1.1.0 // indirect
@@ -164,7 +160,7 @@ require (
 	github.com/inconshreveable/mousetrap v1.1.0 // indirect
 	github.com/jbenet/go-context v0.0.0-20150711004518-d14ea06fba99 // indirect
 	github.com/kevinburke/ssh_config v1.2.0 // indirect
-	github.com/klauspost/compress v1.17.11 // indirect
+	github.com/klauspost/compress v1.18.0 // indirect
 	github.com/klauspost/pgzip v1.2.6 // indirect
 	github.com/kr/pretty v0.3.1 // indirect
 	github.com/kr/text v0.2.0 // indirect
@@ -187,36 +183,36 @@ require (
 	github.com/moby/sys/userns v0.1.0 // indirect
 	github.com/muesli/ansi v0.0.0-20230316100256-276c6243b2f6 // indirect
 	github.com/muesli/cancelreader v0.2.2 // indirect
-	github.com/muesli/termenv v0.15.2 // indirect
+	github.com/muesli/termenv v0.16.0 // indirect
 	github.com/ncruces/go-strftime v0.1.9 // indirect
 	github.com/nwaples/rardecode v1.1.3 // indirect
-	github.com/opencontainers/image-spec v1.1.0 // indirect
+	github.com/opencontainers/image-spec v1.1.1 // indirect
 	github.com/opencontainers/runtime-spec v1.1.0 // indirect
 	github.com/opencontainers/selinux v1.11.0 // indirect
 	github.com/pborman/indent v1.2.1 // indirect
 	github.com/pelletier/go-toml/v2 v2.2.2 // indirect
-	github.com/pierrec/lz4/v4 v4.1.21 // indirect
+	github.com/pierrec/lz4/v4 v4.1.22 // indirect
 	github.com/pjbgf/sha1cd v0.3.2 // indirect
 	github.com/pkg/errors v0.9.1 // indirect
 	github.com/pkg/profile v1.7.0 // indirect
 	github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
 	github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec // indirect
 	github.com/rivo/uniseg v0.4.7 // indirect
-	github.com/rogpeppe/go-internal v1.13.1 // indirect
+	github.com/rogpeppe/go-internal v1.14.1 // indirect
 	github.com/sagikazarmark/locafero v0.4.0 // indirect
 	github.com/sagikazarmark/slog-shim v0.1.0 // indirect
 	github.com/sahilm/fuzzy v0.1.1 // indirect
 	github.com/secDre4mer/pkcs7 v0.0.0-20240322103146-665324a4461d // indirect
 	github.com/shopspring/decimal v1.4.0 // indirect
 	github.com/sirupsen/logrus v1.9.3 // indirect
-	github.com/skeema/knownhosts v1.3.0 // indirect
+	github.com/skeema/knownhosts v1.3.1 // indirect
 	github.com/sourcegraph/conc v0.3.0 // indirect
 	github.com/spf13/cast v1.7.0 // indirect
 	github.com/spf13/pflag v1.0.6 // indirect
 	github.com/spf13/viper v1.19.0 // indirect
 	github.com/subosito/gotenv v1.6.0 // indirect
 	github.com/sylabs/sif/v2 v2.20.2 // indirect
-	github.com/sylabs/squashfs v1.0.4 // indirect
+	github.com/sylabs/squashfs v1.0.5 // indirect
 	github.com/therootcompany/xz v1.0.1 // indirect
 	github.com/tidwall/gjson v1.18.0 // indirect
 	github.com/tidwall/match v1.1.1 // indirect
@@ -238,13 +234,14 @@ require (
 	go.opentelemetry.io/otel/trace v1.33.0 // indirect
 	go.uber.org/atomic v1.9.0 // indirect
 	go.uber.org/multierr v1.9.0 // indirect
-	golang.org/x/crypto v0.33.0 // indirect
-	golang.org/x/sync v0.11.0 // indirect
-	golang.org/x/sys v0.30.0 // indirect
-	golang.org/x/term v0.29.0 // indirect
-	golang.org/x/text v0.22.0 // indirect
+	golang.org/x/crypto v0.36.0 // indirect
+	golang.org/x/sync v0.12.0 // indirect
+	golang.org/x/sys v0.31.0 // indirect
+	golang.org/x/term v0.30.0 // indirect
+	golang.org/x/text v0.23.0 // indirect
 	golang.org/x/tools v0.29.0 // indirect
 	golang.org/x/xerrors v0.0.0-20231012003039-104605ab7028 // indirect
+	google.golang.org/genproto v0.0.0-20241118233622-e639e219e697 // indirect
 	google.golang.org/genproto/googleapis/rpc v0.0.0-20241223144023-3abc09e42ca8 // indirect
 	google.golang.org/grpc v1.67.3 // indirect
 	google.golang.org/protobuf v1.36.3 // indirect
@@ -255,6 +252,11 @@ require (
 	modernc.org/memory v1.8.2 // indirect
 )

+require (
+	github.com/charmbracelet/colorprofile v0.2.3-0.20250311203215-f60798e515dc // indirect
+	github.com/charmbracelet/x/cellbuf v0.0.13-0.20250311204145-2c3ea96c31dd // indirect
+)
+
 retract (
 	v0.53.2
 	v0.53.1 // Published accidentally with incorrect license in depdencies
@@ -116,8 +116,8 @@ github.com/anchore/go-version v1.2.2-0.20200701162849-18adb9c92b9b h1:e1bmaoJfZV
 github.com/anchore/go-version v1.2.2-0.20200701162849-18adb9c92b9b/go.mod h1:Bkc+JYWjMCF8OyZ340IMSIi2Ebf3uwByOk6ho4wne1E=
 github.com/anchore/packageurl-go v0.1.1-0.20250220190351-d62adb6e1115 h1:ZyRCmiEjnoGJZ1+Ah0ZZ/mKKqNhGcUZBl0s7PTTDzvY=
 github.com/anchore/packageurl-go v0.1.1-0.20250220190351-d62adb6e1115/go.mod h1:KoYIv7tdP5+CC9VGkeZV4/vGCKsY55VvoG+5dadg4YI=
-github.com/anchore/stereoscope v0.0.13 h1:9Ivkh7k+vOeG3JHrt44jOg/8UdZrCvMsSjLQ7trHBig=
-github.com/anchore/stereoscope v0.0.13/go.mod h1:QfhhFc2pezp5aX/dVJ5qnBFpBUv5+KUTphwaQLxMUig=
+github.com/anchore/stereoscope v0.1.0 h1:waF2C5b/XRAyShKup3VoJz8Pdv7AiDxUbABTizmJdJ0=
+github.com/anchore/stereoscope v0.1.0/go.mod h1:3vasimie0IJOXvMbMpjwvwIHBDA1+192QZDWNhJRqFQ=
 github.com/andreyvit/diff v0.0.0-20170406064948-c7f18ee00883/go.mod h1:rCTlJbsFo29Kk6CurOXKm700vrz8f0KW0JNfpkRJY/8=
 github.com/andybalholm/brotli v1.1.1 h1:PR2pgnyFznKEugtsUo0xLdDop5SKXd5Qf5ysW+7XdTA=
 github.com/andybalholm/brotli v1.1.1/go.mod h1:05ib4cKhjx3OQYUY22hTVd34Bc8upXjOLL2rKwwZBoA=
@@ -164,14 +164,18 @@ github.com/cespare/xxhash/v2 v2.1.1/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XL
 github.com/cespare/xxhash/v2 v2.1.2/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
 github.com/charmbracelet/bubbles v0.20.0 h1:jSZu6qD8cRQ6k9OMfR1WlM+ruM8fkPWkHvQWD9LIutE=
 github.com/charmbracelet/bubbles v0.20.0/go.mod h1:39slydyswPy+uVOHZ5x/GjwVAFkCsV8IIVy+4MhzwwU=
-github.com/charmbracelet/bubbletea v1.2.4 h1:KN8aCViA0eps9SCOThb2/XPIlea3ANJLUkv3KnQRNCE=
-github.com/charmbracelet/bubbletea v1.2.4/go.mod h1:Qr6fVQw+wX7JkWWkVyXYk/ZUQ92a6XNekLXa3rR18MM=
+github.com/charmbracelet/bubbletea v1.3.4 h1:kCg7B+jSCFPLYRA52SDZjr51kG/fMUEoPoZrkaDHyoI=
+github.com/charmbracelet/bubbletea v1.3.4/go.mod h1:dtcUCyCGEX3g9tosuYiut3MXgY/Jsv9nKVdibKKRRXo=
+github.com/charmbracelet/colorprofile v0.2.3-0.20250311203215-f60798e515dc h1:4pZI35227imm7yK2bGPcfpFEmuY1gc2YSTShr4iJBfs=
+github.com/charmbracelet/colorprofile v0.2.3-0.20250311203215-f60798e515dc/go.mod h1:X4/0JoqgTIPSFcRA/P6INZzIuyqdFY5rm8tb41s9okk=
 github.com/charmbracelet/harmonica v0.2.0 h1:8NxJWRWg/bzKqqEaaeFNipOu77YR5t8aSwG4pgaUBiQ=
 github.com/charmbracelet/harmonica v0.2.0/go.mod h1:KSri/1RMQOZLbw7AHqgcBycp8pgJnQMYYT8QZRqZ1Ao=
-github.com/charmbracelet/lipgloss v1.0.0 h1:O7VkGDvqEdGi93X+DeqsQ7PKHDgtQfF8j8/O2qFMQNg=
-github.com/charmbracelet/lipgloss v1.0.0/go.mod h1:U5fy9Z+C38obMs+T+tJqst9VGzlOYGj4ri9reL3qUlo=
-github.com/charmbracelet/x/ansi v0.4.5 h1:LqK4vwBNaXw2AyGIICa5/29Sbdq58GbGdFngSexTdRM=
-github.com/charmbracelet/x/ansi v0.4.5/go.mod h1:dk73KoMTT5AX5BsX0KrqhsTqAnhZZoCBjs7dGWp4Ktw=
+github.com/charmbracelet/lipgloss v1.1.0 h1:vYXsiLHVkK7fp74RkV7b2kq9+zDLoEU4MZoFqR/noCY=
+github.com/charmbracelet/lipgloss v1.1.0/go.mod h1:/6Q8FR2o+kj8rz4Dq0zQc3vYf7X+B0binUUBwA0aL30=
+github.com/charmbracelet/x/ansi v0.8.0 h1:9GTq3xq9caJW8ZrBTe0LIe2fvfLR/bYXKTx2llXn7xE=
+github.com/charmbracelet/x/ansi v0.8.0/go.mod h1:wdYl/ONOLHLIVmQaxbIYEC/cRKOQyjTkowiI4blgS9Q=
+github.com/charmbracelet/x/cellbuf v0.0.13-0.20250311204145-2c3ea96c31dd h1:vy0GVL4jeHEwG5YOXDmi86oYw2yuYUGqz6a8sLwg0X8=
+github.com/charmbracelet/x/cellbuf v0.0.13-0.20250311204145-2c3ea96c31dd/go.mod h1:xe0nKWGd3eJgtqZRaN9RjMtK7xUYchjzPr7q6kcvCCs=
 github.com/charmbracelet/x/term v0.2.1 h1:AQeHeLZ1OqSXhrAWpYUtZyX1T3zVxfpZuEQMIQaGIAQ=
 github.com/charmbracelet/x/term v0.2.1/go.mod h1:oQ4enTYFV7QN4m0i9mzHrViD7TQKvNEEkHUMCmsxdUg=
 github.com/chromedp/cdproto v0.0.0-20230802225258-3cf4e6d46a89/go.mod h1:GKljq0VrfU4D5yc+2qA6OVr8pmO/MBbPEWqWQ/oqGEs=
@@ -186,8 +190,8 @@ github.com/chzyer/test v1.0.0/go.mod h1:2JlltgoNkt4TW/z9V/IzDdFaMTM2JPIi26O1pF38
 github.com/circonus-labs/circonus-gometrics v2.3.1+incompatible/go.mod h1:nmEj6Dob7S7YxXgwXpfOuvO54S+tGdZdw9fuRZt25Ag=
 github.com/circonus-labs/circonusllhist v0.1.3/go.mod h1:kMXHVDlOchFAehlya5ePtbp5jckzBHf4XRpQvBOLI+I=
 github.com/client9/misspell v0.3.4/go.mod h1:qj6jICC3Q7zFZvVWo7KLAzC3yx5G7kyvSDkc90ppPyw=
-github.com/cloudflare/circl v1.3.8 h1:j+V8jJt09PoeMFIu2uh5JUyEaIHTXVOHslFoLNAKqwI=
-github.com/cloudflare/circl v1.3.8/go.mod h1:PDRU+oXvdD7KCtgKxW95M5Z8BpSCJXQORiZFnBQS5QU=
+github.com/cloudflare/circl v1.6.0 h1:cr5JKic4HI+LkINy2lg3W2jF8sHCVTBncJr5gIIq7qk=
+github.com/cloudflare/circl v1.6.0/go.mod h1:uddAzsPgqdMAYatqJ0lsjX1oECcQLIlRpzZh3pJrofs=
 github.com/cncf/udpa/go v0.0.0-20191209042840-269d4d468f6f/go.mod h1:M8M6+tZqaGXZJjfX53e64911xZQV5JYwmTeXPW+k8Sc=
 github.com/cncf/udpa/go v0.0.0-20200629203442-efcf912fb354/go.mod h1:WmhPx2Nbnhtbo57+VJT5O0JRkEi1Wbu0z5j0R8u5Hbk=
 github.com/cncf/udpa/go v0.0.0-20201120205902-5459f2c99403/go.mod h1:WmhPx2Nbnhtbo57+VJT5O0JRkEi1Wbu0z5j0R8u5Hbk=
@@ -200,12 +204,12 @@ github.com/cncf/xds/go v0.0.0-20211011173535-cb28da3451f1/go.mod h1:eXthEFrGJvWH
 github.com/cncf/xds/go v0.0.0-20211130200136-a8f946100490/go.mod h1:eXthEFrGJvWHgFFCl3hGmgk+/aYT6PnTQLykKQRLhEs=
 github.com/containerd/cgroups v1.1.0 h1:v8rEWFl6EoqHB+swVNjVoCJE8o3jX7e8nqBGPLaDFBM=
 github.com/containerd/cgroups v1.1.0/go.mod h1:6ppBcbh/NOOUU+dMKrykgaBnK9lCIBxHqJDGwsa1mIw=
-github.com/containerd/containerd v1.7.24 h1:zxszGrGjrra1yYJW/6rhm9cJ1ZQ8rkKBR48brqsa7nA=
-github.com/containerd/containerd v1.7.24/go.mod h1:7QUzfURqZWCZV7RLNEn1XjUCQLEf0bkaK4GjUaZehxw=
-github.com/containerd/containerd/api v1.7.19 h1:VWbJL+8Ap4Ju2mx9c9qS1uFSB1OVYr5JJrW2yT5vFoA=
-github.com/containerd/containerd/api v1.7.19/go.mod h1:fwGavl3LNwAV5ilJ0sbrABL44AQxmNjDRcwheXDb6Ig=
-github.com/containerd/continuity v0.4.2 h1:v3y/4Yz5jwnvqPKJJ+7Wf93fyWoCB3F5EclWG023MDM=
-github.com/containerd/continuity v0.4.2/go.mod h1:F6PTNCKepoxEaXLQp3wDAjygEnImnZ/7o4JzpodfroQ=
+github.com/containerd/containerd v1.7.26 h1:3cs8K2RHlMQaPifLqgRyI4VBkoldNdEw62cb7qQga7k=
+github.com/containerd/containerd v1.7.26/go.mod h1:m4JU0E+h0ebbo9yXD7Hyt+sWnc8tChm7MudCjj4jRvQ=
+github.com/containerd/containerd/api v1.8.0 h1:hVTNJKR8fMc/2Tiw60ZRijntNMd1U+JVMyTRdsD2bS0=
+github.com/containerd/containerd/api v1.8.0/go.mod h1:dFv4lt6S20wTu/hMcP4350RL87qPWLVa/OHOwmmdnYc=
+github.com/containerd/continuity v0.4.4 h1:/fNVfTJ7wIl/YPMHjf+5H32uFhl63JucB34PlCpMKII=
+github.com/containerd/continuity v0.4.4/go.mod h1:/lNJvtJKUQStBzpVQ1+rasXO1LAWtUQssk28EZvJ3nE=
 github.com/containerd/errdefs v0.3.0 h1:FSZgGOeK4yuT/+DnF07/Olde/q4KBoMsaamhXxIMDp4=
 github.com/containerd/errdefs v0.3.0/go.mod h1:+YBYIdtsnF4Iw6nWZhJcqGSg/dwvV7tyJ/kCkyJ2k+M=
 github.com/containerd/fifo v1.1.0 h1:4I2mbh5stb1u6ycIABlBw9zgtlK8viPI9QkQNRQEEmY=
@@ -216,8 +220,8 @@ github.com/containerd/platforms v0.2.1 h1:zvwtM3rz2YHPQsF2CHYM8+KtB5dvhISiXh5ZpS
 github.com/containerd/platforms v0.2.1/go.mod h1:XHCb+2/hzowdiut9rkudds9bE5yJ7npe7dG/wG+uFPw=
 github.com/containerd/stargz-snapshotter/estargz v0.16.3 h1:7evrXtoh1mSbGj/pfRccTampEyKpjpOnS3CyiV1Ebr8=
 github.com/containerd/stargz-snapshotter/estargz v0.16.3/go.mod h1:uyr4BfYfOj3G9WBVE8cOlQmXAbPN9VEQpBBeJIuOipU=
-github.com/containerd/ttrpc v1.2.5 h1:IFckT1EFQoFBMG4c3sMdT8EP3/aKfumK1msY+Ze4oLU=
-github.com/containerd/ttrpc v1.2.5/go.mod h1:YCXHsb32f+Sq5/72xHubdiJRQY9inL4a4ZQrAbN1q9o=
+github.com/containerd/ttrpc v1.2.7 h1:qIrroQvuOL9HQ1X6KHe2ohc7p+HP/0VE6XPU7elJRqQ=
+github.com/containerd/ttrpc v1.2.7/go.mod h1:YCXHsb32f+Sq5/72xHubdiJRQY9inL4a4ZQrAbN1q9o=
 github.com/containerd/typeurl/v2 v2.1.1 h1:3Q4Pt7i8nYwy2KmQWIw2+1hTvwTE/6w9FqcttATPO/4=
 github.com/containerd/typeurl/v2 v2.1.1/go.mod h1:IDp2JFvbwZ31H8dQbEIY7sDl2L3o3HZj1hsSQlywkQ0=
 github.com/coreos/go-semver v0.3.0/go.mod h1:nnelYz7RCh+5ahJtPPxZlU+153eP4D4r3EedlOD2RNk=
@@ -225,8 +229,8 @@ github.com/coreos/go-systemd/v22 v22.3.2/go.mod h1:Y58oyj3AT4RCenI/lSvhwexgC+NSV
 github.com/cpuguy83/go-md2man/v2 v2.0.1/go.mod h1:tgQtvFlXSQOSOSIRvRPT7W67SCa46tRHOmNcaadrF8o=
 github.com/cpuguy83/go-md2man/v2 v2.0.6/go.mod h1:oOW0eioCTA6cOiMLiUPZOpcVxMig6NIQQ7OS05n1F4g=
 github.com/creack/pty v1.1.9/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ33E=
-github.com/cyphar/filepath-securejoin v0.3.6 h1:4d9N5ykBnSp5Xn2JkhocYDkOpURL/18CYMpo6xB9uWM=
-github.com/cyphar/filepath-securejoin v0.3.6/go.mod h1:Sdj7gXlvMcPZsbhwhQ33GguGLDGQL7h7bg04C/+u9jI=
+github.com/cyphar/filepath-securejoin v0.4.1 h1:JyxxyPEaktOD+GAnqIqTf9A8tHyAG22rowi7HkoSU1s=
+github.com/cyphar/filepath-securejoin v0.4.1/go.mod h1:Sdj7gXlvMcPZsbhwhQ33GguGLDGQL7h7bg04C/+u9jI=
 github.com/dave/jennifer v1.7.1 h1:B4jJJDHelWcDhlRQxWeo0Npa/pYKBLrirAQoTN45txo=
 github.com/dave/jennifer v1.7.1/go.mod h1:nXbxhEmQfOZhWml3D1cDK5M1FLnMSozpbFN/m3RmGZc=
 github.com/davecgh/go-spew v0.0.0-20161028175848-04cdfd42973b/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
@@ -239,12 +243,12 @@ github.com/deitch/magic v0.0.0-20230404182410-1ff89d7342da/go.mod h1:B3tI9iGHi4i
 github.com/dgrijalva/jwt-go/v4 v4.0.0-preview1/go.mod h1:+hnT3ywWDTAFrW5aE+u2Sa/wT555ZqwoCS+pk3p6ry4=
 github.com/distribution/reference v0.6.0 h1:0IXCQ5g4/QMHHkarYzh5l+u8T3t73zM5QvfrDyIgxBk=
 github.com/distribution/reference v0.6.0/go.mod h1:BbU0aIcezP1/5jX/8MP0YiH4SdvB5Y4f/wlDRiLyi3E=
-github.com/docker/cli v27.5.0+incompatible h1:aMphQkcGtpHixwwhAXJT1rrK/detk2JIvDaFkLctbGM=
-github.com/docker/cli v27.5.0+incompatible/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8=
+github.com/docker/cli v28.0.1+incompatible h1:g0h5NQNda3/CxIsaZfH4Tyf6vpxFth7PYl3hgCPOKzs=
+github.com/docker/cli v28.0.1+incompatible/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8=
 github.com/docker/distribution v2.8.3+incompatible h1:AtKxIZ36LoNK51+Z6RpzLpddBirtxJnzDrHLEKxTAYk=
 github.com/docker/distribution v2.8.3+incompatible/go.mod h1:J2gT2udsDAN96Uj4KfcMRqY0/ypR+oyYUYmja8H+y+w=
-github.com/docker/docker v28.0.0+incompatible h1:Olh0KS820sJ7nPsBKChVhk5pzqcwDR15fumfAd/p9hM=
-github.com/docker/docker v28.0.0+incompatible/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk=
+github.com/docker/docker v28.0.1+incompatible h1:FCHjSRdXhNRFjlHMTv4jUNlIBbTeRjrWfeFuJp7jpo0=
+github.com/docker/docker v28.0.1+incompatible/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk=
 github.com/docker/docker-credential-helpers v0.8.2 h1:bX3YxiGzFP5sOXWc3bTPEXdEaZSeVMrFgOr3T+zrFAo=
 github.com/docker/docker-credential-helpers v0.8.2/go.mod h1:P3ci7E3lwkZg6XiHdRKft1KckHiO9a2rNtyFbZ/ry9M=
 github.com/docker/go-connections v0.5.0 h1:USnMq7hx7gwdVZq1L49hLXaFtUdTADjXGp+uj1Br63c=
@@ -260,8 +264,8 @@ github.com/dustin/go-humanize v1.0.1 h1:GzkhY7T5VNhEkwH0PVJgjz+fX1rhBrR7pRT3mDkp
 github.com/dustin/go-humanize v1.0.1/go.mod h1:Mu1zIs6XwVuF/gI1OepvI0qD18qycQx+mFykh5fBlto=
 github.com/edsrzf/mmap-go v1.1.0 h1:6EUwBLQ/Mcr1EYLE4Tn1VdW1A4ckqCQWZBw8Hr0kjpQ=
 github.com/edsrzf/mmap-go v1.1.0/go.mod h1:19H/e8pUPLicwkyNgOykDXkJ9F0MHE+Z52B8EIth78Q=
-github.com/elazarl/goproxy v1.4.0 h1:4GyuSbFa+s26+3rmYNSuUVsx+HgPrV1bk1jXI0l9wjM=
-github.com/elazarl/goproxy v1.4.0/go.mod h1:X/5W/t+gzDyLfHW4DrMdpjqYjpXsURlBt9lpBDxZZZQ=
+github.com/elazarl/goproxy v1.7.2 h1:Y2o6urb7Eule09PjlhQRGNsqRfPmYI3KKQLFpCAV3+o=
+github.com/elazarl/goproxy v1.7.2/go.mod h1:82vkLNir0ALaW14Rc399OTTjyNREgmdL2cVoIbS6XaE=
 github.com/elliotchance/phpserialize v1.4.0 h1:cAp/9+KSnEbUC8oYCE32n2n84BeW8HOY3HMDI8hG2OY=
 github.com/elliotchance/phpserialize v1.4.0/go.mod h1:gt7XX9+ETUcLXbtTKEuyrqW3lcLUAeS/AnGZ2e49TZs=
 github.com/emirpasic/gods v1.18.1 h1:FXtiHYKDGKCW2KzwZKx0iC0PQmdlorYgdFG9jPXJ1Bc=
@@ -318,8 +322,8 @@ github.com/go-git/go-billy/v5 v5.6.2 h1:6Q86EsPXMa7c3YZ3aLAQsMA0VlWmy43r6FHqa/UN
 github.com/go-git/go-billy/v5 v5.6.2/go.mod h1:rcFC2rAsp/erv7CMz9GczHcuD0D32fWzH+MJAU+jaUU=
 github.com/go-git/go-git-fixtures/v4 v4.3.2-0.20231010084843-55a94097c399 h1:eMje31YglSBqCdIqdhKBW8lokaMrL3uTkpGYlE2OOT4=
 github.com/go-git/go-git-fixtures/v4 v4.3.2-0.20231010084843-55a94097c399/go.mod h1:1OCfN199q1Jm3HZlxleg+Dw/mwps2Wbk9frAWm+4FII=
-github.com/go-git/go-git/v5 v5.13.2 h1:7O7xvsK7K+rZPKW6AQR1YyNhfywkv7B8/FsP3ki6Zv0=
-github.com/go-git/go-git/v5 v5.13.2/go.mod h1:hWdW5P4YZRjmpGHwRH2v3zkWcNl6HeXaXQEMGb3NJ9A=
+github.com/go-git/go-git/v5 v5.14.0 h1:/MD3lCrGjCen5WfEAzKg00MJJffKhC8gzS80ycmCi60=
+github.com/go-git/go-git/v5 v5.14.0/go.mod h1:Z5Xhoia5PcWA3NF8vRLURn9E5FRhSl7dGj9ItW3Wk5k=
 github.com/go-gl/glfw v0.0.0-20190409004039-e6da0acd62b1/go.mod h1:vR7hzQXu2zJy9AVAgeJqvqgH9Q5CA+iKCZ2gyEVpxRU=
 github.com/go-gl/glfw/v3.3/glfw v0.0.0-20191125211704-12ad95a8df72/go.mod h1:tQ2UAYgL5IevRw8kRxooKSPJfGvJ9fJQFa0TUsXzTg8=
 github.com/go-gl/glfw/v3.3/glfw v0.0.0-20200222043503-6f7a984d4dc4/go.mod h1:tQ2UAYgL5IevRw8kRxooKSPJfGvJ9fJQFa0TUsXzTg8=
@@ -351,8 +355,9 @@ github.com/golang/glog v0.0.0-20160126235308-23def4e6c14b/go.mod h1:SBH7ygxi8pfU
 github.com/golang/groupcache v0.0.0-20190702054246-869f871628b6/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
 github.com/golang/groupcache v0.0.0-20191227052852-215e87163ea7/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
 github.com/golang/groupcache v0.0.0-20200121045136-8c9f03a8e57e/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
-github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da h1:oI5xCqsCo564l8iNU+DwB5epxmsaqB+rhGL0m5jtYqE=
 github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
+github.com/golang/groupcache v0.0.0-20241129210726-2c02b8208cf8 h1:f+oWsMOmNPc8JmEHVZIycC7hBoQxHH9pNKQORJNozsQ=
+github.com/golang/groupcache v0.0.0-20241129210726-2c02b8208cf8/go.mod h1:wcDNUvekVysuuOpQKo3191zZyTpiI6se1N1ULghS0sw=
 github.com/golang/mock v1.1.1/go.mod h1:oTYuIxOrZwtPieC+H1uAHpcLFnEyAGVDL/k47Jfbm0A=
 github.com/golang/mock v1.2.0/go.mod h1:oTYuIxOrZwtPieC+H1uAHpcLFnEyAGVDL/k47Jfbm0A=
 github.com/golang/mock v1.3.1/go.mod h1:sBzyDLLjw3U8JLTeZvSv8jJB+tU5PVekmnlKIyFUx0Y=
@@ -397,8 +402,9 @@ github.com/google/go-cmp v0.5.4/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/
 github.com/google/go-cmp v0.5.5/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
 github.com/google/go-cmp v0.5.6/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
 github.com/google/go-cmp v0.5.9/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
-github.com/google/go-cmp v0.6.0 h1:ofyhxvXcZhMsU5ulbFiLKl/XBFqE1GSq7atu8tAmTRI=
 github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
+github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
+github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
 github.com/google/go-containerregistry v0.20.3 h1:oNx7IdTI936V8CQRveCjaxOiegWwvM7kqkbXTpyiovI=
 github.com/google/go-containerregistry v0.20.3/go.mod h1:w00pIgBRDVUDFM6bq+Qx8lwNWK+cxgCuX1vd3PIBDNI=
 github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
@@ -496,8 +502,8 @@ github.com/invopop/jsonschema v0.7.0 h1:2vgQcBz1n256N+FpX3Jq7Y17AjYt46Ig3zIWyy77
 github.com/invopop/jsonschema v0.7.0/go.mod h1:O9uiLokuu0+MGFlyiaqtWxwqJm41/+8Nj0lD7A36YH0=
 github.com/jbenet/go-context v0.0.0-20150711004518-d14ea06fba99 h1:BQSFePA1RWJOlocH6Fxy8MmwDt+yVQYULKfN0RoTN8A=
 github.com/jbenet/go-context v0.0.0-20150711004518-d14ea06fba99/go.mod h1:1lJo3i6rXxKeerYnT8Nvf0QmHCRC1n8sfWVwXF2Frvo=
-github.com/jedib0t/go-pretty/v6 v6.6.6 h1:LyezkL+1SuqH2z47e5IMQkYUIcs2BD+MnpdPRiRcN0c=
-github.com/jedib0t/go-pretty/v6 v6.6.6/go.mod h1:YwC5CE4fJ1HFUDeivSV1r//AmANFHyqczZk+U6BDALU=
+github.com/jedib0t/go-pretty/v6 v6.6.7 h1:m+LbHpm0aIAPLzLbMfn8dc3Ht8MW7lsSO4MPItz/Uuo=
+github.com/jedib0t/go-pretty/v6 v6.6.7/go.mod h1:YwC5CE4fJ1HFUDeivSV1r//AmANFHyqczZk+U6BDALU=
 github.com/jinzhu/copier v0.4.0 h1:w3ciUoD19shMCRargcpm0cm91ytaBhDvuRpz1ODO/U8=
 github.com/jinzhu/copier v0.4.0/go.mod h1:DfbEm0FYsaqBcKcFuvmOZb218JkPGtvSHsKg8S8hyyg=
 github.com/josharian/intern v1.0.0/go.mod h1:5DoeVV0s6jJacbCEi61lwdGj/aVlrQvzHFFd8Hwg//Y=
@@ -515,8 +521,8 @@ github.com/kevinburke/ssh_config v1.2.0/go.mod h1:CT57kijsi8u/K/BOFA39wgDQJ9CxiF
 github.com/kisielk/errcheck v1.5.0/go.mod h1:pFxgyoBC7bSaBwPgfKdkLd5X25qrDl4LWUI2bnpBCr8=
 github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+oQHNcck=
 github.com/klauspost/compress v1.4.1/go.mod h1:RyIbtBH6LamlWaDj8nUwkbUhJ87Yi3uG0guNDohfE1A=
-github.com/klauspost/compress v1.17.11 h1:In6xLpyWOi1+C7tXUUWv2ot1QvBjxevKAaI6IXrJmUc=
-github.com/klauspost/compress v1.17.11/go.mod h1:pMDklpSncoRMuLFrf1W9Ss9KT+0rH90U12bZKk7uwG0=
+github.com/klauspost/compress v1.18.0 h1:c/Cqfb0r+Yi+JtIEq73FWXVkRonBlf0CRNYc8Zttxdo=
+github.com/klauspost/compress v1.18.0/go.mod h1:2Pp+KzxcywXVXMr50+X0Q/Lsb43OQHYWRCY2AiWywWQ=
 github.com/klauspost/cpuid v1.2.0/go.mod h1:Pj4uuM528wm8OyEC2QMXAi2YiTZ96dNQPGgoMS4s3ek=
 github.com/klauspost/pgzip v1.2.6 h1:8RXeL5crjEUFnR2/Sn6GJNWtSQ3Dk8pq4CL3jvdDyjU=
 github.com/klauspost/pgzip v1.2.6/go.mod h1:Ch1tH69qFZu15pkjo5kYi6mth2Zzwzt50oCQKQE9RUs=
@@ -572,8 +578,6 @@ github.com/mattn/go-runewidth v0.0.16/go.mod h1:Jdepj2loyihRzMpdS35Xk/zdY8IAYHsh
 github.com/matttproud/golang_protobuf_extensions v1.0.1/go.mod h1:D8He9yQNgCq6Z5Ld7szi9bcBfOoFv/3dc6xSMkL2PC0=
 github.com/mgutz/ansi v0.0.0-20200706080929-d51e80ef957d h1:5PJl274Y63IEHC+7izoQE9x6ikvDFZS2mDVS3drnohI=
 github.com/mgutz/ansi v0.0.0-20200706080929-d51e80ef957d/go.mod h1:01TrycV0kFyexm33Z7vhZRXopbI8J3TDReVlkTgMUxE=
-github.com/microsoft/go-rustaudit v0.0.0-20220730194248-4b17361d90a5 h1:tQRHcLQwnwrPq2j2Qra/NnyjyESBGwdeBeVdAE9kXYg=
-github.com/microsoft/go-rustaudit v0.0.0-20220730194248-4b17361d90a5/go.mod h1:vYT9HE7WCvL64iVeZylKmCsWKfE+JZ8105iuh2Trk8g=
 github.com/miekg/dns v1.0.14/go.mod h1:W1PPwlIAgtquWBMBEV9nkV9Cazfe8ScdGz/Lj7v3Nrg=
 github.com/miekg/dns v1.1.26/go.mod h1:bPDLeHnStXmXAq1m/Ch/hvfNHr14JKNPMBo3VZKjuso=
 github.com/miekg/dns v1.1.41/go.mod h1:p6aan82bvRIyn+zDIv9xYNUpwa73JcSh9BKwknJysuI=
@@ -621,8 +625,8 @@ github.com/muesli/ansi v0.0.0-20230316100256-276c6243b2f6 h1:ZK8zHtRHOkbHy6Mmr5D
 github.com/muesli/ansi v0.0.0-20230316100256-276c6243b2f6/go.mod h1:CJlz5H+gyd6CUWT45Oy4q24RdLyn7Md9Vj2/ldJBSIo=
 github.com/muesli/cancelreader v0.2.2 h1:3I4Kt4BQjOR54NavqnDogx/MIoWBFa0StPA8ELUXHmA=
 github.com/muesli/cancelreader v0.2.2/go.mod h1:3XuTXfFS2VjM+HTLZY9Ak0l6eUKfijIfMUZ4EgX0QYo=
-github.com/muesli/termenv v0.15.2 h1:GohcuySI0QmI3wN8Ok9PtKGkgkFIk7y6Vpb5PvrY+Wo=
-github.com/muesli/termenv v0.15.2/go.mod h1:Epx+iuz8sNs7mNKhxzH4fWXGNpZwUaJKRS1noLXviQ8=
+github.com/muesli/termenv v0.16.0 h1:S5AlUN9dENB57rsbnkPyfdGuWIlkmzJjbFf0Tf5FWUc=
+github.com/muesli/termenv v0.16.0/go.mod h1:ZRfOIKPFDYQoDFF4Olj7/QJbW60Ol/kL1pU3VfY/Cnk=
 github.com/mwitkow/go-conntrack v0.0.0-20161129095857-cc309e4a2223/go.mod h1:qRWi+5nqEBWmkhHvq77mSJWrCKwh8bxhgT7d/eI7P4U=
 github.com/ncruces/go-strftime v0.1.9 h1:bY0MQC28UADQmHmaF5dgpLmImcShSi2kHU9XLdhx/f4=
 github.com/ncruces/go-strftime v0.1.9/go.mod h1:Fwc5htZGVVkseilnfgOVb9mKy6w1naJmn9CehxcKcls=
@@ -634,8 +638,8 @@ github.com/onsi/gomega v1.34.1 h1:EUMJIKUjM8sKjYbtxQI9A4z2o+rruxnzNvpknOXie6k=
 github.com/onsi/gomega v1.34.1/go.mod h1:kU1QgUvBDLXBJq618Xvm2LUX6rSAfRaFRTcdOeDLwwY=
 github.com/opencontainers/go-digest v1.0.0 h1:apOUWs51W5PlhuyGyz9FCeeBIOUDA/6nW8Oi/yOhh5U=
 github.com/opencontainers/go-digest v1.0.0/go.mod h1:0JzlMkj0TRzQZfJkVvzbP0HBR3IKzErnv2BNG4W4MAM=
-github.com/opencontainers/image-spec v1.1.0 h1:8SG7/vwALn54lVB/0yZ/MMwhFrPYtpEHQb2IpWsCzug=
-github.com/opencontainers/image-spec v1.1.0/go.mod h1:W4s4sFTMaBeK1BQLXbG4AdM2szdn85PY75RI83NrTrM=
+github.com/opencontainers/image-spec v1.1.1 h1:y0fUlFfIZhPF1W537XOLg0/fcx6zcHCJwooC2xJA040=
+github.com/opencontainers/image-spec v1.1.1/go.mod h1:qpqAh3Dmcf36wStyyWU+kCeDgrGnAve2nCC8+7h8Q0M=
 github.com/opencontainers/runtime-spec v1.1.0 h1:HHUyrt9mwHUjtasSbXSMvs4cyFxh+Bll4AjJ9odEGpg=
 github.com/opencontainers/runtime-spec v1.1.0/go.mod h1:jwyrGlmzljRJv/Fgzds9SsS/C5hL+LL3ko9hs6T5lQ0=
 github.com/opencontainers/selinux v1.11.0 h1:+5Zbo97w3Lbmb3PeqQtpmTkMwsW5nRI3YaLpt7tQ7oU=
@@ -650,8 +654,8 @@ github.com/pelletier/go-toml v1.9.5 h1:4yBQzkHv+7BHq2PQUZF3Mx0IYxG7LsP222s7Agd3v
 github.com/pelletier/go-toml v1.9.5/go.mod h1:u1nR/EPcESfeI/szUZKdtJ0xRNbUoANCkoOuaOx1Y+c=
 github.com/pelletier/go-toml/v2 v2.2.2 h1:aYUidT7k73Pcl9nb2gScu7NSrKCSHIDE89b3+6Wq+LM=
 github.com/pelletier/go-toml/v2 v2.2.2/go.mod h1:1t835xjRzz80PqgE6HHgN2JOsmgYu/h4qDAS4n929Rs=
-github.com/pierrec/lz4/v4 v4.1.21 h1:yOVMLb6qSIDP67pl/5F7RepeKYu/VmTyEXvuMI5d9mQ=
-github.com/pierrec/lz4/v4 v4.1.21/go.mod h1:gZWDp/Ze/IJXGXf23ltt2EXimqmTUXEy0GFuRQyBid4=
+github.com/pierrec/lz4/v4 v4.1.22 h1:cKFw6uJDK+/gfw5BcDL0JL5aBsAFdsIT18eRtLj7VIU=
+github.com/pierrec/lz4/v4 v4.1.22/go.mod h1:gZWDp/Ze/IJXGXf23ltt2EXimqmTUXEy0GFuRQyBid4=
 github.com/pjbgf/sha1cd v0.3.2 h1:a9wb0bp1oC2TGwStyn0Umc/IGKQnEgF0vVaZ8QF8eo4=
 github.com/pjbgf/sha1cd v0.3.2/go.mod h1:zQWigSxVmsHEZow5qaLtPYxpcKMMQpa09ixqBxuCS6A=
 github.com/pkg/diff v0.0.0-20210226163009-20ebb0f2a09e/go.mod h1:pJLUxLENpZxwdsKMEsNbx1VGcRFpLqf3715MtcvvzbA=
@@ -692,9 +696,11 @@ github.com/rivo/uniseg v0.4.7/go.mod h1:FN3SvrM+Zdj16jyLfmOkMNblXMcoc8DfTHruCPUc
 github.com/rogpeppe/fastuuid v1.2.0/go.mod h1:jVj6XXZzXRy/MSR5jhDC/2q6DgLz+nrA6LYCDYWNEvQ=
 github.com/rogpeppe/go-internal v1.3.0/go.mod h1:M8bDsm7K2OlrFYOpmOWEs/qY81heoFRclV5y23lUDJ4=
 github.com/rogpeppe/go-internal v1.9.0/go.mod h1:WtVeX8xhTBvf0smdhujwtBcq4Qrzq/fJaraNFVN+nFs=
-github.com/rogpeppe/go-internal v1.13.1 h1:KvO1DLK/DRN07sQ1LQKScxyZJuNnedQ5/wKSR38lUII=
-github.com/rogpeppe/go-internal v1.13.1/go.mod h1:uMEvuHeurkdAXX61udpOXGD/AzZDWNMNyH2VO9fmH0o=
+github.com/rogpeppe/go-internal v1.14.1 h1:UQB4HGPB6osV0SQTLymcB4TgvyWu6ZyliaW0tI/otEQ=
+github.com/rogpeppe/go-internal v1.14.1/go.mod h1:MaRKkUm5W0goXpeCfT7UZI6fk/L7L7so1lCWt35ZSgc=
 github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
+github.com/rust-secure-code/go-rustaudit v0.0.0-20250226111315-e20ec32e963c h1:8gOLsYwaY2JwlTMT4brS5/9XJdrdIbmk2obvQ748CC0=
+github.com/rust-secure-code/go-rustaudit v0.0.0-20250226111315-e20ec32e963c/go.mod h1:kwM/7r/rVluTE8qJbHAffduuqmSv4knVQT2IajGvSiA=
 github.com/ryanuber/columnize v0.0.0-20160712163229-9b3edd62028f/go.mod h1:sm1tb6uqfes/u+d4ooFouqFdy9/2g9QGwK3SQygK0Ts=
 github.com/saferwall/pe v1.5.6 h1:DrRLnoQFxHWJ5lJUmrH7X2L0xeUu6SUS95Dc61eW2Yc=
 github.com/saferwall/pe v1.5.6/go.mod h1:mJx+PuptmNpoPFBNhWs/uDMFL/kTHVZIkg0d4OUJFbQ=
@@ -729,18 +735,19 @@ github.com/sirupsen/logrus v1.4.2/go.mod h1:tLMulIdttU9McNUspp0xgXVQah82FyeX6Mwd
 github.com/sirupsen/logrus v1.7.0/go.mod h1:yWOB1SBYBC5VeMP7gHvWumXLIWorT60ONWic61uBYv0=
 github.com/sirupsen/logrus v1.9.3 h1:dueUQJ1C2q9oE3F7wvmSGAaVtTmUizReu6fjN8uqzbQ=
 github.com/sirupsen/logrus v1.9.3/go.mod h1:naHLuLoDiP4jHNo9R0sCBMtWGeIprob74mVsIT4qYEQ=
-github.com/skeema/knownhosts v1.3.0 h1:AM+y0rI04VksttfwjkSTNQorvGqmwATnvnAHpSgc0LY=
-github.com/skeema/knownhosts v1.3.0/go.mod h1:sPINvnADmT/qYH1kfv+ePMmOBTH6Tbl7b5LvTDjFK7M=
+github.com/skeema/knownhosts v1.3.1 h1:X2osQ+RAjK76shCbvhHHHVl3ZlgDm8apHEHFqRjnBY8=
+github.com/skeema/knownhosts v1.3.1/go.mod h1:r7KTdC8l4uxWRyK2TpQZ/1o5HaSzh06ePQNxPwTcfiY=
 github.com/sourcegraph/conc v0.3.0 h1:OQTbbt6P72L20UqAkXXuLOj79LfEanQ+YQFNpLA9ySo=
 github.com/sourcegraph/conc v0.3.0/go.mod h1:Sdozi7LEKbFPqYX2/J+iBAM6HpqSLTASQIKqDmF7Mt0=
 github.com/spaolacci/murmur3 v0.0.0-20180118202830-f09979ecbc72/go.mod h1:JwIasOWyU6f++ZhiEuf87xNszmSA2myDM2Kzu9HwQUA=
+github.com/spdx/gordf v0.0.0-20201111095634-7098f93598fb h1:bLo8hvc8XFm9J47r690TUKBzcjSWdJDxmjXJZ+/f92U=
 github.com/spdx/gordf v0.0.0-20201111095634-7098f93598fb/go.mod h1:uKWaldnbMnjsSAXRurWqqrdyZen1R7kxl8TkmWk2OyM=
 github.com/spdx/tools-golang v0.5.5 h1:61c0KLfAcNqAjlg6UNMdkwpMernhw3zVRwDZ2x9XOmk=
 github.com/spdx/tools-golang v0.5.5/go.mod h1:MVIsXx8ZZzaRWNQpUDhC4Dud34edUYJYecciXgrw5vE=
 github.com/spf13/afero v1.3.3/go.mod h1:5KUK8ByomD5Ti5Artl0RtHeI5pTF7MIDuXL3yY520V4=
 github.com/spf13/afero v1.6.0/go.mod h1:Ai8FlHk4v/PARR026UzYexafAt9roJ7LcLMAmO6Z93I=
-github.com/spf13/afero v1.12.0 h1:UcOPyRBYczmFn6yvphxkn9ZEOY65cpwGKb5mL36mrqs=
-github.com/spf13/afero v1.12.0/go.mod h1:ZTlWwG4/ahT8W7T0WQ5uYmjI9duaLQGy3Q2OAl4sk/4=
+github.com/spf13/afero v1.14.0 h1:9tH6MapGnn/j0eb0yIXiLjERO8RB6xIVZRDCX7PtqWA=
+github.com/spf13/afero v1.14.0/go.mod h1:acJQ8t0ohCGuMN3O+Pv0V0hgMxNYDlvdk+VTfyZmbYo=
 github.com/spf13/cast v1.4.1/go.mod h1:Qx5cxh0v+4UWYiBimWS+eyWzqEqokIECu5etghLkUJE=
 github.com/spf13/cast v1.7.0 h1:ntdiHjuueXFgm5nzDRdOS4yfT43P5Fnud6DH50rz/7w=
 github.com/spf13/cast v1.7.0/go.mod h1:ancEpBxwJDODSW/UG4rDrAqiKolqNNh2DX3mk86cAdo=
@@ -780,8 +787,8 @@ github.com/subosito/gotenv v1.6.0 h1:9NlTDc1FTs4qu0DDq7AEtTPNw6SVm7uBMsUCUjABIf8
 github.com/subosito/gotenv v1.6.0/go.mod h1:Dk4QP5c2W3ibzajGcXpNraDfq2IrhjMIvMSWPKKo0FU=
 github.com/sylabs/sif/v2 v2.20.2 h1:HGEPzauCHhIosw5o6xmT3jczuKEuaFzSfdjAsH33vYw=
 github.com/sylabs/sif/v2 v2.20.2/go.mod h1:WyYryGRaR4Wp21SAymm5pK0p45qzZCSRiZMFvUZiuhc=
-github.com/sylabs/squashfs v1.0.4 h1:uFSw7WXv7zjutPvU+JzY0nY494Vw8s4FAf4+7DhoMdI=
-github.com/sylabs/squashfs v1.0.4/go.mod h1:PDgf8YmCntvN4d9Y8hBUBDCZL6qZOzOQwRGxnIdbERk=
+github.com/sylabs/squashfs v1.0.5 h1:KExbrvScUVk/drh6gPfnZY7T7SZ+cQpcSJEOK32dppU=
+github.com/sylabs/squashfs v1.0.5/go.mod h1:DlDeUawVXLWAsSRa085Eo0ZenGzAB32JdAUFaB0LZfE=
 github.com/terminalstatic/go-xsd-validate v0.1.6 h1:TenYeQ3eY631qNi1/cTmLH/s2slHPRKTTHT+XSHkepo=
 github.com/terminalstatic/go-xsd-validate v0.1.6/go.mod h1:18lsvYFofBflqCrvo1umpABZ99+GneNTw2kEEc8UPJw=
 github.com/therootcompany/xz v1.0.1 h1:CmOtsn1CbtmyYiusbfmhmkpAAETj0wBIH6kCYaX+xzw=
@@ -889,8 +896,8 @@ golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPh
 golang.org/x/crypto v0.0.0-20210817164053-32db794688a5/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
 golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
 golang.org/x/crypto v0.0.0-20220622213112-05595931fe9d/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=
-golang.org/x/crypto v0.33.0 h1:IOBPskki6Lysi0lo9qQvbxiQ+FvsCC/YWOecCHAixus=
-golang.org/x/crypto v0.33.0/go.mod h1:bVdXmD7IV/4GdElGPozy6U7lWdRXA4qyRVGJV57uQ5M=
+golang.org/x/crypto v0.36.0 h1:AnAEvhDddvBdpY+uR+MyHmuZzzNqXSe/GvuDeob5L34=
+golang.org/x/crypto v0.36.0/go.mod h1:Y4J0ReaxCR1IMaabaSMugxJES1EpwhBHhv2bDHklZvc=
 golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
 golang.org/x/exp v0.0.0-20190306152737-a1d7652674e8/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
 golang.org/x/exp v0.0.0-20190510132918-efd6b22b2522/go.mod h1:ZjyILWgesfNpC6sMxTJOJm9Kp84zZh5NQWvqDGG3Qr8=
@@ -930,8 +937,8 @@ golang.org/x/mod v0.4.1/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.4.2/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.5.0/go.mod h1:5OXOZSfqPIIbmVBIIKWRFfZjPR0E5r58TLhUjH0a2Ro=
 golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4=
-golang.org/x/mod v0.23.0 h1:Zb7khfcRGKk+kqfxFaP5tZqCnDZMjC5VtUBs87Hr6QM=
-golang.org/x/mod v0.23.0/go.mod h1:6SkKJ3Xj0I0BrPOZoBy3bdMptDDU9oJrpohJ3eWZ1fY=
+golang.org/x/mod v0.24.0 h1:ZfthKaKaT4NrhGVZHO1/WDTwGES4De8KtWO0SIbNJMU=
+golang.org/x/mod v0.24.0/go.mod h1:IXM97Txy2VM4PJ3gI61r1YEk/gAj6zAHN3AdZt6S9Ww=
 golang.org/x/net v0.0.0-20180724234803-3673e40ba225/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20180826012351-8a410e7b638d/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20181023162649-9b4f9f5ad519/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
@@ -975,8 +982,8 @@ golang.org/x/net v0.0.0-20210503060351-7fd8e65b6420/go.mod h1:9nx3DQGgdP8bBQD5qx
 golang.org/x/net v0.0.0-20210813160813-60bc85c4be6d/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
 golang.org/x/net v0.0.0-20211112202133-69e39bad7dc2/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
 golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
-golang.org/x/net v0.35.0 h1:T5GQRQb2y08kTAByq9L4/bz8cipCdA8FbRTXewonqY8=
-golang.org/x/net v0.35.0/go.mod h1:EglIi67kWsHKlRzzVMUD93VMSWGFOMSZgxFjparz1Qk=
+golang.org/x/net v0.37.0 h1:1zLorHbz+LYj7MQlSf1+2tPIIgibq2eL5xkrGk6f+2c=
+golang.org/x/net v0.37.0/go.mod h1:ivrbrMbzFq5J41QOQh0siUuly180yBYtLp+CKbEaFx8=
 golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
 golang.org/x/oauth2 v0.0.0-20190226205417-e64efc72b421/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
 golang.org/x/oauth2 v0.0.0-20190604053449-0f29369cfe45/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
@@ -1006,8 +1013,8 @@ golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJ
 golang.org/x/sync v0.0.0-20201207232520-09787c993a3a/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20210220032951-036812b2e83c/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.11.0 h1:GGz8+XQP4FvTTrjZPzNKTMFtSXH80RAzG+5ghFPgK9w=
-golang.org/x/sync v0.11.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
+golang.org/x/sync v0.12.0 h1:MHc5BpPuC30uJk597Ri8TV3CNZcTLu6B6z4lJy+g6Jw=
+golang.org/x/sync v0.12.0/go.mod h1:1dzgHSNfp02xaA81J2MS99Qcpr2w7fw1gpm99rleRqA=
 golang.org/x/sys v0.0.0-20180823144017-11551d06cbcc/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20180830151530-49385e6e1522/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20180905080454-ebe1bf3edb33/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
@@ -1083,12 +1090,12 @@ golang.org/x/sys v0.0.0-20220715151400-c0bba94af5f8/go.mod h1:oPkhp1MJrh7nUepCBc
 golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220811171246-fbc7d0a398ab/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.30.0 h1:QjkSwP/36a20jFYWkSue1YwXzLmsV5Gfq7Eiy72C1uc=
-golang.org/x/sys v0.30.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
+golang.org/x/sys v0.31.0 h1:ioabZlmFYtWhL+TRYpcnNlLwhyxaM9kWTDEmfnprqik=
+golang.org/x/sys v0.31.0/go.mod h1:BJP2sWEmIv4KK5OTEluFJCKSidICx8ciO85XgH3Ak8k=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
-golang.org/x/term v0.29.0 h1:L6pJp37ocefwRRtYPKSWOWzOtWSxVajvz2ldH/xi3iU=
-golang.org/x/term v0.29.0/go.mod h1:6bl4lRlvVuDgSf3179VpIxBF0o10JUpXWOnI7nErv7s=
+golang.org/x/term v0.30.0 h1:PQ39fJZ+mfadBm0y5WlL4vlM7Sx1Hgf13sMIY2+QS9Y=
+golang.org/x/term v0.30.0/go.mod h1:NYYFdzHoI5wRh/h5tDMdMqCqPJZEuNqVR5xJLd/n67g=
 golang.org/x/text v0.0.0-20170915032832-14c0d48ead0c/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.1-0.20180807135948-17ff2d5776d2/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
@@ -1099,13 +1106,13 @@ golang.org/x/text v0.3.5/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
 golang.org/x/text v0.7.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
-golang.org/x/text v0.22.0 h1:bofq7m3/HAFvbF51jz3Q9wLg3jkvSPuiZu/pD1XwgtM=
-golang.org/x/text v0.22.0/go.mod h1:YRoo4H8PVmsu+E3Ou7cqLVH8oXWIHVoX0jqUWALQhfY=
+golang.org/x/text v0.23.0 h1:D71I7dUrlY+VX0gQShAThNGHFxZ13dGLBHQLVl1mJlY=
+golang.org/x/text v0.23.0/go.mod h1:/BLNzu4aZCJ1+kcD0DNRotWKage4q2rGVAg4o22unh4=
 golang.org/x/time v0.0.0-20181108054448-85acf8d2951c/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.0.0-20190308202827-9d24e82272b4/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.0.0-20191024005414-555d28b269f0/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
-golang.org/x/time v0.8.0 h1:9i3RxcPv3PZnitoVGMPDKZSq1xW1gK1Xy3ArNOGZfEg=
-golang.org/x/time v0.8.0/go.mod h1:3BpzKBy/shNhVucY/MWOyx10tF3SFh9QdLuxbVysPQM=
+golang.org/x/time v0.5.0 h1:o7cqy6amK/52YcAKIPlM3a+Fpj35zvRj2TP+e1xFSfk=
+golang.org/x/time v0.5.0/go.mod h1:3BpzKBy/shNhVucY/MWOyx10tF3SFh9QdLuxbVysPQM=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20190114222345-bf090417da8b/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20190226205152-f727befe758c/go.mod h1:9Yl7xja0Znq3iFh3HoIrodX9oNMXvdceNzlUR8zjMvY=
@@ -1273,8 +1280,8 @@ google.golang.org/genproto v0.0.0-20211206160659-862468c7d6e0/go.mod h1:5CzLGKJ6
 google.golang.org/genproto v0.0.0-20211208223120-3a66f561d7aa/go.mod h1:5CzLGKJ67TSI2B9POpiiyGha0AjJvZIUgRMt1dSmuhc=
 google.golang.org/genproto v0.0.0-20241118233622-e639e219e697 h1:ToEetK57OidYuqD4Q5w+vfEnPvPpuTwedCNVohYJfNk=
 google.golang.org/genproto v0.0.0-20241118233622-e639e219e697/go.mod h1:JJrvXBWRZaFMxBufik1a4RpFw4HhgVtBBWQeQgUj2cc=
-google.golang.org/genproto/googleapis/api v0.0.0-20241209162323-e6fa225c2576 h1:CkkIfIt50+lT6NHAVoRYEyAvQGFM7xEwXUUywFvEb3Q=
-google.golang.org/genproto/googleapis/api v0.0.0-20241209162323-e6fa225c2576/go.mod h1:1R3kvZ1dtP3+4p4d3G8uJ8rFk/fWlScl38vanWACI08=
+google.golang.org/genproto/googleapis/api v0.0.0-20241113202542-65e8d215514f h1:M65LEviCfuZTfrfzwwEoxVtgvfkFkBUbFnRbxCXuXhU=
+google.golang.org/genproto/googleapis/api v0.0.0-20241113202542-65e8d215514f/go.mod h1:Yo94eF2nj7igQt+TiJ49KxjIH8ndLYPZMIRSiRcEbg0=
 google.golang.org/genproto/googleapis/rpc v0.0.0-20241223144023-3abc09e42ca8 h1:TqExAhdPaB60Ux47Cn0oLV07rGnxZzIsaRhQaqS666A=
 google.golang.org/genproto/googleapis/rpc v0.0.0-20241223144023-3abc09e42ca8/go.mod h1:lcTa1sDdWEIHMWlITnIczmw5w60CF9ffkb8Z+DVmmjA=
 google.golang.org/grpc v1.19.0/go.mod h1:mqu4LbDTu4XGKhr4mRzUsmM4RtVoemTSY81AxZiDr8c=
@@ -1372,8 +1379,8 @@ modernc.org/opt v0.1.4 h1:2kNGMRiUjrp4LcaPuLY2PzUfqM/w9N23quVwhKt5Qm8=
 modernc.org/opt v0.1.4/go.mod h1:03fq9lsNfvkYSfxrfUhZCWPk1lm4cq4N+Bh//bEtgns=
 modernc.org/sortutil v1.2.1 h1:+xyoGf15mM3NMlPDnFqrteY07klSFxLElE2PVuWIJ7w=
 modernc.org/sortutil v1.2.1/go.mod h1:7ZI3a3REbai7gzCLcotuw9AC4VZVpYMjDzETGsSMqJE=
-modernc.org/sqlite v1.35.0 h1:yQps4fegMnZFdphtzlfQTCNBWtS0CZv48pRpW3RFHRw=
-modernc.org/sqlite v1.35.0/go.mod h1:9cr2sicr7jIaWTBKQmAxQLfBv9LL0su4ZTEV+utt3ic=
+modernc.org/sqlite v1.36.1 h1:bDa8BJUH4lg6EGkLbahKe/8QqoF8p9gArSc6fTqYhyQ=
+modernc.org/sqlite v1.36.1/go.mod h1:7MPwH7Z6bREicF9ZVUR78P1IKuxfZ8mRIDHD0iD+8TU=
 modernc.org/strutil v1.2.1 h1:UneZBkQA+DX2Rp35KcM69cSsNES9ly8mQWD71HKlOA0=
 modernc.org/strutil v1.2.1/go.mod h1:EHkiggD70koQxjVdSBM3JKM7k6L0FbGE5eymy9i3B9A=
 modernc.org/token v1.1.0 h1:Xl7Ap9dKaEs5kLoOQeQmPWevfnk/DM5qcLcYlA8ys6Y=
@@ -8,11 +8,15 @@ import (
 	"github.com/anchore/syft/syft/pkg"
 )

-func DefaultCommonOptions() []cmp.Option {
-	return CommonOptions(nil, nil)
+func DefaultOptions() []cmp.Option {
+	return BuildOptions(nil, nil)
 }

-func CommonOptions(licenseCmp LicenseComparer, locationCmp LocationComparer) []cmp.Option {
+func DefaultIgnoreLocationLayerOptions() []cmp.Option {
+	return BuildOptions(LicenseComparerWithoutLocationLayer, LocationComparerWithoutLayer)
+}
+
+func BuildOptions(licenseCmp LicenseComparer, locationCmp LocationComparer) []cmp.Option {
 	if licenseCmp == nil {
 		licenseCmp = DefaultLicenseComparer
 	}
@@ -25,47 +29,9 @@ func CommonOptions(licenseCmp LicenseComparer, locationCmp LocationComparer) []c
 		cmpopts.IgnoreFields(pkg.Package{}, "id"), // note: ID is not deterministic for test purposes
 		cmpopts.SortSlices(pkg.Less),
 		cmpopts.SortSlices(DefaultRelationshipComparer),
-		cmp.Comparer(
-			func(x, y file.LocationSet) bool {
-				xs := x.ToSlice()
-				ys := y.ToSlice()
-
-				if len(xs) != len(ys) {
-					return false
-				}
-				for i, xe := range xs {
-					ye := ys[i]
-					if !locationCmp(xe, ye) {
-						return false
-					}
-				}
-
-				return true
-			},
-		),
-		cmp.Comparer(
-			func(x, y pkg.LicenseSet) bool {
-				xs := x.ToSlice()
-				ys := y.ToSlice()
-
-				if len(xs) != len(ys) {
-					return false
-				}
-				for i, xe := range xs {
-					ye := ys[i]
-					if !licenseCmp(xe, ye) {
-						return false
-					}
-				}
-
-				return true
-			},
-		),
-		cmp.Comparer(
-			locationCmp,
-		),
-		cmp.Comparer(
-			licenseCmp,
-		),
+		cmp.Comparer(buildSetComparer[file.Location, file.LocationSet](locationCmp)),
+		cmp.Comparer(buildSetComparer[pkg.License, pkg.LicenseSet](licenseCmp)),
+		cmp.Comparer(locationCmp),
+		cmp.Comparer(licenseCmp),
 	}
 }
@@ -10,20 +10,17 @@ import (
 type LicenseComparer func(x, y pkg.License) bool

 func DefaultLicenseComparer(x, y pkg.License) bool {
-	return cmp.Equal(x, y, cmp.Comparer(DefaultLocationComparer), cmp.Comparer(
-		func(x, y file.LocationSet) bool {
-			xs := x.ToSlice()
-			ys := y.ToSlice()
-			if len(xs) != len(ys) {
-				return false
-			}
-			for i, xe := range xs {
-				ye := ys[i]
-				if !DefaultLocationComparer(xe, ye) {
-					return false
-				}
-			}
-			return true
-		},
-	))
+	return cmp.Equal(
+		x, y,
+		cmp.Comparer(DefaultLocationComparer),
+		cmp.Comparer(buildSetComparer[file.Location, file.LocationSet](DefaultLocationComparer)),
+	)
+}
+
+func LicenseComparerWithoutLocationLayer(x, y pkg.License) bool {
+	return cmp.Equal(
+		x, y,
+		cmp.Comparer(LocationComparerWithoutLayer),
+		cmp.Comparer(buildSetComparer[file.Location, file.LocationSet](LocationComparerWithoutLayer)),
+	)
 }
@@ -11,3 +11,7 @@ type LocationComparer func(x, y file.Location) bool
 func DefaultLocationComparer(x, y file.Location) bool {
 	return cmp.Equal(x.Coordinates, y.Coordinates) && cmp.Equal(x.AccessPath, y.AccessPath)
 }
+
+func LocationComparerWithoutLayer(x, y file.Location) bool {
+	return cmp.Equal(x.Coordinates.RealPath, y.Coordinates.RealPath) && cmp.Equal(x.AccessPath, y.AccessPath)
+}
@@ -0,0 +1,24 @@
+package cmptest
+
+type slicer[T any] interface {
+	ToSlice() []T
+}
+
+func buildSetComparer[T any, S slicer[T]](l func(x, y T) bool) func(x, y S) bool {
+	return func(x, y S) bool {
+		xs := x.ToSlice()
+		ys := y.ToSlice()
+
+		if len(xs) != len(ys) {
+			return false
+		}
+		for i, xe := range xs {
+			ye := ys[i]
+			if !l(xe, ye) {
+				return false
+			}
+		}
+
+		return true
+	}
+}
@@ -4,6 +4,7 @@ import (
 	"errors"
 	"fmt"
 	"io"
+	"io/fs"
 	"os"

 	"github.com/anchore/syft/internal/log"
@@ -12,6 +13,10 @@ import (
 // CloseAndLogError closes the given io.Closer and reports any errors found as a warning in the log
 func CloseAndLogError(closer io.Closer, location string) {
 	if err := closer.Close(); err != nil {
+		// suppress "file already closed" log messages
+		if errors.Is(err, fs.ErrClosed) {
+			return
+		}
 		log.Debugf("unable to close file for location=%q: %+v", location, err)
 	}
 }
@@ -0,0 +1,9 @@
+package evidence
+
+// this package exists so that the file package can reference package evidence in tests without creating a circular dependency.
+
+const (
+	AnnotationKey        = "evidence"
+	PrimaryAnnotation    = "primary"
+	SupportingAnnotation = "supporting"
+)
@@ -145,7 +145,7 @@ func TestOwnershipByFilesRelationship(t *testing.T) {
 			assert.Len(t, relationships, len(expectedRelations))
 			for idx, expectedRelationship := range expectedRelations {
 				actualRelationship := relationships[idx]
-				if d := cmp.Diff(expectedRelationship, actualRelationship, cmptest.DefaultCommonOptions()...); d != "" {
+				if d := cmp.Diff(expectedRelationship, actualRelationship, cmptest.DefaultOptions()...); d != "" {
 					t.Errorf("unexpected relationship (-want, +got): %s", d)
 				}
 			}
@@ -1,15 +1,17 @@
 package file

 import (
+	"sort"
 	"testing"

 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"

+	"github.com/anchore/syft/internal/evidence"
 	"github.com/anchore/syft/syft/artifact"
 )

-func TestLocationSet(t *testing.T) {
+func TestLocationSet_SortPaths(t *testing.T) {

 	etcHostsLinkVar := Location{
 		LocationData: LocationData{
@@ -93,6 +95,117 @@ func TestLocationSet(t *testing.T) {
 	}
 }

+func TestLocationSet_SortEvidence(t *testing.T) {
+	primaryEvidence := map[string]string{evidence.AnnotationKey: evidence.PrimaryAnnotation}
+	secondaryEvidence := map[string]string{evidence.AnnotationKey: evidence.SupportingAnnotation}
+
+	binPrimary := Location{
+		LocationData: LocationData{
+			Coordinates: Coordinates{
+				RealPath:     "/bin",
+				FileSystemID: "a",
+			},
+			AccessPath: "/usr/bin",
+		},
+		LocationMetadata: LocationMetadata{
+			Annotations: primaryEvidence,
+		},
+	}
+
+	binSecondary := Location{
+		LocationData: LocationData{
+			Coordinates: Coordinates{
+				RealPath:     "/bin",
+				FileSystemID: "a",
+			},
+			AccessPath: "/usr/bin",
+		},
+		LocationMetadata: LocationMetadata{
+			Annotations: secondaryEvidence,
+		},
+	}
+
+	binNoEvidence := Location{
+		LocationData: LocationData{
+			Coordinates: Coordinates{
+				RealPath:     "/bin",
+				FileSystemID: "a",
+			},
+			AccessPath: "/usr/bin",
+		},
+	}
+
+	etcHostsPrimary := Location{
+		LocationData: LocationData{
+			Coordinates: Coordinates{
+				RealPath:     "/etc/hosts",
+				FileSystemID: "a",
+			},
+			AccessPath: "/var/etc/hosts",
+		},
+		LocationMetadata: LocationMetadata{
+			Annotations: primaryEvidence,
+		},
+	}
+
+	etcHostsSecondary := Location{
+		LocationData: LocationData{
+			Coordinates: Coordinates{
+				RealPath:     "/etc/hosts",
+				FileSystemID: "a",
+			},
+			AccessPath: "/var/etc/hosts",
+		},
+		LocationMetadata: LocationMetadata{
+			Annotations: secondaryEvidence,
+		},
+	}
+
+	etcHostsNoEvidence := Location{
+		LocationData: LocationData{
+			Coordinates: Coordinates{
+				RealPath:     "/etc/hosts",
+				FileSystemID: "a",
+			},
+			AccessPath: "/var/etc/hosts",
+		},
+	}
+
+	tests := []struct {
+		name     string
+		input    []Location
+		expected []Location
+	}{
+		{
+			name: "sort primary, secondary, tertiary, no evidence",
+			input: []Location{
+				binNoEvidence, binPrimary, binSecondary,
+			},
+			expected: []Location{
+				binPrimary, binSecondary, binNoEvidence,
+			},
+		},
+		{
+			name: "sort by evidence, then path",
+			input: []Location{
+				etcHostsNoEvidence, etcHostsSecondary,
+				binSecondary, binNoEvidence,
+				binPrimary, etcHostsPrimary,
+			},
+			expected: []Location{
+				binPrimary, etcHostsPrimary, binSecondary, etcHostsSecondary, binNoEvidence, etcHostsNoEvidence,
+			},
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			sort.Sort(Locations(test.input))
+			assert.Equal(t, test.expected, test.input)
+		})
+	}
+}
+
 func TestLocationSet_Hash(t *testing.T) {
 	etcAlink := Location{
 		LocationData: LocationData{
@@ -1,5 +1,7 @@
 package file

+import "github.com/anchore/syft/internal/evidence"
+
 type Locations []Location

 func (l Locations) Len() int {
@@ -7,13 +9,25 @@ func (l Locations) Len() int {
 }

 func (l Locations) Less(i, j int) bool {
-	if l[i].RealPath == l[j].RealPath {
-		if l[i].AccessPath == l[j].AccessPath {
-			return l[i].FileSystemID < l[j].FileSystemID
+	liEvidence := l[i].Annotations[evidence.AnnotationKey]
+	ljEvidence := l[j].Annotations[evidence.AnnotationKey]
+	if liEvidence == ljEvidence {
+		if l[i].RealPath == l[j].RealPath {
+			if l[i].AccessPath == l[j].AccessPath {
+				return l[i].FileSystemID < l[j].FileSystemID
+			}
+			return l[i].AccessPath < l[j].AccessPath
 		}
-		return l[i].AccessPath < l[j].AccessPath
+		return l[i].RealPath < l[j].RealPath
 	}
-	return l[i].RealPath < l[j].RealPath
+	if liEvidence == evidence.PrimaryAnnotation {
+		return true
+	}
+	if ljEvidence == evidence.PrimaryAnnotation {
+		return false
+	}
+
+	return liEvidence > ljEvidence
 }

 func (l Locations) Swap(i, j int) {
@@ -54,7 +54,7 @@ func lowerFirst(s string) string {
 }

 // Encode recursively encodes the object's properties as an ordered set of NameValue pairs
-func Encode(obj interface{}, prefix string, fn FieldName) map[string]string {
+func Encode(obj any, prefix string, fn FieldName) map[string]string {
 	if obj == nil {
 		return nil
 	}
@@ -86,7 +86,7 @@ func Sorted(values map[string]string) (out []NameValue) {
 }

 func encode(out map[string]string, value reflect.Value, prefix string, fn FieldName) {
-	if !value.IsValid() || value.Type() == nil {
+	if !value.IsValid() {
 		return
 	}

@@ -156,7 +156,7 @@ func fieldName(f reflect.StructField, prefix string, fn FieldName) (string, bool
 }

 // Decode based on the given type, applies all values to hydrate a new instance
-func Decode(typ reflect.Type, values map[string]string, prefix string, fn FieldName) interface{} {
+func Decode(typ reflect.Type, values map[string]string, prefix string, fn FieldName) any {
 	isPtr := false
 	for typ.Kind() == reflect.Ptr {
 		typ = typ.Elem()
@@ -185,7 +185,7 @@ func Decode(typ reflect.Type, values map[string]string, prefix string, fn FieldN
 }

 // DecodeInto decodes all values to hydrate the given object instance
-func DecodeInto(obj interface{}, values map[string]string, prefix string, fn FieldName) {
+func DecodeInto(obj any, values map[string]string, prefix string, fn FieldName) {
 	value := reflect.ValueOf(obj)

 	for value.Type().Kind() == reflect.Ptr {
@@ -197,7 +197,7 @@ func DecodeInto(obj interface{}, values map[string]string, prefix string, fn Fie

 //nolint:funlen,gocognit,gocyclo
 func decode(vals map[string]string, value reflect.Value, prefix string, fn FieldName) bool {
-	if !value.IsValid() || value.Type() == nil {
+	if !value.IsValid() {
 		return false
 	}

@@ -361,7 +361,7 @@ func decode(vals map[string]string, value reflect.Value, prefix string, fn Field
 	return true
 }

-func PtrToStruct(ptr interface{}) interface{} {
+func PtrToStruct(ptr any) any {
 	v := reflect.ValueOf(ptr)
 	if v.IsZero() && v.Type().Kind() != reflect.Struct {
 		return nil
@@ -371,6 +371,10 @@ func PtrToStruct(ptr interface{}) interface{} {
 		return PtrToStruct(v.Elem().Interface())
 	case reflect.Interface:
 		return PtrToStruct(v.Elem().Interface())
+	default:
+		if v.CanInterface() {
+			return v.Interface()
+		}
 	}
-	return v.Interface()
+	return nil
 }
@@ -1,6 +1,12 @@
 package helpers

-import "github.com/anchore/syft/syft/pkg"
+import (
+	"strings"
+
+	urilib "github.com/spdx/gordf/uri"
+
+	"github.com/anchore/syft/syft/pkg"
+)

 const NONE = "NONE"
 const NOASSERTION = "NOASSERTION"
@@ -14,21 +20,37 @@ func DownloadLocation(p pkg.Package) string {
 	//   (ii) the SPDX file creator has made no attempt to determine this field; or
 	//   (iii) the SPDX file creator has intentionally provided no information (no meaning should be implied by doing so).

+	var location string
 	if hasMetadata(p) {
 		switch metadata := p.Metadata.(type) {
 		case pkg.ApkDBEntry:
-			return NoneIfEmpty(metadata.URL)
+			location = metadata.URL
 		case pkg.NpmPackage:
-			return NoneIfEmpty(metadata.URL)
+			location = metadata.URL
 		case pkg.NpmPackageLockEntry:
-			return NoneIfEmpty(metadata.Resolved)
+			location = metadata.Resolved
 		case pkg.PhpComposerLockEntry:
-			return NoneIfEmpty(metadata.Dist.URL)
+			location = metadata.Dist.URL
 		case pkg.PhpComposerInstalledEntry:
-			return NoneIfEmpty(metadata.Dist.URL)
+			location = metadata.Dist.URL
 		case pkg.OpamPackage:
-			return NoneIfEmpty(metadata.URL)
+			location = metadata.URL
 		}
 	}
-	return NOASSERTION
+	return URIValue(location)
+}
+
+func isURIValid(uri string) bool {
+	_, err := urilib.NewURIRef(uri)
+	return err == nil
+}
+
+func URIValue(uri string) string {
+	if strings.ToLower(uri) != "none" {
+		if isURIValid(uri) {
+			return uri
+		}
+		return NOASSERTION
+	}
+	return NONE
 }
@@ -44,7 +44,7 @@ func Test_DownloadLocation(t *testing.T) {
 					URL: "",
 				},
 			},
-			expected: NONE,
+			expected: NOASSERTION,
 		},
 		{
 			name: "from npm package-lock should include resolved",
@@ -62,7 +62,7 @@ func Test_DownloadLocation(t *testing.T) {
 					Resolved: "",
 				},
 			},
-			expected: NONE,
+			expected: NOASSERTION,
 		},
 		{
 			name: "from php installed.json",
@@ -84,7 +84,7 @@ func Test_DownloadLocation(t *testing.T) {
 					},
 				},
 			},
-			expected: "NONE",
+			expected: NOASSERTION,
 		},
 		{
 			name: "from php composer.lock",
@@ -106,7 +106,539 @@ func Test_DownloadLocation(t *testing.T) {
 					},
 				},
 			},
-			expected: "NONE",
+			expected: NOASSERTION,
+		},
+		{
+			name: "none",
+			input: pkg.Package{
+				Metadata: pkg.PhpComposerLockEntry{
+					Dist: pkg.PhpComposerExternalReference{
+						URL: "none",
+					},
+				},
+			},
+			expected: NONE,
+		},
+		{
+			name: "none uppercase",
+			input: pkg.Package{
+				Metadata: pkg.PhpComposerLockEntry{
+					Dist: pkg.PhpComposerExternalReference{
+						URL: "NONE",
+					},
+				},
+			},
+			expected: NONE,
+		},
+		{
+			name: "invalid uri",
+			input: pkg.Package{
+				Metadata: pkg.PhpComposerLockEntry{
+					Dist: pkg.PhpComposerExternalReference{
+						URL: "example/package",
+					},
+				},
+			},
+			expected: NOASSERTION,
+		},
+		{
+			name: "Basic Git Protocol URL",
+			input: pkg.Package{
+				Metadata: pkg.PhpComposerLockEntry{
+					Dist: pkg.PhpComposerExternalReference{
+						URL: "git://git.myproject.org/MyProject",
+					},
+				},
+			},
+			expected: "git://git.myproject.org/MyProject",
+		},
+		{
+			name: "Git HTTPS URL with .git Extension",
+			input: pkg.Package{
+				Metadata: pkg.PhpComposerLockEntry{
+					Dist: pkg.PhpComposerExternalReference{
+						URL: "git+https://git.myproject.org/MyProject.git",
+					},
+				},
+			},
+			expected: "git+https://git.myproject.org/MyProject.git",
+		},
+		{
+			name: "Git HTTP URL",
+			input: pkg.Package{
+				Metadata: pkg.PhpComposerLockEntry{
+					Dist: pkg.PhpComposerExternalReference{
+						URL: "git+http://git.myproject.org/MyProject",
+					},
+				},
+			},
+			expected: "git+http://git.myproject.org/MyProject",
+		},
+		{
+			name: "Git SSH URL with .git Extension",
+			input: pkg.Package{
+				Metadata: pkg.PhpComposerLockEntry{
+					Dist: pkg.PhpComposerExternalReference{
+						URL: "git+ssh://git.myproject.org/MyProject.git",
+					},
+				},
+			},
+			expected: "git+ssh://git.myproject.org/MyProject.git",
+		},
+		{
+			name: "Git Protocol with Prefix",
+			input: pkg.Package{
+				Metadata: pkg.PhpComposerLockEntry{
+					Dist: pkg.PhpComposerExternalReference{
+						URL: "git+git://git.myproject.org/MyProject",
+					},
+				},
+			},
+			expected: "git+git://git.myproject.org/MyProject",
+		},
+		{
+			name: "Git URL with C File Fragment",
+			input: pkg.Package{
+				Metadata: pkg.PhpComposerLockEntry{
+					Dist: pkg.PhpComposerExternalReference{
+						URL: "git://git.myproject.org/MyProject#src/somefile.c",
+					},
+				},
+			},
+			expected: "git://git.myproject.org/MyProject#src/somefile.c",
+		},
+		{
+			name: "Git HTTPS URL with Java File Fragment",
+			input: pkg.Package{
+				Metadata: pkg.PhpComposerLockEntry{
+					Dist: pkg.PhpComposerExternalReference{
+						URL: "git+https://git.myproject.org/MyProject#src/Class.java",
+					},
+				},
+			},
+			expected: "git+https://git.myproject.org/MyProject#src/Class.java",
+		},
+		{
+			name: "Git URL with Master Branch",
+			input: pkg.Package{
+				Metadata: pkg.PhpComposerLockEntry{
+					Dist: pkg.PhpComposerExternalReference{
+						URL: "git://git.myproject.org/MyProject.git@master",
+					},
+				},
+			},
+			expected: "git://git.myproject.org/MyProject.git@master",
+		},
+		{
+			name: "Git HTTPS URL with Version Tag",
+			input: pkg.Package{
+				Metadata: pkg.PhpComposerLockEntry{
+					Dist: pkg.PhpComposerExternalReference{
+						URL: "git+https://git.myproject.org/MyProject.git@v1.0",
+					},
+				},
+			},
+			expected: "git+https://git.myproject.org/MyProject.git@v1.0",
+		},
+		{
+			name: "Git URL with Full Commit Hash",
+			input: pkg.Package{
+				Metadata: pkg.PhpComposerLockEntry{
+					Dist: pkg.PhpComposerExternalReference{
+						URL: "git://git.myproject.org/MyProject.git@da39a3ee5e6b4b0d3255bfef95601890afd80709",
+					},
+				},
+			},
+			expected: "git://git.myproject.org/MyProject.git@da39a3ee5e6b4b0d3255bfef95601890afd80709",
+		},
+		{
+			name: "Git HTTPS URL with Branch and CPP File Path",
+			input: pkg.Package{
+				Metadata: pkg.PhpComposerLockEntry{
+					Dist: pkg.PhpComposerExternalReference{
+						URL: "git+https://git.myproject.org/MyProject.git@master#/src/MyClass.cpp",
+					},
+				},
+			},
+			expected: "git+https://git.myproject.org/MyProject.git@master#/src/MyClass.cpp",
+		},
+		{
+			name: "Git HTTPS URL with Commit Hash and Ruby File",
+			input: pkg.Package{
+				Metadata: pkg.PhpComposerLockEntry{
+					Dist: pkg.PhpComposerExternalReference{
+						URL: "git+https://git.myproject.org/MyProject@da39a3ee5e6b4b0d3255bfef95601890afd80709#lib/variable.rb",
+					},
+				},
+			},
+			expected: "git+https://git.myproject.org/MyProject@da39a3ee5e6b4b0d3255bfef95601890afd80709#lib/variable.rb",
+		},
+		{
+			name: "Basic Mercurial HTTP URL",
+			input: pkg.Package{
+				Metadata: pkg.PhpComposerLockEntry{
+					Dist: pkg.PhpComposerExternalReference{
+						URL: "hg+http://hg.myproject.org/MyProject",
+					},
+				},
+			},
+			expected: "hg+http://hg.myproject.org/MyProject",
+		},
+		{
+			name: "Basic Mercurial HTTPS URL",
+			input: pkg.Package{
+				Metadata: pkg.PhpComposerLockEntry{
+					Dist: pkg.PhpComposerExternalReference{
+						URL: "hg+https://hg.myproject.org/MyProject",
+					},
+				},
+			},
+			expected: "hg+https://hg.myproject.org/MyProject",
+		},
+		{
+			name: "Basic Mercurial SSH URL",
+			input: pkg.Package{
+				Metadata: pkg.PhpComposerLockEntry{
+					Dist: pkg.PhpComposerExternalReference{
+						URL: "hg+ssh://hg.myproject.org/MyProject",
+					},
+				},
+			},
+			expected: "hg+ssh://hg.myproject.org/MyProject",
+		},
+		{
+			name: "Mercurial URL with File Fragment",
+			input: pkg.Package{
+				Metadata: pkg.PhpComposerLockEntry{
+					Dist: pkg.PhpComposerExternalReference{
+						URL: "hg+https://hg.myproject.org/MyProject#src/somefile.c",
+					},
+				},
+			},
+			expected: "hg+https://hg.myproject.org/MyProject#src/somefile.c",
+		},
+		{
+			name: "Mercurial URL with Java Class Fragment",
+			input: pkg.Package{
+				Metadata: pkg.PhpComposerLockEntry{
+					Dist: pkg.PhpComposerExternalReference{
+						URL: "hg+https://hg.myproject.org/MyProject#src/Class.java",
+					},
+				},
+			},
+			expected: "hg+https://hg.myproject.org/MyProject#src/Class.java",
+		},
+		{
+			name: "Mercurial URL with Commit Hash",
+			input: pkg.Package{
+				Metadata: pkg.PhpComposerLockEntry{
+					Dist: pkg.PhpComposerExternalReference{
+						URL: "hg+https://hg.myproject.org/MyProject@da39a3ee5e6b",
+					},
+				},
+			},
+			expected: "hg+https://hg.myproject.org/MyProject@da39a3ee5e6b",
+		},
+		{
+			name: "Mercurial URL with Year Reference",
+			input: pkg.Package{
+				Metadata: pkg.PhpComposerLockEntry{
+					Dist: pkg.PhpComposerExternalReference{
+						URL: "hg+https://hg.myproject.org/MyProject@2019",
+					},
+				},
+			},
+			expected: "hg+https://hg.myproject.org/MyProject@2019",
+		},
+		{
+			name: "Mercurial URL with Version Tag",
+			input: pkg.Package{
+				Metadata: pkg.PhpComposerLockEntry{
+					Dist: pkg.PhpComposerExternalReference{
+						URL: "hg+https://hg.myproject.org/MyProject@v1.0",
+					},
+				},
+			},
+			expected: "hg+https://hg.myproject.org/MyProject@v1.0",
+		},
+		{
+			name: "Mercurial URL with Feature Branch",
+			input: pkg.Package{
+				Metadata: pkg.PhpComposerLockEntry{
+					Dist: pkg.PhpComposerExternalReference{
+						URL: "hg+https://hg.myproject.org/MyProject@special_feature",
+					},
+				},
+			},
+			expected: "hg+https://hg.myproject.org/MyProject@special_feature",
+		},
+		{
+			name: "Mercurial URL with Branch and File Path",
+			input: pkg.Package{
+				Metadata: pkg.PhpComposerLockEntry{
+					Dist: pkg.PhpComposerExternalReference{
+						URL: "hg+https://hg.myproject.org/MyProject@master#/src/MyClass.cpp",
+					},
+				},
+			},
+			expected: "hg+https://hg.myproject.org/MyProject@master#/src/MyClass.cpp",
+		},
+		{
+			name: "Mercurial URL with Commit Hash and Ruby File",
+			input: pkg.Package{
+				Metadata: pkg.PhpComposerLockEntry{
+					Dist: pkg.PhpComposerExternalReference{
+						URL: "hg+https://hg.myproject.org/MyProject@da39a3ee5e6b#lib/variable.rb",
+					},
+				},
+			},
+			expected: "hg+https://hg.myproject.org/MyProject@da39a3ee5e6b#lib/variable.rb",
+		},
+
+		// Test cases for Subversion (svn) URLs
+		{
+			name: "Basic SVN URL",
+			input: pkg.Package{
+				Metadata: pkg.PhpComposerLockEntry{
+					Dist: pkg.PhpComposerExternalReference{
+						URL: "svn://svn.myproject.org/svn/MyProject",
+					},
+				},
+			},
+			expected: "svn://svn.myproject.org/svn/MyProject",
+		},
+		{
+			name: "SVN URL with Protocol Prefix",
+			input: pkg.Package{
+				Metadata: pkg.PhpComposerLockEntry{
+					Dist: pkg.PhpComposerExternalReference{
+						URL: "svn+svn://svn.myproject.org/svn/MyProject",
+					},
+				},
+			},
+			expected: "svn+svn://svn.myproject.org/svn/MyProject",
+		},
+		{
+			name: "SVN HTTP URL with Trunk",
+			input: pkg.Package{
+				Metadata: pkg.PhpComposerLockEntry{
+					Dist: pkg.PhpComposerExternalReference{
+						URL: "svn+http://svn.myproject.org/svn/MyProject/trunk",
+					},
+				},
+			},
+			expected: "svn+http://svn.myproject.org/svn/MyProject/trunk",
+		},
+		{
+			name: "SVN HTTPS URL with Trunk",
+			input: pkg.Package{
+				Metadata: pkg.PhpComposerLockEntry{
+					Dist: pkg.PhpComposerExternalReference{
+						URL: "svn+https://svn.myproject.org/svn/MyProject/trunk",
+					},
+				},
+			},
+			expected: "svn+https://svn.myproject.org/svn/MyProject/trunk",
+		},
+		{
+			name: "SVN URL with C File Fragment",
+			input: pkg.Package{
+				Metadata: pkg.PhpComposerLockEntry{
+					Dist: pkg.PhpComposerExternalReference{
+						URL: "svn+https://svn.myproject.org/MyProject#src/somefile.c",
+					},
+				},
+			},
+			expected: "svn+https://svn.myproject.org/MyProject#src/somefile.c",
+		},
+		{
+			name: "SVN URL with Java Class Fragment",
+			input: pkg.Package{
+				Metadata: pkg.PhpComposerLockEntry{
+					Dist: pkg.PhpComposerExternalReference{
+						URL: "svn+https://svn.myproject.org/MyProject#src/Class.java",
+					},
+				},
+			},
+			expected: "svn+https://svn.myproject.org/MyProject#src/Class.java",
+		},
+		{
+			name: "SVN URL with Trunk and C File Fragment",
+			input: pkg.Package{
+				Metadata: pkg.PhpComposerLockEntry{
+					Dist: pkg.PhpComposerExternalReference{
+						URL: "svn+https://svn.myproject.org/MyProject/trunk#src/somefile.c",
+					},
+				},
+			},
+			expected: "svn+https://svn.myproject.org/MyProject/trunk#src/somefile.c",
+		},
+		{
+			name: "SVN URL with Full File Path",
+			input: pkg.Package{
+				Metadata: pkg.PhpComposerLockEntry{
+					Dist: pkg.PhpComposerExternalReference{
+						URL: "svn+https://svn.myproject.org/MyProject/trunk/src/somefile.c",
+					},
+				},
+			},
+			expected: "svn+https://svn.myproject.org/MyProject/trunk/src/somefile.c",
+		},
+		{
+			name: "SVN URL with Revision Number",
+			input: pkg.Package{
+				Metadata: pkg.PhpComposerLockEntry{
+					Dist: pkg.PhpComposerExternalReference{
+						URL: "svn+https://svn.myproject.org/svn/MyProject/trunk@2019",
+					},
+				},
+			},
+			expected: "svn+https://svn.myproject.org/svn/MyProject/trunk@2019",
+		},
+		{
+			name: "SVN URL with Revision and CPP File Path",
+			input: pkg.Package{
+				Metadata: pkg.PhpComposerLockEntry{
+					Dist: pkg.PhpComposerExternalReference{
+						URL: "svn+https://svn.myproject.org/MyProject@123#/src/MyClass.cpp",
+					},
+				},
+			},
+			expected: "svn+https://svn.myproject.org/MyProject@123#/src/MyClass.cpp",
+		},
+		{
+			name: "SVN URL with Trunk, Revision and Ruby File Path",
+			input: pkg.Package{
+				Metadata: pkg.PhpComposerLockEntry{
+					Dist: pkg.PhpComposerExternalReference{
+						URL: "svn+https://svn.myproject.org/MyProject/trunk@1234#lib/variable/variable.rb",
+					},
+				},
+			},
+			expected: "svn+https://svn.myproject.org/MyProject/trunk@1234#lib/variable/variable.rb",
+		},
+
+		// Test cases for Bazaar (bzr) URLs
+		{
+			name: "Bazaar HTTPS URL with Trunk",
+			input: pkg.Package{
+				Metadata: pkg.PhpComposerLockEntry{
+					Dist: pkg.PhpComposerExternalReference{
+						URL: "bzr+https://bzr.myproject.org/MyProject/trunk",
+					},
+				},
+			},
+			expected: "bzr+https://bzr.myproject.org/MyProject/trunk",
+		},
+		{
+			name: "Bazaar HTTP URL with Trunk",
+			input: pkg.Package{
+				Metadata: pkg.PhpComposerLockEntry{
+					Dist: pkg.PhpComposerExternalReference{
+						URL: "bzr+http://bzr.myproject.org/MyProject/trunk",
+					},
+				},
+			},
+			expected: "bzr+http://bzr.myproject.org/MyProject/trunk",
+		},
+		{
+			name: "Bazaar SFTP URL with Trunk",
+			input: pkg.Package{
+				Metadata: pkg.PhpComposerLockEntry{
+					Dist: pkg.PhpComposerExternalReference{
+						URL: "bzr+sftp://myproject.org/MyProject/trunk",
+					},
+				},
+			},
+			expected: "bzr+sftp://myproject.org/MyProject/trunk",
+		},
+		{
+			name: "Bazaar SSH URL with Trunk",
+			input: pkg.Package{
+				Metadata: pkg.PhpComposerLockEntry{
+					Dist: pkg.PhpComposerExternalReference{
+						URL: "bzr+ssh://myproject.org/MyProject/trunk",
+					},
+				},
+			},
+			expected: "bzr+ssh://myproject.org/MyProject/trunk",
+		},
+		{
+			name: "Bazaar FTP URL with Trunk",
+			input: pkg.Package{
+				Metadata: pkg.PhpComposerLockEntry{
+					Dist: pkg.PhpComposerExternalReference{
+						URL: "bzr+ftp://myproject.org/MyProject/trunk",
+					},
+				},
+			},
+			expected: "bzr+ftp://myproject.org/MyProject/trunk",
+		},
+		{
+			name: "Bazaar Launchpad URL",
+			input: pkg.Package{
+				Metadata: pkg.PhpComposerLockEntry{
+					Dist: pkg.PhpComposerExternalReference{
+						URL: "bzr+lp:MyProject",
+					},
+				},
+			},
+			expected: "bzr+lp:MyProject",
+		},
+		{
+			name: "Bazaar URL with C File Fragment",
+			input: pkg.Package{
+				Metadata: pkg.PhpComposerLockEntry{
+					Dist: pkg.PhpComposerExternalReference{
+						URL: "bzr+https://bzr.myproject.org/MyProject/trunk#src/somefile.c",
+					},
+				},
+			},
+			expected: "bzr+https://bzr.myproject.org/MyProject/trunk#src/somefile.c",
+		},
+		{
+			name: "Bazaar URL with Java Class Fragment",
+			input: pkg.Package{
+				Metadata: pkg.PhpComposerLockEntry{
+					Dist: pkg.PhpComposerExternalReference{
+						URL: "bzr+https://bzr.myproject.org/MyProject/trunk#src/Class.java",
+					},
+				},
+			},
+			expected: "bzr+https://bzr.myproject.org/MyProject/trunk#src/Class.java",
+		},
+		{
+			name: "Bazaar URL with Revision",
+			input: pkg.Package{
+				Metadata: pkg.PhpComposerLockEntry{
+					Dist: pkg.PhpComposerExternalReference{
+						URL: "bzr+https://bzr.myproject.org/MyProject/trunk@2019",
+					},
+				},
+			},
+			expected: "bzr+https://bzr.myproject.org/MyProject/trunk@2019",
+		},
+		{
+			name: "Bazaar URL with Version Tag",
+			input: pkg.Package{
+				Metadata: pkg.PhpComposerLockEntry{
+					Dist: pkg.PhpComposerExternalReference{
+						URL: "bzr+http://bzr.myproject.org/MyProject/trunk@v1.0",
+					},
+				},
+			},
+			expected: "bzr+http://bzr.myproject.org/MyProject/trunk@v1.0",
+		},
+		{
+			name: "Bazaar URL with Revision and C File Fragment",
+			input: pkg.Package{
+				Metadata: pkg.PhpComposerLockEntry{
+					Dist: pkg.PhpComposerExternalReference{
+						URL: "bzr+https://bzr.myproject.org/MyProject/trunk@2019#src/somefile.c",
+					},
+				},
+			},
+			expected: "bzr+https://bzr.myproject.org/MyProject/trunk@2019#src/somefile.c",
 		},
 	}
 	for _, test := range tests {
@@ -1,12 +0,0 @@
-package helpers
-
-import (
-	"strings"
-)
-
-func NoneIfEmpty(value string) string {
-	if strings.TrimSpace(value) == "" {
-		return NONE
-	}
-	return value
-}
@@ -1,41 +0,0 @@
-package helpers
-
-import (
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-)
-
-func Test_noneIfEmpty(t *testing.T) {
-	tests := []struct {
-		name     string
-		value    string
-		expected string
-	}{
-		{
-			name:     "non-zero value",
-			value:    "something",
-			expected: "something",
-		},
-		{
-			name:     "empty",
-			value:    "",
-			expected: NONE,
-		},
-		{
-			name:     "space",
-			value:    " ",
-			expected: NONE,
-		},
-		{
-			name:     "tab",
-			value:    "\t",
-			expected: NONE,
-		},
-	}
-	for _, test := range tests {
-		t.Run(test.name, func(t *testing.T) {
-			assert.Equal(t, test.expected, NoneIfEmpty(test.value))
-		})
-	}
-}
@@ -143,7 +143,11 @@ func containsPath(p1, p2 string) bool {
 	if p1Clean == p2Clean {
 		return true
 	}
-	return strings.HasPrefix(p1Clean, p2Clean+"/")
+	if !strings.HasPrefix(p1Clean, p2Clean) {
+		return false
+	}
+	// This is done to avoid allocation of a new string
+	return len(p1Clean) > len(p2Clean) && p1Clean[len(p2Clean)] == '/'
 }

 func simpleClean(p string) string {
@@ -171,18 +171,36 @@ func parseSystemReleaseCPE(contents string) (*Release, error) {
 }

 // example: "CentOS release 6.10 (Final)"
-var redhatReleaseMatcher = regexp.MustCompile(`(.*?)\srelease\s(\d\.\d+)`)
+var redhatReleaseMatcher = regexp.MustCompile(`(?P<name>.*?)\srelease\s(?P<version>(?P<versionid>\d\.\d+).*)`)

 // parseRedhatRelease is a fallback parsing method for determining distro information in older redhat versions
 func parseRedhatRelease(contents string) (*Release, error) {
-	matches := redhatReleaseMatcher.FindAllStringSubmatch(contents, -1)
-	for _, match := range matches {
-		if len(match) < 3 {
-			continue
-		}
-		return simpleRelease(match[1], strings.ToLower(match[1]), match[2], ""), nil
+	contents = strings.TrimSpace(contents)
+	matches := internal.MatchNamedCaptureGroups(redhatReleaseMatcher, contents)
+	name := matches["name"]
+	version := matches["version"]
+	versionID := matches["versionid"]
+	if name == "" || versionID == "" {
+		return nil, nil
 	}
-	return nil, nil
+
+	id := strings.ToLower(name)
+	switch {
+	case strings.HasPrefix(id, "red hat enterprise linux"):
+		id = "rhel"
+	case strings.HasPrefix(id, "centos"):
+		// ignore the parenthetical version information
+		version = versionID
+	}
+
+	return &Release{
+		PrettyName: contents,
+		Name:       name,
+		ID:         id,
+		IDLike:     []string{id},
+		Version:    version,
+		VersionID:  versionID,
+	}, nil
 }

 func simpleRelease(prettyName, name, version, cpe string) *Release {
@@ -107,7 +107,7 @@ func TestIdentifyRelease(t *testing.T) {
 			},
 		},
 		{
-			fixture: "test-fixtures/os/redhat",
+			fixture: "test-fixtures/os/redhat/from-os-release",
 			release: &Release{
 				PrettyName:   "Red Hat Enterprise Linux Server 7.3 (Maipo)",
 				Name:         "Red Hat Enterprise Linux Server",
@@ -120,6 +120,17 @@ func TestIdentifyRelease(t *testing.T) {
 				CPEName:      "cpe:/o:redhat:enterprise_linux:7.3:GA:server",
 			},
 		},
+		{
+			fixture: "test-fixtures/os/redhat/from-redhat-release",
+			release: &Release{
+				PrettyName: "Red Hat Enterprise Linux release 8.10 (Ootpa)",
+				Name:       "Red Hat Enterprise Linux",
+				ID:         "rhel",
+				IDLike:     []string{"rhel"},
+				Version:    "8.10 (Ootpa)",
+				VersionID:  "8.10",
+			},
+		},
 		{
 			fixture: "test-fixtures/os/ubuntu",
 			release: &Release{
@@ -266,8 +277,8 @@ func TestIdentifyRelease(t *testing.T) {
 		{
 			fixture: "test-fixtures/os/centos5",
 			release: &Release{
-				PrettyName: "CentOS",
-				Name:       "centos",
+				PrettyName: "CentOS release 5.7 (Final)",
+				Name:       "CentOS",
 				ID:         "centos",
 				IDLike:     []string{"centos"},
 				Version:    "5.7",
@@ -506,8 +517,8 @@ func TestParseRedhatRelease(t *testing.T) {
 			fixture: "test-fixtures/os/centos5/etc/redhat-release",
 			name:    "Centos 5",
 			release: &Release{
-				PrettyName: "CentOS",
-				Name:       "centos",
+				PrettyName: "CentOS release 5.7 (Final)",
+				Name:       "CentOS",
 				ID:         "centos",
 				IDLike:     []string{"centos"},
 				Version:    "5.7",
@@ -0,0 +1 @@
+Red Hat Enterprise Linux release 8.10 (Ootpa)
@@ -1221,6 +1221,17 @@ func Test_Cataloger_PositiveCases(t *testing.T) {
 				Metadata:  metadata("fluent-bit-binary"),
 			},
 		},
+		{
+			logicalFixture: "fluent-bit/1.7.0-dev-3/linux-amd64",
+			expected: pkg.Package{
+				Name:      "fluent-bit",
+				Version:   "1.7.0",
+				Type:      "binary",
+				PURL:      "pkg:github/fluent/fluent-bit@1.7.0",
+				Locations: locations("fluent-bit"),
+				Metadata:  metadata("fluent-bit-binary"),
+			},
+		},
 		{
 			logicalFixture: "wp/2.9.0/linux-amd64",
 			expected: pkg.Package{
@@ -572,7 +572,8 @@ func DefaultClassifiers() []Classifier {
 				// [NUL]3.0.2[NUL]%sFluent Bit
 				// [NUL]2.2.3[NUL]Fluent Bit
 				// [NUL]2.2.1[NUL][NUL][NUL]Fluent Bit
-				`\x00(?P<version>[0-9]+\.[0-9]+\.[0-9]+)\x00[^\d]*Fluent`,
+				// [NUL]1.7.0[NUL]\x1b[1m[NUL]%sFluent Bit (versions 1.7.0-dev-3 through 1.7.0-dev-9 and 1.7.0-rc4 through 1.7.0-rc8)
+				`\x00(?P<version>[0-9]+\.[0-9]+\.[0-9]+)\x00(\x1b\[1m\x00|\x00\x00)?(%s)?Fluent`,
 			),
 			Package: "fluent-bit",
 			PURL:    mustPURL("pkg:github/fluent/fluent-bit@version"),
@@ -688,6 +688,13 @@ from-images:
    paths:
      - /fluent-bit/bin/fluent-bit

+  - version: 1.7.0-dev-3
+    images:
+      - ref: fluent/fluent-bit:1.7.0-dev-3@sha256:d8105ebefa27ca7d8ad2233ab0a4364ff43a9b31c484bde27f0d3d18988b34a0
+        platform: linux/amd64
+    paths:
+      - /fluent-bit/bin/fluent-bit
+
  - name: openssl
    version: 1.1.1w
    images:
@@ -4,8 +4,10 @@ import (
 	"context"
 	"fmt"
 	"net/url"
+	"regexp"
 	"sort"

+	"github.com/Masterminds/semver"
 	"gopkg.in/yaml.v3"

 	"github.com/anchore/syft/internal/log"
@@ -68,7 +70,26 @@ func parsePubspecLock(_ context.Context, _ file.Resolver, _ *generic.Environment
 	}

 	var names []string
-	for name := range p.Packages {
+	for name, pkg := range p.Packages {
+		if pkg.Source == "sdk" && pkg.Version == "0.0.0" {
+			// Packages that are delivered as part of an SDK (e.g. Flutter) have their
+			// version set to "0.0.0" in the package definition. The actual version
+			// should refer to the SDK version, which is defined in a dedicated section
+			// in the pubspec.lock file and uses a version range constraint.
+			//
+			// If such a package is detected, look up the version range constraint of
+			// its matching SDK, and set the minimum supported version as its new version.
+			sdkName := pkg.Description.Name
+			sdkVersion, err := p.getSdkVersion(sdkName)
+
+			if err != nil {
+				log.Tracef("failed to resolve %s SDK version for package %s: %v", sdkName, name, err)
+				continue
+			}
+			pkg.Version = sdkVersion
+			p.Packages[name] = pkg
+		}
+
 		names = append(names, name)
 	}

@@ -89,6 +110,68 @@ func parsePubspecLock(_ context.Context, _ file.Resolver, _ *generic.Environment
 	return pkgs, nil, unknown.IfEmptyf(pkgs, "unable to determine packages")
 }

+// Look up the version range constraint for a given sdk name, if found,
+// and return its lowest supported version matching that constraint.
+//
+// The sdks and their constraints are defined in the pubspec.lock file, e.g.
+//
+//	sdks:
+//		dart: ">=2.12.0 <3.0.0"
+//		flutter: ">=3.24.5"
+//
+// and stored in the pubspecLock.Sdks map during parsing.
+//
+// Example based on the data above:
+//
+//	getSdkVersion("dart") -> "2.12.0"
+//	getSdkVersion("flutter") -> "3.24.5"
+//	getSdkVersion("undefined") -> error
+func (psl *pubspecLock) getSdkVersion(sdk string) (string, error) {
+	constraint, found := psl.Sdks[sdk]
+
+	if !found {
+		return "", fmt.Errorf("cannot find %s SDK", sdk)
+	}
+
+	return parseMinimumSdkVersion(constraint)
+}
+
+// Parse a given version range constraint and return its lowest supported version.
+//
+// This is intended for packages that are part of an SDK (e.g. Flutter) and don't
+// have an explicit version string set. This will take the given constraint
+// parameter, ensure it's a valid constraint string, and return the lowest version
+// within that constraint range.
+//
+// Examples:
+//
+//	parseMinimumSdkVersion("^1.2.3") -> "1.2.3"
+//	parseMinimumSdkVersion(">=1.2.3") -> "1.2.3"
+//	parseMinimumSdkVersion(">=1.2.3 <2.0.0") -> "1.2.3"
+//	parseMinimumSdkVersion("1.2.3") -> error
+//
+// see https://dart.dev/tools/pub/dependencies#version-constraints for the
+// constraint format used in Dart SDK defintions.
+func parseMinimumSdkVersion(constraint string) (string, error) {
+	// Match strings that
+	//  1. start with either "^" or ">=" (Dart SDK constraints only use those two)
+	//  2. followed by a valid semantic version, matched as "version" named subexpression
+	//  3. followed by a space (if there's a range) or end of string (if there's only a lower boundary)
+	//                        |---1--||------------------2------------------||-3-|
+	re := regexp.MustCompile(`^(\^|>=)(?P<version>` + semver.SemVerRegex + `)( |$)`)
+
+	if !re.MatchString(constraint) {
+		return "", fmt.Errorf("unsupported or invalid constraint '%s'", constraint)
+	}
+
+	// Read "version" subexpression (see 2. above) into version variable
+	var version []byte
+	matchIndex := re.FindStringSubmatchIndex(constraint)
+	version = re.ExpandString(version, "$version", constraint, matchIndex)
+
+	return string(version), nil
+}
+
 func (p *pubspecLockPackage) getVcsURL() string {
 	if p.Source == "git" {
 		if p.Description.Path == "." {
@@ -3,6 +3,8 @@ package dart
 import (
 	"testing"

+	"github.com/stretchr/testify/assert"
+
 	"github.com/anchore/syft/syft/artifact"
 	"github.com/anchore/syft/syft/file"
 	"github.com/anchore/syft/syft/pkg"
@@ -76,14 +78,14 @@ func TestParsePubspecLock(t *testing.T) {
 		},
 		{
 			Name:      "flutter",
-			Version:   "0.0.0",
-			PURL:      "pkg:pub/flutter@0.0.0",
+			Version:   "3.24.5",
+			PURL:      "pkg:pub/flutter@3.24.5",
 			Locations: fixtureLocationSet,
 			Language:  pkg.Dart,
 			Type:      pkg.DartPubPkg,
 			Metadata: pkg.DartPubspecLockEntry{
 				Name:    "flutter",
-				Version: "0.0.0",
+				Version: "3.24.5",
 			},
 		},
 		{
@@ -113,3 +115,163 @@ func Test_corruptPubspecLock(t *testing.T) {
 		WithError().
 		TestParser(t, parsePubspecLock)
 }
+
+func Test_missingSdkEntryPubspecLock(t *testing.T) {
+	fixture := "test-fixtures/missing-sdk/pubspec.lock"
+	fixtureLocationSet := file.NewLocationSet(file.NewLocation(fixture))
+
+	// SDK version is missing, so flutter version cannot be determined and
+	// is ignored, expecting args as only package in the list as a result.
+	expected := []pkg.Package{
+		{
+			Name:      "args",
+			Version:   "1.6.0",
+			PURL:      "pkg:pub/args@1.6.0",
+			Locations: fixtureLocationSet,
+			Language:  pkg.Dart,
+			Type:      pkg.DartPubPkg,
+			Metadata: pkg.DartPubspecLockEntry{
+				Name:    "args",
+				Version: "1.6.0",
+			},
+		},
+	}
+
+	// TODO: relationships are not under test
+	var expectedRelationships []artifact.Relationship
+
+	pkgtest.TestFileParser(t, fixture, parsePubspecLock, expected, expectedRelationships)
+}
+
+func Test_invalidSdkEntryPubspecLock(t *testing.T) {
+	fixture := "test-fixtures/invalid-sdk/pubspec.lock"
+	fixtureLocationSet := file.NewLocationSet(file.NewLocation(fixture))
+
+	// SDK version is invalid, so flutter version cannot be determined and
+	// is ignored, expecting args as only package in the list as a result.
+	expected := []pkg.Package{
+		{
+			Name:      "args",
+			Version:   "1.6.0",
+			PURL:      "pkg:pub/args@1.6.0",
+			Locations: fixtureLocationSet,
+			Language:  pkg.Dart,
+			Type:      pkg.DartPubPkg,
+			Metadata: pkg.DartPubspecLockEntry{
+				Name:    "args",
+				Version: "1.6.0",
+			},
+		},
+	}
+
+	// TODO: relationships are not under test
+	var expectedRelationships []artifact.Relationship
+
+	pkgtest.TestFileParser(t, fixture, parsePubspecLock, expected, expectedRelationships)
+}
+
+func Test_sdkVersionLookup(t *testing.T) {
+	psl := &pubspecLock{
+		Sdks: make(map[string]string, 5),
+	}
+
+	psl.Sdks["minVersionSdk"] = ">=0.1.2"
+	psl.Sdks["rangeVersionSdk"] = ">=1.2.3 <2.0.0"
+	psl.Sdks["caretVersionSdk"] = "^2.3.4"
+	psl.Sdks["emptyVersionSdk"] = ""
+	psl.Sdks["invalidVersionSdk"] = "not a constraint"
+
+	var version string
+	var err error
+
+	version, err = psl.getSdkVersion("minVersionSdk")
+	assert.NoError(t, err)
+	assert.Equal(t, "0.1.2", version)
+
+	version, err = psl.getSdkVersion("rangeVersionSdk")
+	assert.NoError(t, err)
+	assert.Equal(t, "1.2.3", version)
+
+	version, err = psl.getSdkVersion("caretVersionSdk")
+	assert.NoError(t, err)
+	assert.Equal(t, "2.3.4", version)
+
+	version, err = psl.getSdkVersion("emptyVersionSdk")
+	assert.Error(t, err)
+	assert.Equal(t, "", version)
+
+	version, err = psl.getSdkVersion("invalidVersionSdk")
+	assert.Error(t, err)
+	assert.Equal(t, "", version)
+
+	version, err = psl.getSdkVersion("nonexistantSdk")
+	assert.Error(t, err)
+	assert.Equal(t, "", version)
+}
+
+func Test_sdkVersionParser_valid(t *testing.T) {
+	var version string
+	var err error
+
+	// map constraints to expected version
+	patterns := map[string]string{
+		"^0.0.0":                "0.0.0",
+		">=0.0.0":               "0.0.0",
+		"^1.23.4":               "1.23.4",
+		">=1.23.4":              "1.23.4",
+		"^11.22.33":             "11.22.33",
+		">=11.22.33":            "11.22.33",
+		"^123.123456.12345678":  "123.123456.12345678",
+		">=123.123456.12345678": "123.123456.12345678",
+		">=1.2.3 <2.3.4":        "1.2.3",
+		">=1.2.3 random string": "1.2.3",
+		">=1.2.3 >=0.1.2":       "1.2.3",
+		"^1.2":                  "1.2",
+		">=1.2":                 "1.2",
+		"^1.2.3-rc4":            "1.2.3-rc4",
+		">=1.2.3-rc4":           "1.2.3-rc4",
+		"^2.34.5+hotfix6":       "2.34.5+hotfix6",
+		">=2.34.5+hotfix6":      "2.34.5+hotfix6",
+	}
+
+	for constraint, expected := range patterns {
+		version, err = parseMinimumSdkVersion(constraint)
+		assert.NoError(t, err)
+		assert.Equalf(t, expected, version, "constraint '%s", constraint)
+	}
+}
+
+func Test_sdkVersionParser_invalid(t *testing.T) {
+	var version string
+	var err error
+
+	patterns := []string{
+		"",
+		"abc",
+		"^abc",
+		">=abc",
+		"^a.b.c",
+		">=a.b.c",
+		"1.2.34",
+		">1.2.34",
+		"<=1.2.34",
+		"<1.2.34",
+		"^1.2.3.4",
+		">=1.2.3.4",
+		"^1.x.0",
+		">=1.x.0",
+		"^1x2x3",
+		">=1x2x3",
+		"^1.-2.3",
+		">=1.-2.3",
+		"abc <1.2.34",
+		"^2.3.45hotfix6",
+		">=2.3.45hotfix6",
+	}
+
+	for _, pattern := range patterns {
+		version, err = parseMinimumSdkVersion(pattern)
+		assert.Error(t, err)
+		assert.Equalf(t, "", version, "constraint '%s'", pattern)
+	}
+}
@@ -0,0 +1,15 @@
+packages:
+  args:
+    dependency: transitive
+    description:
+      name: args
+      url: "https://pub.dartlang.org"
+    source: hosted
+    version: "1.6.0"
+  flutter:
+    dependency: "direct main"
+    description: flutter
+    source: sdk
+    version: "0.0.0"
+sdks:
+  flutter: "3.24.5"
@@ -0,0 +1,13 @@
+packages:
+  args:
+    dependency: transitive
+    description:
+      name: args
+      url: "https://pub.dartlang.org"
+    source: hosted
+    version: "1.6.0"
+  flutter:
+    dependency: "direct main"
+    description: flutter
+    source: sdk
+    version: "0.0.0"
@@ -52,3 +52,4 @@ packages:
    version: "1.11.20"
 sdks:
  dart: ">=2.12.0 <3.0.0"
+  flutter: ">=3.24.5"
@@ -30,11 +30,11 @@ func TestDpkgCataloger(t *testing.T) {
 						pkg.NewLicenseFromLocations("LGPL-2.1", file.NewLocation("/usr/share/doc/libpam-runtime/copyright")),
 					),
 					Locations: file.NewLocationSet(
-						file.NewLocation("/var/lib/dpkg/status"),
-						file.NewLocation("/var/lib/dpkg/info/libpam-runtime.preinst"),
-						file.NewLocation("/var/lib/dpkg/info/libpam-runtime.md5sums"),
-						file.NewLocation("/var/lib/dpkg/info/libpam-runtime.conffiles"),
-						file.NewLocation("/usr/share/doc/libpam-runtime/copyright"),
+						file.NewLocation("/var/lib/dpkg/status").WithAnnotation(pkg.EvidenceAnnotationKey, pkg.PrimaryEvidenceAnnotation),
+						file.NewLocation("/var/lib/dpkg/info/libpam-runtime.preinst").WithAnnotation(pkg.EvidenceAnnotationKey, pkg.SupportingEvidenceAnnotation),
+						file.NewLocation("/var/lib/dpkg/info/libpam-runtime.md5sums").WithAnnotation(pkg.EvidenceAnnotationKey, pkg.SupportingEvidenceAnnotation),
+						file.NewLocation("/var/lib/dpkg/info/libpam-runtime.conffiles").WithAnnotation(pkg.EvidenceAnnotationKey, pkg.SupportingEvidenceAnnotation),
+						file.NewLocation("/usr/share/doc/libpam-runtime/copyright").WithAnnotation(pkg.EvidenceAnnotationKey, pkg.SupportingEvidenceAnnotation),
 					),
 					Type: pkg.DebPkg,
 					Metadata: pkg.DpkgDBEntry{
@@ -104,10 +104,10 @@ func TestDpkgCataloger(t *testing.T) {
 						pkg.NewLicenseFromLocations("GPL-2", file.NewLocation("/usr/share/doc/libsqlite3-0/copyright")),
 					),
 					Locations: file.NewLocationSet(
-						file.NewLocation("/var/lib/dpkg/status.d/libsqlite3-0"),
-						file.NewLocation("/var/lib/dpkg/status.d/libsqlite3-0.md5sums"),
-						file.NewLocation("/var/lib/dpkg/status.d/libsqlite3-0.preinst"),
-						file.NewLocation("/usr/share/doc/libsqlite3-0/copyright"),
+						file.NewLocation("/var/lib/dpkg/status.d/libsqlite3-0").WithAnnotation(pkg.EvidenceAnnotationKey, pkg.PrimaryEvidenceAnnotation),
+						file.NewLocation("/var/lib/dpkg/status.d/libsqlite3-0.md5sums").WithAnnotation(pkg.EvidenceAnnotationKey, pkg.SupportingEvidenceAnnotation),
+						file.NewLocation("/var/lib/dpkg/status.d/libsqlite3-0.preinst").WithAnnotation(pkg.EvidenceAnnotationKey, pkg.SupportingEvidenceAnnotation),
+						file.NewLocation("/usr/share/doc/libsqlite3-0/copyright").WithAnnotation(pkg.EvidenceAnnotationKey, pkg.SupportingEvidenceAnnotation),
 					),
 					Type: pkg.DebPkg,
 					Metadata: pkg.DpkgDBEntry{
@@ -123,7 +123,7 @@ func newDotnetPackagesLockPackage(name string, dep dotnetPackagesLockDep, locati
 		Type:        dep.Type,
 	}

-	return &pkg.Package{
+	p := &pkg.Package{
 		Name:      name,
 		Version:   dep.Resolved,
 		Type:      pkg.DotnetPkg,
@@ -132,6 +132,10 @@ func newDotnetPackagesLockPackage(name string, dep dotnetPackagesLockDep, locati
 		Language:  pkg.Dotnet,
 		PURL:      packagesLockPackageURL(name, dep.Resolved),
 	}
+
+	p.SetID()
+
+	return p
 }

 func packagesLockPackageURL(name, version string) string {
@@ -505,7 +505,7 @@ func (s *Section) Data() ([]byte, error) {
 // 	return dwarf.New(abbrev, nil, nil, info, line, nil, ranges, str)
 // }

-// readImportID returns the import file IDs stored inside the .loader section.
+// readImportIDs returns the import file IDs stored inside the .loader section.
 // Library name pattern is either path/base/member or base/member
 func (f *File) readImportIDs(s *Section) ([]string, error) {
 	// Read loader header
@@ -139,14 +139,14 @@ func Test_stdlibPackageAndRelationships_values(t *testing.T) {
 	require.Len(t, gotPkgs, 1)

 	gotPkg := gotPkgs[0]
-	if d := cmp.Diff(expectedPkg, gotPkg, cmptest.DefaultCommonOptions()...); d != "" {
+	if d := cmp.Diff(expectedPkg, gotPkg, cmptest.DefaultOptions()...); d != "" {
 		t.Errorf("unexpected package (-want +got): %s", d)
 	}

 	require.Len(t, gotRels, 1)
 	gotRel := gotRels[0]

-	if d := cmp.Diff(expectedRel, gotRel, cmptest.DefaultCommonOptions()...); d != "" {
+	if d := cmp.Diff(expectedRel, gotRel, cmptest.DefaultOptions()...); d != "" {
 		t.Errorf("unexpected relationship (-want +got): %s", d)
 	}

@@ -378,6 +378,12 @@
      "build-metrics": [
        "cpe:2.3:a:jenkins:build-metrics:*:*:*:*:*:jenkins:*:*"
      ],
+      "build-monitor": [
+        "cpe:2.3:a:jenkins:build_monitor_view:*:*:*:*:*:jenkins:*:*"
+      ],
+      "build-monitor-plugin": [
+        "cpe:2.3:a:jenkins:build_monitor_view:*:*:*:*:*:jenkins:*:*"
+      ],
      "build-notifications": [
        "cpe:2.3:a:jenkins:build_notifications:*:*:*:*:*:jenkins:*:*"
      ],
@@ -3633,7 +3639,7 @@
        "cpe:2.3:a:json-bigint_project:json-bigint:*:*:*:*:*:node.js:*:*"
      ],
      "json-pointer": [
-        "cpe:2.3:a:smallpdf:json-pointer:*:*:*:*:*:node.js:*:*"
+        "cpe:2.3:a:manuelstofer:json-pointer:*:*:*:*:*:node.js:*:*"
      ],
      "json-web-token": [
        "cpe:2.3:a:joaquimserafim:json_web_token:*:*:*:*:*:node.js:*:*"
@@ -3645,7 +3651,7 @@
        "cpe:2.3:a:json8-merge-patch_project:json8-merge-patch:*:*:*:*:*:node.js:*:*"
      ],
      "jsonpointer": [
-        "cpe:2.3:a:jsonpointer_project:jsonpointer:*:*:*:*:*:node.js:*:*"
+        "cpe:2.3:a:janl:jsonpointer:*:*:*:*:*:node.js:*:*"
      ],
      "jsonwebtoken": [
        "cpe:2.3:a:auth0:jsonwebtoken:*:*:*:*:*:node.js:*:*"
@@ -5576,6 +5582,9 @@
      "XML2Dict": [
        "cpe:2.3:a:xml2dict_project:xml2dict:*:*:*:*:*:python:*:*"
      ],
+      "aiohttp-session": [
+        "cpe:2.3:a:aio-libs:aiohttp_session:*:*:*:*:*:*:*:*"
+      ],
      "aniso8601": [
        "cpe:2.3:a:aniso8601_project:aniso8601:*:*:*:*:*:*:*:*"
      ],
@@ -6316,6 +6325,9 @@
      "pghero": [
        "cpe:2.3:a:pghero_project:pghero:*:*:*:*:*:ruby:*:*"
      ],
+      "phlex": [
+        "cpe:2.3:a:phlex:phlex:*:*:*:*:*:ruby:*:*"
+      ],
      "point-cli": [
        "cpe:2.3:a:point-cli_project:point-cli:*:*:*:*:*:ruby:*:*"
      ],
@@ -7371,6 +7383,9 @@
      "adif-log-search-widget": [
        "cpe:2.3:a:dh9sb.dx-info:adif_log_search_widget:*:*:*:*:*:wordpress:*:*"
      ],
+      "adirectory": [
+        "cpe:2.3:a:quomodosoft:adirectory:*:*:*:*:*:wordpress:*:*"
+      ],
      "adl-team": [
        "cpe:2.3:a:wpwax:team:*:*:*:*:*:wordpress:*:*"
      ],
@@ -7780,6 +7795,9 @@
      "animated-number-counters": [
        "cpe:2.3:a:wpmart:animated_number_counters:*:*:*:*:*:wordpress:*:*"
      ],
+      "animategl": [
+        "cpe:2.3:a:creativeinteractivemedia:animategl_animations:*:*:*:*:*:wordpress:*:*"
+      ],
      "announcer": [
        "cpe:2.3:a:aakashweb:announcer:*:*:*:*:*:wordpress:*:*"
      ],
@@ -7874,6 +7892,9 @@
      "aprils-super-functions-pack": [
        "cpe:2.3:a:april\\'s_super_functions_pack_project:april\\'s_super_functions_pack:*:*:*:*:*:wordpress:*:*"
      ],
+      "apus-framework": [
+        "cpe:2.3:a:apusthemes:superio:*:*:*:*:*:wordpress:*:*"
+      ],
      "ar-for-wordpress": [
        "cpe:2.3:a:webandprint:ar:*:*:*:*:*:wordpress:*:*"
      ],
@@ -7881,9 +7902,15 @@
        "cpe:2.3:a:archivist_-_custom_archive_templates_project:archivist_-_custom_archive_templates:*:*:*:*:*:wordpress:*:*",
        "cpe:2.3:a:ericteubert:archivist_-_custom_archive_templates:*:*:*:*:*:wordpress:*:*"
      ],
+      "arconix-faq": [
+        "cpe:2.3:a:tychesoftwares:arconix_faq:*:*:*:*:*:wordpress:*:*"
+      ],
      "arconix-shortcodes": [
        "cpe:2.3:a:tychesoftwares:arconix_shortcodes:*:*:*:*:*:wordpress:*:*"
      ],
+      "arena-liveblog-and-chat-tool": [
+        "cpe:2.3:a:arena.im:arena.im:*:*:*:*:*:wordpress:*:*"
+      ],
      "arforms-form-builder": [
        "cpe:2.3:a:reputeinfosystems:arforms_form_builder:*:*:*:*:*:wordpress:*:*",
        "cpe:2.3:a:reputeinfosystems:contact_form\\,_survey_\\\u0026_popup_form_plugin_for_wordpress_-_arforms_form_builder:*:*:*:*:*:wordpress:*:*"
@@ -7951,7 +7978,7 @@
        "cpe:2.3:a:atarim:visual_website_collaboration\\,_feedback_\\\u0026_project_management:*:*:*:*:*:wordpress:*:*"
      ],
      "athemes-addons-for-elementor-lite": [
-        "cpe:2.3:a:athemes:athemes_addons_for_elementor:*:*:*:*:*:wordpress:*:*"
+        "cpe:2.3:a:athemes:athemes_addons_for_elementor:*:*:*:*:free:wordpress:*:*"
      ],
      "attendance-manager": [
        "cpe:2.3:a:sukimalab:attendance_manager:*:*:*:*:*:wordpress:*:*"
@@ -8271,6 +8298,9 @@
      "better-anchor-links": [
        "cpe:2.3:a:ludek:better_anchor_links:*:*:*:*:*:wordpress:*:*"
      ],
+      "better-elementor-addons": [
+        "cpe:2.3:a:kitforest:better_elementor_addons:*:*:*:*:*:wordpress:*:*"
+      ],
      "better-font-awesome": [
        "cpe:2.3:a:better_font_awesome_project:better_font_awesome:*:*:*:*:*:wordpress:*:*"
      ],
@@ -8539,7 +8569,9 @@
      ],
      "brizy": [
        "cpe:2.3:a:brizy:brizy-page_builder:*:*:*:*:*:wordpress:*:*",
-        "cpe:2.3:a:brizy:brizy:*:*:*:*:free:wordpress:*:*"
+        "cpe:2.3:a:brizy:brizy:*:*:*:*:-:wordpress:*:*",
+        "cpe:2.3:a:brizy:brizy:*:*:*:*:free:wordpress:*:*",
+        "cpe:2.3:a:brizy:brizy:*:*:*:*:pro:wordpress:*:*"
      ],
      "broken-link-checker": [
        "cpe:2.3:a:managewp:broken_link_checker:*:*:*:*:*:wordpress:*:*"
@@ -8657,6 +8689,9 @@
      "business-manager": [
        "cpe:2.3:a:linksoftwarellc:business_manager:*:*:*:*:*:wordpress:*:*"
      ],
+      "button-block": [
+        "cpe:2.3:a:bplugins:button_block:*:*:*:*:*:wordpress:*:*"
+      ],
      "button-generation": [
        "cpe:2.3:a:wow-company:button_generator:*:*:*:*:*:wordpress:*:*"
      ],
@@ -8897,6 +8932,9 @@
      "ce21-suite": [
        "cpe:2.3:a:ce21:ce21_suite:*:*:*:*:*:wordpress:*:*"
      ],
+      "cf-geoplugin": [
+        "cpe:2.3:a:infinitumform:geo_controller:*:*:*:*:*:wordpress:*:*"
+      ],
      "cf7-constant-contact": [
        "cpe:2.3:a:crmperks:integration_for_constant_contact_and_contact_form_7\\,_wpforms\\,_elementor\\,_ninja:*:*:*:*:*:wordpress:*:*"
      ],
@@ -9119,6 +9157,9 @@
        "cpe:2.3:a:code_snippets_extended_project:code_snippets_extended:*:*:*:*:*:wordpress:*:*",
        "cpe:2.3:a:codesnippets:code_snippets:*:*:*:*:*:wordpress:*:*"
      ],
+      "codebard-help-desk": [
+        "cpe:2.3:a:codebard:codebard_help_desk:*:*:*:*:*:wordpress:*:*"
+      ],
      "codecolorer": [
        "cpe:2.3:a:codecolorer_project:codecolorer:*:*:*:*:*:wordpress:*:*"
      ],
@@ -10028,6 +10069,9 @@
      "directorypress": [
        "cpe:2.3:a:designinvento:directorypress:*:*:*:*:*:wordpress:*:*"
      ],
+      "directorypress-frontend": [
+        "cpe:2.3:a:designinvento:directorypress:*:*:*:*:*:wordpress:*:*"
+      ],
      "disable-comments": [
        "cpe:2.3:a:disable_comments:disable_comments_project:*:*:*:*:*:wordpress:*:*"
      ],
@@ -10497,7 +10541,7 @@
        "cpe:2.3:a:wpai:elegant_themes_icons:*:*:*:*:*:wordpress:*:*"
      ],
      "element-ready-lite": [
-        "cpe:2.3:a:quomodosoft:elementsready:*:*:*:*:*:wordpress:*:*"
+        "cpe:2.3:a:quomodosoft:elementsready:*:*:*:*:free:wordpress:*:*"
      ],
      "elementary-addons": [
        "cpe:2.3:a:camilluskillus:elementary_addons:*:*:*:*:*:wordpress:*:*"
@@ -10524,6 +10568,9 @@
      "elespare": [
        "cpe:2.3:a:elespare:elespare:*:*:*:*:*:wordpress:*:*"
      ],
+      "elex-helpdesk-customer-support-ticket-system": [
+        "cpe:2.3:a:elula:wsdesk:*:*:*:*:free:wordpress:*:*"
+      ],
      "elo-rating-shortcode": [
        "cpe:2.3:a:timelord:elo_rating_shortcode:*:*:*:*:*:wordpress:*:*"
      ],
@@ -10568,6 +10615,9 @@
      "email-users": [
        "cpe:2.3:a:email_users_project:email_users:*:*:*:*:*:wordpress:*:*"
      ],
+      "emails-verification-for-woocommerce": [
+        "cpe:2.3:a:wpfactory:customer_email_verification_for_woocommerce:*:*:*:*:*:wordpress:*:*"
+      ],
      "embed-any-document": [
        "cpe:2.3:a:awsm:embed_any_document:*:*:*:*:*:wordpress:*:*"
      ],
@@ -10617,8 +10667,8 @@
        "cpe:2.3:a:english_wordpress_admin_project:english_wordpress_admin:*:*:*:*:*:wordpress:*:*"
      ],
      "enhanced-e-commerce-for-woocommerce-store": [
-        "cpe:2.3:a:conversios:google_analytics_integration_for_woocommerce:*:*:*:*:*:wordpress:*:*",
-        "cpe:2.3:a:tatvic:conversios.io:*:*:*:*:*:wordpress:*:*"
+        "cpe:2.3:a:conversios:conversios:*:*:*:*:*:wordpress:*:*",
+        "cpe:2.3:a:conversios:google_analytics_integration_for_woocommerce:*:*:*:*:*:wordpress:*:*"
      ],
      "enhanced-plugin-admin": [
        "cpe:2.3:a:infolific:enhanced_plugin_admin:*:*:*:*:*:wordpress:*:*"
@@ -10690,6 +10740,9 @@
      "essential-widgets": [
        "cpe:2.3:a:catchplugins:essential_widgets:*:*:*:*:*:wordpress:*:*"
      ],
+      "essential-wp-real-estate": [
+        "cpe:2.3:a:smartdatasoft:essential_wp_real_estate:*:*:*:*:*:wordpress:*:*"
+      ],
      "estatik": [
        "cpe:2.3:a:estatik:estatik:*:*:*:*:*:wordpress:*:*"
      ],
@@ -11188,6 +11241,9 @@
      "font-awesome-4-menus": [
        "cpe:2.3:a:newnine:font_awesome_4_menus:*:*:*:*:*:wordpress:*:*"
      ],
+      "fontific": [
+        "cpe:2.3:a:andrei_ivasiuc:fontific:*:*:*:*:*:wordpress:*:*"
+      ],
      "fontmeister": [
        "cpe:2.3:a:fontmeister_project:fontmeister:*:*:*:*:*:wordpress:*:*"
      ],
@@ -11202,7 +11258,8 @@
        "cpe:2.3:a:fooplugins:foogallery:*:*:*:*:premium:wordpress:*:*"
      ],
      "foogallery-premium": [
-        "cpe:2.3:a:fooplugins:foogallery:*:*:*:*:-:wordpress:*:*"
+        "cpe:2.3:a:fooplugins:foogallery:*:*:*:*:-:wordpress:*:*",
+        "cpe:2.3:a:fooplugins:foogallery:*:*:*:*:premium:wordpress:*:*"
      ],
      "football-leagues-by-anwppro": [
        "cpe:2.3:a:anwp:football_leagues:*:*:*:*:free:wordpress:*:*",
@@ -11847,6 +11904,12 @@
      "happyforms": [
        "cpe:2.3:a:happyforms:happyforms:*:*:*:*:*:wordpress:*:*"
      ],
+      "hash-elements": [
+        "cpe:2.3:a:hashthemes:hash_elements:*:*:*:*:*:wordpress:*:*"
+      ],
+      "hash-form": [
+        "cpe:2.3:a:hashthemes:hash_form:*:*:*:*:*:wordpress:*:*"
+      ],
      "hashbar-wp-notification-bar": [
        "cpe:2.3:a:hasthemes:hashbar:*:*:*:*:*:wordpress:*:*"
      ],
@@ -13063,6 +13126,9 @@
      "maintenance": [
        "cpe:2.3:a:webfactoryltd:maintenance:*:*:*:*:*:wordpress:*:*"
      ],
+      "maintenance-page": [
+        "cpe:2.3:a:themegrill:maintenance_page:*:*:*:*:*:wordpress:*:*"
+      ],
      "mainwp": [
        "cpe:2.3:a:mainwp:mainwp_dashboard:*:*:*:*:*:wordpress:*:*"
      ],
@@ -13392,6 +13458,9 @@
      "miniorange-login-with-eve-online-google-facebook": [
        "cpe:2.3:a:miniorange:oauth_single_sign_on:*:*:*:*:*:wordpress:*:*"
      ],
+      "miniorange-malware-protection": [
+        "cpe:2.3:a:miniorange:malware_scanner:*:*:*:*:*:wordpress:*:*"
+      ],
      "miniorange-oauth-20-server": [
        "cpe:2.3:a:miniorange:wp_oauth_server:*:*:*:*:*:wordpress:*:*"
      ],
@@ -14438,6 +14507,9 @@
      "plugnedit": [
        "cpe:2.3:a:simplysymphony:plugnedit:*:*:*:*:*:wordpress:*:*"
      ],
+      "pocket-news-generator": [
+        "cpe:2.3:a:logicore:pocket_news_generator:*:*:*:*:*:wordpress:*:*"
+      ],
      "podcast-channels": [
        "cpe:2.3:a:podcast_channels_project:podcast_channels:*:*:*:*:*:wordpress:*:*"
      ],
@@ -15216,7 +15288,8 @@
      ],
      "responsive-add-ons": [
        "cpe:2.3:a:cyberchimps:gutenberg_\\\u0026_elementor_templates_importer_for_responsive:*:*:*:*:*:wordpress:*:*",
-        "cpe:2.3:a:cyberchimps:responsive_addons:*:*:*:*:*:wordpress:*:*"
+        "cpe:2.3:a:cyberchimps:responsive_addons:*:*:*:*:*:wordpress:*:*",
+        "cpe:2.3:a:cyberchimps:responsive_blocks:*:*:*:*:*:wordpress:*:*"
      ],
      "responsive-addons-for-elementor": [
        "cpe:2.3:a:cyberchimps:responsive_addons_for_elementor:*:*:*:*:*:wordpress:*:*"
@@ -15278,6 +15351,9 @@
      "restrict-for-elementor": [
        "cpe:2.3:a:tickera:restrict_for_elementor:*:*:*:*:*:wordpress:*:*"
      ],
+      "restrict-user-access": [
+        "cpe:2.3:a:dev.institute:restrict_user_access:*:*:*:*:*:wordpress:*:*"
+      ],
      "restrict-usernames-emails-characters": [
        "cpe:2.3:a:benaceur-php:restrict_usernames_emails_characters:*:*:*:*:*:wordpress:*:*"
      ],
@@ -16096,6 +16172,9 @@
      "site-reviews": [
        "cpe:2.3:a:geminilabs:site_reviews:*:*:*:*:*:wordpress:*:*"
      ],
+      "site-search-360": [
+        "cpe:2.3:a:sitesearch360:site_search_360:*:*:*:*:*:wordpress:*:*"
+      ],
      "sitebuilder-dynamic-components": [
        "cpe:2.3:a:brandonclark:sitebuilder_dynamic_components:*:*:*:*:*:wordpress:*:*",
        "cpe:2.3:a:sitebuilder_dynamic_components_project:sitebuilder_dynamic_components:*:*:*:*:*:wordpress:*:*"
@@ -16115,6 +16194,9 @@
      "siteorigin-panels": [
        "cpe:2.3:a:siteorigin:page_builder:*:*:*:*:*:wordpress:*:*"
      ],
+      "sitepact-klaviyo-contact-form-7": [
+        "cpe:2.3:a:sitepact:contact_form_7_extension_for_klaviyo:*:*:*:*:*:wordpress:*:*"
+      ],
      "sitepress-multilingual-cms": [
        "cpe:2.3:a:onthegosystems:sitepress-multilingual-cms:*:*:*:*:*:wordpress:*:*"
      ],
@@ -16133,6 +16215,9 @@
      "sksdev-toolkit": [
        "cpe:2.3:a:sksdev:sksdev_toolkit:*:*:*:*:*:wordpress:*:*"
      ],
+      "skt-addons-for-elementor": [
+        "cpe:2.3:a:sktthemes:skt_addons_for_elementor:*:*:*:*:*:wordpress:*:*"
+      ],
      "skt-templates": [
        "cpe:2.3:a:sktthemes:skt_templates:*:*:*:*:*:wordpress:*:*"
      ],
@@ -16177,6 +16262,9 @@
      "slider-blocks": [
        "cpe:2.3:a:makegutenblock:gutslider:*:*:*:*:*:wordpress:*:*"
      ],
+      "slider-by-supsystic": [
+        "cpe:2.3:a:supsystic:slider:*:*:*:*:*:wordpress:*:*"
+      ],
      "slider-comparison-image-before-and-after": [
        "cpe:2.3:a:artembovkun:slider_comparison_image_before_and_after:*:*:*:*:*:wordpress:*:*"
      ],
@@ -16209,6 +16297,9 @@
      "slideshow-se": [
        "cpe:2.3:a:slideshow_se_project:slideshow_se:*:*:*:*:*:wordpress:*:*"
      ],
+      "small-package-quotes-ups-edition": [
+        "cpe:2.3:a:enituretechnology:small_package_quotes:*:*:*:*:ups:wordpress:*:*"
+      ],
      "smart-app-banner": [
        "cpe:2.3:a:wandlesoftware:smart_app_banner:*:*:*:*:*:wordpress:*:*"
      ],
@@ -16581,6 +16672,9 @@
      "strategery-migrations": [
        "cpe:2.3:a:strategery_migrations_project:strategery_migrations:*:*:*:*:*:wordpress:*:*"
      ],
+      "stray-quotes": [
+        "cpe:2.3:a:unalignedcode:stray_random_quotes:*:*:*:*:*:wordpress:*:*"
+      ],
      "stream": [
        "cpe:2.3:a:xwp:stream:*:*:*:*:*:wordpress:*:*"
      ],
@@ -16751,6 +16845,9 @@
      "tags-cloud-manager": [
        "cpe:2.3:a:tags_cloud_manager_project:tags_cloud_manager:*:*:*:*:*:wordpress:*:*"
      ],
+      "tainacan": [
+        "cpe:2.3:a:tainacan:tainacan:*:*:*:*:*:wordpress:*:*"
+      ],
      "tarteaucitronjs": [
        "cpe:2.3:a:tarteaucitron.js_-_cookies_legislation_\\\u0026_gdpr_project:tarteaucitron.js_-_cookies_legislation_\\\u0026_gdpr:*:*:*:*:*:wordpress:*:*"
      ],
@@ -16861,6 +16958,9 @@
      "the-moneytizer": [
        "cpe:2.3:a:themoneytizer:the_moneytizer:*:*:*:*:*:wordpress:*:*"
      ],
+      "the-pack-addon": [
+        "cpe:2.3:a:webangon:the_pack_elementor_addons:*:*:*:*:*:wordpress:*:*"
+      ],
      "the-plus-addons-for-block-editor": [
        "cpe:2.3:a:posimyth:nexter_blocks:*:*:*:*:*:wordpress:*:*"
      ],
@@ -16938,6 +17038,9 @@
      "themify-portfolio-post": [
        "cpe:2.3:a:themify:portfolio_post:*:*:*:*:*:wordpress:*:*"
      ],
+      "themify-shortcodes": [
+        "cpe:2.3:a:themify:themify_shortcodes:*:*:*:*:*:wordpress:*:*"
+      ],
      "themify-wc-product-filter": [
        "cpe:2.3:a:themify:product_filter:*:*:*:*:*:wordpress:*:*",
        "cpe:2.3:a:themify:woocommerce_product_filter:*:*:*:*:*:wordpress:*:*"
@@ -17051,6 +17154,9 @@
      "tour-operator": [
        "cpe:2.3:a:lightspeedwp:lsx_tour_operator:*:*:*:*:*:wordpress:*:*"
      ],
+      "tourfic": [
+        "cpe:2.3:a:themefic:tourfic:*:*:*:*:*:wordpress:*:*"
+      ],
      "tp-education": [
        "cpe:2.3:a:themepalace:tp_education:*:*:*:*:*:wordpress:*:*"
      ],
@@ -17381,8 +17487,8 @@
        "cpe:2.3:a:kaizencoders:url_shortify:*:*:*:*:*:wordpress:*:*"
      ],
      "usc-e-shop": [
-        "cpe:2.3:a:collne:welcart:*:*:*:*:*:wordpress:*:*",
-        "cpe:2.3:a:collne:welcart_e-commerce:*:*:*:*:*:wordpress:*:*"
+        "cpe:2.3:a:collne:welcart_e-commerce:*:*:*:*:*:wordpress:*:*",
+        "cpe:2.3:a:welcart:welcart_e-commerce:*:*:*:*:*:wordpress:*:*"
      ],
      "use-any-font": [
        "cpe:2.3:a:anyfont_plugin_project:anyfont:*:*:*:*:*:wordpress:*:*",
@@ -19069,6 +19175,9 @@
      "wp-mpdf": [
        "cpe:2.3:a:wp-mpdf_project:wp-mpdf:*:*:*:*:*:wordpress:*:*"
      ],
+      "wp-multi-store-locator": [
+        "cpe:2.3:a:wpexperts:wp_multi_store_locator:*:*:*:*:*:wordpress:*:*"
+      ],
      "wp-nested-pages": [
        "cpe:2.3:a:kylephillips:nested_pages:*:*:*:*:*:wordpress:*:*"
      ],
@@ -19235,7 +19344,7 @@
        "cpe:2.3:a:wedevs:recaptcha_integration:*:*:*:*:*:wordpress:*:*"
      ],
      "wp-recipe-maker": [
-        "cpe:2.3:a:bootstrapped:wp_recipe_maker:*:*:*:*:*:wordpress:*:*"
+        "cpe:2.3:a:bootstrapped:wp_recipe_maker:*:*:*:*:free:wordpress:*:*"
      ],
      "wp-remote-site-search": [
        "cpe:2.3:a:brainstormforce:wp_remote_site_search:*:*:*:*:*:wordpress:*:*"
@@ -19333,6 +19442,7 @@
        "cpe:2.3:a:jamos:wp_show_more:*:*:*:*:*:wordpress:*:*"
      ],
      "wp-show-posts": [
+        "cpe:2.3:a:generatepress:wp_show_posts:*:*:*:*:*:wordpress:*:*",
        "cpe:2.3:a:wp_show_posts_project:wp_show_posts:*:*:*:*:*:wordpress:*:*"
      ],
      "wp-simple-booking-calendar": [
@@ -19658,7 +19768,7 @@
        "cpe:2.3:a:wordpress_page_contact_project:wordpress_page_contact:*:*:*:*:*:wordpress:*:*"
      ],
      "wpappninja": [
-        "cpe:2.3:a:wpmobile.app_project:wpmobile.app:*:*:*:*:*:wordpress:*:*"
+        "cpe:2.3:a:amauri:wpmobile.app:*:*:*:*:*:wordpress:*:*"
      ],
      "wpaudio-mp3-player": [
        "cpe:2.3:a:wpaudio_mp3_player_project:wpaudio_mp3_player:*:*:*:*:*:wordpress:*:*"
@@ -19666,9 +19776,15 @@
      "wpb-advanced-faq": [
        "cpe:2.3:a:wpbean:wpb_advanced_faq:*:*:*:*:*:wordpress:*:*"
      ],
+      "wpb-elementor-addons": [
+        "cpe:2.3:a:wpbean:wpb_elementor_addons:*:*:*:*:*:wordpress:*:*"
+      ],
      "wpb-show-core": [
        "cpe:2.3:a:wpb_show_core_project:wpb_show_core:*:*:*:*:*:wordpress:*:*"
      ],
+      "wpbits-addons-for-elementor": [
+        "cpe:2.3:a:wpbits:wpbits_addons_for_elementor_page_builder:*:*:*:*:*:wordpress:*:*"
+      ],
      "wpbulky-wp-bulk-edit-post-types": [
        "cpe:2.3:a:villatheme:wpbulky:*:*:*:*:*:wordpress:*:*"
      ],
@@ -19751,7 +19867,7 @@
        "cpe:2.3:a:wpfront:wpfront_user_role_editor:*:*:*:*:*:wordpress:*:*"
      ],
      "wpfunnels": [
-        "cpe:2.3:a:coderex:wpfunnels:*:*:*:*:*:wordpress:*:*"
+        "cpe:2.3:a:getwpfunnels:wpfunnels:*:*:*:*:*:wordpress:*:*"
      ],
      "wpgenious-job-listing": [
        "cpe:2.3:a:wpgenious:wpgenius_job_listing:*:*:*:*:*:wordpress:*:*"
@@ -19772,6 +19888,9 @@
        "cpe:2.3:a:xplodedthemes:wpide:*:*:*:*:*:wordpress:*:*",
        "cpe:2.3:a:xplodedthemes:wpide_-_file_manager_\\\u0026_code_editor:*:*:*:*:*:wordpress:*:*"
      ],
+      "wpify-woo": [
+        "cpe:2.3:a:wpify:woo_czech:*:*:*:*:*:wordpress:*:*"
+      ],
      "wpjam-basic": [
        "cpe:2.3:a:wpjam_basic_project:wpjam_basic:*:*:*:*:*:wordpress:*:*"
      ],
@@ -146,29 +146,8 @@ func (p *CatalogTester) ExpectsAssertion(a func(t *testing.T, pkgs []pkg.Package
 }

 func (p *CatalogTester) IgnoreLocationLayer() *CatalogTester {
-	p.locationComparer = func(x, y file.Location) bool {
-		return cmp.Equal(x.Coordinates.RealPath, y.Coordinates.RealPath) && cmp.Equal(x.AccessPath, y.AccessPath)
-	}
-
-	// we need to update the license comparer to use the ignored location layer
-	p.licenseComparer = func(x, y pkg.License) bool {
-		return cmp.Equal(x, y, cmp.Comparer(p.locationComparer), cmp.Comparer(
-			func(x, y file.LocationSet) bool {
-				xs := x.ToSlice()
-				ys := y.ToSlice()
-				if len(xs) != len(ys) {
-					return false
-				}
-				for i, xe := range xs {
-					ye := ys[i]
-					if !p.locationComparer(xe, ye) {
-						return false
-					}
-				}
-
-				return true
-			}))
-	}
+	p.locationComparer = cmptest.LocationComparerWithoutLayer
+	p.licenseComparer = cmptest.LicenseComparerWithoutLocationLayer
 	return p
 }

@@ -272,7 +251,7 @@ func (p *CatalogTester) TestCataloger(t *testing.T, cataloger pkg.Cataloger) {
 func (p *CatalogTester) assertPkgs(t *testing.T, pkgs []pkg.Package, relationships []artifact.Relationship) {
 	t.Helper()

-	p.compareOptions = append(p.compareOptions, cmptest.CommonOptions(p.licenseComparer, p.locationComparer)...)
+	p.compareOptions = append(p.compareOptions, cmptest.BuildOptions(p.licenseComparer, p.locationComparer)...)

 	{
 		r := cmptest.NewDiffReporter()
@@ -325,53 +304,20 @@ func TestFileParserWithEnv(t *testing.T, fixturePath string, parser generic.Pars
 	NewCatalogTester().FromFile(t, fixturePath).WithEnv(env).Expects(expectedPkgs, expectedRelationships).TestParser(t, parser)
 }

-func AssertPackagesEqual(t *testing.T, a, b pkg.Package) {
+func AssertPackagesEqual(t *testing.T, a, b pkg.Package, userOpts ...cmp.Option) {
 	t.Helper()
-	opts := []cmp.Option{
-		cmpopts.IgnoreFields(pkg.Package{}, "id"), // note: ID is not deterministic for test purposes
-		cmp.Comparer(
-			func(x, y file.LocationSet) bool {
-				xs := x.ToSlice()
-				ys := y.ToSlice()
+	opts := cmptest.DefaultOptions()
+	opts = append(opts, userOpts...)

-				if len(xs) != len(ys) {
-					return false
-				}
-				for i, xe := range xs {
-					ye := ys[i]
-					if !cmptest.DefaultLocationComparer(xe, ye) {
-						return false
-					}
-				}
-
-				return true
-			},
-		),
-		cmp.Comparer(
-			func(x, y pkg.LicenseSet) bool {
-				xs := x.ToSlice()
-				ys := y.ToSlice()
-
-				if len(xs) != len(ys) {
-					return false
-				}
-				for i, xe := range xs {
-					ye := ys[i]
-					if !cmptest.DefaultLicenseComparer(xe, ye) {
-						return false
-					}
-				}
-
-				return true
-			},
-		),
-		cmp.Comparer(
-			cmptest.DefaultLocationComparer,
-		),
-		cmp.Comparer(
-			cmptest.DefaultLicenseComparer,
-		),
+	if diff := cmp.Diff(a, b, opts...); diff != "" {
+		t.Errorf("unexpected packages from parsing (-expected +actual)\n%s", diff)
 	}
+}
+
+func AssertPackagesEqualIgnoreLayers(t *testing.T, a, b pkg.Package, userOpts ...cmp.Option) {
+	t.Helper()
+	opts := cmptest.DefaultIgnoreLocationLayerOptions()
+	opts = append(opts, userOpts...)

 	if diff := cmp.Diff(a, b, opts...); diff != "" {
 		t.Errorf("unexpected packages from parsing (-expected +actual)\n%s", diff)
@@ -251,11 +251,11 @@ func (ni nativeImageElf) fetchPkgs() (pkgs []pkg.Package, relationships []artifa
 	var sbomLength elf.Symbol
 	var svmVersion elf.Symbol

-	si, err := bi.Symbols()
+	si, err := ni.getSymbols()
 	if err != nil {
-		return nil, nil, fmt.Errorf("no symbols found in binary: %w", err)
+		return nil, nil, err
 	}
-	if si == nil {
+	if len(si) == 0 {
 		return nil, nil, errors.New(nativeImageMissingSymbolsError)
 	}
 	for _, s := range si {
@@ -286,6 +286,31 @@ func (ni nativeImageElf) fetchPkgs() (pkgs []pkg.Package, relationships []artifa
 	return decompressSbom(data, sbomLocation, lengthLocation)
 }

+// getSymbols obtains the union of the symbols in the .symtab and .dynsym sections of the ELF file
+func (ni nativeImageElf) getSymbols() ([]elf.Symbol, error) {
+	var symbols []elf.Symbol
+	symsErr := error(nil)
+	dynErr := error(nil)
+
+	if syms, err := ni.file.Symbols(); err == nil {
+		symbols = append(symbols, syms...)
+	} else {
+		symsErr = err
+	}
+
+	if dynSyms, err := ni.file.DynamicSymbols(); err == nil {
+		symbols = append(symbols, dynSyms...)
+	} else {
+		dynErr = err
+	}
+
+	if symsErr != nil && dynErr != nil {
+		return nil, fmt.Errorf("could not retrieve symbols from binary: SHT_SYMTAB error: %v, SHT_DYNSYM error: %v", symsErr, dynErr)
+	}
+
+	return symbols, nil
+}
+
 // fetchPkgs obtains the packages from a Native Image given as a Mach O file.
 func (ni nativeImageMachO) fetchPkgs() (pkgs []pkg.Package, relationships []artifact.Relationship, retErr error) {
 	defer func() {
@@ -76,7 +76,7 @@ func TestParseWheelEggMetadata(t *testing.T) {
 				t.Fatalf("failed to parse: %+v", err)
 			}

-			if d := cmp.Diff(test.ExpectedMetadata, actual, cmptest.DefaultCommonOptions()...); d != "" {
+			if d := cmp.Diff(test.ExpectedMetadata, actual, cmptest.DefaultOptions()...); d != "" {
 				t.Errorf("metadata mismatch (-want +got):\n%s", d)
 			}
 		})
@@ -17,7 +17,7 @@ import (
 	"github.com/anchore/syft/syft/pkg/cataloger/generic"
 )

-// parseRpmDb parses an "Packages" RPM DB and returns the Packages listed within it.
+// parseRpmDB parses an "Packages" RPM DB and returns the Packages listed within it.
 //
 //nolint:funlen
 func parseRpmDB(_ context.Context, resolver file.Resolver, env *generic.Environment, reader file.LocationReadCloser) ([]pkg.Package, []artifact.Relationship, error) {
@@ -1,7 +1,7 @@
 package rust

 import (
-	"github.com/microsoft/go-rustaudit"
+	"github.com/rust-secure-code/go-rustaudit"

 	"github.com/anchore/packageurl-go"
 	"github.com/anchore/syft/syft/file"
@@ -5,7 +5,7 @@ import (
 	"errors"
 	"fmt"

-	"github.com/microsoft/go-rustaudit"
+	"github.com/rust-secure-code/go-rustaudit"

 	"github.com/anchore/syft/internal/log"
 	"github.com/anchore/syft/internal/relationship"
@@ -1,7 +1,9 @@
 package pkg

+import "github.com/anchore/syft/internal/evidence"
+
 const (
-	EvidenceAnnotationKey        = "evidence"
-	PrimaryEvidenceAnnotation    = "primary"
-	SupportingEvidenceAnnotation = "supporting"
+	EvidenceAnnotationKey        = evidence.AnnotationKey
+	PrimaryEvidenceAnnotation    = evidence.PrimaryAnnotation
+	SupportingEvidenceAnnotation = evidence.SupportingAnnotation
 )
				`@@ -0,0 +1 @@`
				`Red Hat Enterprise Linux release 8.10 (Ootpa)`