limit source-distribution refs to deb and rpm

- apk origins and alpm pkgbases are build recipes, not published source packages, and their names are usually also real binary packages, so a `source-distribution` ref there would point at a binary package. They keep relying on the `upstream` PURL qualifier. - document why this is an external reference rather than `pedigree.ancestors`, with links to the CycloneDX spec discussion (CycloneDX/specification#612) Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
build source PURL from metadata and gate it to CycloneDX 1.6+
2026-10-12 06:07:20 +02:00 · 2026-09-30 12:56:05 -04:00 · 2026-09-30 12:56:05 -04:00 · 2026-09-30 12:56:05 -04:00 · 2026-09-30 12:56:05 -04:00 · 2026-09-30 12:56:05 -04:00
541 changed files with 55522 additions and 4365 deletions
@@ -16,7 +16,7 @@ tools:
  # used to upload test fixture cache
  - name: oras
    version:
-      want: v1.3.2
+      want: v1.3.4
    method: github-release
    with:
      repo: oras-project/oras
@@ -24,7 +24,7 @@ tools:
  # used to parse JSON/YAML annotations on the fixture cache image
  - name: yq
    version:
-      want: v4.53.3
+      want: v4.53.6
    method: github-release
    with:
      repo: mikefarah/yq
@@ -0,0 +1,7 @@
+# check out text files with lf on every platform (regardless of core.autocrlf), letting git detect binary files
+* text=auto eol=lf
+
+# fixtures that must keep their crlf line endings byte for byte
+syft/linux/testdata/unprintable -text
+syft/pkg/cataloger/bitnami/testdata/no-rel/opt/bitnami/redis/.spdx-redis.spdx -text
+syft/pkg/cataloger/java/testdata/jar-metadata/**/META-INF/MANIFEST.MF -text
@@ -30,7 +30,7 @@ runs:
  using: "composite"
  steps:
    - name: Setup go + go-make tooling
-      uses: anchore/go-make/.github/actions/setup@39fe5f71112d4dceb3ff0a92a40f272f067fc457 # v0.6.0
+      uses: anchore/go-make/.github/actions/setup@fa5421b3bf24c9d18f11a736c5eb4172f2b7d683 # v0.8.1
      with:
        go-version: ${{ inputs.go-version }}
        cache-key-prefix: ${{ inputs.cache-key-prefix }}
@@ -47,12 +47,22 @@ runs:
        APT_PACKAGES: ${{ inputs.bootstrap-apt-packages }}
      run: |
        IFS=' ' read -ra packages <<< "$APT_PACKAGES"
-        DEBIAN_FRONTEND=noninteractive sudo apt update && sudo -E apt install -y "${packages[@]}"
+        # the AMI already ships most of these, and `apt update` costs ~40MB of index (minutes,
+        # when archive.ubuntu.com throttles us) to find that out. only touch apt if we must.
+        missing=()
+        for pkg in "${packages[@]}"; do
+          dpkg -s "$pkg" >/dev/null 2>&1 || missing+=("$pkg")
+        done
+        if [ ${#missing[@]} -eq 0 ]; then
+          echo "all apt packages already present: ${packages[*]}"
+          exit 0
+        fi
+        DEBIAN_FRONTEND=noninteractive sudo apt update && sudo -E apt install -y "${missing[@]}"

    # ORAS cache: restore-only on non-default branches / forks
    - name: Restore ORAS cache from github actions
      if: ${{ inputs.download-test-fixture-cache == 'true' && (github.ref != format('refs/heads/{0}', github.event.repository.default_branch) || github.event.repository.fork == true) }}
-      uses: actions/cache/restore@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+      uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
      with:
        path: ${{ github.workspace }}/.tmp/oras-cache
        key: ${{ inputs.cache-key-prefix }}-oras-cache
@@ -60,7 +70,7 @@ runs:
    # ORAS cache: restore + save on the default branch of the canonical repo only.
    - name: Restore and save ORAS cache from github actions
      if: ${{ inputs.download-test-fixture-cache == 'true' && github.ref == format('refs/heads/{0}', github.event.repository.default_branch) && github.event.repository.fork == false }}
-      uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+      uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
      with:
        path: ${{ github.workspace }}/.tmp/oras-cache
        key: ${{ inputs.cache-key-prefix }}-oras-cache
@@ -13,7 +13,7 @@ permissions: {}
 jobs:
  analyze:
    name: Analyze
-    uses: anchore/workflows/.github/workflows/codeql.yaml@b0c30a80409130d329aaa356fd64a34d8c0b3375 # v0.7.2
+    uses: anchore/workflows/.github/workflows/codeql.yaml@7212994dc8fc3a53fe9c8e766ab5b4ddd16ea3d4 # v0.8.0
    permissions:
      security-events: write
      packages: read
@@ -32,7 +32,7 @@ jobs:
    if: ${{ github.event.inputs.phase == 'all' }}
    permissions:
      contents: read # required for fetching tags
-    uses: anchore/workflows/.github/workflows/check-version-available.yaml@b0c30a80409130d329aaa356fd64a34d8c0b3375 # v0.7.2
+    uses: anchore/workflows/.github/workflows/check-version-available.yaml@7212994dc8fc3a53fe9c8e766ab5b4ddd16ea3d4 # v0.8.0
    with:
      version: ${{ github.event.inputs.version }}

@@ -41,7 +41,7 @@ jobs:
    permissions:
      contents: read
      checks: read # required for getting the status of specific check names
-    uses: anchore/workflows/.github/workflows/check-gate.yaml@b0c30a80409130d329aaa356fd64a34d8c0b3375 # v0.7.2
+    uses: anchore/workflows/.github/workflows/check-gate.yaml@7212994dc8fc3a53fe9c8e766ab5b4ddd16ea3d4 # v0.8.0
    with:
      # these are checks that should be run on pull-request and merges to main.
      # we do NOT want to kick off a release if these have not been verified on main.
@@ -63,14 +63,19 @@ jobs:
    #   spot disabled: reliability for build workflows (used for releases too)
    #   goreleaser uses parallelism of 12, so we need more CPUs
    #   s3-cache: faster actions cache
-    #   tmpfs: faster io-intensive workflows
-    runs-on: runs-on=${{ github.run_id }}/cpu=16+32/ram=32+128/family=c5+c6+c7+c8/spot=false/extras=s3-cache+tmpfs
+    #   volume: enlarge dist/ disk -- the default 40GB EBS root fills up during the multi-arch
+    #   image + binary build and OOMs (runs out of disk); size it well above peak usage.
+    #   provisioned throughput/iops above the gp3 free baseline (125mbs/3000iops) approximate
+    #   the tmpfs IO speed on disk, for ~1c/run.
+    #   note: tmpfs intentionally omitted -- a RAM-backed dist/ never touches the enlarged
+    #   volume and competes with the build's memory peak, so keep dist/ on disk.
+    runs-on: runs-on=${{ github.run_id }}/cpu=16+32/ram=32+128/family=c5+c6+c7+c8/spot=false/extras=s3-cache/volume=120gb:gp3:500mbs:4000iops
    permissions:
      contents: write # required for creating the GitHub release and pushing the version tag
      packages: write # required for publishing release artifacts to GitHub packages
      id-token: write # required for keyless signing (cosign/sigstore OIDC)
    steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 #v6.0.3
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 #v7.0.1
        with:
          fetch-depth: 0
          persist-credentials: true
@@ -78,14 +83,19 @@ jobs:
      - name: Bootstrap environment
        uses: ./.github/actions/bootstrap

+      # dockers_v2 builds multi-platform manifests in a single buildx invocation, which requires a
+      # docker-container driver builder (the default builder on the runner cannot build multi-platform).
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1
+
      - name: Login to Docker Hub
-        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee #v4.2.0
+        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f #v4.6.0
        with:
          username: ${{ secrets.ANCHOREOSSWRITE_DH_USERNAME }}
          password: ${{ secrets.ANCHOREOSSWRITE_DH_PAT }}

      - name: Login to GitHub Container Registry
-        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee #v4.2.0
+        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f #v4.6.0
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
@@ -108,7 +118,7 @@ jobs:
          # for updating brew formula in anchore/homebrew-syft
          GITHUB_BREW_TOKEN: ${{ secrets.ANCHOREOPS_GITHUB_OSS_WRITE_TOKEN }}

-      - uses: anchore/sbom-action@e22c389904149dbc22b58101806040fa8d37a610 #v0.24.0
+      - uses: anchore/sbom-action@3ad7283483fc7af8ff2b4ea19663c2d5ca935e26 #v0.24.2
        continue-on-error: true
        with:
          file: go.mod
@@ -119,7 +129,7 @@ jobs:
    if: ${{ always() && (needs.release.result == 'success' || github.event.inputs.phase == 'install-script-only') }}
    permissions:
      contents: read # required for the reusable workflow to check out the repo and publish the install script
-    uses: anchore/workflows/.github/workflows/release-install-script.yaml@b0c30a80409130d329aaa356fd64a34d8c0b3375 # v0.7.2
+    uses: anchore/workflows/.github/workflows/release-install-script.yaml@7212994dc8fc3a53fe9c8e766ab5b4ddd16ea3d4 # v0.8.0
    with:
      tag: ${{ github.event.inputs.version }}
    secrets:
@@ -20,12 +20,12 @@ jobs:
      contents: read
      security-events: write  # for uploading SARIF results
    steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: "Run zizmor"
-        uses: zizmorcore/zizmor-action@5f14fd08f7cf1cb1609c1e344975f152c7ee938d # v0.5.6
+        uses: zizmorcore/zizmor-action@cc914d7f3750a2d13d75c7f184a1060aa0e9d482 # v0.6.4
        with:
          # there is a pass/fail gate as a repo ruleset (if there is no ruleset configured then the action will pass by default)
          advanced-security: true
@@ -21,14 +21,17 @@ jobs:
    name: "Static analysis"
    # runs-on.com: memory & general purpose instances for testing
    #   spot enabled: ok to interrupt non-production workloads
-    #   tmpfs: faster io-intensive workflows
+    #   tmpfs intentionally omitted -- it RAM-backs /home/runner, /tmp and /var/lib/docker at
+    #   100% of instance memory, starving `make unit` of headroom to link with -race.
+    #   volume: the caches and docker images tmpfs used to hold. gp3 baseline throughput is
+    #   enough; a 4 vCPU instance can't pull much more than that anyway.
    #   note: s3-cache intentionally omitted -- PR runs are untrusted and must not write to the
    #   shared cache backend that the trusted release workflow reads from (cache poisoning).
-    runs-on: &test-runner "runs-on=${{ github.run_id }}/cpu=4+8/ram=32+128/family=r5+r6+r7+r8+m4+m5+m6+m7+m8/spot=price-capacity-optimized/extras=tmpfs"
+    runs-on: &test-runner "runs-on=${{ github.run_id }}/cpu=4+8/ram=16+32/family=m6+m7+m8+c6+c7+c8/spot=price-capacity-optimized/volume=100gb"
    permissions:
      contents: read
    steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 #v6.0.3
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 #v7.0.1
        with:
          persist-credentials: false

@@ -46,11 +49,18 @@ jobs:
  Unit-Test:
    # Note: changing this job name requires making the same update in the .github/workflows/release.yaml pipeline
    name: "Unit tests"
+    runs-on: ubuntu-latest
+    needs: [Unit-Test-Linux, Unit-Test-Windows]
+    steps:
+      - run: echo All unit tests passed!
+
+  Unit-Test-Linux:
+    name: "Unit tests (Linux)"
    runs-on: *test-runner
    permissions:
      contents: read
    steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 #v6.0.3
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 #v7.0.1
        with:
          persist-credentials: false

@@ -65,6 +75,27 @@ jobs:
      - name: Check for capability drift
        run: make check-capability-drift

+  Unit-Test-Windows:
+    name: "Unit tests (Windows)"
+    runs-on: windows-latest
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 #v7.0.1
+        with:
+          persist-credentials: false
+
+      # go-make's setup only (not ./.github/actions/bootstrap): no apt, binny tools, or fixture cache are needed
+      - name: Setup go + go-make tooling
+        uses: anchore/go-make/.github/actions/setup@fa5421b3bf24c9d18f11a736c5eb4172f2b7d683 # v0.8.1
+        with:
+          # keep in sync with the go-version default in ./.github/actions/bootstrap
+          go-version: "1.26.2"
+
+      # the full unit suite leans on linux docker fixtures, so this runs the windows-relevant subset
+      - name: Run unit tests
+        run: make unit:windows
+
  Integration-Test:
    # Note: changing this job name requires making the same update in the .github/workflows/release.yaml pipeline
    name: "Integration tests"
@@ -72,7 +103,7 @@ jobs:
    permissions:
      contents: read
    steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 #v6.0.3
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 #v7.0.1
        with:
          persist-credentials: false

@@ -92,14 +123,20 @@ jobs:
    # runs-on.com: compute instances for parallel builds
    #   spot disabled: reliability for build workflows (used for releases too)
    #   goreleaser uses parallelism of 12, so we need more CPUs
-    #   tmpfs: faster io-intensive workflows
+    #   tmpfs intentionally omitted -- a RAM-backed dist/ competes with the goreleaser
+    #   build's memory peak (parallel binaries + multi-arch image assembly) and OOMs the
+    #   instance; keep dist/ on disk.
    #   note: s3-cache intentionally omitted -- PR runs are untrusted and must not write to the
    #   shared cache backend that the trusted release workflow reads from (cache poisoning).
-    runs-on: "runs-on=${{ github.run_id }}/cpu=16+32/ram=32+128/family=c5+c6+c7+c8/spot=false/extras=tmpfs"
+    #   volume: enlarge dist/ disk -- the default 40GB EBS root fills up during the multi-arch
+    #   image + binary build and OOMs (runs out of disk); size it well above peak usage.
+    #   provisioned throughput/iops above the gp3 free baseline (125mbs/3000iops) approximate
+    #   the tmpfs IO speed on disk, for ~1c/run.
+    runs-on: "runs-on=${{ github.run_id }}/cpu=16+32/ram=32+128/family=c5+c6+c7+c8/spot=false/volume=120gb:gp3:500mbs:4000iops"
    permissions:
      contents: read
    steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 #v6.0.3
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 #v7.0.1
        with:
          persist-credentials: false

@@ -129,7 +166,7 @@ jobs:
    permissions:
      contents: read
    steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 #v6.0.3
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 #v7.0.1
        with:
          persist-credentials: false

@@ -173,7 +210,7 @@ jobs:
      - name: Install Cosign
        uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2

-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 #v6.0.3
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 #v7.0.1
        with:
          persist-credentials: false

@@ -207,7 +244,7 @@ jobs:
    permissions:
      contents: read
    steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 #v6.0.3
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 #v7.0.1
        with:
          persist-credentials: false

@@ -20,6 +20,7 @@ bin/
 /.tool
 /.task
 /generate
+/spec
 /specs
 mise.toml
 .make/.make
@@ -7,6 +7,7 @@ linters:
    - asciicheck
    - bodyclose
    - copyloopvar
+    - depguard
    - dogsled
    - dupl
    - errcheck
@@ -29,9 +30,20 @@ linters:
    - unused
    - whitespace
  settings:
+    depguard:
+      rules:
+        yaml:
+          deny:
+            # gopkg.in/yaml.v3 is unmaintained and panics on some malformed input (see #5327)
+            - pkg: gopkg.in/yaml.v3
+              desc: use go.yaml.in/yaml/v3 instead
    funlen:
      lines: 70
      statements: 50
+    goconst:
+      # the default of 3 turns every repeated literal in a lookup table or a test fixture into a finding.
+      # 5 keeps the ones worth hoisting without flagging data that reads better written out.
+      min-occurrences: 5
    gocritic:
      enabled-checks:
        - deferInLoop
@@ -54,6 +66,12 @@ linters:
      - linters:
          - revive
        text: "var-naming: avoid package names that conflict"
+      # cpegenerate is almost entirely lookup tables mapping artifact names to vendors, products, and
+      # maven group ids. The repeated strings are the data itself, so hoisting them to constants would
+      # replace a readable table with indirection for no gain.
+      - linters:
+          - goconst
+        path: syft/pkg/cataloger/internal/cpegenerate/
    paths:
      - third_party$
      - builtin$
@@ -61,7 +79,6 @@ linters:

 # do not enable...
 #    - deadcode          # The owner seems to have abandoned the linter. Replaced by "unused".
-#    - depguard          # We don't have a configuration for this yet
 #    - goprintffuncname  # does not catch all cases and there are exceptions
 #    - nakedret          # does not catch all cases and should not fail a build
 #    - gochecknoglobals
@@ -73,306 +73,88 @@ brews:
    description: *description
    license: "Apache License 2.0"

-dockers:
-  # production images...
-  - image_templates:
-      - anchore/syft:{{.Tag}}-amd64
-      - ghcr.io/anchore/syft:{{.Tag}}-amd64
-    goarch: amd64
+dockers_v2:
+  # production images (scratch base, root)
+  - id: production
    dockerfile: Dockerfile
-    use: buildx
-    build_flag_templates:
-      - "--platform=linux/amd64"
-      - "--build-arg=BUILD_DATE={{.Date}}"
-      - "--build-arg=BUILD_VERSION={{.Version}}"
-      - "--build-arg=VCS_REF={{.FullCommit}}"
-      - "--build-arg=VCS_URL={{.GitURL}}"
+    ids: &docker-ids
+      - linux-build
+    images: &docker-images
+      - anchore/syft
+      - ghcr.io/anchore/syft
+    platforms: &docker-platforms
+      - linux/amd64
+      - linux/arm64
+      - linux/ppc64le
+      - linux/riscv64
+      - linux/s390x
+    labels: &docker-labels
+      "org.opencontainers.image.created": "{{.Date}}"
+      "org.opencontainers.image.title": "syft"
+      "org.opencontainers.image.description": "CLI tool and library for generating a Software Bill of Materials from container images and filesystems"
+      "org.opencontainers.image.source": "{{.GitURL}}"
+      "org.opencontainers.image.revision": "{{.FullCommit}}"
+      "org.opencontainers.image.vendor": "Anchore, Inc."
+      "org.opencontainers.image.version": "{{.Version}}"
+      "org.opencontainers.image.licenses": "Apache-2.0"
+      "io.artifacthub.package.readme-url": "https://raw.githubusercontent.com/anchore/syft/main/README.md"
+      "io.artifacthub.package.logo-url": "https://user-images.githubusercontent.com/5199289/136844524-1527b09f-c5cb-4aa9-be54-5aa92a6086c1.png"
+      "io.artifacthub.package.license": "Apache-2.0"
+    tags:
+      - latest
+      - "{{.Tag}}"
+    # DEBIAN_VERSION 13 (trixie) is the first distroless release with a riscv64 base image
+    # and is a superset of debian 12 for the other targeted arches; docker_v2 builds all
+    # platforms in a single buildx invocation, so build_args cannot vary per platform.
+    build_args: &docker-build-args
+      DEBIAN_VERSION: "13"
+    # disable provenance attestations to keep the manifest free of unknown/unknown entries
+    flags: &docker-flags
+      - "--provenance=false"
+    # SBOMs are produced separately for the archives (see the sboms section)
+    sbom: &docker-sbom "false"

-  - image_templates:
-      - anchore/syft:{{.Tag}}-arm64v8
-      - ghcr.io/anchore/syft:{{.Tag}}-arm64v8
-    goarch: arm64
-    dockerfile: Dockerfile
-    use: buildx
-    build_flag_templates:
-      - "--platform=linux/arm64/v8"
-      - "--build-arg=BUILD_DATE={{.Date}}"
-      - "--build-arg=BUILD_VERSION={{.Version}}"
-      - "--build-arg=VCS_REF={{.FullCommit}}"
-      - "--build-arg=VCS_URL={{.GitURL}}"
-
-  - image_templates:
-      - anchore/syft:{{.Tag}}-ppc64le
-      - ghcr.io/anchore/syft:{{.Tag}}-ppc64le
-    goarch: ppc64le
-    dockerfile: Dockerfile
-    use: buildx
-    build_flag_templates:
-      - "--platform=linux/ppc64le"
-      - "--build-arg=BUILD_DATE={{.Date}}"
-      - "--build-arg=BUILD_VERSION={{.Version}}"
-      - "--build-arg=VCS_REF={{.FullCommit}}"
-      - "--build-arg=VCS_URL={{.GitURL}}"
-
-  - image_templates:
-      - anchore/syft:{{.Tag}}-riscv64
-      - ghcr.io/anchore/syft:{{.Tag}}-riscv64
-    goarch: riscv64
-    dockerfile: Dockerfile
-    use: buildx
-    build_flag_templates:
-      - "--platform=linux/riscv64"
-      - "--build-arg=DEBIAN_VERSION=13"
-      - "--build-arg=BUILD_DATE={{.Date}}"
-      - "--build-arg=BUILD_VERSION={{.Version}}"
-      - "--build-arg=VCS_REF={{.FullCommit}}"
-      - "--build-arg=VCS_URL={{.GitURL}}"
-
-  - image_templates:
-      - anchore/syft:{{.Tag}}-s390x
-      - ghcr.io/anchore/syft:{{.Tag}}-s390x
-    goarch: s390x
-    dockerfile: Dockerfile
-    use: buildx
-    build_flag_templates:
-      - "--platform=linux/s390x"
-      - "--build-arg=BUILD_DATE={{.Date}}"
-      - "--build-arg=BUILD_VERSION={{.Version}}"
-      - "--build-arg=VCS_REF={{.FullCommit}}"
-      - "--build-arg=VCS_URL={{.GitURL}}"
-
-  # nonroot images...
-  - image_templates:
-      - anchore/syft:{{.Tag}}-nonroot-amd64
-      - ghcr.io/anchore/syft:{{.Tag}}-nonroot-amd64
-    goarch: amd64
+  # nonroot images
+  - id: nonroot
    dockerfile: Dockerfile.nonroot
-    use: buildx
-    build_flag_templates:
-      - "--platform=linux/amd64"
-      - "--build-arg=BUILD_DATE={{.Date}}"
-      - "--build-arg=BUILD_VERSION={{.Version}}"
-      - "--build-arg=VCS_REF={{.FullCommit}}"
-      - "--build-arg=VCS_URL={{.GitURL}}"
+    ids: *docker-ids
+    images: *docker-images
+    platforms: *docker-platforms
+    labels: *docker-labels
+    tags:
+      - nonroot
+      - "{{.Tag}}-nonroot"
+    build_args: *docker-build-args
+    flags: *docker-flags
+    sbom: *docker-sbom

-  - image_templates:
-      - anchore/syft:{{.Tag}}-nonroot-arm64v8
-      - ghcr.io/anchore/syft:{{.Tag}}-nonroot-arm64v8
-    goarch: arm64
-    dockerfile: Dockerfile.nonroot
-    use: buildx
-    build_flag_templates:
-      - "--platform=linux/arm64/v8"
-      - "--build-arg=BUILD_DATE={{.Date}}"
-      - "--build-arg=BUILD_VERSION={{.Version}}"
-      - "--build-arg=VCS_REF={{.FullCommit}}"
-      - "--build-arg=VCS_URL={{.GitURL}}"
-
-  - image_templates:
-      - anchore/syft:{{.Tag}}-nonroot-ppc64le
-      - ghcr.io/anchore/syft:{{.Tag}}-nonroot-ppc64le
-    goarch: ppc64le
-    dockerfile: Dockerfile.nonroot
-    use: buildx
-    build_flag_templates:
-      - "--platform=linux/ppc64le"
-      - "--build-arg=BUILD_DATE={{.Date}}"
-      - "--build-arg=BUILD_VERSION={{.Version}}"
-      - "--build-arg=VCS_REF={{.FullCommit}}"
-      - "--build-arg=VCS_URL={{.GitURL}}"
-
-  - image_templates:
-      - anchore/syft:{{.Tag}}-nonroot-riscv64
-      - ghcr.io/anchore/syft:{{.Tag}}-nonroot-riscv64
-    goarch: riscv64
-    dockerfile: Dockerfile.nonroot
-    use: buildx
-    build_flag_templates:
-      - "--platform=linux/riscv64"
-      - "--build-arg=DEBIAN_VERSION=13"
-      - "--build-arg=BUILD_DATE={{.Date}}"
-      - "--build-arg=BUILD_VERSION={{.Version}}"
-      - "--build-arg=VCS_REF={{.FullCommit}}"
-      - "--build-arg=VCS_URL={{.GitURL}}"
-
-  - image_templates:
-      - anchore/syft:{{.Tag}}-nonroot-s390x
-      - ghcr.io/anchore/syft:{{.Tag}}-nonroot-s390x
-    goarch: s390x
-    dockerfile: Dockerfile.nonroot
-    use: buildx
-    build_flag_templates:
-      - "--platform=linux/s390x"
-      - "--build-arg=BUILD_DATE={{.Date}}"
-      - "--build-arg=BUILD_VERSION={{.Version}}"
-      - "--build-arg=VCS_REF={{.FullCommit}}"
-      - "--build-arg=VCS_URL={{.GitURL}}"
-
-  # debug images...
-  - image_templates:
-      - anchore/syft:{{.Tag}}-debug-amd64
-      - ghcr.io/anchore/syft:{{.Tag}}-debug-amd64
-    goarch: amd64
+  # debug images (root)
+  - id: debug
    dockerfile: Dockerfile.debug
-    use: buildx
-    build_flag_templates:
-      - "--platform=linux/amd64"
-      - "--build-arg=BUILD_DATE={{.Date}}"
-      - "--build-arg=BUILD_VERSION={{.Version}}"
-      - "--build-arg=VCS_REF={{.FullCommit}}"
-      - "--build-arg=VCS_URL={{.GitURL}}"
+    ids: *docker-ids
+    images: *docker-images
+    platforms: *docker-platforms
+    labels: *docker-labels
+    tags:
+      - debug
+      - "{{.Tag}}-debug"
+    build_args: *docker-build-args
+    flags: *docker-flags
+    sbom: *docker-sbom

-  - image_templates:
-      - anchore/syft:{{.Tag}}-debug-arm64v8
-      - ghcr.io/anchore/syft:{{.Tag}}-debug-arm64v8
-    goarch: arm64
-    dockerfile: Dockerfile.debug
-    use: buildx
-    build_flag_templates:
-      - "--platform=linux/arm64/v8"
-      - "--build-arg=BUILD_DATE={{.Date}}"
-      - "--build-arg=BUILD_VERSION={{.Version}}"
-      - "--build-arg=VCS_REF={{.FullCommit}}"
-      - "--build-arg=VCS_URL={{.GitURL}}"
-
-  - image_templates:
-      - anchore/syft:{{.Tag}}-debug-ppc64le
-      - ghcr.io/anchore/syft:{{.Tag}}-debug-ppc64le
-    goarch: ppc64le
-    dockerfile: Dockerfile.debug
-    use: buildx
-    build_flag_templates:
-      - "--platform=linux/ppc64le"
-      - "--build-arg=BUILD_DATE={{.Date}}"
-      - "--build-arg=BUILD_VERSION={{.Version}}"
-      - "--build-arg=VCS_REF={{.FullCommit}}"
-      - "--build-arg=VCS_URL={{.GitURL}}"
-
-  - image_templates:
-      - anchore/syft:{{.Tag}}-debug-riscv64
-      - ghcr.io/anchore/syft:{{.Tag}}-debug-riscv64
-    goarch: riscv64
-    dockerfile: Dockerfile.debug
-    use: buildx
-    build_flag_templates:
-      - "--platform=linux/riscv64"
-      - "--build-arg=DEBIAN_VERSION=13"
-      - "--build-arg=BUILD_DATE={{.Date}}"
-      - "--build-arg=BUILD_VERSION={{.Version}}"
-      - "--build-arg=VCS_REF={{.FullCommit}}"
-      - "--build-arg=VCS_URL={{.GitURL}}"
-
-  - image_templates:
-      - anchore/syft:{{.Tag}}-debug-s390x
-      - ghcr.io/anchore/syft:{{.Tag}}-debug-s390x
-    goarch: s390x
-    dockerfile: Dockerfile.debug
-    use: buildx
-    build_flag_templates:
-      - "--platform=linux/s390x"
-      - "--build-arg=BUILD_DATE={{.Date}}"
-      - "--build-arg=BUILD_VERSION={{.Version}}"
-      - "--build-arg=VCS_REF={{.FullCommit}}"
-      - "--build-arg=VCS_URL={{.GitURL}}"
-
-docker_manifests:
-  - name_template: anchore/syft:latest
-    image_templates:
-      - anchore/syft:{{.Tag}}-amd64
-      - anchore/syft:{{.Tag}}-arm64v8
-      - anchore/syft:{{.Tag}}-ppc64le
-      - anchore/syft:{{.Tag}}-riscv64
-      - anchore/syft:{{.Tag}}-s390x
-
-  - name_template: ghcr.io/anchore/syft:latest
-    image_templates:
-      - ghcr.io/anchore/syft:{{.Tag}}-amd64
-      - ghcr.io/anchore/syft:{{.Tag}}-arm64v8
-      - ghcr.io/anchore/syft:{{.Tag}}-ppc64le
-      - ghcr.io/anchore/syft:{{.Tag}}-riscv64
-      - ghcr.io/anchore/syft:{{.Tag}}-s390x
-
-  - name_template: anchore/syft:{{.Tag}}
-    image_templates:
-      - anchore/syft:{{.Tag}}-amd64
-      - anchore/syft:{{.Tag}}-arm64v8
-      - anchore/syft:{{.Tag}}-ppc64le
-      - anchore/syft:{{.Tag}}-riscv64
-      - anchore/syft:{{.Tag}}-s390x
-
-  - name_template: ghcr.io/anchore/syft:{{.Tag}}
-    image_templates:
-      - ghcr.io/anchore/syft:{{.Tag}}-amd64
-      - ghcr.io/anchore/syft:{{.Tag}}-arm64v8
-      - ghcr.io/anchore/syft:{{.Tag}}-ppc64le
-      - ghcr.io/anchore/syft:{{.Tag}}-riscv64
-      - ghcr.io/anchore/syft:{{.Tag}}-s390x
-
-  # nonroot images...
-  - name_template: anchore/syft:nonroot
-    image_templates:
-      - anchore/syft:{{.Tag}}-nonroot-amd64
-      - anchore/syft:{{.Tag}}-nonroot-arm64v8
-      - anchore/syft:{{.Tag}}-nonroot-ppc64le
-      - anchore/syft:{{.Tag}}-nonroot-riscv64
-      - anchore/syft:{{.Tag}}-nonroot-s390x
-
-  - name_template: ghcr.io/anchore/syft:nonroot
-    image_templates:
-      - ghcr.io/anchore/syft:{{.Tag}}-nonroot-amd64
-      - ghcr.io/anchore/syft:{{.Tag}}-nonroot-arm64v8
-      - ghcr.io/anchore/syft:{{.Tag}}-nonroot-ppc64le
-      - ghcr.io/anchore/syft:{{.Tag}}-nonroot-riscv64
-      - ghcr.io/anchore/syft:{{.Tag}}-nonroot-s390x
-
-  - name_template: anchore/syft:{{.Tag}}-nonroot
-    image_templates:
-      - anchore/syft:{{.Tag}}-nonroot-amd64
-      - anchore/syft:{{.Tag}}-nonroot-arm64v8
-      - anchore/syft:{{.Tag}}-nonroot-ppc64le
-      - anchore/syft:{{.Tag}}-nonroot-riscv64
-      - anchore/syft:{{.Tag}}-nonroot-s390x
-
-  - name_template: ghcr.io/anchore/syft:{{.Tag}}-nonroot
-    image_templates:
-      - ghcr.io/anchore/syft:{{.Tag}}-nonroot-amd64
-      - ghcr.io/anchore/syft:{{.Tag}}-nonroot-arm64v8
-      - ghcr.io/anchore/syft:{{.Tag}}-nonroot-ppc64le
-      - ghcr.io/anchore/syft:{{.Tag}}-nonroot-riscv64
-      - ghcr.io/anchore/syft:{{.Tag}}-nonroot-s390x
-
-  # debug images...
-  - name_template: anchore/syft:debug
-    image_templates:
-      - anchore/syft:{{.Tag}}-debug-amd64
-      - anchore/syft:{{.Tag}}-debug-arm64v8
-      - anchore/syft:{{.Tag}}-debug-ppc64le
-      - anchore/syft:{{.Tag}}-debug-riscv64
-      - anchore/syft:{{.Tag}}-debug-s390x
-
-  - name_template: ghcr.io/anchore/syft:debug
-    image_templates:
-      - ghcr.io/anchore/syft:{{.Tag}}-debug-amd64
-      - ghcr.io/anchore/syft:{{.Tag}}-debug-arm64v8
-      - ghcr.io/anchore/syft:{{.Tag}}-debug-ppc64le
-      - ghcr.io/anchore/syft:{{.Tag}}-debug-riscv64
-      - ghcr.io/anchore/syft:{{.Tag}}-debug-s390x
-
-  - name_template: anchore/syft:{{.Tag}}-debug
-    image_templates:
-      - anchore/syft:{{.Tag}}-debug-amd64
-      - anchore/syft:{{.Tag}}-debug-arm64v8
-      - anchore/syft:{{.Tag}}-debug-ppc64le
-      - anchore/syft:{{.Tag}}-debug-riscv64
-      - anchore/syft:{{.Tag}}-debug-s390x
-
-  - name_template: ghcr.io/anchore/syft:{{.Tag}}-debug
-    image_templates:
-      - ghcr.io/anchore/syft:{{.Tag}}-debug-amd64
-      - ghcr.io/anchore/syft:{{.Tag}}-debug-arm64v8
-      - ghcr.io/anchore/syft:{{.Tag}}-debug-ppc64le
-      - ghcr.io/anchore/syft:{{.Tag}}-debug-riscv64
-      - ghcr.io/anchore/syft:{{.Tag}}-debug-s390x
+  # debug-nonroot images
+  - id: debug-nonroot
+    dockerfile: Dockerfile.debug-nonroot
+    ids: *docker-ids
+    images: *docker-images
+    platforms: *docker-platforms
+    labels: *docker-labels
+    tags:
+      - debug-nonroot
+      - "{{.Tag}}-debug-nonroot"
+    build_args: *docker-build-args
+    flags: *docker-flags
+    sbom: *docker-sbom

 sboms:
  - artifacts: archive
@@ -2,11 +2,11 @@ module github.com/anchore/syft/.make

 go 1.25.8

-require github.com/anchore/go-make v0.8.0
+require github.com/anchore/go-make v0.8.1

 require (
 	github.com/bmatcuk/doublestar/v4 v4.10.0 // indirect
 	github.com/goccy/go-yaml v1.19.2 // indirect
-	golang.org/x/mod v0.37.0 // indirect
-	golang.org/x/sys v0.46.0 // indirect
+	golang.org/x/mod v0.40.0 // indirect
+	golang.org/x/sys v0.47.0 // indirect
 )
@@ -1,10 +1,10 @@
-github.com/anchore/go-make v0.8.0 h1:3XAD4WNHIbqY4kwFyCQJ7kKiYLzSzjB0UwzDVwRqlUY=
-github.com/anchore/go-make v0.8.0/go.mod h1:4M6TnArb5w693VyWsgr5dCWrk2BLNu/ed4JUcsrzS34=
+github.com/anchore/go-make v0.8.1 h1:GAhPXR+9qVQhFB1pfVlHFOzxAt3dTDTUIA7Tp7nx9tg=
+github.com/anchore/go-make v0.8.1/go.mod h1:xALbVsPsDoJnJxdkjPlxOLZV7GbAdT5Pv3gd0kP1Lz0=
 github.com/bmatcuk/doublestar/v4 v4.10.0 h1:zU9WiOla1YA122oLM6i4EXvGW62DvKZVxIe6TYWexEs=
 github.com/bmatcuk/doublestar/v4 v4.10.0/go.mod h1:xBQ8jztBU6kakFMg+8WGxn0c6z1fTSPVIjEY1Wr7jzc=
 github.com/goccy/go-yaml v1.19.2 h1:PmFC1S6h8ljIz6gMRBopkjP1TVT7xuwrButHID66PoM=
 github.com/goccy/go-yaml v1.19.2/go.mod h1:XBurs7gK8ATbW4ZPGKgcbrY1Br56PdM69F7LkFRi1kA=
-golang.org/x/mod v0.37.0 h1:vF1DjpVEshcIqoEaauuHebaLk1O1forxjxBaVn884JQ=
-golang.org/x/mod v0.37.0/go.mod h1:m8S8VeM9r4dzDwjrKO0a1sZP3YjeMamRRlD+fmR2Q/0=
-golang.org/x/sys v0.46.0 h1:noSf2Fq6F8DBgS+LysIkx7rIExoNHJsxOAtPp4rthXw=
-golang.org/x/sys v0.46.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
+golang.org/x/mod v0.40.0 h1:hUv+3cXcdRHz08UmSiOob7sadHig73uo5bkXxQ/tvUs=
+golang.org/x/mod v0.40.0/go.mod h1:0/weTWkPWGBikyTWAX3dkjVztMmBA5hM0DH6BElSupE=
+golang.org/x/sys v0.47.0 h1:o7XGOvZQCADBQQ4Y7VNq2dRWQR7JmOUW8Kxx4ZsNgWs=
+golang.org/x/sys v0.47.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
@@ -1,10 +1,13 @@
 package main

 import (
+	"os"
 	"path/filepath"
 	"runtime"
+	"strconv"

 	. "github.com/anchore/go-make"
+	"github.com/anchore/go-make/config"
 	"github.com/anchore/go-make/file"
 	"github.com/anchore/go-make/lang"
 	"github.com/anchore/go-make/run"
@@ -27,22 +30,43 @@ func main() {
 			gotest.Name("unit"),
 			gotest.ExcludeGlob("**/test/**"),
 			gotest.CoverageThreshold(62),
+			race(),
 		),

-		// integration tests: native go-make Task. The race-detector smoke against a
-		// real image stays bundled here (RunsOn integration) so `make integration`
-		// behaves like the Taskfile version did.
-		gotest.Tasks(
-			gotest.Name("integration"),
-			gotest.IncludeGlob("./cmd/syft/internal/test/integration/..."),
-			gotest.Verbose(),
-			gotest.NoCoverage(),
-		),
+		// integration tests: run `go test` directly instead of via gotest.Tasks(), which
+		// has no way to set a timeout. The suite is a single package of ~36 sequential
+		// tests over 18 docker fixture images, so with a cold fixture cache (every image
+		// built + saved inline, under -race) it runs well past `go test`'s default 10m
+		// timeout -- which is exactly the case when regenerating the fixture cache from
+		// scratch. -count=1 keeps the go test cache from short-circuiting a run whose
+		// side effect (the built fixtures) is the thing we're after.
+		//
+		// The race-detector smoke against a real image stays bundled here (RunsOn
+		// integration) so `make integration` behaves like the Taskfile version did.
+		Task{
+			Name:        "integration",
+			Description: "run integration tests",
+			RunsOn:      lang.List("test"),
+			Run: func() {
+				raceFlag := ""
+				if raceEnabled() {
+					raceFlag = " -race"
+				}
+				Run(
+					"go test -count=1 -timeout=30m"+raceFlag+" ./cmd/syft/internal/test/integration/...",
+					run.Env("GODEBUG", "dontfreezetheworld=1"),
+				)
+			},
+		},
 		Task{
 			Name:        "integration:race-smoke",
 			Description: "exercise the CLI with the race detector",
 			RunsOn:      lang.List("integration"),
 			Run: func() {
+				if !raceEnabled() {
+					Log("race detector disabled (RACE=false); skipping race smoke")
+					return
+				}
 				Run("go run -race cmd/syft/main.go anchore/test_images:grype-quality-dotnet-69f15d2")
 			},
 		},
@@ -73,6 +97,23 @@ func main() {
 			},
 		},

+		// windows unit tests: deliberately not hooked into "test" (no RunsOn). The full unit suite leans on
+		// linux docker fixture images and posix-only assumptions, so this covers the packages that own
+		// host path handling (where windows bugs live) and skips the tests that need docker image fixtures.
+		// ponytail: curated package list, widen it as more of the suite is made windows-safe.
+		Task{
+			Name:        "unit:windows",
+			Description: "run the windows-relevant subset of unit tests",
+			Run: func() {
+				Run("go test -count=1"+
+					` -skip "Image|Squash|AllLayers|MixFileTypes|GivenCoordinates"`+
+					" ./syft/internal/windows/... ./syft/internal/fileresolver/... ./syft/source/directorysource/... ./syft/source/filesource/..."+
+					" ./syft/file ./syft/file/cataloger/filedigest/... ./syft/file/cataloger/filecontent/...",
+					run.Stdout(os.Stderr),
+				)
+			},
+		},
+
 		// default validation pipeline (replaces Taskfile `default`/`pr-validations`/`validations`).
 		Task{
 			Name:         "default",
@@ -132,6 +173,26 @@ func main() {
 	)
 }

+// raceEnabled is the single switch for the race detector across every test suite.
+// Unset it and we keep go-make's behavior (on in CI, off locally and on windows);
+// set RACE=false to turn it off everywhere -- worth doing when rebuilding the test
+// fixture cache from scratch, where every suite is dominated by building docker
+// fixtures and the race detector only adds wall clock. RACE=true forces it on.
+func raceEnabled() bool {
+	if enabled, err := strconv.ParseBool(config.Env("RACE", "")); err == nil {
+		return enabled
+	}
+	return config.CI && !config.Windows
+}
+
+// race applies raceEnabled() to a gotest suite. gotest exposes no functional option
+// for the race detector, but gotest.Config.Race is exported.
+func race() gotest.Option {
+	return func(c *gotest.Config) {
+		c.Race = raceEnabled()
+	}
+}
+
 // snapshotBinPath replicates the SNAPSHOT_BIN computation from the prior Taskfile:
 // <repoRoot>/snapshot/<os>-build_<os>_<arch>/syft, where arch maps amd64->amd64_v1
 // and arm64->arm64_v8.0 to match goreleaser's per-target output directory naming.
@@ -0,0 +1,49 @@
+package main
+
+import (
+	"os"
+	"testing"
+
+	"github.com/anchore/go-make/config"
+	"github.com/anchore/go-make/tasks/gotest"
+)
+
+func TestRaceEnabled(t *testing.T) {
+	tests := []struct {
+		name string
+		env  string // "" means RACE is unset
+		ci   bool
+		want bool
+	}{
+		{name: "default in CI", ci: true, want: true},
+		{name: "default locally", ci: false, want: false},
+		{name: "explicitly off in CI", env: "false", ci: true, want: false},
+		{name: "explicitly on locally", env: "true", ci: false, want: true},
+		{name: "unparseable falls back to default", env: "yes-please", ci: true, want: true},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			// always go through t.Setenv (it registers the restore) so an ambient
+			// RACE from the caller's environment can't leak into the unset cases
+			t.Setenv("RACE", tt.env)
+			if tt.env == "" {
+				os.Unsetenv("RACE")
+			}
+			orig := config.CI
+			config.CI = tt.ci
+			t.Cleanup(func() { config.CI = orig })
+
+			if got := raceEnabled(); got != tt.want {
+				t.Errorf("raceEnabled() = %v, want %v", got, tt.want)
+			}
+
+			// the gotest suites get the same answer through the functional option
+			var cfg gotest.Config
+			race()(&cfg)
+			if cfg.Race != tt.want {
+				t.Errorf("race() set Race = %v, want %v", cfg.Race, tt.want)
+			}
+		})
+	}
+}
@@ -1,4 +1,4 @@
-ARG DEBIAN_VERSION=12
+ARG DEBIAN_VERSION=13
 FROM gcr.io/distroless/static-debian${DEBIAN_VERSION}:latest AS build

 FROM scratch
@@ -8,23 +8,7 @@ COPY --from=build /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/ca-certifica
 # create the /tmp dir, which is needed for image content cache
 WORKDIR /tmp

-COPY syft /
-
-ARG BUILD_DATE
-ARG BUILD_VERSION
-ARG VCS_REF
-ARG VCS_URL
-
-LABEL org.opencontainers.image.created=$BUILD_DATE
-LABEL org.opencontainers.image.title="syft"
-LABEL org.opencontainers.image.description="CLI tool and library for generating a Software Bill of Materials from container images and filesystems"
-LABEL org.opencontainers.image.source=$VCS_URL
-LABEL org.opencontainers.image.revision=$VCS_REF
-LABEL org.opencontainers.image.vendor="Anchore, Inc."
-LABEL org.opencontainers.image.version=$BUILD_VERSION
-LABEL org.opencontainers.image.licenses="Apache-2.0"
-LABEL io.artifacthub.package.readme-url="https://raw.githubusercontent.com/anchore/syft/main/README.md"
-LABEL io.artifacthub.package.logo-url="https://user-images.githubusercontent.com/5199289/136844524-1527b09f-c5cb-4aa9-be54-5aa92a6086c1.png"
-LABEL io.artifacthub.package.license="Apache-2.0"
+ARG TARGETPLATFORM
+COPY ${TARGETPLATFORM}/syft /

 ENTRYPOINT ["/syft"]
@@ -1,28 +1,10 @@
-ARG DEBIAN_VERSION=12
-FROM gcr.io/distroless/static-debian${DEBIAN_VERSION}:debug-nonroot
+ARG DEBIAN_VERSION=13
+FROM gcr.io/distroless/static-debian${DEBIAN_VERSION}:debug

 # create the /tmp dir, which is needed for image content cache
 WORKDIR /tmp

-COPY syft /
-
-USER nonroot
-
-ARG BUILD_DATE
-ARG BUILD_VERSION
-ARG VCS_REF
-ARG VCS_URL
-
-LABEL org.opencontainers.image.created=$BUILD_DATE
-LABEL org.opencontainers.image.title="syft"
-LABEL org.opencontainers.image.description="CLI tool and library for generating a Software Bill of Materials from container images and filesystems"
-LABEL org.opencontainers.image.source=$VCS_URL
-LABEL org.opencontainers.image.revision=$VCS_REF
-LABEL org.opencontainers.image.vendor="Anchore, Inc."
-LABEL org.opencontainers.image.version=$BUILD_VERSION
-LABEL org.opencontainers.image.licenses="Apache-2.0"
-LABEL io.artifacthub.package.readme-url="https://raw.githubusercontent.com/anchore/syft/main/README.md"
-LABEL io.artifacthub.package.logo-url="https://user-images.githubusercontent.com/5199289/136844524-1527b09f-c5cb-4aa9-be54-5aa92a6086c1.png"
-LABEL io.artifacthub.package.license="Apache-2.0"
+ARG TARGETPLATFORM
+COPY ${TARGETPLATFORM}/syft /

 ENTRYPOINT ["/syft"]
@@ -0,0 +1,12 @@
+ARG DEBIAN_VERSION=13
+FROM gcr.io/distroless/static-debian${DEBIAN_VERSION}:debug-nonroot
+
+# create the /tmp dir, which is needed for image content cache
+WORKDIR /tmp
+
+ARG TARGETPLATFORM
+COPY ${TARGETPLATFORM}/syft /
+
+USER nonroot
+
+ENTRYPOINT ["/syft"]
@@ -1,28 +1,12 @@
-ARG DEBIAN_VERSION=12
+ARG DEBIAN_VERSION=13
 FROM gcr.io/distroless/static-debian${DEBIAN_VERSION}:nonroot

 # create the /tmp dir, which is needed for image content cache
 WORKDIR /tmp

-COPY syft /
+ARG TARGETPLATFORM
+COPY ${TARGETPLATFORM}/syft /

 USER nonroot

-ARG BUILD_DATE
-ARG BUILD_VERSION
-ARG VCS_REF
-ARG VCS_URL
-
-LABEL org.opencontainers.image.created=$BUILD_DATE
-LABEL org.opencontainers.image.title="syft"
-LABEL org.opencontainers.image.description="CLI tool and library for generating a Software Bill of Materials from container images and filesystems"
-LABEL org.opencontainers.image.source=$VCS_URL
-LABEL org.opencontainers.image.revision=$VCS_REF
-LABEL org.opencontainers.image.vendor="Anchore, Inc."
-LABEL org.opencontainers.image.version=$BUILD_VERSION
-LABEL org.opencontainers.image.licenses="Apache-2.0"
-LABEL io.artifacthub.package.readme-url="https://raw.githubusercontent.com/anchore/syft/main/README.md"
-LABEL io.artifacthub.package.logo-url="https://user-images.githubusercontent.com/5199289/136844524-1527b09f-c5cb-4aa9-be54-5aa92a6086c1.png"
-LABEL io.artifacthub.package.license="Apache-2.0"
-
 ENTRYPOINT ["/syft"]
@@ -8,10 +8,9 @@

 <p align="center">
 &nbsp;<a href="https://github.com/anchore/syft/actions/workflows/validations.yaml" target="_blank"><img alt="Validations" src="https://github.com/anchore/syft/actions/workflows/validations.yaml/badge.svg"></a>&nbsp;
- &nbsp;<a href="https://goreportcard.com/report/github.com/anchore/syft" target="_blank"><img alt="Go Report Card" src="https://goreportcard.com/badge/github.com/anchore/syft"></a>&nbsp;
 &nbsp;<a href="https://github.com/anchore/syft/releases/latest" target="_blank"><img alt="GitHub release" src="https://img.shields.io/github/release/anchore/syft.svg"></a>&nbsp;
 &nbsp;<a href="https://github.com/anchore/syft" target="_blank"><img alt="GitHub go.mod Go version" src="https://img.shields.io/github/go-mod/go-version/anchore/syft.svg"></a>&nbsp;
- &nbsp;<a href="" target="_blank"><img alt="License: Apache-2.0" src="https://img.shields.io/badge/License-Apache%202.0-blue.svg"></a>&nbsp;
+ &nbsp;<a href="https://github.com/anchore/syft/blob/main/LICENSE" target="_blank"><img alt="License: Apache-2.0" src="https://img.shields.io/badge/License-Apache%202.0-blue.svg"></a>&nbsp;
 &nbsp;<a href="https://anchore.com/discourse" target="_blank"><img alt="Join our Discourse" src="https://img.shields.io/badge/Discourse-Join-blue?logo=discourse"/></a>&nbsp;
 &nbsp;<a rel="me" href="https://fosstodon.org/@syft"><img alt="Follow on Mastodon" src="https://img.shields.io/badge/Mastodon-Follow-blue?logoColor=white&logo=mastodon"/></a>&nbsp;
 </p>
@@ -39,6 +39,12 @@ vars:
  PROJECT_ROOT:
    sh: echo $PWD

+  # docker platform suffix goreleaser appends to snapshot image tags (e.g. latest-amd64).
+  # snapshot builds load per-arch images rather than a multi-arch manifest, so the smoke
+  # test must run the host-native tag to avoid emulation (and red-local/green-CI splits).
+  DOCKER_ARCH:
+    sh: go env GOARCH
+
  # note: the snapshot dir must be a relative path starting with ./
  # e.g. when installing snapshot debs from a local path, ./ forces the deb to be installed in the current working directory instead of referencing a package name
  SNAPSHOT_DIR: ./snapshot
@@ -119,6 +125,7 @@ tasks:
    desc: Run tests for pipeline utils
    cmds:
      - cmd: .github/scripts/labeler_test.py
+      - cmd: go test -C .make ./...

  snapshot-smoke-test:
    desc: Run a smoke test on the snapshot builds + docker images
@@ -129,8 +136,8 @@ tasks:
        silent: true
      - "{{ .SNAPSHOT_BIN }} version"
      - "{{ .SNAPSHOT_BIN }} scan alpine:latest"
-      - docker run --rm anchore/syft:latest version
-      - docker run --rm anchore/syft:latest scan alpine:latest
+      - docker run --pull=never --rm anchore/syft:latest-{{ .DOCKER_ARCH }} version
+      - docker run --pull=never --rm anchore/syft:latest-{{ .DOCKER_ARCH }} scan alpine:latest

  ## Test-fixture-related targets ###########################################

@@ -158,6 +158,11 @@ func (l *backgroundLineReader) read(reader io.Reader, stage *progress.Stage) {

 		l.lock.Unlock()
 	}
+	if err := s.Err(); err != nil {
+		log.WithFields("error", err).Debug("unable to read attestation output")
+		// keep draining so the writer never blocks on a full pipe
+		_, _ = io.Copy(io.Discard, reader)
+	}
 }

 func (l backgroundLineReader) Lines() []string {
@@ -349,8 +349,8 @@ func renderCatalogerInfoTable(_ *capabilities.Document, catalogers []capabilitie
 		})),
 		tablewriter.WithConfig(tablewriter.Config{
 			Row: tw.CellConfig{
-				Formatting: tw.CellFormatting{MergeMode: tw.MergeHierarchical},
-				Alignment:  tw.CellAlignment{Global: tw.AlignLeft},
+				Merging:   tw.CellMerging{Mode: tw.MergeHierarchical},
+				Alignment: tw.CellAlignment{Global: tw.AlignLeft},
 			},
 		}),
 	)
@@ -1,24 +1,34 @@
 package commands

 import (
+	"context"
 	"fmt"
 	"io"
 	"os"
+	"path/filepath"
+	"strings"

 	"github.com/spf13/cobra"

 	"github.com/anchore/clio"
+	"github.com/anchore/go-homedir"
 	"github.com/anchore/syft/cmd/syft/internal/options"
 	"github.com/anchore/syft/cmd/syft/internal/ui"
 	"github.com/anchore/syft/internal"
+	"github.com/anchore/syft/internal/bus"
 	"github.com/anchore/syft/internal/log"
+	"github.com/anchore/syft/internal/spillbuf"
+	"github.com/anchore/syft/internal/tmpdir"
 	"github.com/anchore/syft/syft/format"
+	"github.com/anchore/syft/syft/format/syftjson"
+	"github.com/anchore/syft/syft/sbom"
 )

 const (
 	convertExample = `  {{.appName}} {{.command}} img.syft.json -o spdx-json                      convert a syft SBOM to spdx-json, output goes to stdout
  {{.appName}} {{.command}} img.syft.json -o cyclonedx-json=img.cdx.json    convert a syft SBOM to CycloneDX, output is written to the file "img.cdx.json"
  {{.appName}} {{.command}} - -o spdx-json                                  convert an SBOM from STDIN to spdx-json
+  SYFT_CONVERT_PASSTHROUGH_EXACT_FORMAT=true {{.appName}} {{.command}} img.syft.json -o syft-json=out.syft.json    copy the input to "out.syft.json" unchanged if it is already syft-json at the current schema version
 `
 )

@@ -26,6 +36,7 @@ type ConvertOptions struct {
 	options.Config      `yaml:",inline" mapstructure:",squash"`
 	options.Output      `yaml:",inline" mapstructure:",squash"`
 	options.UpdateCheck `yaml:",inline" mapstructure:",squash"`
+	Convert             options.Convert `yaml:"convert" json:"convert" mapstructure:"convert"`
 }

 func Convert(app clio.Application) *cobra.Command {
@@ -34,6 +45,7 @@ func Convert(app clio.Application) *cobra.Command {
 	opts := &ConvertOptions{
 		UpdateCheck: options.DefaultUpdateCheck(),
 		Output:      options.DefaultOutput(),
+		Convert:     options.DefaultConvert(),
 	}

 	return app.SetupCommand(&cobra.Command{
@@ -46,11 +58,11 @@ func Convert(app clio.Application) *cobra.Command {
 		}),
 		Args:    validateConvertArgs,
 		PreRunE: applicationUpdateCheck(id, &opts.UpdateCheck),
-		RunE: func(_ *cobra.Command, args []string) error {
+		RunE: func(cmd *cobra.Command, args []string) error {
 			restoreStdout := ui.CaptureStdoutToTraceLog()
 			defer restoreStdout()

-			return RunConvert(opts, args[0])
+			return RunConvert(cmd.Context(), opts, args[0])
 		},
 	}, opts)
 }
@@ -59,30 +71,63 @@ func validateConvertArgs(cmd *cobra.Command, args []string) error {
 	return validateArgs(cmd, args, "an SBOM argument is required")
 }

-func RunConvert(opts *ConvertOptions, userInput string) error {
+func RunConvert(ctx context.Context, opts *ConvertOptions, userInput string) error {
 	log.Warn("convert is an experimental feature, run `syft convert -h` for help")

-	writer, err := opts.SBOMWriter()
+	// a temp dir is only needed when STDIN is a pipe and has to be spilled to disk; it is created lazily on
+	// first use (under the user's TMPDIR), so a file input never touches it. Mirrors syft.CreateSBOM, which
+	// also honors a TempDir already attached to the context.
+	td := tmpdir.FromContext(ctx)
+	if td == nil {
+		_, td = tmpdir.Root(ctx, "syft-convert")
+		defer func() {
+			_ = td.Cleanup()
+		}()
+	}
+
+	reader, inputInfo, err := openConvertInput(userInput, td)
 	if err != nil {
 		return err
 	}
+	defer func() {
+		_ = reader.Close()
+	}()

-	var reader io.ReadSeekCloser
+	outputs := opts.Outputs
+	var unchanged []string
+	if opts.Convert.PassthroughExactFormat {
+		log.Warn("convert.passthrough-exact-format is enabled: syft-json input that already exactly matches a requested output format and schema version will be copied to that output unchanged (this does not apply to any other input format)")

-	if userInput == "-" {
-		// though os.Stdin is an os.File, it does not support seeking
-		// you will get errors such as "seek /dev/stdin: illegal seek".
-		// We need to buffer what we read.
-		reader = internal.NewBufferedSeeker(os.Stdin)
-	} else {
-		f, err := os.Open(userInput)
+		unchanged, outputs, err = partitionOutputsBySourceFormat(opts.Output, reader)
 		if err != nil {
-			return fmt.Errorf("failed to open SBOM file: %w", err)
+			return err
 		}
-		defer func() {
-			_ = f.Close()
-		}()
-		reader = f
+	}
+
+	// resolve (and validate) every output that needs converting before writing anything, so that
+	// a bad -o value fails the command without leaving partial results behind
+	var writer sbom.Writer
+	if len(outputs) > 0 {
+		outputOpts := opts.Output
+		outputOpts.Outputs = outputs
+		writer, err = outputOpts.SBOMWriter()
+		if err != nil {
+			return err
+		}
+	}
+
+	for _, output := range unchanged {
+		if err := writeUnchanged(output, opts.LegacyFile, inputInfo, reader); err != nil {
+			return err
+		}
+	}
+
+	if writer == nil {
+		return nil
+	}
+
+	if _, err := reader.Seek(0, io.SeekStart); err != nil {
+		return fmt.Errorf("unable to seek to start of SBOM: %w", err)
 	}

 	s, _, _, err := format.Decode(reader)
@@ -100,3 +145,171 @@ func RunConvert(opts *ConvertOptions, userInput string) error {

 	return nil
 }
+
+// openConvertInput opens the SBOM document at the given path, or STDIN when "-". The returned reader is seekable so
+// the document can be identified, copied, and decoded in turn without being loaded into memory. The returned
+// os.FileInfo describes the file the document is being read from, so that writing back over it can be recognized;
+// it is nil when the input is not a file (a pipe or a terminal on STDIN).
+func openConvertInput(userInput string, td *tmpdir.TempDir) (io.ReadSeekCloser, os.FileInfo, error) {
+	if userInput == "-" {
+		return openStdin(td)
+	}
+
+	f, err := os.Open(userInput)
+	if err != nil {
+		return nil, nil, fmt.Errorf("failed to open SBOM file: %w", err)
+	}
+
+	info, err := f.Stat()
+	if err != nil {
+		// the document is readable, we just cannot recognize it as an output destination
+		log.WithFields("error", err, "path", userInput).Debug("unable to stat SBOM file")
+	}
+	return f, info, nil
+}
+
+// openStdin returns a seekable view of STDIN. When STDIN is a regular file (such as a shell redirect) it is read in
+// place. A pipe or terminal cannot seek (you will get errors such as "seek /dev/stdin: illegal seek"), so its
+// contents are drained into a spill buffer: a small head stays in memory and everything beyond it goes to a temp
+// file under td, so an arbitrarily large piped SBOM never has to be held in memory to be made seekable.
+func openStdin(td *tmpdir.TempDir) (io.ReadSeekCloser, os.FileInfo, error) {
+	if info, err := os.Stdin.Stat(); err == nil && info.Mode().IsRegular() {
+		if start, err := os.Stdin.Seek(0, io.SeekCurrent); err == nil {
+			// a redirect reads the file in place, so it is just as much an input file as a path argument is
+			return readSeekNopCloser{io.NewSectionReader(os.Stdin, start, info.Size()-start)}, info, nil
+		}
+	}
+
+	buf := spillbuf.New(td)
+	if _, err := io.Copy(io.NewOffsetWriter(buf, 0), os.Stdin); err != nil {
+		_ = buf.Close()
+		return nil, nil, fmt.Errorf("failed to read SBOM from STDIN: %w", err)
+	}
+
+	return &spilledReader{
+		SectionReader: io.NewSectionReader(buf, 0, buf.Size()),
+		buf:           buf,
+	}, nil, nil
+}
+
+type readSeekNopCloser struct {
+	io.ReadSeeker
+}
+
+func (readSeekNopCloser) Close() error {
+	return nil
+}
+
+// spilledReader is a seekable view over a spill buffer; closing it releases the buffer's memory and spill file.
+type spilledReader struct {
+	*io.SectionReader
+	buf *spillbuf.Buffer
+}
+
+func (r *spilledReader) Close() error {
+	return r.buf.Close()
+}
+
+// partitionOutputsBySourceFormat splits the requested outputs (in "<format>[@<version>][=<path>]" form) into those
+// that exactly match the format and schema version of a syft-json input document (which can be written out
+// unchanged) and those that still require conversion. Input in any other format is always converted. Outputs that
+// cannot be resolved to an encoder are left for the writer to report on.
+func partitionOutputsBySourceFormat(output options.Output, reader io.ReadSeeker) (unchanged []string, toConvert []string, err error) {
+	if _, err := reader.Seek(0, io.SeekStart); err != nil {
+		return nil, nil, fmt.Errorf("unable to seek to start of SBOM: %w", err)
+	}
+
+	id, version := format.Identify(reader)
+	if id == "" || version == "" {
+		// let decoding surface the appropriate error
+		return nil, output.Outputs, nil
+	}
+
+	if id != syftjson.ID {
+		log.WithFields("format", id, "version", version).Debug("input is not syft-json, passthrough does not apply")
+		return nil, output.Outputs, nil
+	}
+
+	encoders, err := output.Encoders()
+	if err != nil {
+		return nil, nil, err
+	}
+	collection := format.NewEncoderCollection(encoders...)
+
+	for _, out := range output.Outputs {
+		name, _, _ := strings.Cut(strings.TrimSpace(out), "=")
+		enc := collection.GetByString(name)
+		if enc != nil && enc.ID() == id && enc.Version() == version {
+			log.WithFields("format", id, "version", version, "output", out).Warn("input already exactly matches the requested output format and schema version, copying it unchanged instead of converting it")
+			unchanged = append(unchanged, out)
+			continue
+		}
+		toConvert = append(toConvert, out)
+	}
+
+	return unchanged, toConvert, nil
+}
+
+// writeUnchanged copies the SBOM document as-is to the destination described by the given "<format>[=<path>]"
+// output value, falling back to the (deprecated) --file path, and finally to the report bus (STDOUT). When the
+// destination is the input file itself there is nothing to do.
+func writeUnchanged(output string, defaultFile string, inputInfo os.FileInfo, reader io.ReadSeeker) error {
+	if _, err := reader.Seek(0, io.SeekStart); err != nil {
+		return fmt.Errorf("unable to seek to start of SBOM: %w", err)
+	}
+
+	_, path, _ := strings.Cut(strings.TrimSpace(output), "=")
+	if path == "" {
+		path = defaultFile
+	}
+
+	if path == "" {
+		// the report bus only carries strings, so STDOUT output must be materialized in memory
+		content, err := io.ReadAll(reader) //nolint:gocritic // the whole SBOM is the report; there is no meaningful bound
+		if err != nil {
+			return fmt.Errorf("unable to read SBOM: %w", err)
+		}
+		bus.Report(string(content))
+		return nil
+	}
+
+	expandedPath, err := homedir.Expand(path)
+	if err != nil {
+		log.Warnf("could not expand given writer output path=%q: %w", path, err)
+		expandedPath = path
+	}
+
+	if isSameFile(inputInfo, expandedPath) {
+		log.WithFields("path", expandedPath).Info("output is the input file, leaving it as-is")
+		return nil
+	}
+
+	if err := os.MkdirAll(filepath.Dir(expandedPath), 0755); err != nil {
+		return fmt.Errorf("unable to create report directory: %w", err)
+	}
+
+	f, err := os.OpenFile(expandedPath, os.O_WRONLY|os.O_CREATE|os.O_TRUNC, 0644)
+	if err != nil {
+		return fmt.Errorf("unable to create report file: %w", err)
+	}
+
+	if _, err := io.Copy(f, reader); err != nil {
+		_ = f.Close()
+		return fmt.Errorf("unable to write report file: %w", err)
+	}
+
+	return f.Close()
+}
+
+// isSameFile reports whether the given path names the file the input is being read from. Comparing the input's
+// os.FileInfo rather than its path covers a shell redirect onto STDIN, which has no path to compare.
+func isSameFile(inputInfo os.FileInfo, path string) bool {
+	if inputInfo == nil {
+		return false
+	}
+	pathInfo, err := os.Stat(path)
+	if err != nil {
+		return false
+	}
+	return os.SameFile(inputInfo, pathInfo)
+}
@@ -0,0 +1,448 @@
+package commands
+
+import (
+	"bytes"
+	"context"
+	"fmt"
+	"os"
+	"path/filepath"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"github.com/wagoodman/go-partybus"
+
+	"github.com/anchore/syft/cmd/syft/internal/options"
+	"github.com/anchore/syft/internal/bus"
+	"github.com/anchore/syft/internal/spillbuf"
+	"github.com/anchore/syft/syft/event"
+	"github.com/anchore/syft/syft/file"
+	"github.com/anchore/syft/syft/format"
+	"github.com/anchore/syft/syft/format/cyclonedxjson"
+	"github.com/anchore/syft/syft/format/spdxjson"
+	"github.com/anchore/syft/syft/format/syftjson"
+	"github.com/anchore/syft/syft/pkg"
+	"github.com/anchore/syft/syft/sbom"
+	"github.com/anchore/syft/syft/source"
+)
+
+func convertTestSBOM() sbom.SBOM {
+	catalog := pkg.NewCollection()
+	catalog.Add(pkg.Package{
+		Name:    "musl-utils",
+		Version: "1.2.3-r4",
+		Type:    pkg.ApkPkg,
+		FoundBy: "apk-db-cataloger",
+		Locations: file.NewLocationSet(
+			file.NewLocation("/lib/apk/db/installed"),
+		),
+		PURL: "pkg:apk/alpine/musl-utils@1.2.3-r4",
+	})
+
+	return sbom.SBOM{
+		Artifacts: sbom.Artifacts{
+			Packages: catalog,
+		},
+		Source: source.Description{
+			ID:      "some-id",
+			Name:    "some-dir",
+			Version: "latest",
+			Metadata: source.DirectoryMetadata{
+				Path: "/some/path",
+			},
+		},
+		Descriptor: sbom.Descriptor{
+			Name:    "syft",
+			Version: "v0.0.0-test",
+		},
+	}
+}
+
+func mustConvertEncoder(enc sbom.FormatEncoder, err error) sbom.FormatEncoder {
+	if err != nil {
+		panic(err)
+	}
+	return enc
+}
+
+func encodeConvertTestSBOM(t *testing.T, enc sbom.FormatEncoder) []byte {
+	buf := &bytes.Buffer{}
+	require.NoError(t, enc.Encode(buf, convertTestSBOM()))
+	return buf.Bytes()
+}
+
+// prettySyftJSON returns the test SBOM as pretty-printed syft-json. Pretty input makes a verbatim copy
+// distinguishable from a re-encode, since re-encoding always produces compact output here.
+func prettySyftJSON(t *testing.T) []byte {
+	cfg := syftjson.DefaultEncoderConfig()
+	cfg.Pretty = true
+	return encodeConvertTestSBOM(t, mustConvertEncoder(syftjson.NewFormatEncoderWithConfig(cfg)))
+}
+
+func Test_partitionOutputsBySourceFormat(t *testing.T) {
+	syftEncoder := mustConvertEncoder(syftjson.NewFormatEncoderWithConfig(syftjson.DefaultEncoderConfig()))
+	syftVersion := syftEncoder.Version()
+	syftContent := encodeConvertTestSBOM(t, syftEncoder)
+
+	// the same document claiming an older schema version
+	olderSyftContent := bytes.ReplaceAll(syftContent, []byte(`"version":"`+syftVersion+`"`), []byte(`"version":"16.0.0"`))
+	require.NotEqual(t, syftContent, olderSyftContent)
+
+	cdxContent := encodeConvertTestSBOM(t, mustConvertEncoder(cyclonedxjson.NewFormatEncoderWithConfig(cyclonedxjson.DefaultEncoderConfig())))
+
+	tests := []struct {
+		name          string
+		content       []byte
+		outputs       []string
+		wantUnchanged []string
+		wantToConvert []string
+	}{
+		{
+			name:          "syft-json matches the bare format name",
+			content:       syftContent,
+			outputs:       []string{"syft-json"},
+			wantUnchanged: []string{"syft-json"},
+		},
+		{
+			name:          "syft-json matches its alias",
+			content:       syftContent,
+			outputs:       []string{"json"},
+			wantUnchanged: []string{"json"},
+		},
+		{
+			name:          "syft-json matches an explicit version and file path",
+			content:       syftContent,
+			outputs:       []string{"syft-json@" + syftVersion + "=out/some.syft.json"},
+			wantUnchanged: []string{"syft-json@" + syftVersion + "=out/some.syft.json"},
+		},
+		{
+			name:          "syft-json at an older schema version requires conversion",
+			content:       olderSyftContent,
+			outputs:       []string{"syft-json"},
+			wantToConvert: []string{"syft-json"},
+		},
+		{
+			name:          "a different output format requires conversion",
+			content:       syftContent,
+			outputs:       []string{"spdx-json"},
+			wantToConvert: []string{"spdx-json"},
+		},
+		{
+			name:          "mixed outputs are partitioned",
+			content:       syftContent,
+			outputs:       []string{"syft-json=a.json", "spdx-json=b.json", "cyclonedx-xml"},
+			wantUnchanged: []string{"syft-json=a.json"},
+			wantToConvert: []string{"spdx-json=b.json", "cyclonedx-xml"},
+		},
+		{
+			name:          "unknown format is left for the writer to report",
+			content:       syftContent,
+			outputs:       []string{"bogus"},
+			wantToConvert: []string{"bogus"},
+		},
+		{
+			name:          "non syft-json input is always converted, even when it matches the output",
+			content:       cdxContent,
+			outputs:       []string{"cyclonedx-json"},
+			wantToConvert: []string{"cyclonedx-json"},
+		},
+		{
+			name:          "unidentifiable content is left for the decoder to report",
+			content:       []byte("definitely not an sbom"),
+			outputs:       []string{"syft-json"},
+			wantToConvert: []string{"syft-json"},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			output := options.DefaultOutput()
+			output.Outputs = tt.outputs
+
+			unchanged, toConvert, err := partitionOutputsBySourceFormat(output, bytes.NewReader(tt.content))
+			require.NoError(t, err)
+			assert.Equal(t, tt.wantUnchanged, unchanged)
+			assert.Equal(t, tt.wantToConvert, toConvert)
+		})
+	}
+}
+
+func Test_RunConvert_passthroughExactFormat(t *testing.T) {
+	syftContent := prettySyftJSON(t)
+
+	newOpts := func(passthrough bool, outputs ...string) *ConvertOptions {
+		opts := &ConvertOptions{
+			Output: options.DefaultOutput(),
+			Convert: options.Convert{
+				PassthroughExactFormat: passthrough,
+			},
+		}
+		opts.Outputs = outputs
+		return opts
+	}
+
+	writeInput := func(t *testing.T, content []byte) string {
+		input := filepath.Join(t.TempDir(), "input.json")
+		require.NoError(t, os.WriteFile(input, content, 0600))
+		return input
+	}
+
+	t.Run("matching output is copied unchanged while others are converted", func(t *testing.T) {
+		dir := t.TempDir()
+		syftOut := filepath.Join(dir, "out.syft.json")
+		spdxOut := filepath.Join(dir, "out.spdx.json")
+
+		opts := newOpts(true, "syft-json="+syftOut, "spdx-json="+spdxOut)
+		require.NoError(t, RunConvert(context.Background(), opts, writeInput(t, syftContent)))
+
+		got, err := os.ReadFile(syftOut)
+		require.NoError(t, err)
+		assert.Equal(t, syftContent, got)
+
+		spdx, err := os.ReadFile(spdxOut)
+		require.NoError(t, err)
+		id, _ := format.Identify(bytes.NewReader(spdx))
+		assert.Equal(t, spdxjson.ID, id)
+	})
+
+	t.Run("STDIN input is copied unchanged while others are converted", func(t *testing.T) {
+		dir := t.TempDir()
+		syftOut := filepath.Join(dir, "out.syft.json")
+		spdxOut := filepath.Join(dir, "out.spdx.json")
+
+		stdin, err := os.Open(writeInput(t, syftContent))
+		require.NoError(t, err)
+		defer stdin.Close()
+
+		originalStdin := os.Stdin
+		os.Stdin = stdin
+		t.Cleanup(func() { os.Stdin = originalStdin })
+
+		opts := newOpts(true, "syft-json="+syftOut, "spdx-json="+spdxOut)
+		require.NoError(t, RunConvert(context.Background(), opts, "-"))
+
+		got, err := os.ReadFile(syftOut)
+		require.NoError(t, err)
+		assert.Equal(t, syftContent, got)
+
+		spdx, err := os.ReadFile(spdxOut)
+		require.NoError(t, err)
+		id, _ := format.Identify(bytes.NewReader(spdx))
+		assert.Equal(t, spdxjson.ID, id)
+	})
+
+	t.Run("piped STDIN input is copied unchanged while others are converted", func(t *testing.T) {
+		dir := t.TempDir()
+		syftOut := filepath.Join(dir, "out.syft.json")
+		spdxOut := filepath.Join(dir, "out.spdx.json")
+
+		pipeReader, pipeWriter, err := os.Pipe()
+		require.NoError(t, err)
+		defer pipeReader.Close()
+		go func() {
+			defer pipeWriter.Close()
+			_, _ = pipeWriter.Write(syftContent)
+		}()
+
+		originalStdin := os.Stdin
+		os.Stdin = pipeReader
+		t.Cleanup(func() { os.Stdin = originalStdin })
+
+		opts := newOpts(true, "syft-json="+syftOut, "spdx-json="+spdxOut)
+		require.NoError(t, RunConvert(context.Background(), opts, "-"))
+
+		got, err := os.ReadFile(syftOut)
+		require.NoError(t, err)
+		assert.Equal(t, syftContent, got)
+
+		spdx, err := os.ReadFile(spdxOut)
+		require.NoError(t, err)
+		id, _ := format.Identify(bytes.NewReader(spdx))
+		assert.Equal(t, spdxjson.ID, id)
+	})
+
+	t.Run("without the option the matching output is re-encoded", func(t *testing.T) {
+		syftOut := filepath.Join(t.TempDir(), "out.syft.json")
+
+		opts := newOpts(false, "syft-json="+syftOut)
+		require.NoError(t, RunConvert(context.Background(), opts, writeInput(t, syftContent)))
+
+		got, err := os.ReadFile(syftOut)
+		require.NoError(t, err)
+		id, _ := format.Identify(bytes.NewReader(got))
+		assert.Equal(t, syftjson.ID, id)
+		// the input was pretty-printed and the encoder is not configured to be, so a re-encode cannot reproduce it
+		assert.NotEqual(t, syftContent, got)
+	})
+
+	t.Run("non syft-json input is re-encoded even when it matches the output", func(t *testing.T) {
+		cdxContent := encodeConvertTestSBOM(t, mustConvertEncoder(cyclonedxjson.NewFormatEncoderWithConfig(cyclonedxjson.DefaultEncoderConfig())))
+		cdxOut := filepath.Join(t.TempDir(), "out.cdx.json")
+
+		opts := newOpts(true, "cyclonedx-json="+cdxOut)
+		require.NoError(t, RunConvert(context.Background(), opts, writeInput(t, cdxContent)))
+
+		got, err := os.ReadFile(cdxOut)
+		require.NoError(t, err)
+		id, _ := format.Identify(bytes.NewReader(got))
+		assert.Equal(t, cyclonedxjson.ID, id)
+		// a fresh serial number is minted on every encode, so a round trip never reproduces the input
+		assert.NotEqual(t, cdxContent, got)
+	})
+
+	t.Run("the deprecated --file path is honored", func(t *testing.T) {
+		syftOut := filepath.Join(t.TempDir(), "out.syft.json")
+
+		opts := newOpts(true, "syft-json")
+		opts.LegacyFile = syftOut
+		require.NoError(t, RunConvert(context.Background(), opts, writeInput(t, syftContent)))
+
+		got, err := os.ReadFile(syftOut)
+		require.NoError(t, err)
+		assert.Equal(t, syftContent, got)
+	})
+
+	t.Run("writing over the input file leaves it intact", func(t *testing.T) {
+		input := writeInput(t, syftContent)
+
+		opts := newOpts(true, "syft-json="+input)
+		require.NoError(t, RunConvert(context.Background(), opts, input))
+
+		got, err := os.ReadFile(input)
+		require.NoError(t, err)
+		assert.Equal(t, syftContent, got)
+	})
+
+	t.Run("writing over a redirected STDIN input leaves it intact", func(t *testing.T) {
+		input := writeInput(t, syftContent)
+
+		stdin, err := os.Open(input)
+		require.NoError(t, err)
+		defer stdin.Close()
+
+		originalStdin := os.Stdin
+		os.Stdin = stdin
+		t.Cleanup(func() { os.Stdin = originalStdin })
+
+		opts := newOpts(true, "syft-json="+input)
+		require.NoError(t, RunConvert(context.Background(), opts, "-"))
+
+		got, err := os.ReadFile(input)
+		require.NoError(t, err)
+		assert.Equal(t, syftContent, got)
+	})
+
+	t.Run("an invalid output fails before anything is written", func(t *testing.T) {
+		syftOut := filepath.Join(t.TempDir(), "out.syft.json")
+
+		opts := newOpts(true, "syft-json="+syftOut, "bogus")
+		require.Error(t, RunConvert(context.Background(), opts, writeInput(t, syftContent)))
+
+		assert.NoFileExists(t, syftOut)
+	})
+
+	t.Run("a missing input file is reported", func(t *testing.T) {
+		syftOut := filepath.Join(t.TempDir(), "out.syft.json")
+
+		opts := newOpts(true, "syft-json="+syftOut)
+		err := RunConvert(context.Background(), opts, filepath.Join(t.TempDir(), "does-not-exist.json"))
+		require.ErrorContains(t, err, "failed to open SBOM file")
+
+		assert.NoFileExists(t, syftOut)
+	})
+
+	t.Run("unrecognized input is left to the decoder to reject", func(t *testing.T) {
+		syftOut := filepath.Join(t.TempDir(), "out.syft.json")
+
+		opts := newOpts(true, "syft-json="+syftOut)
+		err := RunConvert(context.Background(), opts, writeInput(t, []byte("definitely not an sbom")))
+		require.ErrorContains(t, err, "failed to decode SBOM")
+	})
+}
+
+// largeSyftJSON returns a pretty-printed syft-json document of at least minBytes, built from many small packages.
+func largeSyftJSON(t *testing.T, minBytes int64) []byte {
+	catalog := pkg.NewCollection()
+	for i := 0; i < int(minBytes/100); i++ {
+		catalog.Add(pkg.Package{
+			Name:    fmt.Sprintf("pkg-%d", i),
+			Version: "1.0.0",
+			Type:    pkg.ApkPkg,
+			PURL:    fmt.Sprintf("pkg:apk/alpine/pkg-%d@1.0.0", i),
+		})
+	}
+	s := convertTestSBOM()
+	s.Artifacts.Packages = catalog
+
+	cfg := syftjson.DefaultEncoderConfig()
+	cfg.Pretty = true
+	enc := mustConvertEncoder(syftjson.NewFormatEncoderWithConfig(cfg))
+
+	buf := &bytes.Buffer{}
+	require.NoError(t, enc.Encode(buf, s))
+	require.Greater(t, int64(buf.Len()), minBytes)
+	return buf.Bytes()
+}
+
+func Test_RunConvert_pipedInputLargerThanMemoryLimitSpillsToDisk(t *testing.T) {
+	// a piped document bigger than the spill buffer's in-memory tier is written to a temp file under TMPDIR;
+	// the conversion must identify, copy and clean up from there rather than holding the document in memory
+	dir := t.TempDir()
+	syftOut := filepath.Join(dir, "out.syft.json")
+	spillRoot := filepath.Join(dir, "spill")
+	require.NoError(t, os.Mkdir(spillRoot, 0o755))
+	t.Setenv("TMPDIR", spillRoot)
+
+	content := largeSyftJSON(t, 2*spillbuf.DefaultMemLimit)
+
+	pipeReader, pipeWriter, err := os.Pipe()
+	require.NoError(t, err)
+	defer pipeReader.Close()
+	go func() {
+		defer pipeWriter.Close()
+		_, _ = pipeWriter.Write(content)
+	}()
+
+	originalStdin := os.Stdin
+	os.Stdin = pipeReader
+	t.Cleanup(func() { os.Stdin = originalStdin })
+
+	opts := &ConvertOptions{
+		Output: options.DefaultOutput(),
+		Convert: options.Convert{
+			PassthroughExactFormat: true,
+		},
+	}
+	opts.Outputs = []string{"syft-json=" + syftOut}
+	require.NoError(t, RunConvert(context.Background(), opts, "-"))
+
+	got, err := os.ReadFile(syftOut)
+	require.NoError(t, err)
+	assert.Equal(t, content, got)
+
+	entries, err := os.ReadDir(spillRoot)
+	require.NoError(t, err)
+	assert.Empty(t, entries, "the spill directory must be removed once the conversion finishes")
+}
+
+func Test_writeUnchanged_stdout(t *testing.T) {
+	// with no output path the document is published on the report bus, which is how the CLI writes to STDOUT
+	b := partybus.NewBus()
+	subscription := b.Subscribe()
+	bus.Set(b)
+	t.Cleanup(func() {
+		bus.Set(nil)
+	})
+
+	content := []byte(`{"some":"document"}`)
+	require.NoError(t, writeUnchanged("syft-json", "", nil, bytes.NewReader(content)))
+
+	select {
+	case e := <-subscription.Events():
+		assert.Equal(t, event.CLIReport, e.Type)
+		assert.Equal(t, string(content), e.Value)
+	case <-time.After(time.Second):
+		t.Fatal("no report was published")
+	}
+}
@@ -7,6 +7,7 @@ import (
 	"os"
 	"reflect"
 	"strings"
+	"time"

 	"github.com/hashicorp/go-multierror"
 	"github.com/spf13/cobra"
@@ -171,6 +172,11 @@ func validateArgs(cmd *cobra.Command, args []string, err string) error {
 }

 func runScan(ctx context.Context, id clio.Identification, opts *scanOptions, userInput string) error {
+	scanStart := time.Now()
+	defer func() {
+		log.Infof("scan completed in %s", time.Since(scanStart).Round(time.Millisecond))
+	}()
+
 	writer, err := opts.SBOMWriter()
 	if err != nil {
 		return err
@@ -20,6 +20,7 @@ import (
 	"github.com/anchore/syft/syft/file/cataloger/executable"
 	"github.com/anchore/syft/syft/file/cataloger/filecontent"
 	"github.com/anchore/syft/syft/pkg/cataloger/binary"
+	"github.com/anchore/syft/syft/pkg/cataloger/cpp"
 	"github.com/anchore/syft/syft/pkg/cataloger/dotnet"
 	"github.com/anchore/syft/syft/pkg/cataloger/golang"
 	"github.com/anchore/syft/syft/pkg/cataloger/java"
@@ -44,6 +45,7 @@ type Catalog struct {
 	Enrich        []string            `yaml:"enrich" json:"enrich" mapstructure:"enrich"`

 	// ecosystem-specific cataloger configuration
+	Cpp         cppConfig         `yaml:"cpp" json:"cpp" mapstructure:"cpp"`
 	Dotnet      dotnetConfig      `yaml:"dotnet" json:"dotnet" mapstructure:"dotnet"`
 	Golang      golangConfig      `yaml:"golang" json:"golang" mapstructure:"golang"`
 	Java        javaConfig        `yaml:"java" json:"java" mapstructure:"java"`
@@ -80,6 +82,7 @@ func DefaultCatalog() Catalog {
 		JavaScript:    defaultJavaScriptConfig(),
 		Python:        defaultPythonConfig(),
 		Nix:           defaultNixConfig(),
+		Cpp:           defaultCppConfig(),
 		Dotnet:        defaultDotnetConfig(),
 		Golang:        defaultGolangConfig(),
 		Java:          defaultJavaConfig(),
@@ -172,11 +175,15 @@ func (cfg Catalog) ToPackagesConfig() pkgcataloging.Config {
 	}
 	return pkgcataloging.Config{
 		Binary: binary.DefaultClassifierCatalogerConfig(),
+		Cpp: cpp.DefaultCatalogerConfig().
+			WithVcpkgAllowGitClone(*multiLevelOption(false, enrichmentEnabled(cfg.Enrich, task.Cpp, task.Vcpkg), cfg.Cpp.VcpkgAllowGitClone)),
 		Dotnet: dotnet.DefaultCatalogerConfig().
 			WithDepPackagesMustHaveDLL(cfg.Dotnet.DepPackagesMustHaveDLL).
 			WithDepPackagesMustClaimDLL(cfg.Dotnet.DepPackagesMustClaimDLL).
 			WithPropagateDLLClaimsToParents(cfg.Dotnet.PropagateDLLClaimsToParents).
-			WithRelaxDLLClaimsWhenBundlingDetected(cfg.Dotnet.RelaxDLLClaimsWhenBundlingDetected),
+			WithRelaxDLLClaimsWhenBundlingDetected(cfg.Dotnet.RelaxDLLClaimsWhenBundlingDetected).
+			WithExcludeProjectReferences(cfg.Dotnet.ExcludeProjectReferences),
+
 		Golang: golang.DefaultCatalogerConfig().
 			WithSearchLocalModCacheLicenses(*multiLevelOption(false, enrichmentEnabled(cfg.Enrich, task.Go, task.Golang), cfg.Golang.SearchLocalModCacheLicenses)).
 			WithLocalModCacheDir(cfg.Golang.LocalModCacheDir).
@@ -191,7 +198,9 @@ func (cfg Catalog) ToPackagesConfig() pkgcataloging.Config {
 					WithFromBuildSettings(cfg.Golang.MainModuleVersion.FromBuildSettings).
 					WithFromLDFlags(cfg.Golang.MainModuleVersion.FromLDFlags),
 			).
-			WithUsePackagesLib(*multiLevelOption(true, enrichmentEnabled(cfg.Enrich, task.Go, task.Golang), cfg.Golang.UsePackagesLib)),
+			WithUsePackagesLib(*multiLevelOption(true, enrichmentEnabled(cfg.Enrich, task.Go, task.Golang), cfg.Golang.UsePackagesLib)).
+			WithCaptureSymbols(cfg.Golang.CaptureSymbols).
+			WithCaptureSymbolsModules(cfg.Golang.CaptureSymbolsModules),
 		JavaScript: javascript.DefaultCatalogerConfig().
 			WithIncludeDevDependencies(*multiLevelOption(false, cfg.JavaScript.IncludeDevDependencies)).
 			WithSearchRemoteLicenses(*multiLevelOption(false, enrichmentEnabled(cfg.Enrich, task.JavaScript, task.Node, task.NPM), cfg.JavaScript.SearchRemoteLicenses)).
@@ -299,6 +308,7 @@ var publicisedEnrichmentOptions = []string{
 	task.Java,
 	task.JavaScript,
 	task.Python,
+	task.Vcpkg,
 }

 func enrichmentEnabled(enrichDirectives []string, features ...string) *bool {
@@ -0,0 +1,27 @@
+package options
+
+import (
+	"github.com/anchore/clio"
+)
+
+var _ clio.FieldDescriber = (*Convert)(nil)
+
+// Convert holds the options specific to the convert command. These are deliberately configuration-only (config file
+// or environment) rather than flags: they change how the command behaves for every invocation in a pipeline and are
+// not expected to vary from one call to the next.
+type Convert struct {
+	PassthroughExactFormat bool `yaml:"passthrough-exact-format" json:"passthrough-exact-format" mapstructure:"passthrough-exact-format"`
+}
+
+func DefaultConvert() Convert {
+	return Convert{
+		PassthroughExactFormat: false,
+	}
+}
+
+func (o *Convert) DescribeFields(descriptions clio.FieldDescriptionSet) {
+	descriptions.Add(&o.PassthroughExactFormat, `when a syft-json input SBOM already exactly matches the requested output format and schema version, copy it to that output unchanged instead of decoding and re-encoding it.
+Note: this only applies to syft-json input, and only when the document's schema version is identical to the schema version this version of syft produces. Any other input is always converted.
+Note: output written this way is a byte-for-byte copy of the input, so format options (such as 'format.pretty' or 'format.json.legacy') are not applied to it.
+Note: to keep memory use minimal on large documents, give the input as a file path (or a shell redirect) and write the output with '-o <format>=<path>'. Piped input, or output to STDOUT, requires the whole document to be held in memory.`)
+}
@@ -0,0 +1,30 @@
+package options
+
+import (
+	"github.com/anchore/clio"
+	"github.com/anchore/syft/syft/pkg/cataloger/cpp"
+)
+
+type cppConfig struct {
+	VcpkgAllowGitClone *bool `yaml:"vcpkg-allow-git-clone" json:"vcpkg-allow-git-clone" mapstructure:"vcpkg-allow-git-clone"`
+}
+
+func defaultCppConfig() cppConfig {
+	// reference the cataloger default so capability generation can associate this config with the cpp
+	// ecosystem (it discovers ecosystem configs by their cataloger import). the value itself stays nil:
+	// nil defaults to false (no network), and leaving it unset lets --enrich opt in. cloning requires a
+	// network connection, which must be opt-in.
+	_ = cpp.DefaultCatalogerConfig()
+	return cppConfig{
+		VcpkgAllowGitClone: nil,
+	}
+}
+
+var _ interface {
+	clio.FieldDescriber
+} = (*cppConfig)(nil)
+
+func (o *cppConfig) DescribeFields(descriptions clio.FieldDescriptionSet) {
+	descriptions.Add(&o.VcpkgAllowGitClone, `enables Syft to use clone remote repositories for vcpkg custom git registries. 
+	(also useful if the builtin vcpkg registry is not cloned locally)`)
+}
@@ -4,6 +4,8 @@ import (
 	"strings"

 	"github.com/anchore/clio"
+	"github.com/anchore/syft/internal/log"
+	"github.com/anchore/syft/syft/cataloging"
 	"github.com/anchore/syft/syft/pkg/cataloger/golang"
 )

@@ -17,10 +19,13 @@ type golangConfig struct {
 	NoProxy                     string                        `json:"no-proxy" yaml:"no-proxy" mapstructure:"no-proxy"`
 	MainModuleVersion           golangMainModuleVersionConfig `json:"main-module-version" yaml:"main-module-version" mapstructure:"main-module-version"`
 	UsePackagesLib              *bool                         `json:"use-packages-lib" yaml:"use-packages-lib" mapstructure:"use-packages-lib"`
+	CaptureSymbols              cataloging.SymbolScope        `json:"capture-symbols" yaml:"capture-symbols" mapstructure:"capture-symbols"`
+	CaptureSymbolsModules       []string                      `json:"capture-symbols-modules" yaml:"capture-symbols-modules" mapstructure:"capture-symbols-modules"`
 }

 var _ interface {
 	clio.FieldDescriber
+	clio.PostLoader
 } = (*golangConfig)(nil)

 func (o *golangConfig) DescribeFields(descriptions clio.FieldDescriptionSet) {
@@ -39,12 +44,44 @@ if unset this defaults to $GONOPROXY`)
 always show (devel) as the version. Use these options to control heuristics to guess
 a more accurate version from the binary.`)
 	descriptions.Add(&o.UsePackagesLib, `use the golang.org/x/tools/go/packages library, which executes golang tooling found on the path in addition to potential network access to get the most accurate results`)
+	// note: descriptions must be static string literals; the app config discovery that generates the
+	// capability docs reads them straight out of the AST
+	descriptions.Add(&o.CaptureSymbols, `capture function symbols from the binary symbol table (pclntab). valid values are:
+"none" (disabled), "stdlib" (only the synthetic stdlib package), "extended-stdlib" (stdlib plus every
+module under golang.org/x/), and "all" (all module packages plus stdlib)`)
+	descriptions.Add(&o.CaptureSymbolsModules, `glob patterns matched against go module paths (e.g. github.com/klauspost/**) that should have symbols
+captured in addition to whatever capture-symbols selects. ** crosses path separators, * does not.
+a trailing major version suffix is ignored when matching, so github.com/foo/* covers github.com/foo/bar/v2;
+spelling a suffix out in the pattern selects only that major version.
+this can only widen the selection, never narrow it, and is inert when capture-symbols is none`)
 	descriptions.Add(&o.MainModuleVersion.FromLDFlags, `look for LD flags that appear to be setting a version (e.g. -X main.version=1.0.0)`)
-	descriptions.Add(&o.MainModuleVersion.FromBuildSettings, `use the build settings (e.g. vcs.version & vcs.time) to craft a v0 pseudo version 
+	descriptions.Add(&o.MainModuleVersion.FromBuildSettings, `use the build settings (e.g. vcs.version & vcs.time) to craft a v0 pseudo version
 (e.g. v0.0.0-20220308212642-53e6d0aaf6fb) when a more accurate version cannot be found otherwise`)
 	descriptions.Add(&o.MainModuleVersion.FromContents, `search for semver-like strings in the binary contents`)
 }

+func (o *golangConfig) PostLoad() error {
+	raw := strings.TrimSpace(string(o.CaptureSymbols))
+	o.CaptureSymbols = o.CaptureSymbols.Parse()
+
+	// an unrecognized value still resolves to "none", but say so rather than silently capturing nothing.
+	// stay quiet for unset and an explicit "none", which is the default and would otherwise warn on nearly
+	// every scan.
+	if o.CaptureSymbols == cataloging.SymbolScopeNone && raw != "" && !strings.EqualFold(raw, string(cataloging.SymbolScopeNone)) {
+		log.Warnf("unknown golang.capture-symbols value %q, defaulting to %q (valid values: none, stdlib, extended-stdlib, all)", raw, cataloging.SymbolScopeNone)
+	}
+
+	// trim only, deliberately not Flatten: viper already splits a comma-separated scalar (env var or a bare
+	// yaml string) into a slice before this point, and there is no CLI flag feeding this key. The one thing
+	// Flatten would add is splitting commas *inside* a list entry, which silently breaks doublestar brace
+	// alternation like github.com/{foo,bar}/**. Viper's split does not trim, so that part is still needed.
+	for i, pattern := range o.CaptureSymbolsModules {
+		o.CaptureSymbolsModules[i] = strings.TrimSpace(pattern)
+	}
+
+	return nil
+}
+
 type golangMainModuleVersionConfig struct {
 	FromLDFlags       bool `json:"from-ld-flags" yaml:"from-ld-flags" mapstructure:"from-ld-flags"`
 	FromContents      bool `json:"from-contents" yaml:"from-contents" mapstructure:"from-contents"`
@@ -66,6 +103,8 @@ func defaultGolangConfig() golangConfig {
 			FromContents:      def.MainModuleVersion.FromContents,
 			FromBuildSettings: def.MainModuleVersion.FromBuildSettings,
 		},
-		UsePackagesLib: nil, // this defaults to true, which is the API default
+		UsePackagesLib:        nil, // this defaults to true, which is the API default
+		CaptureSymbols:        def.CaptureSymbols,
+		CaptureSymbolsModules: def.CaptureSymbolsModules,
 	}
 }
@@ -0,0 +1,95 @@
+package options
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+
+	"github.com/anchore/syft/syft/cataloging"
+)
+
+func Test_golangConfig_PostLoad(t *testing.T) {
+	tests := []struct {
+		name            string
+		cfg             golangConfig
+		expected        cataloging.SymbolScope
+		expectedModules []string
+		wantErr         assert.ErrorAssertionFunc
+	}{
+		{
+			name:     "normalize all",
+			cfg:      golangConfig{CaptureSymbols: "all"},
+			expected: cataloging.SymbolScopeAll,
+		},
+		{
+			name:     "normalize stdlib",
+			cfg:      golangConfig{CaptureSymbols: "stdlib"},
+			expected: cataloging.SymbolScopeStdlib,
+		},
+		{
+			name:     "normalize extended-stdlib",
+			cfg:      golangConfig{CaptureSymbols: " Extended-Stdlib "},
+			expected: cataloging.SymbolScopeExtendedStdlib,
+		},
+		{
+			name: "module patterns keep embedded commas",
+			cfg: golangConfig{
+				CaptureSymbols: "stdlib",
+				// brace alternation contains a comma; splitting on it would corrupt the pattern
+				CaptureSymbolsModules: []string{"github.com/{foo,bar}/**", "golang.org/x/**"},
+			},
+			expected:        cataloging.SymbolScopeStdlib,
+			expectedModules: []string{"github.com/{foo,bar}/**", "golang.org/x/**"},
+		},
+		{
+			// viper splits a comma-separated scalar (env var or bare yaml string) but does not trim,
+			// so a leading space would otherwise survive into a pattern that silently matches nothing
+			name: "module patterns are trimmed",
+			cfg: golangConfig{
+				CaptureSymbols:        "stdlib",
+				CaptureSymbolsModules: []string{"golang.org/x/**", " github.com/foo/** "},
+			},
+			expected:        cataloging.SymbolScopeStdlib,
+			expectedModules: []string{"golang.org/x/**", "github.com/foo/**"},
+		},
+		{
+			name:     "empty defaults to none",
+			cfg:      golangConfig{CaptureSymbols: ""},
+			expected: cataloging.SymbolScopeNone,
+		},
+		{
+			name:     "invalid value defaults to none",
+			cfg:      golangConfig{CaptureSymbols: "stdlbi"},
+			expected: cataloging.SymbolScopeNone,
+		},
+		{
+			name:     "boolean spellings default to none",
+			cfg:      golangConfig{CaptureSymbols: "true"},
+			expected: cataloging.SymbolScopeNone,
+		},
+		{
+			name:     "explicit none resolves to none",
+			cfg:      golangConfig{CaptureSymbols: "none"},
+			expected: cataloging.SymbolScopeNone,
+		},
+		{
+			name:     "explicit none is not case sensitive",
+			cfg:      golangConfig{CaptureSymbols: " NONE "},
+			expected: cataloging.SymbolScopeNone,
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			if tt.wantErr == nil {
+				tt.wantErr = assert.NoError
+			}
+			err := tt.cfg.PostLoad()
+			tt.wantErr(t, err)
+			if err != nil {
+				return
+			}
+			assert.Equal(t, tt.expected, tt.cfg.CaptureSymbols)
+			assert.Equal(t, tt.expectedModules, tt.cfg.CaptureSymbolsModules)
+		})
+	}
+}
@@ -89,6 +89,8 @@ func TestPkgCoverageImage(t *testing.T) {
 	definedPkgs.Remove(string(pkg.PhpPeclPkg)) // we have coverage for pear instead
 	definedPkgs.Remove(string(pkg.CondaPkg))
 	definedPkgs.Remove(string(pkg.ModelPkg))
+	definedPkgs.Remove(string(pkg.VcpkgPkg))
+	definedPkgs.Remove(string(pkg.AppleAppBundlePkg))

 	var cases []testCase
 	cases = append(cases, commonTestCases...)
@@ -164,6 +166,8 @@ func TestPkgCoverageDirectory(t *testing.T) {
 	definedPkgs.Remove(string(pkg.CondaPkg))
 	definedPkgs.Remove(string(pkg.PhpPeclPkg)) // this is covered as pear packages
 	definedPkgs.Remove(string(pkg.ModelPkg))
+	definedPkgs.Remove(string(pkg.VcpkgPkg))
+	definedPkgs.Remove(string(pkg.AppleAppBundlePkg))

 	// for directory scans we should not expect to see any of the following package types
 	definedPkgs.Remove(string(pkg.KbPkg))
@@ -0,0 +1,147 @@
+package integration
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"runtime"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/anchore/stereoscope/pkg/image"
+	"github.com/anchore/stereoscope/pkg/imagetest"
+	"github.com/anchore/syft/syft"
+	"github.com/anchore/syft/syft/source"
+)
+
+// multiplatformImage is busybox:1.38.0 pinned by index digest, since docker hub periodically rebuilds and
+// re-pushes official image tags, which changes the per-platform digests asserted below.
+const multiplatformImage = "docker.io/library/busybox@sha256:fd7dc98638c8e305f4dc34e979f1c0fdfdcaeb0fbf8fcff77ae834b6da3d7e6e"
+
+// TestMultiPlatformOCIImageSelection verifies that syft can load a single platform out of a
+// multi-platform OCI image on disk (both --from oci-dir and --from oci-archive) by selecting the
+// image that matches the requested platform.
+func TestMultiPlatformOCIImageSelection(t *testing.T) {
+	// Per-platform image config digests within the multi-platform index, obtained from the OCI layout
+	// (see anchore/stereoscope integration tests: TestPlatformSelectionWithOciLocalSources).
+	expectedDigest := map[string]string{
+		"arm64":   "sha256:d2482869a6b838d3b4c9cad0c8085c06277909482771eb525d298fc3a7d07927",
+		"s390x":   "sha256:e55a0fa55032cceac2d983f4b4a25b28e42303b46a2f1915fc0fa45051e6ca70",
+		"amd64":   "sha256:aaef90e065235eb0b2d9938be85d1b81add2902cf89affe2cdfa19be33476ac0",
+		"ppc64le": "sha256:8158829b015d1c5285d63d54d37e95998ef0af4177e3f416678decbcaff3170c",
+	}
+
+	// syft --from source tag -> stereoscope OCI source used to prepare the local fixture
+	sources := map[string]image.Source{
+		"oci-dir":     image.OciDirectorySource,
+		"oci-archive": image.OciTarballSource,
+	}
+
+	for from, imageSource := range sources {
+		t.Run(from, func(t *testing.T) {
+			localPath := imagetest.PrepareMultiplatformFixtureImage(t, imageSource, multiplatformImage)
+			for _, arch := range []string{"amd64", "arm64", "s390x", "ppc64le"} {
+				t.Run(fmt.Sprintf("linux/%s", arch), func(t *testing.T) {
+					platform, err := image.NewPlatform("linux/" + arch)
+					require.NoError(t, err)
+
+					src, err := syft.GetSource(
+						context.Background(),
+						localPath,
+						syft.DefaultGetSourceConfig().WithSources(from).WithPlatform(platform),
+					)
+					require.NoError(t, err)
+					t.Cleanup(func() {
+						require.NoError(t, src.Close())
+					})
+
+					meta, ok := src.Describe().Metadata.(source.ImageMetadata)
+					require.True(t, ok, "expected image metadata, got %T", src.Describe().Metadata)
+
+					// The raw config of the selected image must match the requested platform...
+					assertConfigPlatform(t, meta.RawConfig, "linux", arch)
+					assert.Equal(t, "linux", meta.OS)
+					assert.Equal(t, arch, meta.Architecture)
+					// ...and it must be the exact per-platform image from the multi-platform index.
+					assert.Equal(t, expectedDigest[arch], meta.ID)
+				})
+			}
+		})
+	}
+}
+
+// TestMultiPlatformOCIImageSelection_UnavailablePlatform verifies that requesting a platform not present
+// in the multi-platform OCI image results in an error rather than silently selecting the wrong image.
+func TestMultiPlatformOCIImageSelection_UnavailablePlatform(t *testing.T) {
+	// windows/amd64 is not present in this linux-only multi-platform image
+	platform, err := image.NewPlatform("windows/amd64")
+	require.NoError(t, err)
+
+	sources := map[string]image.Source{
+		"oci-dir":     image.OciDirectorySource,
+		"oci-archive": image.OciTarballSource,
+	}
+
+	for from, imageSource := range sources {
+		t.Run(from, func(t *testing.T) {
+			localPath := imagetest.PrepareMultiplatformFixtureImage(t, imageSource, multiplatformImage)
+
+			_, err := syft.GetSource(
+				context.Background(),
+				localPath,
+				syft.DefaultGetSourceConfig().WithSources(from).WithPlatform(platform),
+			)
+			require.ErrorContains(t, err, "windows/amd64")
+		})
+	}
+}
+
+// TestMultiPlatformOCIImageSelection_DefaultPlatform verifies that not specifying a platform results
+// in the current platform being selected.
+func TestMultiPlatformOCIImageSelection_DefaultPlatform(t *testing.T) {
+	sources := map[string]image.Source{
+		"oci-dir":     image.OciDirectorySource,
+		"oci-archive": image.OciTarballSource,
+	}
+
+	for from, imageSource := range sources {
+		t.Run(from, func(t *testing.T) {
+			localPath := imagetest.PrepareMultiplatformFixtureImage(t, imageSource, multiplatformImage)
+
+			src, err := syft.GetSource(
+				context.Background(),
+				localPath,
+				syft.DefaultGetSourceConfig().WithSources(from),
+			)
+			require.NoError(t, err)
+			t.Cleanup(func() {
+				require.NoError(t, src.Close())
+			})
+
+			meta, ok := src.Describe().Metadata.(source.ImageMetadata)
+			require.True(t, ok, "expected image metadata, got %T", src.Describe().Metadata)
+
+			// The raw config of the selected image must match the current platform
+			assertConfigPlatform(t, meta.RawConfig, "linux", runtime.GOARCH)
+			assert.Equal(t, "linux", meta.OS)
+			assert.Equal(t, runtime.GOARCH, meta.Architecture)
+		})
+	}
+}
+
+// assertConfigPlatform asserts the os/architecture recorded in a raw OCI image config document.
+func assertConfigPlatform(t *testing.T, rawConfig []byte, os, architecture string) {
+	t.Helper()
+	require.NotEmpty(t, rawConfig)
+
+	var cfg struct {
+		OS           string `json:"os"`
+		Architecture string `json:"architecture"`
+	}
+	require.NoError(t, json.Unmarshal(rawConfig, &cfg))
+
+	assert.Equal(t, os, cfg.OS)
+	assert.Equal(t, architecture, cfg.Architecture)
+}
@@ -0,0 +1,64 @@
+package integration
+
+import (
+	"context"
+	"strings"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/anchore/stereoscope/pkg/image"
+	"github.com/anchore/stereoscope/pkg/imagetest"
+	"github.com/anchore/syft/syft"
+	"github.com/anchore/syft/syft/source"
+)
+
+// TestSinglePlatformOCIImage covers the single-image (non-index) OCI layouts, where syft used to report
+// empty os/architecture metadata and silently accept any --platform. Both now come from the image config.
+func TestSinglePlatformOCIImage(t *testing.T) {
+	// a platform this fixture is never built for, so the mismatch is not host dependent
+	unavailablePlatform, err := image.NewPlatform("linux/ppc64le")
+	require.NoError(t, err)
+
+	sources := map[string]image.Source{
+		"oci-dir":     image.OciDirectorySource,
+		"oci-archive": image.OciTarballSource,
+	}
+
+	for from, imageSource := range sources {
+		t.Run(from, func(t *testing.T) {
+			localPath := strings.TrimPrefix(imagetest.PrepareFixtureImage(t, imageSource, "image-distro-id"), string(imageSource)+":")
+
+			t.Run("reports the platform from the image config", func(t *testing.T) {
+				src, err := syft.GetSource(
+					context.Background(),
+					localPath,
+					syft.DefaultGetSourceConfig().WithSources(from),
+				)
+				require.NoError(t, err)
+				t.Cleanup(func() {
+					require.NoError(t, src.Close())
+				})
+
+				meta, ok := src.Describe().Metadata.(source.ImageMetadata)
+				require.True(t, ok, "expected image metadata, got %T", src.Describe().Metadata)
+
+				// the fixture is built for whatever the local docker daemon runs, so assert against the
+				// config rather than a fixed platform
+				assert.NotEmpty(t, meta.OS)
+				assert.NotEmpty(t, meta.Architecture)
+				assertConfigPlatform(t, meta.RawConfig, meta.OS, meta.Architecture)
+			})
+
+			t.Run("rejects a platform the image does not match", func(t *testing.T) {
+				_, err := syft.GetSource(
+					context.Background(),
+					localPath,
+					syft.DefaultGetSourceConfig().WithSources(from).WithPlatform(unavailablePlatform),
+				)
+				require.ErrorContains(t, err, "linux/ppc64le")
+			})
+		})
+	}
+}
@@ -7,4 +7,6 @@
 !image-pkg-coverage/pkgs/java/*.hpi

 **/go.sum
-!image-go-bin-arch-coverage/go.sum
+!image-go-bin-arch-coverage/go.sum
+
+cache/
@@ -8,8 +8,6 @@ RUN mkdir tmp

 WORKDIR /usr/share/jenkins/tmp

-RUN apt-get update 2>&1 > /dev/null && apt-get install -y less zip 2>&1 > /dev/null
-
 RUN unzip ../jenkins.war 2>&1 > /dev/null

 RUN rm -rf ./META-INF/MANIFEST.MF ./WEB-INF ./jsbundles ./scripts ./css
@@ -18,7 +16,8 @@ WORKDIR /usr/share/jenkins

 RUN rm -rf jenkins.war

-RUN cd ./tmp && zip -r ../jenkins.war . && cd ..
+# use jar (from the JDK in the base image) to rezip -- M keeps it manifest-less, which is the point of this fixture
+RUN cd ./tmp && jar cfM ../jenkins.war . && cd ..

 RUN rm -rf ./tmp

@@ -16,7 +16,7 @@ RUN unxz /lib/modules/6.0.7-301.fc37.x86_64/kernel/drivers/tty/ttynull.ko.xz
 # dotnet pkg coverage
 # https://nuget.info/packages/DocuSign.eSign.dll/6.8.0
 # https://github.com/docusign/docusign-esign-csharp-client/blob/master/LICENSE
-RUN curl -LO https://www.nuget.org/api/v2/package/DocuSign.eSign.dll/6.8.0
+RUN curl -fLO https://www.nuget.org/api/v2/package/DocuSign.eSign.dll/6.8.0
 RUN unzip 6.8.0
 RUN chmod 600 lib/net462/DocuSign.eSign.dll
 RUN rm 6.8.0
@@ -1,6 +1,7 @@
 package ui

 import (
+	"bytes"
 	"fmt"
 	"io"
 	"os"
@@ -8,6 +9,7 @@ import (
 	"time"

 	tea "github.com/charmbracelet/bubbletea"
+	"github.com/charmbracelet/lipgloss"
 	"github.com/wagoodman/go-partybus"

 	"github.com/anchore/bubbly"
@@ -52,7 +54,7 @@ func New(out io.Writer, quiet bool, handlers ...bubbly.EventHandler) *UI {
 func (m *UI) Setup(subscription partybus.Unsubscribable) error {
 	// we still want to collect log messages, however, we also the logger shouldn't write to the screen directly
 	if logWrapper, ok := log.Get().(logger.Controller); ok {
-		logWrapper.SetOutput(m.frame.(*frame.Frame).Footer())
+		logWrapper.SetOutput(&logFooter{w: m.frame.(*frame.Frame).Footer()})
 	}

 	m.subscription = subscription
@@ -100,7 +102,7 @@ func (m *UI) Teardown(force bool) error {
 		})

 		// it may be tempting to use Kill() however it has been found that this can cause the terminal to be left in
-		// a bad state (where Ctrl+C and other control characters no longer works for future processes in that terminal).
+		// a bad state (where Ctrl+C and other control characters no longer work for future processes in that terminal).
 		m.program.Quit()

 		_ = runWithTimeout(250*time.Millisecond, func() error {
@@ -187,6 +189,48 @@ func (m UI) View() string {
 	return m.frame.View()
 }

+var (
+	logTitleStyle = lipgloss.NewStyle().Foreground(lipgloss.Color("8")) // dark grey
+	// the first log line gets a branch pointing at it from the title, the rest are indented to match
+	logBranch = logTitleStyle.Render("└─▶") + " "
+	logIndent = "    "
+)
+
+// logFooter decorates log entries drawn below the TUI with a one-time title (written when the first entry arrives)
+// and a branch from the title to the first log line. Writes are serialized by the logger.
+type logFooter struct {
+	w       io.Writer
+	started bool
+}
+
+func (l *logFooter) Write(p []byte) (int, error) {
+	var buf bytes.Buffer
+	first := !l.started
+	if first {
+		buf.WriteString(logTitleStyle.Render("Logs (non-fatal, see -v for more):") + "\n")
+		l.started = true
+	}
+	for i, line := range bytes.SplitAfter(p, []byte("\n")) {
+		if len(line) == 0 {
+			continue
+		}
+		if first && i == 0 {
+			buf.WriteString(logBranch)
+		} else {
+			buf.WriteString(logIndent)
+		}
+		buf.Write(line)
+	}
+	if _, err := l.w.Write(buf.Bytes()); err != nil {
+		return 0, err
+	}
+	return len(p), nil
+}
+
+// IsTerminal marks the footer as terminal-bound (it is drawn by the TUI) so the logger keeps colors. NO_COLOR is
+// still honored by the formatter.
+func (*logFooter) IsTerminal() bool { return true }
+
 func runWithTimeout(timeout time.Duration, fn func() error) (err error) {
 	c := make(chan struct{}, 1)
 	go func() {
@@ -5,8 +5,10 @@ This directory contains examples of how to use the Syft API.
 - `create_simple_sbom`: Create a simple SBOM from scratch
 - `create_custom_sbom`: Create an SBOM using as much custom configuration as possible, including a custom cataloger implementation
 - `decode_sbom`: Take an existing SBOM file (of arbitrary format) and decode it into a Syft SBOM object
+- `select_catalogers`: Example demonstrating how to select specific catalogers to run
 - `source_detection`: Shows how to detect what to catalog automatically from a user string (e.g. container image vs directory)
- `source_from_image`: Construct a source from a only a container image
+- `source_from_image`: Construct a source from only a container image
+- `source_from_registry`: Construct a source directly from a container registry

 You can run any of these examples from this directory with:

@@ -1,28 +1,28 @@
 module github.com/anchore/syft

-go 1.26.3
+go 1.26.8

 require (
 	github.com/BurntSushi/toml v1.6.0
-	github.com/CycloneDX/cyclonedx-go v0.11.0
+	github.com/CycloneDX/cyclonedx-go v0.12.0
 	github.com/Masterminds/semver/v3 v3.5.0
 	github.com/Masterminds/sprig/v3 v3.3.0
 	github.com/OneOfOne/xxhash v1.2.8
 	github.com/acarl005/stripansi v0.0.0-20180116102854-5a71ef0e047d
 	github.com/acobaugh/osrelease v0.1.0
 	github.com/adrg/xdg v0.5.3
-	github.com/anchore/bubbly v0.2.1
+	github.com/anchore/bubbly v0.2.2
 	github.com/anchore/clio v0.1.1
 	github.com/anchore/fangs v0.1.1
 	github.com/anchore/go-collections v0.1.1
 	github.com/anchore/go-homedir v0.1.1
-	github.com/anchore/go-logger v0.1.1
+	github.com/anchore/go-logger v0.2.0
 	github.com/anchore/go-macholibre v0.1.1
-	github.com/anchore/go-rpmdb v0.1.0
-	github.com/anchore/go-sync v0.1.1
+	github.com/anchore/go-rpmdb v0.2.0
+	github.com/anchore/go-sync v0.1.2
 	github.com/anchore/go-version v1.2.2-0.20200701162849-18adb9c92b9b
 	github.com/anchore/packageurl-go v0.2.0
-	github.com/anchore/stereoscope v0.2.2
+	github.com/anchore/stereoscope v0.3.2
 	github.com/anmitsu/go-shlex v0.0.0-20200514113438-38f4b401e2be
 	github.com/aquasecurity/go-pep440-version v0.0.1
 	github.com/bitnami/go-version v0.0.0-20250131085805-b1f57a8634ef
@@ -34,40 +34,40 @@ require (
 	github.com/charmbracelet/lipgloss v1.1.0
 	github.com/dave/jennifer v1.7.1
 	github.com/deitch/magic v0.0.0-20230404182410-1ff89d7342da
-	github.com/diskfs/go-diskfs v1.9.3
+	github.com/diskfs/go-diskfs v1.9.4
 	github.com/distribution/reference v0.6.0
-	github.com/dustin/go-humanize v1.0.1
+	github.com/dustin/go-humanize v1.1.0
 	github.com/elliotchance/phpserialize v1.4.0
 	github.com/facebookincubator/nvdtools v0.1.5
 	github.com/github/go-spdx/v2 v2.7.0
-	github.com/gkampitakis/go-snaps v0.5.22
-	github.com/go-git/go-billy/v5 v5.9.0
-	github.com/go-git/go-git/v5 v5.19.1
+	github.com/gkampitakis/go-snaps v0.5.23
+	github.com/go-git/go-billy/v5 v5.9.1
+	github.com/go-git/go-git/v5 v5.19.2
 	github.com/go-test/deep v1.1.1
 	github.com/go-viper/mapstructure/v2 v2.5.0
 	github.com/goccy/go-yaml v1.19.2
 	github.com/gohugoio/hashstructure v0.6.0
 	github.com/google/go-cmp v0.7.0
-	github.com/google/go-containerregistry v0.21.7
+	github.com/google/go-containerregistry v0.22.1
 	github.com/google/licensecheck v0.3.1
 	github.com/google/uuid v1.6.0
 	github.com/gookit/color v1.6.1
-	github.com/gpustack/gguf-parser-go v0.24.1
+	github.com/gpustack/gguf-parser-go v0.26.3
 	github.com/hashicorp/go-cleanhttp v0.5.2
-	github.com/hashicorp/go-getter v1.8.6
+	github.com/hashicorp/go-getter v1.8.9
 	github.com/hashicorp/go-multierror v1.1.1
-	github.com/hashicorp/hcl/v2 v2.24.0
+	github.com/hashicorp/hcl/v2 v2.25.0
 	github.com/iancoleman/strcase v0.3.0
 	github.com/invopop/jsonschema v0.14.0
-	github.com/jedib0t/go-pretty/v6 v6.8.1
+	github.com/jedib0t/go-pretty/v6 v6.8.3
 	github.com/jinzhu/copier v0.4.0
 	github.com/kastenhq/goversion v0.0.0-20230811215019-93b2f8823953
-	github.com/klauspost/compress v1.18.6
-	github.com/magiconair/properties v1.8.10
+	github.com/klauspost/compress v1.20.0
+	github.com/magiconair/properties v1.18.12
 	github.com/mholt/archives v0.1.5
 	github.com/moby/sys/mountinfo v0.7.2
 	github.com/nix-community/go-nix v0.0.0-20250101154619-4bdde671e0a1
-	github.com/olekukonko/tablewriter v1.1.4
+	github.com/olekukonko/tablewriter v1.1.5
 	github.com/opencontainers/go-digest v1.0.0
 	github.com/pelletier/go-toml v1.9.5
 	github.com/quasilyte/go-ruleguard/dsl v0.3.23
@@ -82,8 +82,8 @@ require (
 	github.com/spdx/tools-golang v0.6.0-rc4
 	github.com/spf13/afero v1.15.0
 	github.com/spf13/cobra v1.10.2
-	github.com/stretchr/testify v1.11.1
-	github.com/ulikunitz/xz v0.5.15
+	github.com/stretchr/testify v1.12.1
+	github.com/ulikunitz/xz v0.5.16
 	github.com/vbatts/go-mtree v0.7.0
 	github.com/vifraa/gopom v1.0.0
 	github.com/wagoodman/go-partybus v0.0.0-20230516145632-8ccac152c651
@@ -91,35 +91,35 @@ require (
 	github.com/xeipuuv/gojsonschema v1.2.0
 	github.com/zyedidia/generic v1.2.2-0.20230320175451-4410d2372cb1
 	go.uber.org/goleak v1.3.0
-	go.yaml.in/yaml/v3 v3.0.4
+	go.yaml.in/yaml/v3 v3.0.5
 	golang.org/x/exp v0.0.0-20260410095643-746e56fc9e2f
-	golang.org/x/mod v0.37.0
-	golang.org/x/net v0.56.0
-	golang.org/x/time v0.15.0
-	golang.org/x/tools v0.46.0
-	gopkg.in/yaml.v3 v3.0.1
-	modernc.org/sqlite v1.51.0
+	golang.org/x/mod v0.41.0
+	golang.org/x/net v0.59.0
+	golang.org/x/time v0.16.0
+	golang.org/x/tools v0.50.0
+	modernc.org/sqlite v1.59.0
 )

 require (
 	github.com/pb33f/ordered-map/v2 v2.3.1
 	github.com/tailscale/hujson v0.0.0-20260302212456-ecc657c15afd
+	howett.net/plist v1.0.1
 )

 require (
-	cel.dev/expr v0.25.1 // indirect
+	cel.dev/expr v0.25.2 // indirect
 	cloud.google.com/go v0.123.0 // indirect
-	cloud.google.com/go/auth v0.18.2 // indirect
+	cloud.google.com/go/auth v0.23.2 // indirect
 	cloud.google.com/go/auth/oauth2adapt v0.2.8 // indirect
 	cloud.google.com/go/compute/metadata v0.9.0 // indirect
-	cloud.google.com/go/iam v1.5.3 // indirect
-	cloud.google.com/go/monitoring v1.24.3 // indirect
-	cloud.google.com/go/storage v1.61.3 // indirect
+	cloud.google.com/go/iam v1.12.0 // indirect
+	cloud.google.com/go/monitoring v1.30.0 // indirect
+	cloud.google.com/go/storage v1.65.1 // indirect
 	dario.cat/mergo v1.0.2 // indirect
 	github.com/DataDog/zstd v1.5.5 // indirect
-	github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp v1.31.0 // indirect
-	github.com/GoogleCloudPlatform/opentelemetry-operations-go/exporter/metric v0.55.0 // indirect
-	github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/resourcemapping v0.55.0 // indirect
+	github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp v1.33.0 // indirect
+	github.com/GoogleCloudPlatform/opentelemetry-operations-go/exporter/metric v0.57.0 // indirect
+	github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/resourcemapping v0.57.0 // indirect
 	github.com/Masterminds/goutils v1.1.1 // indirect
 	github.com/Microsoft/go-winio v0.6.3-0.20251027160822-ad3df93bed29 // indirect
 	github.com/Microsoft/hcsshim v0.15.0-rc.1 // indirect
@@ -130,27 +130,27 @@ require (
 	github.com/anchore/go-struct-converter v0.2.0-rc2 // indirect
 	github.com/andybalholm/brotli v1.2.0 // indirect
 	github.com/apparentlymart/go-textseg/v15 v15.0.0 // indirect
+	github.com/apparentlymart/go-textseg/v17 v17.0.1 // indirect
 	github.com/aquasecurity/go-version v0.0.1 // indirect
 	github.com/atotto/clipboard v0.1.4 // indirect
-	github.com/aws/aws-sdk-go-v2 v1.41.5 // indirect
-	github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.8 // indirect
-	github.com/aws/aws-sdk-go-v2/config v1.32.12 // indirect
-	github.com/aws/aws-sdk-go-v2/credentials v1.19.12 // indirect
-	github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.20 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.21 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.21 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/ini v1.8.6 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.22 // indirect
-	github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.7 // indirect
-	github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.9.13 // indirect
-	github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.21 // indirect
-	github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.19.21 // indirect
-	github.com/aws/aws-sdk-go-v2/service/s3 v1.97.3 // indirect
-	github.com/aws/aws-sdk-go-v2/service/signin v1.0.8 // indirect
-	github.com/aws/aws-sdk-go-v2/service/sso v1.30.13 // indirect
-	github.com/aws/aws-sdk-go-v2/service/ssooidc v1.35.17 // indirect
-	github.com/aws/aws-sdk-go-v2/service/sts v1.41.9 // indirect
-	github.com/aws/smithy-go v1.24.2 // indirect
+	github.com/aws/aws-sdk-go-v2 v1.44.0 // indirect
+	github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.20 // indirect
+	github.com/aws/aws-sdk-go-v2/config v1.32.40 // indirect
+	github.com/aws/aws-sdk-go-v2/credentials v1.19.39 // indirect
+	github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.40 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.40 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.40 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.41 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.19 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.10.0 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.40 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.19.41 // indirect
+	github.com/aws/aws-sdk-go-v2/service/s3 v1.108.0 // indirect
+	github.com/aws/aws-sdk-go-v2/service/signin v1.6.0 // indirect
+	github.com/aws/aws-sdk-go-v2/service/sso v1.34.0 // indirect
+	github.com/aws/aws-sdk-go-v2/service/ssooidc v1.39.0 // indirect
+	github.com/aws/aws-sdk-go-v2/service/sts v1.46.0 // indirect
+	github.com/aws/smithy-go v1.28.1 // indirect
 	github.com/aymanbagabas/go-osc52/v2 v2.0.1 // indirect
 	github.com/bahlo/generic-list-go v0.2.0 // indirect
 	github.com/becheran/wildmatch-go v1.0.0 // indirect
@@ -167,50 +167,49 @@ require (
 	github.com/clipperhouse/displaywidth v0.11.0 // indirect
 	github.com/clipperhouse/uax29/v2 v2.7.0 // indirect
 	github.com/cloudflare/circl v1.6.3 // indirect
-	github.com/cncf/xds/go v0.0.0-20251210132809-ee656c7534f5 // indirect
+	github.com/cncf/xds/go v0.0.0-20260202195803-dba9d589def2 // indirect
 	github.com/containerd/cgroups/v3 v3.1.3 // indirect
 	github.com/containerd/containerd/api v1.11.1 // indirect
-	github.com/containerd/containerd/v2 v2.3.2 // indirect
+	github.com/containerd/containerd/v2 v2.3.6 // indirect
 	github.com/containerd/continuity v0.5.0 // indirect
 	github.com/containerd/errdefs v1.0.0 // indirect
 	github.com/containerd/errdefs/pkg v0.3.0 // indirect
 	github.com/containerd/fifo v1.1.0 // indirect
 	github.com/containerd/log v0.1.0 // indirect
-	github.com/containerd/platforms v1.0.0-rc.4 // indirect
+	github.com/containerd/platforms v1.0.0-rc.5 // indirect
 	github.com/containerd/plugin v1.1.0 // indirect
 	github.com/containerd/ttrpc v1.2.8 // indirect
 	github.com/containerd/typeurl/v2 v2.2.3 // indirect
 	github.com/cyphar/filepath-securejoin v0.6.1 // indirect
-	github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
-	github.com/docker/cli v29.5.3+incompatible // indirect
+	github.com/docker/cli v29.8.0+incompatible // indirect
 	github.com/docker/docker-credential-helpers v0.9.5 // indirect
-	github.com/docker/go-connections v0.7.0 // indirect
+	github.com/docker/go-connections v0.8.1 // indirect
 	github.com/docker/go-units v0.5.0 // indirect
 	github.com/dsnet/compress v0.0.2-0.20230904184137-39efe44ab707 // indirect
 	github.com/emirpasic/gods v1.18.1 // indirect
-	github.com/envoyproxy/go-control-plane/envoy v1.36.0 // indirect
-	github.com/envoyproxy/protoc-gen-validate v1.3.0 // indirect
+	github.com/envoyproxy/go-control-plane/envoy v1.37.0 // indirect
+	github.com/envoyproxy/protoc-gen-validate v1.3.3 // indirect
 	github.com/erikgeiser/coninput v0.0.0-20211004153227-1c3628e74d0f // indirect
-	github.com/fatih/color v1.18.0 // indirect
+	github.com/fatih/color v1.19.0 // indirect
 	github.com/felixge/fgprof v0.9.5 // indirect
 	github.com/felixge/httpsnoop v1.0.4 // indirect
 	github.com/fsnotify/fsnotify v1.9.0 // indirect
-	github.com/gabriel-vasile/mimetype v1.4.13 // indirect
+	github.com/gabriel-vasile/mimetype v1.4.15 // indirect
 	github.com/gkampitakis/ciinfo v0.3.4 // indirect
 	github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376 // indirect
 	github.com/go-jose/go-jose/v4 v4.1.4 // indirect
-	github.com/go-logr/logr v1.4.3 // indirect
+	github.com/go-logr/logr v1.4.4 // indirect
 	github.com/go-logr/stdr v1.2.2 // indirect
 	github.com/go-restruct/restruct v1.2.0-alpha // indirect
 	github.com/gogo/protobuf v1.3.2 // indirect
 	github.com/golang/groupcache v0.0.0-20241129210726-2c02b8208cf8 // indirect
-	github.com/google/pprof v0.0.0-20250317173921-a4b03ec1a45e // indirect
+	github.com/google/pprof v0.0.0-20260802141513-ef3492d7dac3 // indirect
 	github.com/google/s2a-go v0.1.9 // indirect
-	github.com/googleapis/enterprise-certificate-proxy v0.3.14 // indirect
-	github.com/googleapis/gax-go/v2 v2.17.0 // indirect
-	github.com/hashicorp/aws-sdk-go-base/v2 v2.0.0-beta.72 // indirect
+	github.com/googleapis/enterprise-certificate-proxy v0.3.20 // indirect
+	github.com/googleapis/gax-go/v2 v2.24.0 // indirect
+	github.com/hashicorp/aws-sdk-go-base/v2 v2.0.0-beta.74 // indirect
 	github.com/hashicorp/errwrap v1.1.0 // indirect
-	github.com/hashicorp/go-version v1.8.0 // indirect
+	github.com/hashicorp/go-version v1.9.0 // indirect
 	github.com/hashicorp/golang-lru/v2 v2.0.7 // indirect
 	github.com/henvic/httpretty v0.1.4 // indirect
 	github.com/huandu/xstrings v1.5.0 // indirect
@@ -225,7 +224,7 @@ require (
 	github.com/lucasb-eyer/go-colorful v1.3.0 // indirect
 	github.com/maruel/natural v1.3.0 // indirect
 	github.com/mattn/go-colorable v0.1.14 // indirect
-	github.com/mattn/go-isatty v0.0.20 // indirect
+	github.com/mattn/go-isatty v0.0.24 // indirect
 	github.com/mattn/go-localereader v0.0.2-0.20220822084749-2491eb6c1c75 // indirect
 	github.com/mattn/go-runewidth v0.0.21 // indirect
 	github.com/mgutz/ansi v0.0.0-20200706080929-d51e80ef957d // indirect
@@ -237,8 +236,8 @@ require (
 	github.com/mitchellh/reflectwalk v1.0.2 // indirect
 	github.com/moby/docker-image-spec v1.3.1 // indirect
 	github.com/moby/locker v1.0.1 // indirect
-	github.com/moby/moby/api v1.54.2 // indirect
-	github.com/moby/moby/client v0.4.1 // indirect
+	github.com/moby/moby/api v1.56.0 // indirect
+	github.com/moby/moby/client v0.6.0 // indirect
 	github.com/moby/sys/sequential v0.6.0 // indirect
 	github.com/moby/sys/signal v0.7.1 // indirect
 	github.com/moby/sys/user v0.4.0 // indirect
@@ -249,14 +248,14 @@ require (
 	github.com/muesli/cancelreader v0.2.2 // indirect
 	github.com/muesli/termenv v0.16.0 // indirect
 	github.com/ncruces/go-strftime v1.0.0 // indirect
-	github.com/nwaples/rardecode/v2 v2.2.0 // indirect
+	github.com/nwaples/rardecode/v2 v2.4.1 // indirect
 	github.com/olekukonko/cat v0.0.0-20250911104152-50322a0618f6 // indirect
 	github.com/olekukonko/errors v1.2.0 // indirect
 	github.com/olekukonko/ll v0.1.6 // indirect
 	github.com/opencontainers/image-spec v1.1.1 // indirect
 	github.com/opencontainers/runtime-spec v1.3.0 // indirect
 	github.com/pborman/indent v1.2.1 // indirect
-	github.com/pelletier/go-toml/v2 v2.3.1 // indirect
+	github.com/pelletier/go-toml/v2 v2.4.3 // indirect
 	github.com/pierrec/lz4/v4 v4.1.26 // indirect
 	github.com/piprate/json-gold v0.7.0 // indirect
 	github.com/pjbgf/sha1cd v0.6.0 // indirect
@@ -264,7 +263,6 @@ require (
 	github.com/pkg/profile v1.7.0 // indirect
 	github.com/pkg/xattr v0.4.12 // indirect
 	github.com/planetscale/vtprotobuf v0.6.1-0.20240319094008-0393e58bdf10 // indirect
-	github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
 	github.com/pquerna/cachecontrol v0.0.0-20180517163645-1555304b9b35 // indirect
 	github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec // indirect
 	github.com/rivo/uniseg v0.4.7 // indirect
@@ -280,8 +278,8 @@ require (
 	github.com/spf13/cast v1.10.0 // indirect
 	github.com/spf13/pflag v1.0.10 // indirect
 	github.com/spf13/viper v1.21.0 // indirect
-	github.com/spiffe/go-spiffe/v2 v2.6.0 // indirect
-	github.com/stretchr/objx v0.5.2 // indirect
+	github.com/spiffe/go-spiffe/v2 v2.7.0 // indirect
+	github.com/stretchr/objx v0.5.3 // indirect
 	github.com/subosito/gotenv v1.6.0 // indirect
 	github.com/sylabs/sif/v2 v2.24.1 // indirect
 	github.com/sylabs/squashfs v1.0.6 // indirect
@@ -295,37 +293,37 @@ require (
 	github.com/xeipuuv/gojsonreference v0.0.0-20180127040603-bd5ef7bd5415 // indirect
 	github.com/xi2/xz v0.0.0-20171230120015-48954b6210f8 // indirect
 	github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e // indirect
-	github.com/zclconf/go-cty v1.16.3 // indirect
+	github.com/zclconf/go-cty v1.19.0 // indirect
 	go.opencensus.io v0.24.0 // indirect
 	go.opentelemetry.io/auto/sdk v1.2.1 // indirect
-	go.opentelemetry.io/contrib/detectors/gcp v1.39.0 // indirect
+	go.opentelemetry.io/contrib/detectors/gcp v1.44.0 // indirect
 	go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.68.0 // indirect
 	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.68.0 // indirect
-	go.opentelemetry.io/otel v1.43.0 // indirect
-	go.opentelemetry.io/otel/metric v1.43.0 // indirect
-	go.opentelemetry.io/otel/sdk v1.43.0 // indirect
-	go.opentelemetry.io/otel/sdk/metric v1.43.0 // indirect
-	go.opentelemetry.io/otel/trace v1.43.0 // indirect
+	go.opentelemetry.io/otel v1.45.0 // indirect
+	go.opentelemetry.io/otel/metric v1.45.0 // indirect
+	go.opentelemetry.io/otel/sdk v1.45.0 // indirect
+	go.opentelemetry.io/otel/sdk/metric v1.45.0 // indirect
+	go.opentelemetry.io/otel/trace v1.45.0 // indirect
 	go.yaml.in/yaml/v4 v4.0.0-rc.2 // indirect
 	go4.org v0.0.0-20230225012048-214862532bf5 // indirect
-	golang.org/x/crypto v0.53.0 // indirect
+	golang.org/x/crypto v0.57.0 // indirect
 	golang.org/x/oauth2 v0.36.0 // indirect
-	golang.org/x/sync v0.21.0 // indirect
-	golang.org/x/sys v0.46.0 // indirect
-	golang.org/x/term v0.44.0 // indirect
-	golang.org/x/text v0.38.0 // indirect
+	golang.org/x/sync v0.23.0 // indirect
+	golang.org/x/sys v0.48.0 // indirect
+	golang.org/x/term v0.46.0 // indirect
+	golang.org/x/text v0.42.0 // indirect
 	golang.org/x/xerrors v0.0.0-20231012003039-104605ab7028 // indirect
 	gonum.org/v1/gonum v0.17.0 // indirect
-	google.golang.org/api v0.271.0 // indirect
-	google.golang.org/genproto v0.0.0-20260128011058-8636f8732409 // indirect
-	google.golang.org/genproto/googleapis/api v0.0.0-20260401024825-9d38bb4040a9 // indirect
-	google.golang.org/genproto/googleapis/rpc v0.0.0-20260406210006-6f92a3bedf2d // indirect
-	google.golang.org/grpc v1.80.0 // indirect
-	google.golang.org/protobuf v1.36.12-0.20260120151049-f2248ac996af // indirect
+	google.golang.org/api v0.294.0 // indirect
+	google.golang.org/genproto v0.0.0-20260715232425-e75dac1f907d // indirect
+	google.golang.org/genproto/googleapis/api v0.0.0-20260715232425-e75dac1f907d // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20260819154853-08b0e4226688 // indirect
+	google.golang.org/grpc v1.83.2 // indirect
+	google.golang.org/protobuf v1.36.12 // indirect
 	gopkg.in/warnings.v0 v0.1.2 // indirect
-	modernc.org/libc v1.72.3 // indirect
+	modernc.org/libc v1.75.7 // indirect
 	modernc.org/mathutil v1.7.1 // indirect
-	modernc.org/memory v1.11.0 // indirect
+	modernc.org/memory v1.12.1 // indirect
 )

 retract (
@@ -1,5 +1,5 @@
-cel.dev/expr v0.25.1 h1:1KrZg61W6TWSxuNZ37Xy49ps13NUovb66QLprthtwi4=
-cel.dev/expr v0.25.1/go.mod h1:hrXvqGP6G6gyx8UAHSHJ5RGk//1Oj5nXQ2NI02Nrsg4=
+cel.dev/expr v0.25.2 h1:K6j46C81hXtZQfuX60cVWQFBJahKSE2gfRbNuvr5bFs=
+cel.dev/expr v0.25.2/go.mod h1:hrXvqGP6G6gyx8UAHSHJ5RGk//1Oj5nXQ2NI02Nrsg4=
 cloud.google.com/go v0.26.0/go.mod h1:aQUYkXzVsufM+DwF1aE+0xfcU+56JwCaLick0ClmMTw=
 cloud.google.com/go v0.34.0/go.mod h1:aQUYkXzVsufM+DwF1aE+0xfcU+56JwCaLick0ClmMTw=
 cloud.google.com/go v0.38.0/go.mod h1:990N+gfupTy94rShfmMCWGDn0LpTmnzTp2qbd1dvSRU=
@@ -31,8 +31,8 @@ cloud.google.com/go v0.98.0/go.mod h1:ua6Ush4NALrHk5QXDWnjvZHN93OuF0HfuEPq9I1X0c
 cloud.google.com/go v0.99.0/go.mod h1:w0Xx2nLzqWJPuozYQX+hFfCSI8WioryfRDzkoI/Y2ZA=
 cloud.google.com/go v0.123.0 h1:2NAUJwPR47q+E35uaJeYoNhuNEM9kM8SjgRgdeOJUSE=
 cloud.google.com/go v0.123.0/go.mod h1:xBoMV08QcqUGuPW65Qfm1o9Y4zKZBpGS+7bImXLTAZU=
-cloud.google.com/go/auth v0.18.2 h1:+Nbt5Ev0xEqxlNjd6c+yYUeosQ5TtEUaNcN/3FozlaM=
-cloud.google.com/go/auth v0.18.2/go.mod h1:xD+oY7gcahcu7G2SG2DsBerfFxgPAJz17zz2joOFF3M=
+cloud.google.com/go/auth v0.23.2 h1:pxSCpfiji41hpzpPdMCftEUCezpgpqmmDdYiAjCKXxo=
+cloud.google.com/go/auth v0.23.2/go.mod h1:4DhBRcqvtljQN3dJ57qtqbib5ZGCYE5f2crfiiC2EM0=
 cloud.google.com/go/auth/oauth2adapt v0.2.8 h1:keo8NaayQZ6wimpNSmW5OPc283g65QNIiLpZnkHRbnc=
 cloud.google.com/go/auth/oauth2adapt v0.2.8/go.mod h1:XQ9y31RkqZCcwJWNSx2Xvric3RrU88hAYYbjDWYDL+c=
 cloud.google.com/go/bigquery v1.0.1/go.mod h1:i/xbL2UlR5RvWAURpBYZTtm/cXjCha9lbfbpx4poX+o=
@@ -46,14 +46,14 @@ cloud.google.com/go/compute/metadata v0.9.0/go.mod h1:E0bWwX5wTnLPedCKqk3pJmVgCB
 cloud.google.com/go/datastore v1.0.0/go.mod h1:LXYbyblFSglQ5pkeyhO+Qmw7ukd3C+pD7TKLgZqpHYE=
 cloud.google.com/go/datastore v1.1.0/go.mod h1:umbIZjpQpHh4hmRpGhH4tLFup+FVzqBi1b3c64qFpCk=
 cloud.google.com/go/firestore v1.6.1/go.mod h1:asNXNOzBdyVQmEU+ggO8UPodTkEVFW5Qx+rwHnAz+EY=
-cloud.google.com/go/iam v1.5.3 h1:+vMINPiDF2ognBJ97ABAYYwRgsaqxPbQDlMnbHMjolc=
-cloud.google.com/go/iam v1.5.3/go.mod h1:MR3v9oLkZCTlaqljW6Eb2d3HGDGK5/bDv93jhfISFvU=
-cloud.google.com/go/logging v1.13.1 h1:O7LvmO0kGLaHY/gq8cV7T0dyp6zJhYAOtZPX4TF3QtY=
-cloud.google.com/go/logging v1.13.1/go.mod h1:XAQkfkMBxQRjQek96WLPNze7vsOmay9H5PqfsNYDqvw=
-cloud.google.com/go/longrunning v0.8.0 h1:LiKK77J3bx5gDLi4SMViHixjD2ohlkwBi+mKA7EhfW8=
-cloud.google.com/go/longrunning v0.8.0/go.mod h1:UmErU2Onzi+fKDg2gR7dusz11Pe26aknR4kHmJJqIfk=
-cloud.google.com/go/monitoring v1.24.3 h1:dde+gMNc0UhPZD1Azu6at2e79bfdztVDS5lvhOdsgaE=
-cloud.google.com/go/monitoring v1.24.3/go.mod h1:nYP6W0tm3N9H/bOw8am7t62YTzZY+zUeQ+Bi6+2eonI=
+cloud.google.com/go/iam v1.12.0 h1:Aki3bX9aHUDKPHfnRJfDcTdVedvy6quGBQcTqx3DRXk=
+cloud.google.com/go/iam v1.12.0/go.mod h1:FEZ4lXpADAC2AIpQY7LANNjjwyQ2jK439CI2VaD+sLY=
+cloud.google.com/go/logging v1.19.0 h1:NCqhdVUg3wQ8Cobdf16FDSuTGi3+6+hdSBHrY5TsR6Q=
+cloud.google.com/go/logging v1.19.0/go.mod h1:i40NZCHC9Gqvod4yE+yQfDWwlgwW/SrshkkGibCHxcA=
+cloud.google.com/go/longrunning v1.2.0 h1:WjYH3YHBGCxGJP9M4dWGHBfXr/cFIjMkNgWcJj7/iMM=
+cloud.google.com/go/longrunning v1.2.0/go.mod h1:5KMQALFGOCtFoi2xSOA1u3H7WKlhmckgiyFw7+LGQp0=
+cloud.google.com/go/monitoring v1.30.0 h1:r/d+JUbyKmJ8b07iznuKfzVzrIXTWxHQ3lBRm3x2LlY=
+cloud.google.com/go/monitoring v1.30.0/go.mod h1:htlUR0QWVMrjFzZmN4LGnMAve9xB/eduwjmINxVZ8RM=
 cloud.google.com/go/pubsub v1.0.1/go.mod h1:R0Gpsv3s54REJCy4fxDixWD93lHJMoZTyQ2kNxGRt3I=
 cloud.google.com/go/pubsub v1.1.0/go.mod h1:EwwdRX2sKPjnvnqCa270oGRyludottCI76h+R3AArQw=
 cloud.google.com/go/pubsub v1.2.0/go.mod h1:jhfEVHT8odbXTkndysNHCcx0awwzvfOlguIAii9o8iA=
@@ -63,10 +63,10 @@ cloud.google.com/go/storage v1.5.0/go.mod h1:tpKbwo567HUNpVclU5sGELwQWBDZ8gh0Zeo
 cloud.google.com/go/storage v1.6.0/go.mod h1:N7U0C8pVQ/+NIKOBQyamJIeKQKkZ+mxpohlUTyfDhBk=
 cloud.google.com/go/storage v1.8.0/go.mod h1:Wv1Oy7z6Yz3DshWRJFhqM/UCfaWIRTdp0RXyy7KQOVs=
 cloud.google.com/go/storage v1.10.0/go.mod h1:FLPqc6j+Ki4BU591ie1oL6qBQGu2Bl/tZ9ullr3+Kg0=
-cloud.google.com/go/storage v1.61.3 h1:VS//ZfBuPGDvakfD9xyPW1RGF1Vy3BWUoVZXgW1KMOg=
-cloud.google.com/go/storage v1.61.3/go.mod h1:JtqK8BBB7TWv0HVGHubtUdzYYrakOQIsMLffZ2Z/HWk=
-cloud.google.com/go/trace v1.11.7 h1:kDNDX8JkaAG3R2nq1lIdkb7FCSi1rCmsEtKVsty7p+U=
-cloud.google.com/go/trace v1.11.7/go.mod h1:TNn9d5V3fQVf6s4SCveVMIBS2LJUqo73GACmq/Tky0s=
+cloud.google.com/go/storage v1.65.1 h1:LRRpBJUTf+OXDPX9jZUKZ3mSLIsz3htG+qUpeNZovyA=
+cloud.google.com/go/storage v1.65.1/go.mod h1:UsS9OgFg/XHOSYakQ8ZtLWWeyGkk1WnmD/GsGfN0BHM=
+cloud.google.com/go/trace v1.16.0 h1:GmQovzFc5F0CNfl0VLgL64aoTtu7xsM0YajW2GlG9+E=
+cloud.google.com/go/trace v1.16.0/go.mod h1:r+bdAn16dKLSV1G2D5v3e58IlQlizfxWrUfjx7kM7X0=
 dario.cat/mergo v1.0.2 h1:85+piFYR1tMbRrLcDwR18y4UKJ3aH1Tbzi24VRW1TK8=
 dario.cat/mergo v1.0.2/go.mod h1:E/hbnu0NxMFBjpMIE34DRGLWqDy0g5FuKDhCb31ngxA=
 dmitri.shuralyov.com/gpu/mtl v0.0.0-20190408044501-666a987793e9/go.mod h1:H6x//7gZCb22OMCxBHrMx7a5I7Hp++hsVxbQ4BYO7hU=
@@ -77,19 +77,19 @@ github.com/BurntSushi/toml v0.4.1/go.mod h1:CxXYINrC8qIiEnFrOxCa7Jy5BFHlXnUU2pbi
 github.com/BurntSushi/toml v1.6.0 h1:dRaEfpa2VI55EwlIW72hMRHdWouJeRF7TPYhI+AUQjk=
 github.com/BurntSushi/toml v1.6.0/go.mod h1:ukJfTF/6rtPPRCnwkur4qwRxa8vTRFBF0uk2lLoLwho=
 github.com/BurntSushi/xgb v0.0.0-20160522181843-27f122750802/go.mod h1:IVnqGOEym/WlBOVXweHU+Q+/VP0lqqI8lqeDx9IjBqo=
-github.com/CycloneDX/cyclonedx-go v0.11.0 h1:GokP8FiRC+foiuwWhSSLpSD5H4hSWtGnR3wo7apkBFI=
-github.com/CycloneDX/cyclonedx-go v0.11.0/go.mod h1:vUvbCXQsEm48OI6oOlanxstwNByXjCZ2wuleUlwGEO8=
+github.com/CycloneDX/cyclonedx-go v0.12.0 h1:/7Jum36UA6V043tQZ/fE3jf+Nf9gn/qxUFfd7QReMy8=
+github.com/CycloneDX/cyclonedx-go v0.12.0/go.mod h1:V2577HhxDDCDLYfkm55WJrz16nHTfyQZwcWUBSG7Z28=
 github.com/DataDog/datadog-go v3.2.0+incompatible/go.mod h1:LButxg5PwREeZtORoXG3tL4fMGNddJ+vMq1mwgfaqoQ=
 github.com/DataDog/zstd v1.5.5 h1:oWf5W7GtOLgp6bciQYDmhHHjdhYkALu6S/5Ni9ZgSvQ=
 github.com/DataDog/zstd v1.5.5/go.mod h1:g4AWEaM3yOg3HYfnJ3YIawPnVdXJh9QME85blwSAmyw=
-github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp v1.31.0 h1:DHa2U07rk8syqvCge0QIGMCE1WxGj9njT44GH7zNJLQ=
-github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp v1.31.0/go.mod h1:P4WPRUkOhJC13W//jWpyfJNDAIpvRbAUIYLX/4jtlE0=
-github.com/GoogleCloudPlatform/opentelemetry-operations-go/exporter/metric v0.55.0 h1:UnDZ/zFfG1JhH/DqxIZYU/1CUAlTUScoXD/LcM2Ykk8=
-github.com/GoogleCloudPlatform/opentelemetry-operations-go/exporter/metric v0.55.0/go.mod h1:IA1C1U7jO/ENqm/vhi7V9YYpBsp+IMyqNrEN94N7tVc=
-github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/cloudmock v0.55.0 h1:7t/qx5Ost0s0wbA/VDrByOooURhp+ikYwv20i9Y07TQ=
-github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/cloudmock v0.55.0/go.mod h1:vB2GH9GAYYJTO3mEn8oYwzEdhlayZIdQz6zdzgUIRvA=
-github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/resourcemapping v0.55.0 h1:0s6TxfCu2KHkkZPnBfsQ2y5qia0jl3MMrmBhu3nCOYk=
-github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/resourcemapping v0.55.0/go.mod h1:Mf6O40IAyB9zR/1J8nGDDPirZQQPbYJni8Yisy7NTMc=
+github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp v1.33.0 h1:l7+6kwRMJNwdCvYdDl7Eax+wzEYHSnNY7zrrfbhDdTA=
+github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp v1.33.0/go.mod h1:pJTkW8hEUIIi3Pf65lPZOnn4Y81yCllX6IWk2jNXdkM=
+github.com/GoogleCloudPlatform/opentelemetry-operations-go/exporter/metric v0.57.0 h1:jLdiS1vO+XJFyDSWRHBx56r4s/NNtcl5J6KyCcWUX/w=
+github.com/GoogleCloudPlatform/opentelemetry-operations-go/exporter/metric v0.57.0/go.mod h1:8lmpHY+1VRoteiOwyrQMDt1YGXOrFKCz+1wJW7n3ODY=
+github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/cloudmock v0.57.0 h1:cSjUzZ7KU8hicTgzaSv9NmSyM9fTVK3y5lsBUl3wOis=
+github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/cloudmock v0.57.0/go.mod h1:dzcEjy1WJ0Q4u9twNR3LcLhNoYMRCrMCMafpxa0TjPQ=
+github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/resourcemapping v0.57.0 h1:RoO5+d7uCmDqovLrHCr2/BuViUXvdcrNxyNM1pN9dDQ=
+github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/resourcemapping v0.57.0/go.mod h1:YqwkQPrWSC7+byyc1VlKbWLBF5JsW5IoL6xUkemYSXk=
 github.com/Masterminds/goutils v1.1.1 h1:5nUrii3FMTL5diU80unEVvNevw1nH4+ZV4DSLVJLSYI=
 github.com/Masterminds/goutils v1.1.1/go.mod h1:8cTjp+g8YejhMuvIA5y2vz3BpJxksy863GQaJW2MFNU=
 github.com/Masterminds/semver/v3 v3.5.0 h1:kQceYJfbupGfZOKZQg0kou0DgAKhzDg2NZPAwZ/2OOE=
@@ -120,8 +120,8 @@ github.com/alecthomas/template v0.0.0-20160405071501-a0175ee3bccc/go.mod h1:LOuy
 github.com/alecthomas/template v0.0.0-20190718012654-fb15b899a751/go.mod h1:LOuyumcjzFXgccqObfd/Ljyb9UuFJ6TxHnclSeseNhc=
 github.com/alecthomas/units v0.0.0-20151022065526-2efee857e7cf/go.mod h1:ybxpYRFXyAe+OPACYpWeL0wqObRcbAqCMya13uyzqw0=
 github.com/alecthomas/units v0.0.0-20190717042225-c3de453c63f4/go.mod h1:ybxpYRFXyAe+OPACYpWeL0wqObRcbAqCMya13uyzqw0=
-github.com/anchore/bubbly v0.2.1 h1:b3ZNBefY8ks5DI4SQ7BXSbBIsN6eoaTD6s1su7NuCBo=
-github.com/anchore/bubbly v0.2.1/go.mod h1:o6a9aH3/fCn+mb5g1T1tBbQZ4hGR0yO5/uD1d2Vtago=
+github.com/anchore/bubbly v0.2.2 h1:53JHRlpaNZjMcUYdz7n1U7+kOhy0zsJv9gpGEXvTcz8=
+github.com/anchore/bubbly v0.2.2/go.mod h1:M4twoFkczlfuNdU8QV7oQjVJwPbxdUWRMfKydcLba0U=
 github.com/anchore/clio v0.1.1 h1:9bkYnaFbpT0J3G0qSHyQqa/lpK5zV0C9Gtgh82H/jj0=
 github.com/anchore/clio v0.1.1/go.mod h1:CFPIopJlakJbBpKtAL/EPpj4W9hgBO7PfFc8N2FAtlE=
 github.com/anchore/fangs v0.1.1 h1:NBTHocmWM2/0gNhebpoE/wEB0Z0nxh2lESww2o/Uf5M=
@@ -130,24 +130,24 @@ github.com/anchore/go-collections v0.1.1 h1:kGlmSehs+ctTBZr+98F2+taHeolHy+XDx1Nc
 github.com/anchore/go-collections v0.1.1/go.mod h1:zgDbPSNDpfU47tVo7aW+2suG7+vXB1Sq1qtDhRJknQ0=
 github.com/anchore/go-homedir v0.1.1 h1:KpaO5BPrVT7cVMcEZ9KfFfEi0iuo3DtagPGl0C744X0=
 github.com/anchore/go-homedir v0.1.1/go.mod h1:9B0DGhbmMAJVGGEbrlb+PkORM5eDFCEOtZ3xQ22qaLA=
-github.com/anchore/go-logger v0.1.1 h1:HPBNmQVBdYliwaFVUL7oJ3UvSlaoXAMj/ZagAIYaCpA=
-github.com/anchore/go-logger v0.1.1/go.mod h1:ekWuh5BkZVwyXnyEd4fwL29N4pNLssgRsqh2+kFN/b8=
+github.com/anchore/go-logger v0.2.0 h1:V8Gazz+F8xwWEWz+whqt8/5163IkO4XrAie+1qbK10k=
+github.com/anchore/go-logger v0.2.0/go.mod h1:omqLWBwT/B5/aTwIH6pl5WBylBzeH3BGHUTS6OFeFvY=
 github.com/anchore/go-lzo v0.1.1 h1:IwL/fvkdtlIrYIXck6WxZ3nb8WjjHziYYmGxlooyOnM=
 github.com/anchore/go-lzo v0.1.1/go.mod h1:3kLx0bve2oN1iDwgM1U5zGku1Tfbdb0No5qp1eL1fIk=
 github.com/anchore/go-macholibre v0.1.1 h1:sTBHi3S1WVIOCamc6NyT8Sn9mBmD30DCTfjfVm4k6/M=
 github.com/anchore/go-macholibre v0.1.1/go.mod h1:YNq2610RlvGCK0Za+Klz/OCMtUaEnwwAGA/VfUAQaro=
-github.com/anchore/go-rpmdb v0.1.0 h1:Q8dc208/HYzCqhx0L1zurfm1UPil24hlo9NjkdFmLdE=
-github.com/anchore/go-rpmdb v0.1.0/go.mod h1:eQVa6QFGzKy0qMcnW2pez0XBczvgwSjw9vA23qifEyU=
+github.com/anchore/go-rpmdb v0.2.0 h1:ixcyMg/guhBL9XjBVwhTv9CG48xO07Qkg2uDX2+zx/c=
+github.com/anchore/go-rpmdb v0.2.0/go.mod h1:ATsRlpCXstnoYfzqBfhwGw0U2dolx1BBQ9rAU8jWBAw=
 github.com/anchore/go-struct-converter v0.2.0-rc2 h1:q+859fW2/jbHJHB2etbNfRlFwYpknyvbqqk1hUdamQ4=
 github.com/anchore/go-struct-converter v0.2.0-rc2/go.mod h1:cDBA5vhcR62nXWo8QH9/Kk2807o65ISaHPNPX66L+Uw=
-github.com/anchore/go-sync v0.1.1 h1:91SZ+YqUIIHmf2jPAYZPuHqM/ZqnK1pVJDWtET6+AJE=
-github.com/anchore/go-sync v0.1.1/go.mod h1:3haGsk2BnaoVhsfqae8Kd0FKIAILE1Hw69P4Xo5iVBw=
+github.com/anchore/go-sync v0.1.2 h1:RDD5RCanrWqhbtBulqPSZpERadUlgcYjpybYzYd3Uk8=
+github.com/anchore/go-sync v0.1.2/go.mod h1:grjZH059bCHM6f6jh+Y7VYvX/q8YcjkDJqG6nplHGkE=
 github.com/anchore/go-version v1.2.2-0.20200701162849-18adb9c92b9b h1:e1bmaoJfZVsCYMrIZBpFxwV26CbsuoEh5muXD5I1Ods=
 github.com/anchore/go-version v1.2.2-0.20200701162849-18adb9c92b9b/go.mod h1:Bkc+JYWjMCF8OyZ340IMSIi2Ebf3uwByOk6ho4wne1E=
 github.com/anchore/packageurl-go v0.2.0 h1:CkrM4RMUwrEGAiE1OVlxaZNzWj0TuHRey7o4T/EAErk=
 github.com/anchore/packageurl-go v0.2.0/go.mod h1:2JCgOQMIsqZ7TmliXG4PnUthPJAKE3mWQbsW2XHjAOE=
-github.com/anchore/stereoscope v0.2.2 h1:SGTLGoF6GHmKEn9Bb6LYpzzgz9nhvMZgN/c4fTSQjYY=
-github.com/anchore/stereoscope v0.2.2/go.mod h1:ylJXJKebLctP7u9ewguB1d0zUETJxvAA7r2DiuljDTM=
+github.com/anchore/stereoscope v0.3.2 h1:A2FDMSU56m3rErO1e0CtWAVcDS8tc2iX4UXTw1hyPnI=
+github.com/anchore/stereoscope v0.3.2/go.mod h1:/IUDVDka+4gufc8kDw+JO3gFl9PkpCjJ2r3bd9UWouM=
 github.com/andreyvit/diff v0.0.0-20170406064948-c7f18ee00883/go.mod h1:rCTlJbsFo29Kk6CurOXKm700vrz8f0KW0JNfpkRJY/8=
 github.com/andybalholm/brotli v1.2.0 h1:ukwgCxwYrmACq68yiUqwIWnGY0cTPox/M94sVwToPjQ=
 github.com/andybalholm/brotli v1.2.0/go.mod h1:rzTDkvFWvIrjDXZHkuS16NPggd91W3kUSvPlQ1pLaKY=
@@ -156,6 +156,8 @@ github.com/anmitsu/go-shlex v0.0.0-20200514113438-38f4b401e2be/go.mod h1:ySMOLuW
 github.com/antihax/optional v1.0.0/go.mod h1:uupD/76wgC+ih3iEmQUL+0Ugr19nfwCT1kdvxnR2qWY=
 github.com/apparentlymart/go-textseg/v15 v15.0.0 h1:uYvfpb3DyLSCGWnctWKGj857c6ew1u1fNQOlOtuGxQY=
 github.com/apparentlymart/go-textseg/v15 v15.0.0/go.mod h1:K8XmNZdhEBkdlyDdvbmmsvpAG721bKi0joRfFdHIWJ4=
+github.com/apparentlymart/go-textseg/v17 v17.0.1 h1:bpMXRgQ5cEoRNuQke1a80/Nl6w3G5eoIbWo9f3gXkAs=
+github.com/apparentlymart/go-textseg/v17 v17.0.1/go.mod h1:fa8X4jgGeevslICIY6LcdjkSecWnXmYd9Lk34z/VxZs=
 github.com/aquasecurity/go-pep440-version v0.0.1 h1:8VKKQtH2aV61+0hovZS3T//rUF+6GDn18paFTVS0h0M=
 github.com/aquasecurity/go-pep440-version v0.0.1/go.mod h1:3naPe+Bp6wi3n4l5iBFCZgS0JG8vY6FT0H4NGhFJ+i4=
 github.com/aquasecurity/go-version v0.0.1 h1:4cNl516agK0TCn5F7mmYN+xVs1E3S45LkgZk3cbaW2E=
@@ -169,44 +171,42 @@ github.com/armon/go-socks5 v0.0.0-20160902184237-e75332964ef5 h1:0CwZNZbxp69SHPd
 github.com/armon/go-socks5 v0.0.0-20160902184237-e75332964ef5/go.mod h1:wHh0iHkYZB8zMSxRWpUBQtwG5a7fFgvEO+odwuTv2gs=
 github.com/atotto/clipboard v0.1.4 h1:EH0zSVneZPSuFR11BlR9YppQTVDbh5+16AmcJi4g1z4=
 github.com/atotto/clipboard v0.1.4/go.mod h1:ZY9tmq7sm5xIbd9bOK4onWV4S6X0u6GY7Vn0Yu86PYI=
-github.com/aws/aws-sdk-go-v2 v1.41.5 h1:dj5kopbwUsVUVFgO4Fi5BIT3t4WyqIDjGKCangnV/yY=
-github.com/aws/aws-sdk-go-v2 v1.41.5/go.mod h1:mwsPRE8ceUUpiTgF7QmQIJ7lgsKUPQOUl3o72QBrE1o=
-github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.8 h1:eBMB84YGghSocM7PsjmmPffTa+1FBUeNvGvFou6V/4o=
-github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.8/go.mod h1:lyw7GFp3qENLh7kwzf7iMzAxDn+NzjXEAGjKS2UOKqI=
-github.com/aws/aws-sdk-go-v2/config v1.32.12 h1:O3csC7HUGn2895eNrLytOJQdoL2xyJy0iYXhoZ1OmP0=
-github.com/aws/aws-sdk-go-v2/config v1.32.12/go.mod h1:96zTvoOFR4FURjI+/5wY1vc1ABceROO4lWgWJuxgy0g=
-github.com/aws/aws-sdk-go-v2/credentials v1.19.12 h1:oqtA6v+y5fZg//tcTWahyN9PEn5eDU/Wpvc2+kJ4aY8=
-github.com/aws/aws-sdk-go-v2/credentials v1.19.12/go.mod h1:U3R1RtSHx6NB0DvEQFGyf/0sbrpJrluENHdPy1j/3TE=
-github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.20 h1:zOgq3uezl5nznfoK3ODuqbhVg1JzAGDUhXOsU0IDCAo=
-github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.20/go.mod h1:z/MVwUARehy6GAg/yQ1GO2IMl0k++cu1ohP9zo887wE=
-github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.21 h1:Rgg6wvjjtX8bNHcvi9OnXWwcE0a2vGpbwmtICOsvcf4=
-github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.21/go.mod h1:A/kJFst/nm//cyqonihbdpQZwiUhhzpqTsdbhDdRF9c=
-github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.21 h1:PEgGVtPoB6NTpPrBgqSE5hE/o47Ij9qk/SEZFbUOe9A=
-github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.21/go.mod h1:p+hz+PRAYlY3zcpJhPwXlLC4C+kqn70WIHwnzAfs6ps=
-github.com/aws/aws-sdk-go-v2/internal/ini v1.8.6 h1:qYQ4pzQ2Oz6WpQ8T3HvGHnZydA72MnLuFK9tJwmrbHw=
-github.com/aws/aws-sdk-go-v2/internal/ini v1.8.6/go.mod h1:O3h0IK87yXci+kg6flUKzJnWeziQUKciKrLjcatSNcY=
-github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.22 h1:rWyie/PxDRIdhNf4DzRk0lvjVOqFJuNnO8WwaIRVxzQ=
-github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.22/go.mod h1:zd/JsJ4P7oGfUhXn1VyLqaRZwPmZwg44Jf2dS84Dm3Y=
-github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.7 h1:5EniKhLZe4xzL7a+fU3C2tfUN4nWIqlLesfrjkuPFTY=
-github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.7/go.mod h1:x0nZssQ3qZSnIcePWLvcoFisRXJzcTVvYpAAdYX8+GI=
-github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.9.13 h1:JRaIgADQS/U6uXDqlPiefP32yXTda7Kqfx+LgspooZM=
-github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.9.13/go.mod h1:CEuVn5WqOMilYl+tbccq8+N2ieCy0gVn3OtRb0vBNNM=
-github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.21 h1:c31//R3xgIJMSC8S6hEVq+38DcvUlgFY0FM6mSI5oto=
-github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.21/go.mod h1:r6+pf23ouCB718FUxaqzZdbpYFyDtehyZcmP5KL9FkA=
-github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.19.21 h1:ZlvrNcHSFFWURB8avufQq9gFsheUgjVD9536obIknfM=
-github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.19.21/go.mod h1:cv3TNhVrssKR0O/xxLJVRfd2oazSnZnkUeTf6ctUwfQ=
-github.com/aws/aws-sdk-go-v2/service/s3 v1.97.3 h1:HwxWTbTrIHm5qY+CAEur0s/figc3qwvLWsNkF4RPToo=
-github.com/aws/aws-sdk-go-v2/service/s3 v1.97.3/go.mod h1:uoA43SdFwacedBfSgfFSjjCvYe8aYBS7EnU5GZ/YKMM=
-github.com/aws/aws-sdk-go-v2/service/signin v1.0.8 h1:0GFOLzEbOyZABS3PhYfBIx2rNBACYcKty+XGkTgw1ow=
-github.com/aws/aws-sdk-go-v2/service/signin v1.0.8/go.mod h1:LXypKvk85AROkKhOG6/YEcHFPoX+prKTowKnVdcaIxE=
-github.com/aws/aws-sdk-go-v2/service/sso v1.30.13 h1:kiIDLZ005EcKomYYITtfsjn7dtOwHDOFy7IbPXKek2o=
-github.com/aws/aws-sdk-go-v2/service/sso v1.30.13/go.mod h1:2h/xGEowcW/g38g06g3KpRWDlT+OTfxxI0o1KqayAB8=
-github.com/aws/aws-sdk-go-v2/service/ssooidc v1.35.17 h1:jzKAXIlhZhJbnYwHbvUQZEB8KfgAEuG0dc08Bkda7NU=
-github.com/aws/aws-sdk-go-v2/service/ssooidc v1.35.17/go.mod h1:Al9fFsXjv4KfbzQHGe6V4NZSZQXecFcvaIF4e70FoRA=
-github.com/aws/aws-sdk-go-v2/service/sts v1.41.9 h1:Cng+OOwCHmFljXIxpEVXAGMnBia8MSU6Ch5i9PgBkcU=
-github.com/aws/aws-sdk-go-v2/service/sts v1.41.9/go.mod h1:LrlIndBDdjA/EeXeyNBle+gyCwTlizzW5ycgWnvIxkk=
-github.com/aws/smithy-go v1.24.2 h1:FzA3bu/nt/vDvmnkg+R8Xl46gmzEDam6mZ1hzmwXFng=
-github.com/aws/smithy-go v1.24.2/go.mod h1:YE2RhdIuDbA5E5bTdciG9KrW3+TiEONeUWCqxX9i1Fc=
+github.com/aws/aws-sdk-go-v2 v1.44.0 h1:4IbaHhtzy+4h37z4JQyO9a2QsiCml3CNYHtq5hIHigo=
+github.com/aws/aws-sdk-go-v2 v1.44.0/go.mod h1:bttEH6JqnUL8LepvDVfdrds/fZ5bCIxzpe3abyUrhDU=
+github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.20 h1:GPRlPwz40I2B2VrBEASOA3Bi77NyeqejNLkifosX0rs=
+github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.20/go.mod h1:g7PNzKcsOKWb4fkSRBA7BZVAS6Y8IcxzN+nRohhQ1Q8=
+github.com/aws/aws-sdk-go-v2/config v1.32.40 h1:lAVC9gMmKusmqDRe32dPtgKl/BWvJmMJoWELKHCAObw=
+github.com/aws/aws-sdk-go-v2/config v1.32.40/go.mod h1:8xOJLbe/hOj1g4PVsfJYV7O2byq+UGET1onDdUgbwqc=
+github.com/aws/aws-sdk-go-v2/credentials v1.19.39 h1:XOg8LC3Kgnsa3WiPQjc7Bi8k5IBN92cPYfIV9XMFss0=
+github.com/aws/aws-sdk-go-v2/credentials v1.19.39/go.mod h1:GonTDBQ+mTpCVNwaHjj0PagspfrYYMEqOx7FehoEP/I=
+github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.40 h1:r5aGipEVgI9aT/tAGjdrPbDQvIAKdTrS3rUPQtG4Rmo=
+github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.40/go.mod h1:vOD3CnPxAdkL6MWZeROkZsTlskklMFfgVFkHzx/oZpY=
+github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.40 h1:UIXlbijuB2XK1Kr57fo8iIxCuaSHJzwZ1uo+2tbEYIk=
+github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.40/go.mod h1:wcEsL6jscjZjVUinb0Q5qD/GXOG1yT3GNfmT9HuDwzU=
+github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.40 h1:xLQVRDs2NddDmK9BEyh5KSlJ1Gpy5/GIJXrV6WcVGAE=
+github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.40/go.mod h1:XRXnpFVFGLaEVK+olDdFIM1vNa04ETW452oFGEPUxAo=
+github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.41 h1:nv/ILuCY0yXACzMQwvtt/HbqDDjemZiI0AeDbxGQlnU=
+github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.41/go.mod h1:dzvOSpxaPqQ3j0xS6Lc1vyVuWW0RBj7s/QqYpzu3Q/0=
+github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.19 h1:bAdDl/HkGCcGPoe25ToSHEw23VIxt6CT5fLcg111BKg=
+github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.19/go.mod h1:KaUzbLxv4CeSxh6ZCl9B4m7CuFenS8kUEaDs+f/DQr4=
+github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.10.0 h1:U8/A0RRBaEspzH1uul3JHLbypXwEGUkRkvoT9f0ATcM=
+github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.10.0/go.mod h1:UELStX5KwtJNtQxa+UuF8dc3z4UYc40e8yHYJSozNwY=
+github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.40 h1:gr3Fw1cxZXNCdeo/lQ7isHEHzvHVM7z75qb2zW9aMjw=
+github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.40/go.mod h1:8z/9CmfnQhiuXD7Ykbcg4a/whSWsniE0ODSx9uwVzfk=
+github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.19.41 h1:Q9DIKDuJix/oJnQxFpQ26L0EwVa/YNo4k2kbktrjQjE=
+github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.19.41/go.mod h1:x+TuqkOIG1SZS0+yN54sExGA9ZpjhPO6vPdYnpTFX1M=
+github.com/aws/aws-sdk-go-v2/service/s3 v1.108.0 h1:Yp+x5PKXEmoqHsgP/pAkBy5Tyq1UlXAzM0OInh0vxWw=
+github.com/aws/aws-sdk-go-v2/service/s3 v1.108.0/go.mod h1:locV6DtXyp7Xzr2BG6jtsbeBi3YAWJ/CY4xUThYmIwQ=
+github.com/aws/aws-sdk-go-v2/service/signin v1.6.0 h1:agcr0j8YeFEzdXNo17Rg9MbbjLRjrimabwNtji4e+lU=
+github.com/aws/aws-sdk-go-v2/service/signin v1.6.0/go.mod h1:qU5PxgQ4JiUOOMotzfO3+5oUda5W+8JDVKyLQqlrJik=
+github.com/aws/aws-sdk-go-v2/service/sso v1.34.0 h1:FxaN8/sn61DTXNI6Gt678tFJUY8iUsCchm6Y/F/RjaA=
+github.com/aws/aws-sdk-go-v2/service/sso v1.34.0/go.mod h1:vu4OY6s8LJtT8BtYG2LD6BGSZMptkYn3o5hvCPB22jc=
+github.com/aws/aws-sdk-go-v2/service/ssooidc v1.39.0 h1:crWKPeGYTBTuBxQ3p73kjfJvt4brUIsr+Fuypko8FxY=
+github.com/aws/aws-sdk-go-v2/service/ssooidc v1.39.0/go.mod h1:HjjZVhaBz0JBR/kbWKThmNDhFKS7y6EURuk493tJk9Y=
+github.com/aws/aws-sdk-go-v2/service/sts v1.46.0 h1:IZ63JdogSNNjex/jsODNv7jGDcO/xJYd9FsgyfCsp1g=
+github.com/aws/aws-sdk-go-v2/service/sts v1.46.0/go.mod h1:I+rwAf3spG5dITBaAo3xXRowk8kiOhtU1kYxfvCTC44=
+github.com/aws/smithy-go v1.28.1 h1:R/nXH00c8qcfCzQVELtRw+eLQWtzv+VAIEFJ1/xxXlQ=
+github.com/aws/smithy-go v1.28.1/go.mod h1:YE2RhdIuDbA5E5bTdciG9KrW3+TiEONeUWCqxX9i1Fc=
 github.com/aymanbagabas/go-osc52/v2 v2.0.1 h1:HwpRHbFMcZLEVr42D4p7XBqjyuxQH5SMiErDT4WkJ2k=
 github.com/aymanbagabas/go-osc52/v2 v2.0.1/go.mod h1:uYgXzlJ7ZpABp8OJ+exZzJJhRNQ2ASbcXHWsFqH8hp8=
 github.com/aymanbagabas/go-udiff v0.3.1 h1:LV+qyBQ2pqe0u42ZsUEtPiCaUoqgA9gYRDs3vj1nolY=
@@ -290,14 +290,14 @@ github.com/cncf/xds/go v0.0.0-20210922020428-25de7278fc84/go.mod h1:eXthEFrGJvWH
 github.com/cncf/xds/go v0.0.0-20211001041855-01bcc9b48dfe/go.mod h1:eXthEFrGJvWHgFFCl3hGmgk+/aYT6PnTQLykKQRLhEs=
 github.com/cncf/xds/go v0.0.0-20211011173535-cb28da3451f1/go.mod h1:eXthEFrGJvWHgFFCl3hGmgk+/aYT6PnTQLykKQRLhEs=
 github.com/cncf/xds/go v0.0.0-20211130200136-a8f946100490/go.mod h1:eXthEFrGJvWHgFFCl3hGmgk+/aYT6PnTQLykKQRLhEs=
-github.com/cncf/xds/go v0.0.0-20251210132809-ee656c7534f5 h1:6xNmx7iTtyBRev0+D/Tv1FZd4SCg8axKApyNyRsAt/w=
-github.com/cncf/xds/go v0.0.0-20251210132809-ee656c7534f5/go.mod h1:KdCmV+x/BuvyMxRnYBlmVaq4OLiKW6iRQfvC62cvdkI=
+github.com/cncf/xds/go v0.0.0-20260202195803-dba9d589def2 h1:aBangftG7EVZoUb69Os8IaYg++6uMOdKK83QtkkvJik=
+github.com/cncf/xds/go v0.0.0-20260202195803-dba9d589def2/go.mod h1:qwXFYgsP6T7XnJtbKlf1HP8AjxZZyzxMmc+Lq5GjlU4=
 github.com/containerd/cgroups/v3 v3.1.3 h1:eUNflyMddm18+yrDmZPn3jI7C5hJ9ahABE5q6dyLYXQ=
 github.com/containerd/cgroups/v3 v3.1.3/go.mod h1:PKZ2AcWmSBsY/tJUVhtS/rluX0b1uq1GmPO1ElCmbOw=
 github.com/containerd/containerd/api v1.11.1 h1:h8nfoDW9+fNsC/9TwiAHj8B1GzXKtR4eFtkhi/X5RLU=
 github.com/containerd/containerd/api v1.11.1/go.mod h1:CaQFRu+N1MtbgL6JDOJLUB1hCKESU1lD6MuTJhgtdlw=
-github.com/containerd/containerd/v2 v2.3.2 h1:eLven1YxRMkeiKu7IcMrPKE+gn8sGR1DqHbbshMEvWM=
-github.com/containerd/containerd/v2 v2.3.2/go.mod h1:rHKGm3VW6wNrINb3x8mNT+w7qYXFVElTt/8HTuxVhD4=
+github.com/containerd/containerd/v2 v2.3.6 h1:huoqZXaDW1x1kgPvFC4rMwxv92vUJnqgq7I5b1rSddM=
+github.com/containerd/containerd/v2 v2.3.6/go.mod h1:qaUSWKk9EchqbudSbhv1MxI8dXKGYHLpZtMQdkEkVZ4=
 github.com/containerd/continuity v0.5.0 h1:7a85HZpCSs+1Zps0Ee3DPSuAWY+0SJM1JNM51nlEVDg=
 github.com/containerd/continuity v0.5.0/go.mod h1:/lNJvtJKUQStBzpVQ1+rasXO1LAWtUQssk28EZvJ3nE=
 github.com/containerd/errdefs v1.0.0 h1:tg5yIfIlQIrxYtu9ajqY42W3lpS19XqdxRQeEwYG8PI=
@@ -308,8 +308,8 @@ github.com/containerd/fifo v1.1.0 h1:4I2mbh5stb1u6ycIABlBw9zgtlK8viPI9QkQNRQEEmY
 github.com/containerd/fifo v1.1.0/go.mod h1:bmC4NWMbXlt2EZ0Hc7Fx7QzTFxgPID13eH0Qu+MAb2o=
 github.com/containerd/log v0.1.0 h1:TCJt7ioM2cr/tfR8GPbGf9/VRAX8D2B4PjzCpfX540I=
 github.com/containerd/log v0.1.0/go.mod h1:VRRf09a7mHDIRezVKTRCrOq78v577GXq3bSa3EhrzVo=
-github.com/containerd/platforms v1.0.0-rc.4 h1:M42JrUT4zfZTqtkUwkr0GzmUWbfyO5VO0Q5b3op97T4=
-github.com/containerd/platforms v1.0.0-rc.4/go.mod h1:lKlMXyLybmBedS/JJm11uDofzI8L2v0J2ZbYvNsbq1A=
+github.com/containerd/platforms v1.0.0-rc.5 h1:vXd569rDrz8LeMXzAnBsy6LADV5YtsD8oyaRarxdmSU=
+github.com/containerd/platforms v1.0.0-rc.5/go.mod h1:lKlMXyLybmBedS/JJm11uDofzI8L2v0J2ZbYvNsbq1A=
 github.com/containerd/plugin v1.1.0 h1:O+7lczNJVMy8rz0YNx3xGB8tTf5qY4i5abF041Ew19U=
 github.com/containerd/plugin v1.1.0/go.mod h1:qBTum+A8lJ6lO44A19Eo7y1OlcLj4OWFH1DA/vnHmcc=
 github.com/containerd/ttrpc v1.2.8 h1:xbVu6D4qF2jihdh9rDVOKqUMiFBQk6YctTdo1zk087Y=
@@ -333,25 +333,25 @@ github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc/go.mod h1:J7Y8Yc
 github.com/deitch/magic v0.0.0-20230404182410-1ff89d7342da h1:ZOjWpVsFZ06eIhnh4mkaceTiVoktdU67+M7KDHJ268M=
 github.com/deitch/magic v0.0.0-20230404182410-1ff89d7342da/go.mod h1:B3tI9iGHi4imdLi4Asdha1Sc6feLMTfPLXh9IUYmysk=
 github.com/dgrijalva/jwt-go/v4 v4.0.0-preview1/go.mod h1:+hnT3ywWDTAFrW5aE+u2Sa/wT555ZqwoCS+pk3p6ry4=
-github.com/diskfs/go-diskfs v1.9.3 h1:cLciNCeZ4QAXVxyPJDr1ZJ9N9CCG3rQlQ/z/Cs/cNDM=
-github.com/diskfs/go-diskfs v1.9.3/go.mod h1:TePJORO83Adh5pb2SqsxAwaP0fofFxKLkxctiS/9OQc=
+github.com/diskfs/go-diskfs v1.9.4 h1:0j2d7eG4IjyxL6+ChWbDPocdBCF6HQ4HBWU2WDYWVnc=
+github.com/diskfs/go-diskfs v1.9.4/go.mod h1:TePJORO83Adh5pb2SqsxAwaP0fofFxKLkxctiS/9OQc=
 github.com/distribution/reference v0.6.0 h1:0IXCQ5g4/QMHHkarYzh5l+u8T3t73zM5QvfrDyIgxBk=
 github.com/distribution/reference v0.6.0/go.mod h1:BbU0aIcezP1/5jX/8MP0YiH4SdvB5Y4f/wlDRiLyi3E=
 github.com/djherbis/times v1.6.0 h1:w2ctJ92J8fBvWPxugmXIv7Nz7Q3iDMKNx9v5ocVH20c=
 github.com/djherbis/times v1.6.0/go.mod h1:gOHeRAz2h+VJNZ5Gmc/o7iD9k4wW7NMVqieYCY99oc0=
-github.com/docker/cli v29.5.3+incompatible h1:nbEFfz774vBwQ5KRYv7c/AghjReqnGISvrRhzjV0evs=
-github.com/docker/cli v29.5.3+incompatible/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8=
+github.com/docker/cli v29.8.0+incompatible h1:ih0c2jq/nN7QfES8zIfwSzIhRScjs4ehER+kZ60aeSk=
+github.com/docker/cli v29.8.0+incompatible/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8=
 github.com/docker/docker-credential-helpers v0.9.5 h1:EFNN8DHvaiK8zVqFA2DT6BjXE0GzfLOZ38ggPTKePkY=
 github.com/docker/docker-credential-helpers v0.9.5/go.mod h1:v1S+hepowrQXITkEfw6o4+BMbGot02wiKpzWhGUZK6c=
-github.com/docker/go-connections v0.7.0 h1:6SsRfJddP22WMrCkj19x9WKjEDTB+ahsdiGYf0mN39c=
-github.com/docker/go-connections v0.7.0/go.mod h1:no1qkHdjq7kLMGUXYAduOhYPSJxxvgWBh7ogVvptn3Q=
+github.com/docker/go-connections v0.8.1 h1:JibmG5hULs5qXSr/cp/w3Pw5fZuStt4MOHMUExb29/M=
+github.com/docker/go-connections v0.8.1/go.mod h1:no1qkHdjq7kLMGUXYAduOhYPSJxxvgWBh7ogVvptn3Q=
 github.com/docker/go-units v0.5.0 h1:69rxXcBk27SvSaaxTtLh/8llcHD8vYHT7WSdRZ/jvr4=
 github.com/docker/go-units v0.5.0/go.mod h1:fgPhTUdO+D/Jk86RDLlptpiXQzgHJF7gydDDbaIK4Dk=
 github.com/dsnet/compress v0.0.2-0.20230904184137-39efe44ab707 h1:2tV76y6Q9BB+NEBasnqvs7e49aEBFI8ejC89PSnWH+4=
 github.com/dsnet/compress v0.0.2-0.20230904184137-39efe44ab707/go.mod h1:qssHWj60/X5sZFNxpG4HBPDHVqxNm4DfnCKgrbZOT+s=
 github.com/dsnet/golib v0.0.0-20171103203638-1ea166775780/go.mod h1:Lj+Z9rebOhdfkVLjJ8T6VcRQv3SXugXy999NBtR9aFY=
-github.com/dustin/go-humanize v1.0.1 h1:GzkhY7T5VNhEkwH0PVJgjz+fX1rhBrR7pRT3mDkpeCY=
-github.com/dustin/go-humanize v1.0.1/go.mod h1:Mu1zIs6XwVuF/gI1OepvI0qD18qycQx+mFykh5fBlto=
+github.com/dustin/go-humanize v1.1.0 h1:dbKTrvD0klcbBV/h4AWJdMuZogJACoMlvWIWZ5b2xWg=
+github.com/dustin/go-humanize v1.1.0/go.mod h1:hc1CvRkJMsgxqjmjMQF3QNRAZBwY8AXBAzKYoSX9sFI=
 github.com/elazarl/goproxy v1.7.2 h1:Y2o6urb7Eule09PjlhQRGNsqRfPmYI3KKQLFpCAV3+o=
 github.com/elazarl/goproxy v1.7.2/go.mod h1:82vkLNir0ALaW14Rc399OTTjyNREgmdL2cVoIbS6XaE=
 github.com/elliotchance/phpserialize v1.4.0 h1:cAp/9+KSnEbUC8oYCE32n2n84BeW8HOY3HMDI8hG2OY=
@@ -371,14 +371,14 @@ github.com/envoyproxy/go-control-plane v0.9.10-0.20210907150352-cf90f659a021/go.
 github.com/envoyproxy/go-control-plane v0.10.1/go.mod h1:AY7fTTXNdv/aJ2O5jwpxAPOWUZ7hQAEvzN5Pf27BkQQ=
 github.com/envoyproxy/go-control-plane v0.14.0 h1:hbG2kr4RuFj222B6+7T83thSPqLjwBIfQawTkC++2HA=
 github.com/envoyproxy/go-control-plane v0.14.0/go.mod h1:NcS5X47pLl/hfqxU70yPwL9ZMkUlwlKxtAohpi2wBEU=
-github.com/envoyproxy/go-control-plane/envoy v1.36.0 h1:yg/JjO5E7ubRyKX3m07GF3reDNEnfOboJ0QySbH736g=
-github.com/envoyproxy/go-control-plane/envoy v1.36.0/go.mod h1:ty89S1YCCVruQAm9OtKeEkQLTb+Lkz0k8v9W0Oxsv98=
+github.com/envoyproxy/go-control-plane/envoy v1.37.0 h1:u3riX6BoYRfF4Dr7dwSOroNfdSbEPe9Yyl09/B6wBrQ=
+github.com/envoyproxy/go-control-plane/envoy v1.37.0/go.mod h1:DReE9MMrmecPy+YvQOAOHNYMALuowAnbjjEMkkWOi6A=
 github.com/envoyproxy/go-control-plane/ratelimit v0.1.0 h1:/G9QYbddjL25KvtKTv3an9lx6VBE2cnb8wp1vEGNYGI=
 github.com/envoyproxy/go-control-plane/ratelimit v0.1.0/go.mod h1:Wk+tMFAFbCXaJPzVVHnPgRKdUdwW/KdbRt94AzgRee4=
 github.com/envoyproxy/protoc-gen-validate v0.1.0/go.mod h1:iSmxcyjqTsJpI2R4NaDN7+kN2VEUnK/pcBlmesArF7c=
 github.com/envoyproxy/protoc-gen-validate v0.6.2/go.mod h1:2t7qjJNvHPx8IjnBOzl9E9/baC+qXE/TeeyBRzgJDws=
-github.com/envoyproxy/protoc-gen-validate v1.3.0 h1:TvGH1wof4H33rezVKWSpqKz5NXWg5VPuZ0uONDT6eb4=
-github.com/envoyproxy/protoc-gen-validate v1.3.0/go.mod h1:HvYl7zwPa5mffgyeTUHA9zHIH36nmrm7oCbo4YKoSWA=
+github.com/envoyproxy/protoc-gen-validate v1.3.3 h1:MVQghNeW+LZcmXe7SY1V36Z+WFMDjpqGAGacLe2T0ds=
+github.com/envoyproxy/protoc-gen-validate v1.3.3/go.mod h1:TsndJ/ngyIdQRhMcVVGDDHINPLWB7C82oDArY51KfB0=
 github.com/erikgeiser/coninput v0.0.0-20211004153227-1c3628e74d0f h1:Y/CXytFA4m6baUTXGLOoWe4PQhGxaX0KpnayAqC48p4=
 github.com/erikgeiser/coninput v0.0.0-20211004153227-1c3628e74d0f/go.mod h1:vw97MGsxSvLiUE2X8qFplwetxpGLQrlU1Q9AUEIzCaM=
 github.com/erofs/go-erofs v0.3.0 h1:o/W5ABAA3sHYl97WL93dacKEfeDpJhdFf3c2snAti7I=
@@ -389,8 +389,8 @@ github.com/facebookincubator/nvdtools v0.1.5/go.mod h1:Kh55SAWnjckS96TBSrXI99KrE
 github.com/fatih/color v1.7.0/go.mod h1:Zm6kSWBoL9eyXnKyktHP6abPY2pDugNf5KwzbycvMj4=
 github.com/fatih/color v1.9.0/go.mod h1:eQcE1qtQxscV5RaZvpXrrb8Drkc3/DdQ+uUYCNjL+zU=
 github.com/fatih/color v1.13.0/go.mod h1:kLAiJbzzSOZDVNGyDpeOxJ47H46qBXwg5ILebYFFOfk=
-github.com/fatih/color v1.18.0 h1:S8gINlzdQ840/4pfAwic/ZE0djQEH3wM94VfqLTZcOM=
-github.com/fatih/color v1.18.0/go.mod h1:4FelSpRwEGDpQ12mAdzqdOukCy4u8WUtOY6lkT/6HfU=
+github.com/fatih/color v1.19.0 h1:Zp3PiM21/9Ld6FzSKyL5c/BULoe/ONr9KlbYVOfG8+w=
+github.com/fatih/color v1.19.0/go.mod h1:zNk67I0ZUT1bEGsSGyCZYZNrHuTkJJB+r6Q9VuMi0LE=
 github.com/fatih/set v0.2.1 h1:nn2CaJyknWE/6txyUDGwysr3G5QC6xWB/PtVjPBbeaA=
 github.com/fatih/set v0.2.1/go.mod h1:+RKtMCH+favT2+3YecHGxcc0b4KyVWA1QWWJUs4E0CI=
 github.com/felixge/fgprof v0.9.3/go.mod h1:RdbpDgzqYVh/T9fPELJyV7EYJuHB55UTEULNun8eiPw=
@@ -403,27 +403,27 @@ github.com/frankban/quicktest v1.14.6/go.mod h1:4ptaffx2x8+WTWXmUCuVU6aPUX1/Mz7z
 github.com/fsnotify/fsnotify v1.5.1/go.mod h1:T3375wBYaZdLLcVNkcVbzGHY7f1l/uK5T5Ai1i3InKU=
 github.com/fsnotify/fsnotify v1.9.0 h1:2Ml+OJNzbYCTzsxtv8vKSFD9PbJjmhYF14k/jKC7S9k=
 github.com/fsnotify/fsnotify v1.9.0/go.mod h1:8jBTzvmWwFyi3Pb8djgCCO5IBqzKJ/Jwo8TRcHyHii0=
-github.com/gabriel-vasile/mimetype v1.4.13 h1:46nXokslUBsAJE/wMsp5gtO500a4F3Nkz9Ufpk2AcUM=
-github.com/gabriel-vasile/mimetype v1.4.13/go.mod h1:d+9Oxyo1wTzWdyVUPMmXFvp4F9tea18J8ufA774AB3s=
+github.com/gabriel-vasile/mimetype v1.4.15 h1:05iP/CYtZ/w455R/KZM6rZ5ieAdh99UPtd+d3YzLmaI=
+github.com/gabriel-vasile/mimetype v1.4.15/go.mod h1:azpTcoLcDZRNgFou5j+APrqQx9HqVPWa6ijYQIIVswQ=
 github.com/ghodss/yaml v1.0.0/go.mod h1:4dBDuWmgqj2HViK6kFavaiC9ZROes6MMH2rRYeMEF04=
 github.com/github/go-spdx/v2 v2.7.0 h1:GzfXx4wFdlilARxmFRXW/mgUy3A4vSqZocCMFV6XFdQ=
 github.com/github/go-spdx/v2 v2.7.0/go.mod h1:Ftc45YYG1WzpzwEPKRVm9Jv8vDqOrN4gWoCkK+bHer0=
 github.com/gkampitakis/ciinfo v0.3.4 h1:5eBSibVuSMbb/H6Elc0IIEFbkzCJi3lm94n0+U7Z0KY=
 github.com/gkampitakis/ciinfo v0.3.4/go.mod h1:1NIwaOcFChN4fa/B0hEBdAb6npDlFL8Bwx4dfRLRqAo=
-github.com/gkampitakis/go-snaps v0.5.22 h1:xg9omphRnbDnimMCl1KqznC4krlxOGpkB0vDSfX2P7M=
-github.com/gkampitakis/go-snaps v0.5.22/go.mod h1:uy3lVzCCRRsAwYqSocyw5fY8xRLCYEfqoOJNxr8HonM=
+github.com/gkampitakis/go-snaps v0.5.23 h1:okh5QR48zpUjpWtu65AtqxdCY8huJq+dEDuUzd1PuKg=
+github.com/gkampitakis/go-snaps v0.5.23/go.mod h1:uy3lVzCCRRsAwYqSocyw5fY8xRLCYEfqoOJNxr8HonM=
 github.com/glebarez/go-sqlite v1.20.3 h1:89BkqGOXR9oRmG58ZrzgoY/Fhy5x0M+/WV48U5zVrZ4=
 github.com/glebarez/go-sqlite v1.20.3/go.mod h1:u3N6D/wftiAzIOJtZl6BmedqxmmkDfH3q+ihjqxC9u0=
 github.com/gliderlabs/ssh v0.3.8 h1:a4YXD1V7xMF9g5nTkdfnja3Sxy1PVDCj1Zg4Wb8vY6c=
 github.com/gliderlabs/ssh v0.3.8/go.mod h1:xYoytBv1sV0aL3CavoDuJIQNURXkkfPA/wxQ1pL1fAU=
 github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376 h1:+zs/tPmkDkHx3U66DAb0lQFJrpS6731Oaa12ikc+DiI=
 github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376/go.mod h1:an3vInlBmSxCcxctByoQdvwPiA7DTK7jaaFDBTtu0ic=
-github.com/go-git/go-billy/v5 v5.9.0 h1:jItGXszUDRtR/AlferWPTMN4j38BQ88XnXKbilmmBPA=
-github.com/go-git/go-billy/v5 v5.9.0/go.mod h1:jCnQMLj9eUgGU7+ludSTYoZL/GGmii14RxKFj7ROgHw=
+github.com/go-git/go-billy/v5 v5.9.1 h1:8U73XiOTfINdItHVa6z4Gv7ToObcZ6grkqQbLryLCdA=
+github.com/go-git/go-billy/v5 v5.9.1/go.mod h1:ExsU+jcGwXTBOnyilvAnEM1wug1IxHr4yP2ZXsNRtV0=
 github.com/go-git/go-git-fixtures/v4 v4.3.2-0.20231010084843-55a94097c399 h1:eMje31YglSBqCdIqdhKBW8lokaMrL3uTkpGYlE2OOT4=
 github.com/go-git/go-git-fixtures/v4 v4.3.2-0.20231010084843-55a94097c399/go.mod h1:1OCfN199q1Jm3HZlxleg+Dw/mwps2Wbk9frAWm+4FII=
-github.com/go-git/go-git/v5 v5.19.1 h1:nX27AnaU43/K5bKktKwgBmR9lawoYVe1Ckg0rgzzN00=
-github.com/go-git/go-git/v5 v5.19.1/go.mod h1:Pb1v0c7/g8aGQJwx9Us09W85yGoyvSwuhEGMH7zjDKQ=
+github.com/go-git/go-git/v5 v5.19.2 h1:wkfn7vOlUBu8ivAWKBWisTiwJK4jYHzTF8Ndv1LyGqY=
+github.com/go-git/go-git/v5 v5.19.2/go.mod h1:QqCBE1EFN5ddFmrliLQ3/ntRCUjZU3EJuwuB/jWEHjk=
 github.com/go-gl/glfw v0.0.0-20190409004039-e6da0acd62b1/go.mod h1:vR7hzQXu2zJy9AVAgeJqvqgH9Q5CA+iKCZ2gyEVpxRU=
 github.com/go-gl/glfw/v3.3/glfw v0.0.0-20191125211704-12ad95a8df72/go.mod h1:tQ2UAYgL5IevRw8kRxooKSPJfGvJ9fJQFa0TUsXzTg8=
 github.com/go-gl/glfw/v3.3/glfw v0.0.0-20200222043503-6f7a984d4dc4/go.mod h1:tQ2UAYgL5IevRw8kRxooKSPJfGvJ9fJQFa0TUsXzTg8=
@@ -434,8 +434,8 @@ github.com/go-kit/kit v0.9.0/go.mod h1:xBxKIO96dXMWWy0MnWVtmwkA9/13aqxPnvrjFYMA2
 github.com/go-logfmt/logfmt v0.3.0/go.mod h1:Qt1PoO58o5twSAckw1HlFXLmHsOX5/0LbT9GBnD5lWE=
 github.com/go-logfmt/logfmt v0.4.0/go.mod h1:3RMwSq7FuexP4Kalkev3ejPJsZTpXXBr9+V4qmtdjCk=
 github.com/go-logr/logr v1.2.2/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
-github.com/go-logr/logr v1.4.3 h1:CjnDlHq8ikf6E492q6eKboGOC0T8CDaOvkHCIg8idEI=
-github.com/go-logr/logr v1.4.3/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
+github.com/go-logr/logr v1.4.4 h1:tG4xh9yMsRCAiodLVTxyrkzSZ9+o0L1Kg/+cPVcbP/8=
+github.com/go-logr/logr v1.4.4/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
 github.com/go-logr/stdr v1.2.2 h1:hSWxHoqTgW2S2qGc0LTAI563KZ5YKYRhT3MFKZMbjag=
 github.com/go-logr/stdr v1.2.2/go.mod h1:mMo/vtBO5dYbehREoey6XUKy/eSumjCCveDpRre4VKE=
 github.com/go-restruct/restruct v1.2.0-alpha h1:2Lp474S/9660+SJjpVxoKuWX09JsXHSrdV7Nv3/gkvc=
@@ -509,8 +509,8 @@ github.com/google/go-cmp v0.5.5/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/
 github.com/google/go-cmp v0.5.6/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
 github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
 github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
-github.com/google/go-containerregistry v0.21.7 h1:/vPFuVXDjtFREsVArW+0h1CIl5urnOhzei4X2DMW9IU=
-github.com/google/go-containerregistry v0.21.7/go.mod h1:kjSbt7/zMsKLWfnHrIvKvhXHUw91jbe9DNjPPJ32gXE=
+github.com/google/go-containerregistry v0.22.1 h1:RZuuSYhTvlDvtsK+NkutoCZ//C0X2ebLK8X8l3ULs84=
+github.com/google/go-containerregistry v0.22.1/go.mod h1:bJR35SK8XgisYmhg/FMQ/5RK0S/XrOAqLBV5/LR2XE0=
 github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
 github.com/google/licensecheck v0.3.1 h1:QoxgoDkaeC4nFrtGN1jV7IPmDCHFNIVh54e5hSt6sPs=
 github.com/google/licensecheck v0.3.1/go.mod h1:ORkR35t/JjW+emNKtfJDII0zlciG9JgbT7SmsohlHmY=
@@ -537,32 +537,32 @@ github.com/google/pprof v0.0.0-20210609004039-a478d1d731e9/go.mod h1:kpwsk12EmLe
 github.com/google/pprof v0.0.0-20210720184732-4bb14d4b1be1/go.mod h1:kpwsk12EmLew5upagYY7GY0pfYCcupk39gWOCRROcvE=
 github.com/google/pprof v0.0.0-20211214055906-6f57359322fd/go.mod h1:KgnwoLYCZ8IQu3XUZ8Nc/bM9CCZFOyjUNOSygVozoDg=
 github.com/google/pprof v0.0.0-20240227163752-401108e1b7e7/go.mod h1:czg5+yv1E0ZGTi6S6vVK1mke0fV+FaUhNGcd6VRS9Ik=
-github.com/google/pprof v0.0.0-20250317173921-a4b03ec1a45e h1:ijClszYn+mADRFY17kjQEVQ1XRhq2/JR1M3sGqeJoxs=
-github.com/google/pprof v0.0.0-20250317173921-a4b03ec1a45e/go.mod h1:boTsfXsheKC2y+lKOCMpSfarhxDeIzfZG1jqGcPl3cA=
+github.com/google/pprof v0.0.0-20260802141513-ef3492d7dac3 h1:LMLX+LgTNWpfvCBdFebv6EsYotImrt/Ppc5cXIriCSo=
+github.com/google/pprof v0.0.0-20260802141513-ef3492d7dac3/go.mod h1:jl5iWTm0/hd5PjEYEOuwAJ57L/CibdZfrqZ5XA5GrCk=
 github.com/google/renameio v0.1.0/go.mod h1:KWCgfxg9yswjAJkECMjeO8J8rahYeXnNhOm40UhjYkI=
 github.com/google/s2a-go v0.1.9 h1:LGD7gtMgezd8a/Xak7mEWL0PjoTQFvpRudN895yqKW0=
 github.com/google/s2a-go v0.1.9/go.mod h1:YA0Ei2ZQL3acow2O62kdp9UlnvMmU7kA6Eutn0dXayM=
 github.com/google/uuid v1.1.2/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
 github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
 github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
-github.com/googleapis/enterprise-certificate-proxy v0.3.14 h1:yh8ncqsbUY4shRD5dA6RlzjJaT4hi3kII+zYw8wmLb8=
-github.com/googleapis/enterprise-certificate-proxy v0.3.14/go.mod h1:vqVt9yG9480NtzREnTlmGSBmFrA+bzb0yl0TxoBQXOg=
+github.com/googleapis/enterprise-certificate-proxy v0.3.20 h1:t/xL64VUoN69MuMRQuJETqYGOw4Z9mSRJK9epIEtwFk=
+github.com/googleapis/enterprise-certificate-proxy v0.3.20/go.mod h1:L3D/IQExI6LqEjBdXcZQ1WluSgigQmSwBboFstVPM4w=
 github.com/googleapis/gax-go/v2 v2.0.4/go.mod h1:0Wqv26UfaUD9n4G6kQubkQ+KchISgw+vpHVxEJEs9eg=
 github.com/googleapis/gax-go/v2 v2.0.5/go.mod h1:DWXyrwAJ9X0FpwwEdw+IPEYBICEFu5mhpdKc/us6bOk=
 github.com/googleapis/gax-go/v2 v2.1.0/go.mod h1:Q3nei7sK6ybPYH7twZdmQpAd1MKb7pfu6SK+H1/DsU0=
 github.com/googleapis/gax-go/v2 v2.1.1/go.mod h1:hddJymUZASv3XPyGkUpKj8pPO47Rmb0eJc8R6ouapiM=
-github.com/googleapis/gax-go/v2 v2.17.0 h1:RksgfBpxqff0EZkDWYuz9q/uWsTVz+kf43LsZ1J6SMc=
-github.com/googleapis/gax-go/v2 v2.17.0/go.mod h1:mzaqghpQp4JDh3HvADwrat+6M3MOIDp5YKHhb9PAgDY=
+github.com/googleapis/gax-go/v2 v2.24.0 h1:myMaPYyF9MecEmvQqMqomIwn9t/4KCZN9qnwsS76wlg=
+github.com/googleapis/gax-go/v2 v2.24.0/go.mod h1:IaTHBDd7NHxSCiu0vEs8pQZu4dGZrWwuSoxCnk16OFM=
 github.com/gookit/assert v0.1.1 h1:lh3GcawXe/p+cU7ESTZ5Ui3Sm/x8JWpIis4/1aF0mY0=
 github.com/gookit/assert v0.1.1/go.mod h1:jS5bmIVQZTIwk42uXl4lyj4iaaxx32tqH16CFj0VX2E=
 github.com/gookit/color v1.2.5/go.mod h1:AhIE+pS6D4Ql0SQWbBeXPHw7gY0/sjHoA4s/n1KB7xg=
 github.com/gookit/color v1.6.1 h1:KoTnDxJPRgrL0SoX0f8rCFg2zI0t4E3GZZBMo2nN8LU=
 github.com/gookit/color v1.6.1/go.mod h1:9ACFc7/1IpHGBW8RwuDm/0YEnhg3dwwXpoMsmtyHfjs=
-github.com/gpustack/gguf-parser-go v0.24.1 h1:nTYtL8HFK6ZhB90RKBu4oX2b3ZHpJLrMmKRfL9w9Cyc=
-github.com/gpustack/gguf-parser-go v0.24.1/go.mod h1:y4TwTtDqFWTK+xvprOjRUh+dowgU2TKCX37vRKvGiZ0=
+github.com/gpustack/gguf-parser-go v0.26.3 h1:F63PlUPIW56HGU5k4Crv0JAG9ojtz/TuwzgMYlb82Ec=
+github.com/gpustack/gguf-parser-go v0.26.3/go.mod h1:y4TwTtDqFWTK+xvprOjRUh+dowgU2TKCX37vRKvGiZ0=
 github.com/grpc-ecosystem/grpc-gateway v1.16.0/go.mod h1:BDjrQk3hbvj6Nolgz8mAMFbcEtjT1g+wF4CSlocrBnw=
-github.com/hashicorp/aws-sdk-go-base/v2 v2.0.0-beta.72 h1:vTCWu1wbdYo7PEZFem/rlr01+Un+wwVmI7wiegFdRLk=
-github.com/hashicorp/aws-sdk-go-base/v2 v2.0.0-beta.72/go.mod h1:Vn+BBgKQHVQYdVQ4NZDICE1Brb+JfaONyDHr3q07oQc=
+github.com/hashicorp/aws-sdk-go-base/v2 v2.0.0-beta.74 h1:mymLUKThnV9wFvogOK8NnsMP9/vlhnjXY98gr2QIGW8=
+github.com/hashicorp/aws-sdk-go-base/v2 v2.0.0-beta.74/go.mod h1:Bh9qYL8ehmDxSg14Tk8oxFCP90XHfs6NxV1D84884xA=
 github.com/hashicorp/consul/api v1.11.0/go.mod h1:XjsvQN+RJGWI2TWy1/kqaE16HrR2J/FWgkYjdZQsX9M=
 github.com/hashicorp/consul/sdk v0.8.0/go.mod h1:GBvyrGALthsZObzUGsfgHZQDXjg4lOjagTIwIR1vPms=
 github.com/hashicorp/errwrap v1.0.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
@@ -572,8 +572,8 @@ github.com/hashicorp/go-cleanhttp v0.5.0/go.mod h1:JpRdi6/HCYpAwUzNwuwqhbovhLtng
 github.com/hashicorp/go-cleanhttp v0.5.1/go.mod h1:JpRdi6/HCYpAwUzNwuwqhbovhLtngrth3wmdIIUrZ80=
 github.com/hashicorp/go-cleanhttp v0.5.2 h1:035FKYIWjmULyFRBKPs8TBQoi0x6d9G4xc9neXJWAZQ=
 github.com/hashicorp/go-cleanhttp v0.5.2/go.mod h1:kO/YDlP8L1346E6Sodw+PrpBSV4/SoxCXGY6BqNFT48=
-github.com/hashicorp/go-getter v1.8.6 h1:9sQboWULaydVphxc4S64oAI4YqpuCk7nPmvbk131ebY=
-github.com/hashicorp/go-getter v1.8.6/go.mod h1:nVH12eOV2P58dIiL3rsU6Fh3wLeJEKBOJzhMmzlSWoo=
+github.com/hashicorp/go-getter v1.8.9 h1:1AOTMUmz/S/GuqOTE6+bg6nwPXTEbKr3Tc/T/lVS7is=
+github.com/hashicorp/go-getter v1.8.9/go.mod h1:qI7vH/m552bXutKe4UkWptOJl4bo2KeO/CSOoh4s0ps=
 github.com/hashicorp/go-hclog v0.12.0/go.mod h1:whpDNt7SSdeAju8AWKIWsul05p54N/39EeqMAyrmvFQ=
 github.com/hashicorp/go-hclog v1.0.0/go.mod h1:whpDNt7SSdeAju8AWKIWsul05p54N/39EeqMAyrmvFQ=
 github.com/hashicorp/go-immutable-radix v1.0.0/go.mod h1:0y9vanUI8NX6FsYoO3zeMjhV/C5i9g4Q3DwcSNZ4P60=
@@ -589,16 +589,16 @@ github.com/hashicorp/go-sockaddr v1.0.0/go.mod h1:7Xibr9yA9JjQq1JpNB2Vw7kxv8xerX
 github.com/hashicorp/go-syslog v1.0.0/go.mod h1:qPfqrKkXGihmCqbJM2mZgkZGvKG1dFdvsLplgctolz4=
 github.com/hashicorp/go-uuid v1.0.0/go.mod h1:6SBZvOh/SIDV7/2o3Jml5SYk/TvGqwFJ/bN7x4byOro=
 github.com/hashicorp/go-uuid v1.0.1/go.mod h1:6SBZvOh/SIDV7/2o3Jml5SYk/TvGqwFJ/bN7x4byOro=
-github.com/hashicorp/go-version v1.8.0 h1:KAkNb1HAiZd1ukkxDFGmokVZe1Xy9HG6NUp+bPle2i4=
-github.com/hashicorp/go-version v1.8.0/go.mod h1:fltr4n8CU8Ke44wwGCBoEymUuxUHl09ZGVZPK5anwXA=
+github.com/hashicorp/go-version v1.9.0 h1:CeOIz6k+LoN3qX9Z0tyQrPtiB1DFYRPfCIBtaXPSCnA=
+github.com/hashicorp/go-version v1.9.0/go.mod h1:fltr4n8CU8Ke44wwGCBoEymUuxUHl09ZGVZPK5anwXA=
 github.com/hashicorp/golang-lru v0.5.0/go.mod h1:/m3WP610KZHVQ1SGc6re/UDhFvYD7pJ4Ao+sR/qLZy8=
 github.com/hashicorp/golang-lru v0.5.1/go.mod h1:/m3WP610KZHVQ1SGc6re/UDhFvYD7pJ4Ao+sR/qLZy8=
 github.com/hashicorp/golang-lru v0.5.4/go.mod h1:iADmTwqILo4mZ8BN3D2Q6+9jd8WM5uGBxy+E8yxSoD4=
 github.com/hashicorp/golang-lru/v2 v2.0.7 h1:a+bsQ5rvGLjzHuww6tVxozPZFVghXaHOwFs4luLUK2k=
 github.com/hashicorp/golang-lru/v2 v2.0.7/go.mod h1:QeFd9opnmA6QUJc5vARoKUSoFhyfM2/ZepoAG6RGpeM=
 github.com/hashicorp/hcl v1.0.0/go.mod h1:E5yfLk+7swimpb2L/Alb/PJmXilQ/rhwaUYs4T20WEQ=
-github.com/hashicorp/hcl/v2 v2.24.0 h1:2QJdZ454DSsYGoaE6QheQZjtKZSUs9Nh2izTWiwQxvE=
-github.com/hashicorp/hcl/v2 v2.24.0/go.mod h1:oGoO1FIQYfn/AgyOhlg9qLC6/nOJPX3qGbkZpYAcqfM=
+github.com/hashicorp/hcl/v2 v2.25.0 h1:HmmQVYRny4MaBo4b20TjmL46wyuUxpnMWkPZ4+NTbWk=
+github.com/hashicorp/hcl/v2 v2.25.0/go.mod h1:vR+FKETxoZAmRlHgFfKmuqivj+C4Izm/c66XkmZ3r7M=
 github.com/hashicorp/logutils v1.0.0/go.mod h1:QIAnNjmIWmVIIkWDTG1z5v++HQmx9WQRO+LraFDTW64=
 github.com/hashicorp/mdns v1.0.1/go.mod h1:4gW7WsVCke5TE7EPeYliwHlRUyBtfCwuFwuMg2DmyNY=
 github.com/hashicorp/mdns v1.0.4/go.mod h1:mtBihi+LeNXGtG8L9dX59gAEa12BDtBQSp4v/YAJqrc=
@@ -624,8 +624,9 @@ github.com/invopop/jsonschema v0.14.0 h1:MHQqLhvpNUZfw+hM3AZDYK7jxO8FZoQeQM77g8i
 github.com/invopop/jsonschema v0.14.0/go.mod h1:ygm6C2EaVNMBDPpaPlnOA2pFAxBnxGjFlMZABxm9n2I=
 github.com/jbenet/go-context v0.0.0-20150711004518-d14ea06fba99 h1:BQSFePA1RWJOlocH6Fxy8MmwDt+yVQYULKfN0RoTN8A=
 github.com/jbenet/go-context v0.0.0-20150711004518-d14ea06fba99/go.mod h1:1lJo3i6rXxKeerYnT8Nvf0QmHCRC1n8sfWVwXF2Frvo=
-github.com/jedib0t/go-pretty/v6 v6.8.1 h1:0fkCNhjrX0zPpwkWaDYU5VMrygg41Tu197mWILIJoqQ=
-github.com/jedib0t/go-pretty/v6 v6.8.1/go.mod h1:YwC5CE4fJ1HFUDeivSV1r//AmANFHyqczZk+U6BDALU=
+github.com/jedib0t/go-pretty/v6 v6.8.3 h1:yVSk5aemoYHCvcrtqyXklwqcgHQIQzmy/oUzFlmffSQ=
+github.com/jedib0t/go-pretty/v6 v6.8.3/go.mod h1:YwC5CE4fJ1HFUDeivSV1r//AmANFHyqczZk+U6BDALU=
+github.com/jessevdk/go-flags v1.4.0/go.mod h1:4FA24M0QyGHXBuZZK/XkWh8h0e1EYbRYJSGM75WSRxI=
 github.com/jinzhu/copier v0.4.0 h1:w3ciUoD19shMCRargcpm0cm91ytaBhDvuRpz1ODO/U8=
 github.com/jinzhu/copier v0.4.0/go.mod h1:DfbEm0FYsaqBcKcFuvmOZb218JkPGtvSHsKg8S8hyyg=
 github.com/josharian/intern v1.0.0/go.mod h1:5DoeVV0s6jJacbCEi61lwdGj/aVlrQvzHFFd8Hwg//Y=
@@ -644,8 +645,8 @@ github.com/kevinburke/ssh_config v1.2.0/go.mod h1:CT57kijsi8u/K/BOFA39wgDQJ9CxiF
 github.com/kisielk/errcheck v1.5.0/go.mod h1:pFxgyoBC7bSaBwPgfKdkLd5X25qrDl4LWUI2bnpBCr8=
 github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+oQHNcck=
 github.com/klauspost/compress v1.4.1/go.mod h1:RyIbtBH6LamlWaDj8nUwkbUhJ87Yi3uG0guNDohfE1A=
-github.com/klauspost/compress v1.18.6 h1:2jupLlAwFm95+YDR+NwD2MEfFO9d4z4Prjl1XXDjuao=
-github.com/klauspost/compress v1.18.6/go.mod h1:cwPg85FWrGar70rWktvGQj8/hthj3wpl0PGDogxkrSQ=
+github.com/klauspost/compress v1.20.0 h1:a3C1ke2ohxFymNlb2HWAHjDeKCI90scRskErZkR0ezA=
+github.com/klauspost/compress v1.20.0/go.mod h1:LUdAzn7YLVvxLpc7y3V1m40wESHTgc1422pwwBSKYuI=
 github.com/klauspost/cpuid v1.2.0/go.mod h1:Pj4uuM528wm8OyEC2QMXAi2YiTZ96dNQPGgoMS4s3ek=
 github.com/klauspost/cpuid/v2 v2.3.0 h1:S4CRMLnYUhGeDFDqkGriYKdfoFlDnMtqTiI/sFzhA9Y=
 github.com/klauspost/cpuid/v2 v2.3.0/go.mod h1:hqwkgyIinND0mEev00jJYCxPNVRVXFQeu1XKlok6oO0=
@@ -669,8 +670,8 @@ github.com/lucasb-eyer/go-colorful v1.3.0 h1:2/yBRLdWBZKrf7gB40FoiKfAWYQ0lqNcbuQ
 github.com/lucasb-eyer/go-colorful v1.3.0/go.mod h1:R4dSotOR9KMtayYi1e77YzuveK+i7ruzyGqttikkLy0=
 github.com/lyft/protoc-gen-star v0.5.3/go.mod h1:V0xaHgaf5oCCqmcxYcWiDfTiKsZsRc87/1qhoTACD8w=
 github.com/magiconair/properties v1.8.5/go.mod h1:y3VJvCyxH9uVvJTWEGAELF3aiYNyPKd5NZ3oSwXrF60=
-github.com/magiconair/properties v1.8.10 h1:s31yESBquKXCV9a/ScB3ESkOjUYYv+X0rg8SYxI99mE=
-github.com/magiconair/properties v1.8.10/go.mod h1:Dhd985XPs7jluiymwWYZ0G4Z61jb3vdS329zhj2hYo0=
+github.com/magiconair/properties v1.18.12 h1:sT9zQpvTB3B4gzrX0tmZNTEaGyg8Zw55MFYRE32Mr9I=
+github.com/magiconair/properties v1.18.12/go.mod h1:Dhd985XPs7jluiymwWYZ0G4Z61jb3vdS329zhj2hYo0=
 github.com/mailru/easyjson v0.7.7/go.mod h1:xzfreul335JAWq5oZzymOObrkdz5UnU4kGfJJLY9Nlc=
 github.com/maruel/natural v1.3.0 h1:VsmCsBmEyrR46RomtgHs5hbKADGRVtliHTyCOLFBpsg=
 github.com/maruel/natural v1.3.0/go.mod h1:v+Rfd79xlw1AgVBjbO0BEQmptqb5HvL/k9GRHB7ZKEg=
@@ -687,8 +688,8 @@ github.com/mattn/go-isatty v0.0.10/go.mod h1:qgIWMr58cqv1PHHyhnkY9lrL7etaEgOFcME
 github.com/mattn/go-isatty v0.0.11/go.mod h1:PhnuNfih5lzO57/f3n+odYbM4JtupLOxQOAqxQCu2WE=
 github.com/mattn/go-isatty v0.0.12/go.mod h1:cbi8OIDigv2wuxKPP5vlRcQ1OAZbq2CE4Kysco4FUpU=
 github.com/mattn/go-isatty v0.0.14/go.mod h1:7GGIvUiUoEMVVmxf/4nioHXj79iQHKdU27kJ6hsGG94=
-github.com/mattn/go-isatty v0.0.20 h1:xfD0iDuEKnDkl03q4limB+vH+GxLEtL/jb4xVJSWWEY=
-github.com/mattn/go-isatty v0.0.20/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=
+github.com/mattn/go-isatty v0.0.24 h1:tGZZoVgT/KiqK1c8ocVLeDS8BSWMRd47J3Lbz7vsReI=
+github.com/mattn/go-isatty v0.0.24/go.mod h1:nMCL3Zebbrt45jsMDgnfIwz6ydEQApk5oEI3HqDio6A=
 github.com/mattn/go-localereader v0.0.2-0.20220822084749-2491eb6c1c75 h1:P8UmIzZMYDR+NGImiFvErt6VWfIRPuGM+vyjiEdkmIw=
 github.com/mattn/go-localereader v0.0.2-0.20220822084749-2491eb6c1c75/go.mod h1:8fBrzywKY7BI3czFoHkuzRoWE9C+EiG4R1k4Cjx5p88=
 github.com/mattn/go-runewidth v0.0.21 h1:jJKAZiQH+2mIinzCJIaIG9Be1+0NR+5sz/lYEEjdM8w=
@@ -722,10 +723,10 @@ github.com/moby/docker-image-spec v1.3.1 h1:jMKff3w6PgbfSa69GfNg+zN/XLhfXJGnEx3N
 github.com/moby/docker-image-spec v1.3.1/go.mod h1:eKmb5VW8vQEh/BAr2yvVNvuiJuY6UIocYsFu/DxxRpo=
 github.com/moby/locker v1.0.1 h1:fOXqR41zeveg4fFODix+1Ch4mj/gT0NE1XJbp/epuBg=
 github.com/moby/locker v1.0.1/go.mod h1:S7SDdo5zpBK84bzzVlKr2V0hz+7x9hWbYC/kq7oQppc=
-github.com/moby/moby/api v1.54.2 h1:wiat9QAhnDQjA7wk1kh/TqHz2I1uUA7M7t9SAl/JNXg=
-github.com/moby/moby/api v1.54.2/go.mod h1:+RQ6wluLwtYaTd1WnPLykIDPekkuyD/ROWQClE83pzs=
-github.com/moby/moby/client v0.4.1 h1:DMQgisVoMkmMs7fp3ROSdiBnoAu8+vo3GggFl06M/wY=
-github.com/moby/moby/client v0.4.1/go.mod h1:z52C9O2POPOsnxZAy//WtKcQ32P+jT/NGeXu/7nfjGQ=
+github.com/moby/moby/api v1.56.0 h1:GQzua3NA599ASSIICx0iFgiJeO9YkdDARvQsm23ZZuQ=
+github.com/moby/moby/api v1.56.0/go.mod h1:sZ+THbVWkjOmBPPfbnzdD/G1LuIexWhqlSHHPTDQ1Uk=
+github.com/moby/moby/client v0.6.0 h1:AJjEB21QPbXSXjDsZorFBoDZPhMrfbpaPLgSMAW9Bgs=
+github.com/moby/moby/client v0.6.0/go.mod h1:OCo00wNRyA3m4lmJ228W3JbyCN4ZNNYjpOXiJydBdcQ=
 github.com/moby/sys/mountinfo v0.7.2 h1:1shs6aH5s4o5H2zQLn796ADW1wMrIwHsyJ2v9KouLrg=
 github.com/moby/sys/mountinfo v0.7.2/go.mod h1:1YOa8w8Ih7uW0wALDUgT1dTTSBrZ+HiBLGws92L2RU4=
 github.com/moby/sys/sequential v0.6.0 h1:qrx7XFUd/5DxtqcoH1h438hF5TmOvzC/lspjy7zgvCU=
@@ -757,16 +758,16 @@ github.com/nix-community/go-nix v0.0.0-20250101154619-4bdde671e0a1 h1:kpt9ZfKcm+
 github.com/nix-community/go-nix v0.0.0-20250101154619-4bdde671e0a1/go.mod h1:qgCw4bBKZX8qMgGeEZzGFVT3notl42dBjNqO2jut0M0=
 github.com/nsf/jsondiff v0.0.0-20210926074059-1e845ec5d249 h1:NHrXEjTNQY7P0Zfx1aMrNhpgxHmow66XQtm0aQLY0AE=
 github.com/nsf/jsondiff v0.0.0-20210926074059-1e845ec5d249/go.mod h1:mpRZBD8SJ55OIICQ3iWH0Yz3cjzA61JdqMLoWXeB2+8=
-github.com/nwaples/rardecode/v2 v2.2.0 h1:4ufPGHiNe1rYJxYfehALLjup4Ls3ck42CWwjKiOqu0A=
-github.com/nwaples/rardecode/v2 v2.2.0/go.mod h1:7uz379lSxPe6j9nvzxUZ+n7mnJNgjsRNb6IbvGVHRmw=
+github.com/nwaples/rardecode/v2 v2.4.1 h1:F7zNW2LdAuuBThHWXQaiFUGVD/sef299NfWSB1nHAl4=
+github.com/nwaples/rardecode/v2 v2.4.1/go.mod h1:7uz379lSxPe6j9nvzxUZ+n7mnJNgjsRNb6IbvGVHRmw=
 github.com/olekukonko/cat v0.0.0-20250911104152-50322a0618f6 h1:zrbMGy9YXpIeTnGj4EljqMiZsIcE09mmF8XsD5AYOJc=
 github.com/olekukonko/cat v0.0.0-20250911104152-50322a0618f6/go.mod h1:rEKTHC9roVVicUIfZK7DYrdIoM0EOr8mK1Hj5s3JjH0=
 github.com/olekukonko/errors v1.2.0 h1:10Zcn4GeV59t/EGqJc8fUjtFT/FuUh5bTMzZ1XwmCRo=
 github.com/olekukonko/errors v1.2.0/go.mod h1:ppzxA5jBKcO1vIpCXQ9ZqgDh8iwODz6OXIGKU8r5m4Y=
 github.com/olekukonko/ll v0.1.6 h1:lGVTHO+Qc4Qm+fce/2h2m5y9LvqaW+DCN7xW9hsU3uA=
 github.com/olekukonko/ll v0.1.6/go.mod h1:NVUmjBb/aCtUpjKk75BhWrOlARz3dqsM+OtszpY4o88=
-github.com/olekukonko/tablewriter v1.1.4 h1:ORUMI3dXbMnRlRggJX3+q7OzQFDdvgbN9nVWj1drm6I=
-github.com/olekukonko/tablewriter v1.1.4/go.mod h1:+kedxuyTtgoZLwif3P1Em4hARJs+mVnzKxmsCL/C5RY=
+github.com/olekukonko/tablewriter v1.1.5 h1:4LoZSfMySpMQY3PT8RWJsJeuEuMIoo9xGRgvmqjg6IQ=
+github.com/olekukonko/tablewriter v1.1.5/go.mod h1:+kedxuyTtgoZLwif3P1Em4hARJs+mVnzKxmsCL/C5RY=
 github.com/onsi/gomega v1.34.1 h1:EUMJIKUjM8sKjYbtxQI9A4z2o+rruxnzNvpknOXie6k=
 github.com/onsi/gomega v1.34.1/go.mod h1:kU1QgUvBDLXBJq618Xvm2LUX6rSAfRaFRTcdOeDLwwY=
 github.com/opencontainers/go-digest v1.0.0 h1:apOUWs51W5PlhuyGyz9FCeeBIOUDA/6nW8Oi/yOhh5U=
@@ -785,8 +786,8 @@ github.com/pborman/indent v1.2.1/go.mod h1:FitS+t35kIYtB5xWTZAPhnmrxcciEEOdbyrrp
 github.com/pelletier/go-toml v1.9.4/go.mod h1:u1nR/EPcESfeI/szUZKdtJ0xRNbUoANCkoOuaOx1Y+c=
 github.com/pelletier/go-toml v1.9.5 h1:4yBQzkHv+7BHq2PQUZF3Mx0IYxG7LsP222s7Agd3ve8=
 github.com/pelletier/go-toml v1.9.5/go.mod h1:u1nR/EPcESfeI/szUZKdtJ0xRNbUoANCkoOuaOx1Y+c=
-github.com/pelletier/go-toml/v2 v2.3.1 h1:MYEvvGnQjeNkRF1qUuGolNtNExTDwct51yp7olPtrEc=
-github.com/pelletier/go-toml/v2 v2.3.1/go.mod h1:2gIqNv+qfxSVS7cM2xJQKtLSTLUE9V8t9Stt+h56mCY=
+github.com/pelletier/go-toml/v2 v2.4.3 h1:GTRvJQutkOSftxIFD5xw9aepkYNuPWmVJpffdDPYVpY=
+github.com/pelletier/go-toml/v2 v2.4.3/go.mod h1:2gIqNv+qfxSVS7cM2xJQKtLSTLUE9V8t9Stt+h56mCY=
 github.com/pierrec/lz4/v4 v4.1.26 h1:GrpZw1gZttORinvzBdXPUXATeqlJjqUG/D87TKMnhjY=
 github.com/pierrec/lz4/v4 v4.1.26/go.mod h1:EoQMVJgeeEOMsCqCzqFm2O0cJvljX2nGZjcRIPL34O4=
 github.com/piprate/json-gold v0.7.0 h1:bEMirgA5y8Z2loTQfxyIFfY+EflxH1CTP6r/KIlcJNw=
@@ -901,14 +902,14 @@ github.com/spf13/pflag v1.0.10/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3A
 github.com/spf13/viper v1.10.0/go.mod h1:SoyBPwAtKDzypXNDFKN5kzH7ppppbGZtls1UpIy5AsM=
 github.com/spf13/viper v1.21.0 h1:x5S+0EU27Lbphp4UKm1C+1oQO+rKx36vfCoaVebLFSU=
 github.com/spf13/viper v1.21.0/go.mod h1:P0lhsswPGWD/1lZJ9ny3fYnVqxiegrlNrEmgLjbTCAY=
-github.com/spiffe/go-spiffe/v2 v2.6.0 h1:l+DolpxNWYgruGQVV0xsfeya3CsC7m8iBzDnMpsbLuo=
-github.com/spiffe/go-spiffe/v2 v2.6.0/go.mod h1:gm2SeUoMZEtpnzPNs2Csc0D/gX33k1xIx7lEzqblHEs=
+github.com/spiffe/go-spiffe/v2 v2.7.0 h1:uXe1MflJoHw58wAUvxVlcM7WpKtijWG7I1UidcGh6g4=
+github.com/spiffe/go-spiffe/v2 v2.7.0/go.mod h1:47Q0Q9/AqGha8QLHp+kxpH4Wca7X7EnOtlIJy3mxZ3U=
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
 github.com/stretchr/objx v0.1.1/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
 github.com/stretchr/objx v0.4.0/go.mod h1:YvHI0jy2hoMjB+UWwv71VJQ9isScKT/TqJzVSSt89Yw=
 github.com/stretchr/objx v0.5.0/go.mod h1:Yh+to48EsGEfYuaHDzXPcE3xhTkx73EhmCGUpEOglKo=
-github.com/stretchr/objx v0.5.2 h1:xuMeJ0Sdp5ZMRXx/aWO6RZxdr3beISkG5/G/aIRr3pY=
-github.com/stretchr/objx v0.5.2/go.mod h1:FRsXN1f5AsAjCGJKqEizvkpNtU+EGNCLh3NxZ/8L+MA=
+github.com/stretchr/objx v0.5.3 h1:jmXUvGomnU1o3W/V5h2VEradbpJDwGrzugQQvL0POH4=
+github.com/stretchr/objx v0.5.3/go.mod h1:rDQraq+vQZU7Fde9LOZLr8Tax6zZvy4kuNKF+QYS+U0=
 github.com/stretchr/testify v0.0.0-20161117074351-18a02ba4a312/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXfy6kDkUVs=
 github.com/stretchr/testify v1.2.2/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXfy6kDkUVs=
 github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
@@ -919,8 +920,8 @@ github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/
 github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
 github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU=
 github.com/stretchr/testify v1.8.1/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4=
-github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
-github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
+github.com/stretchr/testify v1.12.1 h1:EuwCh5fleGS7H32xRwO3wRGT7DxrDhLAT6FF8MpWDWE=
+github.com/stretchr/testify v1.12.1/go.mod h1:MDEgiDPPsNp5cuIrHPPCyornHKgEVbtFUmoNlxoYthg=
 github.com/subosito/gotenv v1.2.0/go.mod h1:N0PQaV/YGNqwC0u51sEeR/aUtSLEXKX9iv69rRypqCw=
 github.com/subosito/gotenv v1.6.0 h1:9NlTDc1FTs4qu0DDq7AEtTPNw6SVm7uBMsUCUjABIf8=
 github.com/subosito/gotenv v1.6.0/go.mod h1:Dk4QP5c2W3ibzajGcXpNraDfq2IrhjMIvMSWPKKo0FU=
@@ -930,8 +931,8 @@ github.com/sylabs/squashfs v1.0.6 h1:PvJcDzxr+vIm2kH56mEMbaOzvGu79gK7P7IX+R7BDZI
 github.com/sylabs/squashfs v1.0.6/go.mod h1:DlDeUawVXLWAsSRa085Eo0ZenGzAB32JdAUFaB0LZfE=
 github.com/tailscale/hujson v0.0.0-20260302212456-ecc657c15afd h1:Rf9uhF1+VJ7ZHqxrG8pJ6YacmHvVCmByDmGbAWCc/gA=
 github.com/tailscale/hujson v0.0.0-20260302212456-ecc657c15afd/go.mod h1:EbW0wDK/qEUYI0A5bqq0C2kF8JTQwWONmGDBbzsxxHo=
-github.com/terminalstatic/go-xsd-validate v0.1.6 h1:TenYeQ3eY631qNi1/cTmLH/s2slHPRKTTHT+XSHkepo=
-github.com/terminalstatic/go-xsd-validate v0.1.6/go.mod h1:18lsvYFofBflqCrvo1umpABZ99+GneNTw2kEEc8UPJw=
+github.com/terminalstatic/go-xsd-validate v0.1.8 h1:UVrTCy1j3DhwaYTTUF+QYO/Nan13S0tf+Jwi+p45Bf0=
+github.com/terminalstatic/go-xsd-validate v0.1.8/go.mod h1:1kb47fi2c6onlf+B7UrrQ9VYraOhcYwFm3iG+J6F4Zo=
 github.com/therootcompany/xz v1.0.1 h1:CmOtsn1CbtmyYiusbfmhmkpAAETj0wBIH6kCYaX+xzw=
 github.com/therootcompany/xz v1.0.1/go.mod h1:3K3UH1yCKgBneZYhuQUvJ9HPD19UEXEI0BWbMn8qNMY=
 github.com/tidwall/gjson v1.14.2/go.mod h1:/wbyibRr2FHMks5tjHJ5F8dMZh3AcwJEMf5vlfC0lxk=
@@ -946,8 +947,8 @@ github.com/tidwall/sjson v1.2.5 h1:kLy8mja+1c9jlljvWTlSazM7cKDRfJuR/bOJhcY5NcY=
 github.com/tidwall/sjson v1.2.5/go.mod h1:Fvgq9kS/6ociJEDnK0Fk1cpYF4FIW6ZF7LAe+6jwd28=
 github.com/tv42/httpunix v0.0.0-20150427012821-b75d8614f926/go.mod h1:9ESjWnEqriFuLhtthL60Sar/7RFoluCcXsuvEwTV5KM=
 github.com/ulikunitz/xz v0.5.8/go.mod h1:nbz6k7qbPmH4IRqmfOplQw/tblSgqTqBwxkY0oWt/14=
-github.com/ulikunitz/xz v0.5.15 h1:9DNdB5s+SgV3bQ2ApL10xRc35ck0DuIX/isZvIk+ubY=
-github.com/ulikunitz/xz v0.5.15/go.mod h1:nbz6k7qbPmH4IRqmfOplQw/tblSgqTqBwxkY0oWt/14=
+github.com/ulikunitz/xz v0.5.16 h1:ld6NyySjx5lowVKwJvMRLnW5nxKX/xnpSiFYZ/Lxur0=
+github.com/ulikunitz/xz v0.5.16/go.mod h1:H9Rt/W6/Qj27PGauhQc6nfCDy7vHpzsOThBSaYDoEhw=
 github.com/vbatts/go-mtree v0.7.0 h1:ytmOc3MTRidZiBi9VBCyZ2BHe4fZS47L5v7BVXDWW4E=
 github.com/vbatts/go-mtree v0.7.0/go.mod h1:EjdpFC+LZy1TXbRGNa1MKKgjQ+7ew3foMFJK8o4/TdY=
 github.com/vifraa/gopom v1.0.0 h1:L9XlKbyvid8PAIK8nr0lihMApJQg/12OBvMA28BcWh0=
@@ -977,8 +978,8 @@ github.com/yuin/goldmark v1.1.32/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9de
 github.com/yuin/goldmark v1.2.1/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
 github.com/yuin/goldmark v1.3.5/go.mod h1:mwnBkeHKe2W/ZEtQ+71ViKU8L12m81fl3OWwC1Zlc8k=
 github.com/yuin/goldmark v1.4.13/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY=
-github.com/zclconf/go-cty v1.16.3 h1:osr++gw2T61A8KVYHoQiFbFd1Lh3JOCXc/jFLJXKTxk=
-github.com/zclconf/go-cty v1.16.3/go.mod h1:VvMs5i0vgZdhYawQNq5kePSpLAoz8u1xvZgrPIxfnZE=
+github.com/zclconf/go-cty v1.19.0 h1:IV8WdqYZc2c5rLX9bEoLNXKojBAp0MZPBHMIrCoa/s4=
+github.com/zclconf/go-cty v1.19.0/go.mod h1:12W89jGn3JCOIQi7infWr9m80rOkb5RNYJqXMZcN4c8=
 github.com/zclconf/go-cty-debug v0.0.0-20240509010212-0d6042c53940 h1:4r45xpDWB6ZMSMNJFMOjqrGHynW3DIBuR2H9j0ug+Mo=
 github.com/zclconf/go-cty-debug v0.0.0-20240509010212-0d6042c53940/go.mod h1:CmBdvvj3nqzfzJ6nTCIwDTPZ56aVGvDrmztiO5g3qrM=
 github.com/zyedidia/generic v1.2.2-0.20230320175451-4410d2372cb1 h1:V+UsotZpAVvfj3X/LMoEytoLzSiP6Lg0F7wdVyu9gGg=
@@ -997,32 +998,35 @@ go.opencensus.io v0.24.0 h1:y73uSU6J157QMP2kn2r30vwW1A2W2WFwSCGnAVxeaD0=
 go.opencensus.io v0.24.0/go.mod h1:vNK8G9p7aAivkbmorf4v+7Hgx+Zs0yY+0fOtgBfjQKo=
 go.opentelemetry.io/auto/sdk v1.2.1 h1:jXsnJ4Lmnqd11kwkBV2LgLoFMZKizbCi5fNZ/ipaZ64=
 go.opentelemetry.io/auto/sdk v1.2.1/go.mod h1:KRTj+aOaElaLi+wW1kO/DZRXwkF4C5xPbEe3ZiIhN7Y=
-go.opentelemetry.io/contrib/detectors/gcp v1.39.0 h1:kWRNZMsfBHZ+uHjiH4y7Etn2FK26LAGkNFw7RHv1DhE=
-go.opentelemetry.io/contrib/detectors/gcp v1.39.0/go.mod h1:t/OGqzHBa5v6RHZwrDBJ2OirWc+4q/w2fTbLZwAKjTk=
+go.opentelemetry.io/contrib/detectors/gcp v1.44.0 h1:NmLfL734pJhM0JKaYd2Y28+nY9dPRWYAAbxhRCrKXPw=
+go.opentelemetry.io/contrib/detectors/gcp v1.44.0/go.mod h1:tNAsgd8avTGke1+MndXlU5Cru4PQ9Ai/cCNWQv/ZJ/s=
 go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.68.0 h1:0Qx7VGBacMm9ZENQ7TnNObTYI4ShC+lHI16seduaxZo=
 go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.68.0/go.mod h1:Sje3i3MjSPKTSPvVWCaL8ugBzJwik3u4smCjUeuupqg=
 go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.68.0 h1:CqXxU8VOmDefoh0+ztfGaymYbhdB/tT3zs79QaZTNGY=
 go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.68.0/go.mod h1:BuhAPThV8PBHBvg8ZzZ/Ok3idOdhWIodywz2xEcRbJo=
-go.opentelemetry.io/otel v1.43.0 h1:mYIM03dnh5zfN7HautFE4ieIig9amkNANT+xcVxAj9I=
-go.opentelemetry.io/otel v1.43.0/go.mod h1:JuG+u74mvjvcm8vj8pI5XiHy1zDeoCS2LB1spIq7Ay0=
-go.opentelemetry.io/otel/exporters/stdout/stdoutmetric v1.40.0 h1:ZrPRak/kS4xI3AVXy8F7pipuDXmDsrO8Lg+yQjBLjw0=
-go.opentelemetry.io/otel/exporters/stdout/stdoutmetric v1.40.0/go.mod h1:3y6kQCWztq6hyW8Z9YxQDDm0Je9AJoFar2G0yDcmhRk=
-go.opentelemetry.io/otel/metric v1.43.0 h1:d7638QeInOnuwOONPp4JAOGfbCEpYb+K6DVWvdxGzgM=
-go.opentelemetry.io/otel/metric v1.43.0/go.mod h1:RDnPtIxvqlgO8GRW18W6Z/4P462ldprJtfxHxyKd2PY=
-go.opentelemetry.io/otel/sdk v1.43.0 h1:pi5mE86i5rTeLXqoF/hhiBtUNcrAGHLKQdhg4h4V9Dg=
-go.opentelemetry.io/otel/sdk v1.43.0/go.mod h1:P+IkVU3iWukmiit/Yf9AWvpyRDlUeBaRg6Y+C58QHzg=
-go.opentelemetry.io/otel/sdk/metric v1.43.0 h1:S88dyqXjJkuBNLeMcVPRFXpRw2fuwdvfCGLEo89fDkw=
-go.opentelemetry.io/otel/sdk/metric v1.43.0/go.mod h1:C/RJtwSEJ5hzTiUz5pXF1kILHStzb9zFlIEe85bhj6A=
-go.opentelemetry.io/otel/trace v1.43.0 h1:BkNrHpup+4k4w+ZZ86CZoHHEkohws8AY+WTX09nk+3A=
-go.opentelemetry.io/otel/trace v1.43.0/go.mod h1:/QJhyVBUUswCphDVxq+8mld+AvhXZLhe+8WVFxiFff0=
+go.opentelemetry.io/otel v1.45.0 h1:pdrWmLHofpubmArBv1LgFSv1Z0Ie/ppdZzu+kUN5EeU=
+go.opentelemetry.io/otel v1.45.0/go.mod h1:XZxIqPapzEYnhNSScF5DIqXhm/rYi0FzCe2XddAwZfQ=
+go.opentelemetry.io/otel/exporters/stdout/stdoutmetric v1.44.0 h1:hqxVTu/GtBF+vJ8d1fzW7fRxZFvgoDjWcxwwCaFDYpU=
+go.opentelemetry.io/otel/exporters/stdout/stdoutmetric v1.44.0/go.mod h1:z5fVEF4X5v0ESvlJqBrrFlBVoj5EQuefZpzsu7R+x5Q=
+go.opentelemetry.io/otel/metric v1.45.0 h1:7Eg1uH7CJ5cXv9is6tnBe1FI6rj1nwUdbFypRm3br/M=
+go.opentelemetry.io/otel/metric v1.45.0/go.mod h1:HAPbm1nd3p1PmFH7v2dR+6BjXxw+Lq4a2+pndMAm08s=
+go.opentelemetry.io/otel/metric/x v0.67.0 h1:PcicCNZFkZ4bXfSooXdo3WN7RBOVOtjVdo1wD358Uns=
+go.opentelemetry.io/otel/metric/x v0.67.0/go.mod h1:FBjCWZe6wgcqxcMtjdGiClDKXb2YxxXii0CXftE4QtI=
+go.opentelemetry.io/otel/sdk v1.45.0 h1:4VVSMgQ83dUgW2aoX5f6JgLvHwIvzcuLnF9lUdCSpCw=
+go.opentelemetry.io/otel/sdk v1.45.0/go.mod h1:Sr40LgXV7DsKMMJMKOhUWOgMWTfAaqvm2kF0g7ilwuA=
+go.opentelemetry.io/otel/sdk/metric v1.45.0 h1:oVFszMfyj1Am6s24Vtc7wBb8BKLcwepJjNEYILuiE3o=
+go.opentelemetry.io/otel/sdk/metric v1.45.0/go.mod h1:vUWUxDZvu1WVRj8JA8S0AdhsPrZoDpA2DdZauIh4mDA=
+go.opentelemetry.io/otel/trace v1.45.0 h1:l/mP6Uv7oNO7/TblbhpbgMidxhq1uO/rPsikOyVhxag=
+go.opentelemetry.io/otel/trace v1.45.0/go.mod h1:qoJJA2xNMnxRrdISU/kLtfUH2wNeQbiv+jhs/CxI8bc=
 go.opentelemetry.io/proto/otlp v0.7.0/go.mod h1:PqfVotwruBrMGOCsRd/89rSnXhoiJIqeYNgFYFoEGnI=
 go.uber.org/atomic v1.7.0/go.mod h1:fEN4uk6kAWBTFdckzkM89CLk9XfWZrxpCo0nPH17wJc=
 go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto=
 go.uber.org/goleak v1.3.0/go.mod h1:CoHD4mav9JJNrW/WLlf7HGZPjdw8EucARQHekz1X6bE=
 go.uber.org/multierr v1.6.0/go.mod h1:cdWPpRnG4AhwMwsgIHip0KRBQjJy5kYEpYjJxpXp9iU=
 go.uber.org/zap v1.17.0/go.mod h1:MXVU+bhUf/A7Xi2HNOnopQOrmycQ5Ih87HtOu4q5SSo=
-go.yaml.in/yaml/v3 v3.0.4 h1:tfq32ie2Jv2UxXFdLJdh3jXuOzWiL1fo0bu/FbuKpbc=
 go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg=
+go.yaml.in/yaml/v3 v3.0.5 h1:N6y/pJk8buWs9NY5ERU2HSMfm+IuD/OtfdAnq6kESPw=
+go.yaml.in/yaml/v3 v3.0.5/go.mod h1:HVTZu1O7/Vkt2N+BFy8Zza+lnLsABggaTM2ZpNIGuKg=
 go.yaml.in/yaml/v4 v4.0.0-rc.2 h1:/FrI8D64VSr4HtGIlUtlFMGsm7H7pWTbj6vOLVZcA6s=
 go.yaml.in/yaml/v4 v4.0.0-rc.2/go.mod h1:aZqd9kCMsGL7AuUv/m/PvWLdg5sjJsZ4oHDEnfPPfY0=
 go4.org v0.0.0-20230225012048-214862532bf5 h1:nifaUDeh+rPaBCMPMQHZmvJf+QdpLFnuQPwx+LxVmtc=
@@ -1039,8 +1043,8 @@ golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPh
 golang.org/x/crypto v0.0.0-20210817164053-32db794688a5/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
 golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
 golang.org/x/crypto v0.0.0-20220622213112-05595931fe9d/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=
-golang.org/x/crypto v0.53.0 h1:QZ4Muo8THX6CizN2vPPd5fBGHyogrdK9fG4wLPFUsto=
-golang.org/x/crypto v0.53.0/go.mod h1:DNLU434OwVakk9PzuwV8w62mAJpRJL3vsgcfp4Qnsio=
+golang.org/x/crypto v0.57.0 h1:3ZVCjf8Ggz7zneR/EHRVx68Ctf+2pmIMP2UFhh9cC6M=
+golang.org/x/crypto v0.57.0/go.mod h1:Fdz0i5U6CoizGwLda9DttjSk6qlZo25zYNtR+ycvuZA=
 golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
 golang.org/x/exp v0.0.0-20190306152737-a1d7652674e8/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
 golang.org/x/exp v0.0.0-20190510132918-efd6b22b2522/go.mod h1:ZjyILWgesfNpC6sMxTJOJm9Kp84zZh5NQWvqDGG3Qr8=
@@ -1080,8 +1084,8 @@ golang.org/x/mod v0.4.1/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.4.2/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.5.0/go.mod h1:5OXOZSfqPIIbmVBIIKWRFfZjPR0E5r58TLhUjH0a2Ro=
 golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4=
-golang.org/x/mod v0.37.0 h1:vF1DjpVEshcIqoEaauuHebaLk1O1forxjxBaVn884JQ=
-golang.org/x/mod v0.37.0/go.mod h1:m8S8VeM9r4dzDwjrKO0a1sZP3YjeMamRRlD+fmR2Q/0=
+golang.org/x/mod v0.41.0 h1:qJmnOUb4YB+FsEuM3HcWucdZASCPGhsX6uljO6pog0c=
+golang.org/x/mod v0.41.0/go.mod h1:Ek9pY8RKWXwsWvd3rQiHYtMqkjSUV+s1Rj7j4H5Ur6o=
 golang.org/x/net v0.0.0-20180724234803-3673e40ba225/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20180826012351-8a410e7b638d/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20181023162649-9b4f9f5ad519/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
@@ -1126,8 +1130,8 @@ golang.org/x/net v0.0.0-20210813160813-60bc85c4be6d/go.mod h1:9nx3DQGgdP8bBQD5qx
 golang.org/x/net v0.0.0-20211112202133-69e39bad7dc2/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
 golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
 golang.org/x/net v0.7.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=
-golang.org/x/net v0.56.0 h1:Rw8j/hFzGvJUZwNBXnAtf5sVDVt+65SK2C7IxCxZt5o=
-golang.org/x/net v0.56.0/go.mod h1:D3Ku6r+V6JROoZK144D2XfMHFcMq/0zSfLelVTCFKec=
+golang.org/x/net v0.59.0 h1:5zfYln+w5XCxwrnMMJPufRgNoXEaGxl0wo5GqPXyues=
+golang.org/x/net v0.59.0/go.mod h1:2DA/G1UfVbCpQPeWTmMPGY7Cs2PkBkwu743bVX5PIVg=
 golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
 golang.org/x/oauth2 v0.0.0-20190226205417-e64efc72b421/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
 golang.org/x/oauth2 v0.0.0-20190604053449-0f29369cfe45/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
@@ -1159,8 +1163,8 @@ golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJ
 golang.org/x/sync v0.0.0-20201207232520-09787c993a3a/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20210220032951-036812b2e83c/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.21.0 h1:HLII4xRRTtCRkxYp4HNFF0Js/Og6q2i++KXbg0gHCwM=
-golang.org/x/sync v0.21.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
+golang.org/x/sync v0.23.0 h1:KameEIfc1IkluZyXWLn39Wd4tURc6GbCiISGiZm2bQk=
+golang.org/x/sync v0.23.0/go.mod h1:sUUOizhqBxiL6pEWpqNLUiaJn1ShEbZ6BBqskPbjZm0=
 golang.org/x/sys v0.0.0-20180823144017-11551d06cbcc/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20180830151530-49385e6e1522/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20180905080454-ebe1bf3edb33/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
@@ -1235,13 +1239,13 @@ golang.org/x/sys v0.0.0-20220715151400-c0bba94af5f8/go.mod h1:oPkhp1MJrh7nUepCBc
 golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.46.0 h1:noSf2Fq6F8DBgS+LysIkx7rIExoNHJsxOAtPp4rthXw=
-golang.org/x/sys v0.46.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
+golang.org/x/sys v0.48.0 h1:bbX/i/6MgT9BVLM9RT1thmxL04yeTAhbEz4SyadbXoo=
+golang.org/x/sys v0.48.0/go.mod h1:hNLxWAXmnKAxqDtdwIYC4bM9oQPEecfsnNMuSxOs3og=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
 golang.org/x/term v0.5.0/go.mod h1:jMB1sMXY+tzblOD4FWmEbocvup2/aLOaQEp7JmGp78k=
-golang.org/x/term v0.44.0 h1:0rLvDRCtNj0gZkyIXhCyOb2OAzEhLVqc4B+hrsBhrmc=
-golang.org/x/term v0.44.0/go.mod h1:7ze4MdzUzLXpSAoFP1H0bOI9aXDqveSvatT5vKcFh2Y=
+golang.org/x/term v0.46.0 h1:3+OXuTbaKDgwk8jTi3aSLHRlmWqHEUDUtxnbFigO4YE=
+golang.org/x/term v0.46.0/go.mod h1:+K02xbkittuwc0Am4abfA3Fc+XRGXkvBXNO88NCXPoc=
 golang.org/x/text v0.0.0-20170915032832-14c0d48ead0c/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.1-0.20180807135948-17ff2d5776d2/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
@@ -1252,13 +1256,13 @@ golang.org/x/text v0.3.5/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
 golang.org/x/text v0.7.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
-golang.org/x/text v0.38.0 h1:sXmwo9DwP3OK9EZ7PqAdaooSGozfl/3a6/xJcbzPRhE=
-golang.org/x/text v0.38.0/go.mod h1:YXZt3QhHUKYT53r2lLKFIVi6Ao1jdzrTR/KQ09qyxF4=
+golang.org/x/text v0.42.0 h1:JbOZXgfeCPU9gacVtYliJqOhD+zhrEqK4LfdpmlUZqI=
+golang.org/x/text v0.42.0/go.mod h1:ojzP1Z+2QtioaF8DTtO8K5q7JWVVYwZKenzujK0Zd0E=
 golang.org/x/time v0.0.0-20181108054448-85acf8d2951c/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.0.0-20190308202827-9d24e82272b4/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.0.0-20191024005414-555d28b269f0/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
-golang.org/x/time v0.15.0 h1:bbrp8t3bGUeFOx08pvsMYRTCVSMk89u4tKbNOZbp88U=
-golang.org/x/time v0.15.0/go.mod h1:Y4YMaQmXwGQZoFaVFk4YpCt4FLQMYKZe9oeV/f4MSno=
+golang.org/x/time v0.16.0 h1:vMb6ptszcQMkcwiRTAuNNU50gom6++Q/6gY2hDM6VDE=
+golang.org/x/time v0.16.0/go.mod h1:rVKOqvZeKvrDKTQiAHJ7wmwP0RzleSphoEA9RcdLA0s=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20190114222345-bf090417da8b/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20190226205152-f727befe758c/go.mod h1:9Yl7xja0Znq3iFh3HoIrodX9oNMXvdceNzlUR8zjMvY=
@@ -1314,8 +1318,8 @@ golang.org/x/tools v0.1.3/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk=
 golang.org/x/tools v0.1.4/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk=
 golang.org/x/tools v0.1.5/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk=
 golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc=
-golang.org/x/tools v0.46.0 h1:7jTurBkPZu4moS/Uy4OQT1M+QBlsj3wejyZwsT8Z7rk=
-golang.org/x/tools v0.46.0/go.mod h1:FrD85F8l+NWL+9XWBSyVSHO6Ne4jutsfIFba7AWQ5Ys=
+golang.org/x/tools v0.50.0 h1:c2ifzfcuY7L90lZ2aKd8S4K2NpASF08SZx9ZuJkHmSU=
+golang.org/x/tools v0.50.0/go.mod h1:7ulVMw3831Mwi5EZD6RomGyffr4VFjuNYXf2BbCEAV0=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
@@ -1356,8 +1360,8 @@ google.golang.org/api v0.57.0/go.mod h1:dVPlbZyBo2/OjBpmvNdpn2GRm6rPy75jyU7bmhdr
 google.golang.org/api v0.59.0/go.mod h1:sT2boj7M9YJxZzgeZqXogmhfmRWDtPzT31xkieUbuZU=
 google.golang.org/api v0.61.0/go.mod h1:xQRti5UdCmoCEqFxcz93fTl338AVqDgyaDRuOZ3hg9I=
 google.golang.org/api v0.62.0/go.mod h1:dKmwPCydfsad4qCH08MSdgWjfHOyfpd4VtDGgRFdavw=
-google.golang.org/api v0.271.0 h1:cIPN4qcUc61jlh7oXu6pwOQqbJW2GqYh5PS6rB2C/JY=
-google.golang.org/api v0.271.0/go.mod h1:CGT29bhwkbF+i11qkRUJb2KMKqcJ1hdFceEIRd9u64Q=
+google.golang.org/api v0.294.0 h1:8gASjJxdtcIieB3OqbkLcF0FfbXVNqKtU5iozD1ssvA=
+google.golang.org/api v0.294.0/go.mod h1:02qB8+Ox1ZFzcaKFMguy1nQLJmSIyvV6Ff4txJEXtl4=
 google.golang.org/appengine v1.1.0/go.mod h1:EbEs0AVv82hx2wNQdGPgUI5lhzA/G0D9YwlJXL52JkM=
 google.golang.org/appengine v1.4.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4=
 google.golang.org/appengine v1.5.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4=
@@ -1428,12 +1432,12 @@ google.golang.org/genproto v0.0.0-20211129164237-f09f9a12af12/go.mod h1:5CzLGKJ6
 google.golang.org/genproto v0.0.0-20211203200212-54befc351ae9/go.mod h1:5CzLGKJ67TSI2B9POpiiyGha0AjJvZIUgRMt1dSmuhc=
 google.golang.org/genproto v0.0.0-20211206160659-862468c7d6e0/go.mod h1:5CzLGKJ67TSI2B9POpiiyGha0AjJvZIUgRMt1dSmuhc=
 google.golang.org/genproto v0.0.0-20211208223120-3a66f561d7aa/go.mod h1:5CzLGKJ67TSI2B9POpiiyGha0AjJvZIUgRMt1dSmuhc=
-google.golang.org/genproto v0.0.0-20260128011058-8636f8732409 h1:VQZ/yAbAtjkHgH80teYd2em3xtIkkHd7ZhqfH2N9CsM=
-google.golang.org/genproto v0.0.0-20260128011058-8636f8732409/go.mod h1:rxKD3IEILWEu3P44seeNOAwZN4SaoKaQ/2eTg4mM6EM=
-google.golang.org/genproto/googleapis/api v0.0.0-20260401024825-9d38bb4040a9 h1:VPWxll4HlMw1Vs/qXtN7BvhZqsS9cdAittCNvVENElA=
-google.golang.org/genproto/googleapis/api v0.0.0-20260401024825-9d38bb4040a9/go.mod h1:7QBABkRtR8z+TEnmXTqIqwJLlzrZKVfAUm7tY3yGv0M=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20260406210006-6f92a3bedf2d h1:wT2n40TBqFY6wiwazVK9/iTWbsQrgk5ZfCSVFLO9LQA=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20260406210006-6f92a3bedf2d/go.mod h1:4Hqkh8ycfw05ld/3BWL7rJOSfebL2Q+DVDeRgYgxUU8=
+google.golang.org/genproto v0.0.0-20260715232425-e75dac1f907d h1:C9v1o0/4quuhOAfmRXA2j+we0PqZIp8traLdeogF3Ms=
+google.golang.org/genproto v0.0.0-20260715232425-e75dac1f907d/go.mod h1:Wz2wFJntZFmLGo7pLDXZ3wYk5hyc0Mb+SkHhDDXT+lU=
+google.golang.org/genproto/googleapis/api v0.0.0-20260715232425-e75dac1f907d h1:QwnJwPte4XXAkhPu26LTDIahnsMSUV0kK8HkxbC+Pc4=
+google.golang.org/genproto/googleapis/api v0.0.0-20260715232425-e75dac1f907d/go.mod h1:WRrQ7/7N19PypuT0fxLOL5Lq0waoiRri4FbtHDEKrGE=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20260819154853-08b0e4226688 h1:cYNAzI2sUwhmCcoj9TxvihSrqsxt6uIkj3rDRhSDmW4=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20260819154853-08b0e4226688/go.mod h1:DjtHYE8FKJLivXcBEjGwndXfIC23G0VpXiXKqG179uA=
 google.golang.org/grpc v1.19.0/go.mod h1:mqu4LbDTu4XGKhr4mRzUsmM4RtVoemTSY81AxZiDr8c=
 google.golang.org/grpc v1.20.1/go.mod h1:10oTOabMzJvdu6/UiuZezV6QK5dSlG84ov/aaiqXj38=
 google.golang.org/grpc v1.21.1/go.mod h1:oYelfM1adQP15Ek0mdvEgi9Df8B9CZIaU1084ijfRaM=
@@ -1461,8 +1465,8 @@ google.golang.org/grpc v1.39.1/go.mod h1:PImNr+rS9TWYb2O4/emRugxiyHZ5JyHW5F+RPnD
 google.golang.org/grpc v1.40.0/go.mod h1:ogyxbiOoUXAkP+4+xa6PZSE9DZgIHtSpzjDTB9KAK34=
 google.golang.org/grpc v1.40.1/go.mod h1:ogyxbiOoUXAkP+4+xa6PZSE9DZgIHtSpzjDTB9KAK34=
 google.golang.org/grpc v1.42.0/go.mod h1:k+4IHHFw41K8+bbowsex27ge2rCb65oeWqe4jJ590SU=
-google.golang.org/grpc v1.80.0 h1:Xr6m2WmWZLETvUNvIUmeD5OAagMw3FiKmMlTdViWsHM=
-google.golang.org/grpc v1.80.0/go.mod h1:ho/dLnxwi3EDJA4Zghp7k2Ec1+c2jqup0bFkw07bwF4=
+google.golang.org/grpc v1.83.2 h1:EManeRomTObA0BU7I8vXgg/78uE5MJ9M8B39EX2WscU=
+google.golang.org/grpc v1.83.2/go.mod h1:YPI1hK3kDked6iHvgX3tR0y+nX/qpMFKhPgFsokw1S8=
 google.golang.org/grpc/cmd/protoc-gen-go-grpc v1.1.0/go.mod h1:6Kw0yEErY5E/yWrBtf03jp27GLLJujG4z/JK95pnjjw=
 google.golang.org/protobuf v0.0.0-20200109180630-ec00e32a8dfd/go.mod h1:DFci5gLYBciE7Vtevhsrf46CRTquxDuWsQurQQe4oz8=
 google.golang.org/protobuf v0.0.0-20200221191635-4d8936d0db64/go.mod h1:kwYJMbMJ01Woi6D6+Kah6886xMZcty6N08ah7+eCXa0=
@@ -1477,8 +1481,8 @@ google.golang.org/protobuf v1.25.0/go.mod h1:9JNX74DMeImyA3h4bdi1ymwjUzf21/xIlba
 google.golang.org/protobuf v1.26.0-rc.1/go.mod h1:jlhhOSvTdKEhbULTjvd4ARK9grFBp09yW+WbY/TyQbw=
 google.golang.org/protobuf v1.26.0/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc=
 google.golang.org/protobuf v1.27.1/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc=
-google.golang.org/protobuf v1.36.12-0.20260120151049-f2248ac996af h1:+5/Sw3GsDNlEmu7TfklWKPdQ0Ykja5VEmq2i817+jbI=
-google.golang.org/protobuf v1.36.12-0.20260120151049-f2248ac996af/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco=
+google.golang.org/protobuf v1.36.12 h1:pJOKDDOyeXErUroCihFAd5LQuwXBSpVnKGrj5o/fwxc=
+google.golang.org/protobuf v1.36.12/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco=
 gopkg.in/alecthomas/kingpin.v2 v2.2.6/go.mod h1:FMv+mEhP44yOT+4EoQTLFTRgOQ1FBLkstjWtayDeSgw=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20180628173108-788fd7840127/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
@@ -1489,6 +1493,7 @@ gopkg.in/errgo.v2 v2.1.0/go.mod h1:hNsd1EY+bozCKY1Ytp96fpM3vjJbqLJn88ws8XvfDNI=
 gopkg.in/ini.v1 v1.66.2/go.mod h1:pNLf8WUiyNEtQjuu5G5vTm06TEv9tsIgeAvK8hOrP4k=
 gopkg.in/warnings.v0 v0.1.2 h1:wFXVbFY8DY5/xOe1ECiWdKCzZlxgshcYVNkBHstARME=
 gopkg.in/warnings.v0 v0.1.2/go.mod h1:jksf8JmL6Qr/oQM2OXTHunEvvTAsrWBLb6OOjuVWRNI=
+gopkg.in/yaml.v1 v1.0.0-20140924161607-9f9df34309c0/go.mod h1:WDnlLJ4WF5VGsH/HVa3CI79GS0ol3YnhVnKP89i0kNg=
 gopkg.in/yaml.v2 v2.2.1/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v2 v2.2.3/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
@@ -1509,30 +1514,32 @@ honnef.co/go/tools v0.0.0-20190523083050-ea95bdfd59fc/go.mod h1:rf3lG4BRIbNafJWh
 honnef.co/go/tools v0.0.1-2019.2.3/go.mod h1:a3bituU0lyd329TUQxRnasdCoJDkEUEAqEt0JzvZhAg=
 honnef.co/go/tools v0.0.1-2020.1.3/go.mod h1:X/FiERA/W4tHapMX5mGpAtMSVEeEUOyHaw9vFzvIQ3k=
 honnef.co/go/tools v0.0.1-2020.1.4/go.mod h1:X/FiERA/W4tHapMX5mGpAtMSVEeEUOyHaw9vFzvIQ3k=
-modernc.org/cc/v4 v4.28.2 h1:3tQ0lf2ADtoby2EtSP+J7IE2SHwEJdP8ioR59wx7XpY=
-modernc.org/cc/v4 v4.28.2/go.mod h1:OnovgIhbbMXMu1aISnJ0wvVD1KnW+cAUJkIrAWh+kVI=
-modernc.org/ccgo/v4 v4.34.0 h1:yRLPFZieg532OT4rp4JFNIVcquwalMX26G95WQDqwCQ=
-modernc.org/ccgo/v4 v4.34.0/go.mod h1:AS5WYMyBakQ+fhsHhtP8mWB82KTGPkNNJDGfGQCe0/A=
+howett.net/plist v1.0.1 h1:37GdZ8tP09Q35o9ych3ehygcsL+HqKSwzctveSlarvM=
+howett.net/plist v1.0.1/go.mod h1:lqaXoTrLY4hg8tnEzNru53gicrbv7rrk+2xJA/7hw9g=
+modernc.org/cc/v4 v4.29.2 h1:h6+9ciCnPKutf4I03CvheAvDLX7+IHlqR6Iy6J+cgd8=
+modernc.org/cc/v4 v4.29.2/go.mod h1:OnovgIhbbMXMu1aISnJ0wvVD1KnW+cAUJkIrAWh+kVI=
+modernc.org/ccgo/v4 v4.35.0 h1:F+TUsmw09QxLzmi3aeYYGxjAXarmZaKgj3mKQHNaA8w=
+modernc.org/ccgo/v4 v4.35.0/go.mod h1:qrVGs9S3Sr2Ztcg9ve+kTAYMp5a3YvWjo+SoN06kJ5I=
 modernc.org/fileutil v1.4.0 h1:j6ZzNTftVS054gi281TyLjHPp6CPHr2KCxEXjEbD6SM=
 modernc.org/fileutil v1.4.0/go.mod h1:EqdKFDxiByqxLk8ozOxObDSfcVOv/54xDs/DUHdvCUU=
 modernc.org/gc/v2 v2.6.5 h1:nyqdV8q46KvTpZlsw66kWqwXRHdjIlJOhG6kxiV/9xI=
 modernc.org/gc/v2 v2.6.5/go.mod h1:YgIahr1ypgfe7chRuJi2gD7DBQiKSLMPgBQe9oIiito=
-modernc.org/gc/v3 v3.1.2 h1:ZtDCnhonXSZexk/AYsegNRV1lJGgaNZJuKjJSWKyEqo=
-modernc.org/gc/v3 v3.1.2/go.mod h1:HFK/6AGESC7Ex+EZJhJ2Gni6cTaYpSMmU/cT9RmlfYY=
+modernc.org/gc/v3 v3.1.5 h1:21ldfPfRYE31Tb7B3mwAK8gy1AxP4+dKjrOQPfqakoc=
+modernc.org/gc/v3 v3.1.5/go.mod h1:HFK/6AGESC7Ex+EZJhJ2Gni6cTaYpSMmU/cT9RmlfYY=
 modernc.org/goabi0 v0.2.0 h1:HvEowk7LxcPd0eq6mVOAEMai46V+i7Jrj13t4AzuNks=
 modernc.org/goabi0 v0.2.0/go.mod h1:CEFRnnJhKvWT1c1JTI3Avm+tgOWbkOu5oPA8eH8LnMI=
-modernc.org/libc v1.72.3 h1:ZnDF4tXn4NBXFutMMQC4vtbTFSXhhKzR73fv0beZEAU=
-modernc.org/libc v1.72.3/go.mod h1:dn0dZNnnn1clLyvRxLxYExxiKRZIRENOfqQ8XEeg4Qs=
+modernc.org/libc v1.75.7 h1:o3DTP9/0p9pKmY2WCKQaySW6wIiZhNM7wc2lUoyhfew=
+modernc.org/libc v1.75.7/go.mod h1:bO5o2ztHxBb2rjz0PgdHN0sSMw57CgxGFLZ3Qd/QpVQ=
 modernc.org/mathutil v1.7.1 h1:GCZVGXdaN8gTqB1Mf/usp1Y/hSqgI2vAGGP4jZMCxOU=
 modernc.org/mathutil v1.7.1/go.mod h1:4p5IwJITfppl0G4sUEDtCr4DthTaT47/N3aT6MhfgJg=
-modernc.org/memory v1.11.0 h1:o4QC8aMQzmcwCK3t3Ux/ZHmwFPzE6hf2Y5LbkRs+hbI=
-modernc.org/memory v1.11.0/go.mod h1:/JP4VbVC+K5sU2wZi9bHoq2MAkCnrt2r98UGeSK7Mjw=
+modernc.org/memory v1.12.1 h1:nFMiWrpStgZczNl6XI9GnIk/rWhYIyHGUaR04pGbp9g=
+modernc.org/memory v1.12.1/go.mod h1:/JP4VbVC+K5sU2wZi9bHoq2MAkCnrt2r98UGeSK7Mjw=
 modernc.org/opt v0.2.0 h1:tGyef5ApycA7FSEOMraay9SaTk5zmbx7Tu+cJs4QKZg=
 modernc.org/opt v0.2.0/go.mod h1:03fq9lsNfvkYSfxrfUhZCWPk1lm4cq4N+Bh//bEtgns=
 modernc.org/sortutil v1.2.1 h1:+xyoGf15mM3NMlPDnFqrteY07klSFxLElE2PVuWIJ7w=
 modernc.org/sortutil v1.2.1/go.mod h1:7ZI3a3REbai7gzCLcotuw9AC4VZVpYMjDzETGsSMqJE=
-modernc.org/sqlite v1.51.0 h1:aH/MMSoayAIhozZ7uJbVTT9QO/VhzBf0J9tymmmuC/U=
-modernc.org/sqlite v1.51.0/go.mod h1:tcNzv5p84E0skkmJn038y+hWJbLQXQqEnQfeh5r2JLM=
+modernc.org/sqlite v1.59.0 h1:X1es1GpqBlS/5T+vbM4HLUdaa8OtQx468DF2vrx+38A=
+modernc.org/sqlite v1.59.0/go.mod h1:+paeT2A3iPRHkQDwG7oA6Tk0zQd5woMEI8q7orfry8k=
 modernc.org/strutil v1.2.1 h1:UneZBkQA+DX2Rp35KcM69cSsNES9ly8mQWD71HKlOA0=
 modernc.org/strutil v1.2.1/go.mod h1:EHkiggD70koQxjVdSBM3JKM7k6L0FbGE5eymy9i3B9A=
 modernc.org/token v1.1.0 h1:Xl7Ap9dKaEs5kLoOQeQmPWevfnk/DM5qcLcYlA8ys6Y=
@@ -35,7 +35,8 @@ is_command() (
 )

 echo_stderr() (
-  echo "$@" 1>&2
+  IFS=" "
+  printf "%b\n" "$*" 1>&2
 )

 _logp=2
@@ -75,12 +76,12 @@ init_colors

 log_tag() (
  case $1 in
-    0) echo "${RED}${BOLD}[error]${RESET}" ;;
-    1) echo "${RED}[warn]${RESET}" ;;
-    2) echo "[info]${RESET}" ;;
-    3) echo "${BLUE}[debug]${RESET}" ;;
-    4) echo "${PURPLE}[trace]${RESET}" ;;
-    *) echo "[$1]" ;;
+    0) printf "%b" "${RED}${BOLD}[error]${RESET}" ;;
+    1) printf "%b" "${RED}[warn]${RESET}" ;;
+    2) printf "%b" "[info]${RESET}" ;;
+    3) printf "%b" "${BLUE}[debug]${RESET}" ;;
+    4) printf "%b" "${PURPLE}[trace]${RESET}" ;;
+    *) printf "[%s]" "$1" ;;
  esac
 )

@@ -2,6 +2,8 @@
 # This file is partially auto-generated. Run 'go generate ./internal/capabilities' to regenerate.

 application: # AUTO-GENERATED - application-level config keys
+  - key: cpp.vcpkg-allow-git-clone
+    description: enables Syft to use clone remote repositories for vcpkg custom git registries. (also useful if the builtin vcpkg registry is not cloned locally)
  - key: dotnet.dep-packages-must-claim-dll
    description: only keep dep.json packages which have a runtime/resource DLL claimed in the deps.json targets section (but not necessarily found on disk). The package is also included if any child package claims a DLL, even if the package itself does not claim a DLL.
  - key: dotnet.dep-packages-must-have-dll
@@ -12,6 +14,10 @@ application: # AUTO-GENERATED - application-level config keys
    description: treat DLL claims or on-disk evidence for child packages as DLL claims or on-disk evidence for any parent package
  - key: dotnet.relax-dll-claims-when-bundling-detected
    description: show all packages from the deps.json if bundling tooling is present as a dependency (e.g. ILRepack)
+  - key: golang.capture-symbols
+    description: 'capture function symbols from the binary symbol table (pclntab). valid values are: "none" (disabled), "stdlib" (only the synthetic stdlib package), "extended-stdlib" (stdlib plus every module under golang.org/x/), and "all" (all module packages plus stdlib)'
+  - key: golang.capture-symbols-modules
+    description: glob patterns matched against go module paths (e.g. github.com/klauspost/**) that should have symbols captured in addition to whatever capture-symbols selects. ** crosses path separators, * does not. a trailing major version suffix is ignored when matching, so github.com/foo/* covers github.com/foo/bar/v2; spelling a suffix out in the pattern selects only that major version. this can only widen the selection, never narrow it, and is inert when capture-symbols is none
  - key: golang.local-mod-cache-dir
    description: specify an explicit go mod cache directory, if unset this defaults to $GOPATH/pkg/mod or $HOME/go/pkg/mod
  - key: golang.local-vendor-dir
@@ -9,7 +9,7 @@ import (
 	"sort"

 	"github.com/scylladb/go-set/strset"
-	"gopkg.in/yaml.v3"
+	"go.yaml.in/yaml/v3"

 	"github.com/anchore/syft/internal/task"
 )
@@ -1,4 +1,4 @@
-// this file handles YAML file reading and writing with comment preservation, using gopkg.in/yaml.v3's node tree to maintain all existing comments during regeneration.
+// this file handles YAML file reading and writing with comment preservation, using go.yaml.in/yaml/v3's node tree to maintain all existing comments during regeneration.
 package main

 import (
@@ -6,7 +6,7 @@ import (
 	"os"
 	"regexp"

-	"gopkg.in/yaml.v3"
+	"go.yaml.in/yaml/v3"

 	"github.com/anchore/syft/internal/capabilities"
 	"github.com/anchore/syft/internal/capabilities/internal"
@@ -4,7 +4,7 @@ import (
 	"testing"

 	"github.com/stretchr/testify/require"
-	"gopkg.in/yaml.v3"
+	"go.yaml.in/yaml/v3"
 )

 func TestFindFieldValue(t *testing.T) {
@@ -5,7 +5,7 @@ import (
 	"os"
 	"path/filepath"

-	"gopkg.in/yaml.v3"
+	"go.yaml.in/yaml/v3"

 	"github.com/anchore/syft/internal/capabilities"
 )
@@ -5,7 +5,7 @@ import (

 	"github.com/google/go-cmp/cmp"
 	"github.com/stretchr/testify/require"
-	"gopkg.in/yaml.v3"
+	"go.yaml.in/yaml/v3"
 )

 func TestConfigSchemaExtensions(t *testing.T) {
@@ -3,7 +3,7 @@ package internal
 const (
 	// JSONSchemaVersion is the current schema version output by the JSON encoder
 	// This is roughly following the "SchemaVer" guidelines for versioning the JSON schema. Please see schema/json/README.md for details on how to increment.
-	JSONSchemaVersion = "16.1.5"
+	JSONSchemaVersion = "16.1.10"

 	// Changelog
 	// 16.1.0 - reformulated the python pdm fields (added "URL" and removed the unused "path" field).
@@ -12,5 +12,9 @@ const (
 	// 16.1.3 - add GGUFFileParts to GGUFFileHeader metadata
 	// 16.1.4 - add BunLockEntry metadata type for bun.lock support
 	// 16.1.5 - add DenoLockEntry and DenoRemoteLockEntry metadata types for deno.lock support
-
+	// 16.1.6 - add Dependencies to ElixirMixLockEntry metadata
+	// 16.1.7 - add AppleAppBundleEntry metadata type for the apple app bundle cataloger
+	// 16.1.8 - add VcpkgManifest metadata type for vcpkg manifest support
+	// 16.1.9 - add Symbols (grouped by owning package import path) to GolangBinaryBuildinfoEntry metadata
+	// 16.1.10 - add SafeTensorsModelInfo metadata type for the safetensors AI model cataloger
 )
@@ -0,0 +1,66 @@
+package file
+
+import "io"
+
+// ReaderSize reports the number of bytes behind r. The bool is false when that cannot be determined, and
+// callers must branch on it rather than treating the zero as a size.
+//
+// Binary parsers read sizes out of the files they are parsing and allocate against them. Those sizes are
+// 32- and 64-bit fields under the control of whoever produced the file, so a truncated or hostile input
+// can declare gigabytes that are not there. The read would fail afterwards either way; what matters is
+// refusing before the allocation, and that needs a real byte count to weigh the claim against.
+//
+// The bool is the whole point of the signature. An earlier version returned 0 for every failure mode, and
+// a caller that forgot to special-case it got a bound of "nothing is allowed" or, more often, silently
+// fell back to an unbounded path. Making the caller name the failure keeps that from happening by
+// omission.
+//
+// Both *bytes.Reader and *io.SectionReader answer directly. A file handle only has Seek, so fall back to
+// a save-and-restore seek, which leaves the caller's cursor where it found it. That fallback is not
+// atomic: it moves the cursor and puts it back, so a reader being read concurrently can observe the
+// intermediate position.
+//
+// Neither answer is taken on faith, because a reader can report a length it cannot deliver: an
+// *io.SectionReader answers with the length it was constructed with, and debug/elf and friends construct
+// theirs with a nominal one, so io.NewSectionReader(r, 0, 1<<63-1) would otherwise report a bound that
+// permits everything as if it had been measured. The last byte is read back to confirm the count, which is
+// one ReadAt whatever the size, and the read is what the caller was going to weigh anyway.
+//
+// A wrapper that embeds io.ReaderAt as an interface promotes only ReadAt, so it answers no size here
+// however sizable the reader underneath it is. A type meant to be bounded needs to forward Size() itself.
+func ReaderSize(r io.ReaderAt) (int64, bool) {
+	size, ok := reportedSize(r)
+	if !ok {
+		return 0, false
+	}
+	// ReadAt may return io.EOF alongside a full read, so the count is what says the byte is there
+	var last [1]byte
+	if n, _ := r.ReadAt(last[:], size-1); n != len(last) {
+		return 0, false
+	}
+	return size, true
+}
+
+// reportedSize is what the reader says about itself, before ReaderSize checks whether it can back it up.
+func reportedSize(r io.ReaderAt) (int64, bool) {
+	if sr, ok := r.(interface{ Size() int64 }); ok {
+		size := sr.Size()
+		return size, size > 0
+	}
+	s, ok := r.(io.Seeker)
+	if !ok {
+		return 0, false
+	}
+	cur, err := s.Seek(0, io.SeekCurrent)
+	if err != nil {
+		return 0, false
+	}
+	size, err := s.Seek(0, io.SeekEnd)
+	if err != nil {
+		return 0, false
+	}
+	if _, err := s.Seek(cur, io.SeekStart); err != nil {
+		return 0, false
+	}
+	return size, size > 0
+}
@@ -0,0 +1,140 @@
+package file
+
+import (
+	"bytes"
+	"io"
+	"os"
+	"path/filepath"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestReaderSize(t *testing.T) {
+	tests := []struct {
+		name   string
+		r      io.ReaderAt
+		want   int64
+		wantOK bool
+	}{
+		{
+			name:   "bytes.Reader answers directly",
+			r:      bytes.NewReader(make([]byte, 1234)),
+			want:   1234,
+			wantOK: true,
+		},
+		{
+			// an empty reader is not a size to bound against, so it reports not-ok along with everything
+			// else that cannot be measured
+			name: "empty bytes.Reader",
+			r:    bytes.NewReader(nil),
+			want: 0,
+		},
+		{
+			name:   "SectionReader over a real length",
+			r:      io.NewSectionReader(bytes.NewReader(make([]byte, 500)), 100, 300),
+			want:   300,
+			wantOK: true,
+		},
+		{
+			name:   "seek-only reader falls back to seeking",
+			r:      seekOnly{bytes.NewReader(make([]byte, 4096))},
+			want:   4096,
+			wantOK: true,
+		},
+		{
+			name: "reader with neither Size nor Seek cannot be measured",
+			r:    readAtOnly{bytes.NewReader(make([]byte, 4096))},
+			want: 0,
+		},
+		{
+			// the shape debug/elf, debug/pe and debug/macho build internally. Taking this at its word hands
+			// back a bound that permits everything, reported as if it had been measured.
+			name: "SectionReader over a nominal length reports what it can deliver",
+			r:    io.NewSectionReader(bytes.NewReader(make([]byte, 500)), 0, 1<<63-1),
+			want: 0,
+		},
+		{
+			// a Size() a type simply got wrong is the same failure: the bytes are what decides
+			name: "a size the reader cannot back up is refused",
+			r:    overstatedSize{ReaderAt: bytes.NewReader(make([]byte, 10)), size: 1 << 30},
+			want: 0,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			size, ok := ReaderSize(tt.r)
+			assert.Equal(t, tt.want, size)
+			assert.Equal(t, tt.wantOK, ok)
+		})
+	}
+}
+
+func TestReaderSize_FileHandle(t *testing.T) {
+	path := filepath.Join(t.TempDir(), "f.bin")
+	require.NoError(t, os.WriteFile(path, make([]byte, 7777), 0o600))
+	f, err := os.Open(path)
+	require.NoError(t, err)
+	defer f.Close()
+
+	// the cursor has to come back where it was found: the caller may be mid-read, and an *os.File is the
+	// one input here that carries a shared position
+	_, err = f.Seek(101, io.SeekStart)
+	require.NoError(t, err)
+
+	size, ok := ReaderSize(f)
+	assert.True(t, ok)
+	assert.Equal(t, int64(7777), size)
+
+	at, err := f.Seek(0, io.SeekCurrent)
+	require.NoError(t, err)
+	assert.Equal(t, int64(101), at, "measuring the file must not move the caller's cursor")
+}
+
+// TestReaderSize_WrapperMustForwardSize pins the shape that made every bound expressed against this
+// helper go silently inert. A type that embeds io.ReaderAt as an interface promotes only ReadAt, so it
+// answers 0 here however sizable the reader underneath is, and a caller that treats 0 as "fall back to
+// unbounded" then stops bounding anything. Forwarding Size() is what fixes it, and this is the assertion
+// that a new wrapper has to satisfy.
+func TestReaderSize_WrapperMustForwardSize(t *testing.T) {
+	inner := bytes.NewReader(make([]byte, 2048))
+
+	size, ok := ReaderSize(embedsReaderAt{inner})
+	assert.False(t, ok, "a wrapper that only embeds the interface cannot be measured")
+	assert.Equal(t, int64(0), size)
+
+	size, ok = ReaderSize(forwardsSize{inner})
+	assert.True(t, ok, "a wrapper meant to be bounded has to forward Size itself")
+	assert.Equal(t, int64(2048), size)
+}
+
+type seekOnly struct{ inner *bytes.Reader }
+
+func (s seekOnly) ReadAt(p []byte, off int64) (int, error) { return s.inner.ReadAt(p, off) }
+func (s seekOnly) Seek(off int64, whence int) (int64, error) {
+	return s.inner.Seek(off, whence)
+}
+
+type readAtOnly struct{ inner *bytes.Reader }
+
+func (r readAtOnly) ReadAt(p []byte, off int64) (int, error) { return r.inner.ReadAt(p, off) }
+
+type embedsReaderAt struct{ io.ReaderAt }
+
+type forwardsSize struct{ io.ReaderAt }
+
+func (f forwardsSize) Size() int64 {
+	size, _ := ReaderSize(f.ReaderAt)
+	return size
+}
+
+// overstatedSize answers with a size larger than the bytes behind it, the way a wrapper that returns a
+// declared length rather than a measured one would.
+type overstatedSize struct {
+	io.ReaderAt
+	size int64
+}
+
+func (o overstatedSize) Size() int64 { return o.size }
@@ -0,0 +1,19 @@
+package internal
+
+import (
+	"bufio"
+	"io"
+)
+
+// maxScannedLineSize is the longest line NewLineScanner will return before Scan stops with bufio.ErrTooLong.
+// The buffer only grows to this size when a line needs it.
+const maxScannedLineSize = 1024 * 1024
+
+// NewLineScanner returns a bufio.Scanner that accepts lines up to 1MB rather than the 64KB default, since
+// package metadata files carry long single-line fields (descriptions, license text, dependency lists). Callers
+// must still check Err() after scanning.
+func NewLineScanner(r io.Reader) *bufio.Scanner {
+	s := bufio.NewScanner(r)
+	s.Buffer(nil, maxScannedLineSize)
+	return s
+}
@@ -0,0 +1,24 @@
+package internal
+
+import (
+	"bufio"
+	"strings"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestNewLineScanner(t *testing.T) {
+	long := strings.Repeat("a", 100*1024)
+	s := NewLineScanner(strings.NewReader(long + "\nb\n"))
+	require.True(t, s.Scan())
+	require.Equal(t, long, s.Text())
+	require.True(t, s.Scan())
+	require.Equal(t, "b", s.Text())
+	require.False(t, s.Scan())
+	require.NoError(t, s.Err())
+
+	s = NewLineScanner(strings.NewReader(strings.Repeat("a", maxScannedLineSize+1)))
+	require.False(t, s.Scan())
+	require.ErrorIs(t, s.Err(), bufio.ErrTooLong)
+}
@@ -2,14 +2,18 @@ package os

 import (
 	"context"
+	"encoding/json"
+	"errors"
 	"fmt"
 	"regexp"
+	"slices"

 	"github.com/anchore/syft/internal"
 	"github.com/anchore/syft/internal/log"
 	"github.com/anchore/syft/internal/sbomsync"
 	"github.com/anchore/syft/syft/file"
 	"github.com/anchore/syft/syft/linux"
+	"github.com/anchore/syft/syft/pkg"
 	"github.com/anchore/syft/syft/sbom"
 )

@@ -19,8 +23,11 @@ func DetectFeatures(_ context.Context, resolver file.Resolver, builder sbomsync.
 			return
 		}

-		err := findRhelFeatures(resolver, s.Artifacts.LinuxDistribution)
-		if err != nil {
+		if err := findRhelFeatures(resolver, s.Artifacts.LinuxDistribution); err != nil {
+			log.WithFields("error", err, "release", s.Artifacts.LinuxDistribution).Trace("error searching for extended support")
+		}
+
+		if err := findUbuntuFeatures(resolver, s.Artifacts.LinuxDistribution, s.Artifacts.Packages); err != nil {
 			log.WithFields("error", err, "release", s.Artifacts.LinuxDistribution).Trace("error searching for extended support")
 		}
 	})
@@ -28,6 +35,9 @@ func DetectFeatures(_ context.Context, resolver file.Resolver, builder sbomsync.
 	return nil
 }

+// rhelEUSPatterns match a RHEL content manifest referencing an extended-update-support (EUS) repo.
+var rhelEUSPatterns = []*regexp.Regexp{regexp.MustCompile(`baseos-eus`), regexp.MustCompile(`baseos-eus|appstream-eus`)}
+
 func findRhelFeatures(resolver file.Resolver, release *linux.Release) error {
 	if release == nil || release.ID != "rhel" {
 		return nil
@@ -37,9 +47,9 @@ func findRhelFeatures(resolver file.Resolver, release *linux.Release) error {
 		return fmt.Errorf("unable to find content manifests: %w", err)
 	}
 	for _, contentManifestFile := range contentManifestFiles {
-		found, err := hasRhelExtendedSupportInContentManifest(resolver, contentManifestFile)
+		found, err := fileMatchesAny(resolver, contentManifestFile, rhelEUSPatterns...)
 		if err != nil {
-			return fmt.Errorf("unable to read content manifest from %s: %w", contentManifestFile.String(), err)
+			return fmt.Errorf("unable to read content manifest from %s: %w", contentManifestFile.RealPath, err)
 		}
 		if found {
 			release.ExtendedSupport = true
@@ -49,13 +59,149 @@ func findRhelFeatures(resolver file.Resolver, release *linux.Release) error {
 	return nil
 }

-func hasRhelExtendedSupportInContentManifest(resolver file.Resolver, contentManifestFile file.Location) (bool, error) {
-	contents, err := resolver.FileContentsByLocation(contentManifestFile)
-	if err != nil {
-		return false, fmt.Errorf("unable to read content manifest from %s: %w", contentManifestFile.String(), err)
-	}
-	defer internal.CloseAndLogError(contents, "content-manifest")
+// Ubuntu Pro (formerly Ubuntu Advantage) is Canonical's subscription that unlocks Expanded Security
+// Maintenance (ESM): security fixes past a package's standard support window. we detect the two base ESM
+// streams, esm-infra (the `main` repo) and esm-apps (`universe`), and collapse them into one ExtendedSupport
+// signal; the infra-vs-apps split is disambiguated by the downstream consumer, not by this boolean.
+//
+// the other Pro streams on the same host (esm.ubuntu.com/fips, /fips-updates, /realtime) are deliberately
+// excluded: they are separate compliance products with their own downstream channels, and a host can run
+// them with base ESM disabled, so folding them in would be unsound.
+//
+// detection is deliberately forgiving: apt/status evidence disappears when ESM is disabled, but an installed
+// +esmN package is durable proof ESM content is on disk. so ExtendedSupport means "ESM was or is in effect
+// for this host or its content", not "currently entitled" (mere eligibility, without evidence, is not enough).

-	patterns := []*regexp.Regexp{regexp.MustCompile(`baseos-eus`), regexp.MustCompile(`baseos-eus|appstream-eus`)}
+// esmAptSourcePattern matches an uncommented apt source (classic or DEB822) or auth entry pointing at the
+// plain ESM streams esm.ubuntu.com/infra or /apps. it deliberately scopes to /(infra|apps) so the other
+// Pro streams served from the same host (/fips, /fips-updates, /realtime) are never folded into the base
+// esm channel. the [^#\n]* before the host ensures a leading `#` (comment) can never satisfy the match.
+var esmAptSourcePattern = regexp.MustCompile(`(?m)^[^#\n]*esm\.ubuntu\.com/(infra|apps)`)
+
+// esmVersionPattern matches a dpkg version carrying a numbered ESM pocket suffix, e.g. `...+esm1` or
+// `...~esm2`. the trailing \d scopes this to the ESM pocket and excludes other Pro pockets (e.g. +fips).
+var esmVersionPattern = regexp.MustCompile(`[~+]esm\d`)
+
+func findUbuntuFeatures(resolver file.Resolver, release *linux.Release, packages *pkg.Collection) error {
+	if release == nil || release.ID != "ubuntu" {
+		return nil
+	}
+
+	// an uncommented esm.ubuntu.com apt source or an active pro esm service both prove Pro/ESM was enabled.
+	// these are the durable, file-based signals present on attached hosts. a read error in one signal must
+	// not suppress the others, so errors are collected and detection continues to the next signal.
+	var errs error
+	for _, check := range []func() (bool, error){
+		func() (bool, error) { return hasUbuntuESMAptEvidence(resolver) },
+		func() (bool, error) { return hasActiveUbuntuESMService(resolver) },
+	} {
+		found, err := check()
+		if err != nil {
+			errs = errors.Join(errs, err)
+			continue
+		}
+		if found {
+			release.ExtendedSupport = true
+			return errs
+		}
+	}
+
+	// fallback for images (typically not pro-attached): an installed package whose version carries an
+	// +esm/~esm suffix was pulled from an ESM pocket, so ESM was in effect when it was installed.
+	if hasInstalledESMPackage(packages) {
+		release.ExtendedSupport = true
+	}
+	return errs
+}
+
+// hasUbuntuESMAptEvidence reports whether any apt source (classic .list or DEB822 .sources) or auth entry
+// references esm.ubuntu.com via an uncommented line.
+func hasUbuntuESMAptEvidence(resolver file.Resolver) (bool, error) {
+	// apt source files live in a directory (classic .list or DEB822 .sources), the credentials file is a fixed path.
+	sourceLocations, err := resolver.FilesByGlob("/etc/apt/sources.list.d/*")
+	if err != nil {
+		return false, fmt.Errorf("unable to find apt esm sources: %w", err)
+	}
+	authLocations, err := resolver.FilesByPath("/etc/apt/auth.conf.d/90ubuntu-advantage")
+	if err != nil {
+		return false, fmt.Errorf("unable to find apt esm auth: %w", err)
+	}
+
+	// ponytail: a DEB822 source with `Enabled: no` would still match; the pro client removes/comments the
+	// file on disable rather than toggling that key, so this is an accepted false-positive ceiling. the
+	// auth.conf.d entry is deleted by the pro client on disable, so it is a durable positive-only signal.
+	for _, location := range append(sourceLocations, authLocations...) {
+		match, err := fileMatchesAny(resolver, location, esmAptSourcePattern)
+		if err != nil {
+			return false, err
+		}
+		if match {
+			return true, nil
+		}
+	}
+	return false, nil
+}
+
+// hasActiveUbuntuESMService reports whether the ubuntu-advantage/pro status cache shows an enabled esm service.
+func hasActiveUbuntuESMService(resolver file.Resolver) (bool, error) {
+	locations, err := resolver.FilesByPath("/var/lib/ubuntu-advantage/status.json")
+	if err != nil {
+		return false, fmt.Errorf("unable to find ubuntu-advantage status: %w", err)
+	}
+	for _, location := range locations {
+		enabled, err := hasEnabledESMServiceInStatus(resolver, location)
+		if err != nil {
+			return false, err
+		}
+		if enabled {
+			return true, nil
+		}
+	}
+	return false, nil
+}
+
+func hasEnabledESMServiceInStatus(resolver file.Resolver, location file.Location) (bool, error) {
+	contents, err := resolver.FileContentsByLocation(location)
+	if err != nil {
+		return false, fmt.Errorf("unable to read ubuntu-advantage status from %s: %w", location.RealPath, err)
+	}
+	defer internal.CloseAndLogError(contents, location.RealPath)
+
+	var status struct {
+		Services []struct {
+			Name   string `json:"name"`
+			Status string `json:"status"`
+		} `json:"services"`
+	}
+	if err := json.NewDecoder(contents).Decode(&status); err != nil {
+		return false, fmt.Errorf("unable to parse ubuntu-advantage status from %s: %w", location.RealPath, err)
+	}
+
+	// pro status values are enabled/disabled/n-a/warning/—; only "enabled" proves the stream is active.
+	// warning/expired states are intentionally excluded here and left to the apt-source and installed-package signals.
+	for _, svc := range status.Services {
+		if (svc.Name == "esm-infra" || svc.Name == "esm-apps") && svc.Status == "enabled" {
+			return true, nil
+		}
+	}
+	return false, nil
+}
+
+// hasInstalledESMPackage reports whether any installed dpkg package version carries an ESM pocket suffix.
+func hasInstalledESMPackage(packages *pkg.Collection) bool {
+	if packages == nil {
+		return false
+	}
+	return slices.ContainsFunc(packages.Sorted(pkg.DebPkg), func(p pkg.Package) bool {
+		return esmVersionPattern.MatchString(p.Version)
+	})
+}
+
+func fileMatchesAny(resolver file.Resolver, location file.Location, patterns ...*regexp.Regexp) (bool, error) {
+	contents, err := resolver.FileContentsByLocation(location)
+	if err != nil {
+		return false, fmt.Errorf("unable to read %s: %w", location.RealPath, err)
+	}
+	defer internal.CloseAndLogError(contents, location.RealPath)
 	return internal.MatchAnyFromReader(contents, patterns...)
 }
@@ -2,7 +2,13 @@ package os_test

 import (
 	"context"
+	"io"
+	stdos "os"
+	"path"
+	"path/filepath"
+	"slices"
 	"testing"
+	"time"

 	"github.com/stretchr/testify/require"

@@ -11,7 +17,9 @@ import (
 	"github.com/anchore/syft/internal/sbomsync"
 	"github.com/anchore/syft/internal/task"
 	"github.com/anchore/syft/syft"
+	"github.com/anchore/syft/syft/file"
 	"github.com/anchore/syft/syft/linux"
+	"github.com/anchore/syft/syft/pkg"
 	"github.com/anchore/syft/syft/sbom"
 	"github.com/anchore/syft/syft/source"
 )
@@ -99,3 +107,237 @@ func Test_EnvironmentTask(t *testing.T) {
 		})
 	}
 }
+
+func Test_findUbuntuFeatures(t *testing.T) {
+	tests := []struct {
+		name      string
+		dir       string
+		releaseID string
+		packages  []pkg.Package
+		expected  bool
+	}{
+		{
+			name:      "esm apt source present",
+			dir:       "testdata/ubuntu_esm_apt",
+			releaseID: "ubuntu",
+			expected:  true,
+		},
+		{
+			name:      "esm apt source in DEB822 .sources format",
+			dir:       "testdata/ubuntu_esm_deb822",
+			releaseID: "ubuntu",
+			expected:  true,
+		},
+		{
+			name:      "esm evidence in apt auth.conf.d",
+			dir:       "testdata/ubuntu_esm_authconf",
+			releaseID: "ubuntu",
+			expected:  true,
+		},
+		{
+			name:      "active esm service in ubuntu-advantage status",
+			dir:       "testdata/ubuntu_esm_status",
+			releaseID: "ubuntu",
+			expected:  true,
+		},
+		{
+			name:      "only esm-infra enabled (esm-apps disabled)",
+			dir:       "testdata/ubuntu_esm_infra_only",
+			releaseID: "ubuntu",
+			expected:  true,
+		},
+		{
+			name:      "malformed status.json does not panic or match",
+			dir:       "testdata/ubuntu_esm_malformed",
+			releaseID: "ubuntu",
+			expected:  false,
+		},
+		{
+			name:      "installed +esm package version",
+			dir:       "testdata/ubuntu_plain",
+			releaseID: "ubuntu",
+			packages: []pkg.Package{
+				{Name: "openssl", Version: "1.1.1f-1ubuntu2.19+esm1", Type: pkg.DebPkg},
+			},
+			expected: true,
+		},
+		{
+			name:      "installed ~esm package version",
+			dir:       "testdata/ubuntu_plain",
+			releaseID: "ubuntu",
+			packages: []pkg.Package{
+				{Name: "libcap2", Version: "1:2.32-1ubuntu0.1~esm1", Type: pkg.DebPkg},
+			},
+			expected: true,
+		},
+		{
+			name:      "plain ubuntu with no esm evidence",
+			dir:       "testdata/ubuntu_plain",
+			releaseID: "ubuntu",
+			packages: []pkg.Package{
+				{Name: "openssl", Version: "1.1.1f-1ubuntu2.19", Type: pkg.DebPkg},
+			},
+			expected: false,
+		},
+		{
+			name:      "commented esm source and disabled esm service",
+			dir:       "testdata/ubuntu_esm_disabled",
+			releaseID: "ubuntu",
+			expected:  false,
+		},
+		{
+			name:      "esm disabled but +esm package remains installed",
+			dir:       "testdata/ubuntu_esm_disabled",
+			releaseID: "ubuntu",
+			packages: []pkg.Package{
+				{Name: "openssl", Version: "1.1.1f-1ubuntu2.19+esm1", Type: pkg.DebPkg},
+			},
+			expected: true, // durable proof: ESM content is on disk even though the channel is now off
+		},
+		{
+			name:      "fips-only pro host is not plain esm",
+			dir:       "testdata/ubuntu_fips_only",
+			releaseID: "ubuntu",
+			expected:  false, // esm.ubuntu.com/fips must not be folded into the base esm channel
+		},
+		{
+			name:      "non-ubuntu is unaffected by esm evidence",
+			dir:       "testdata/ubuntu_esm_apt",
+			releaseID: "debian",
+			expected:  false,
+		},
+		{
+			name:      "non-ubuntu is unaffected by esm package version",
+			dir:       "testdata/ubuntu_plain",
+			releaseID: "debian",
+			packages: []pkg.Package{
+				{Name: "openssl", Version: "1.1.1f-1ubuntu2.19+esm1", Type: pkg.DebPkg},
+			},
+			expected: false,
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			resolver := fixtureResolverForDir(t, test.dir)
+
+			s := sbom.SBOM{}
+			s.Artifacts.LinuxDistribution = &linux.Release{ID: test.releaseID}
+			s.Artifacts.Packages = pkg.NewCollection(test.packages...)
+
+			err := os.DetectFeatures(context.Background(), resolver, sbomsync.NewBuilder(&s))
+			require.NoError(t, err)
+
+			require.Equal(t, test.expected, s.Artifacts.LinuxDistribution.ExtendedSupport)
+		})
+	}
+}
+
+// returning early from Collection.Enumerate leaks its goroutine and read lock, so any later write blocks forever.
+func Test_findUbuntuFeatures_releasesPackageCollectionLock(t *testing.T) {
+	resolver := fixtureResolverForDir(t, "testdata/ubuntu_plain")
+
+	s := sbom.SBOM{}
+	s.Artifacts.LinuxDistribution = &linux.Release{ID: "ubuntu"}
+	s.Artifacts.Packages = pkg.NewCollection(
+		pkg.Package{Name: "openssl", Version: "1.1.1f-1ubuntu2.19+esm1", Type: pkg.DebPkg},
+		pkg.Package{Name: "libcap2", Version: "1:2.32-1ubuntu0.1~esm1", Type: pkg.DebPkg},
+	)
+
+	require.NoError(t, os.DetectFeatures(context.Background(), resolver, sbomsync.NewBuilder(&s)))
+	require.True(t, s.Artifacts.LinuxDistribution.ExtendedSupport)
+
+	added := make(chan struct{})
+	go func() {
+		s.Artifacts.Packages.Add(pkg.Package{Name: "zlib1g", Version: "1:1.2.11.dfsg-2ubuntu1", Type: pkg.DebPkg})
+		close(added)
+	}()
+
+	select {
+	case <-added:
+	case <-time.After(5 * time.Second):
+		t.Fatal("package collection is still read-locked after feature detection")
+	}
+}
+
+// a read error in the apt-source signal must not suppress the ubuntu-advantage status signal; the three
+// signals are meant to be independent fallbacks.
+func Test_findUbuntuFeatures_signalErrorDoesNotSuppressOthers(t *testing.T) {
+	resolver := errOnGlobResolver{
+		fixtureResolver: fixtureResolverForDir(t, "testdata/ubuntu_esm_status").(fixtureResolver),
+		errOnGlob:       "/etc/apt/sources.list.d/*",
+	}
+
+	s := sbom.SBOM{}
+	s.Artifacts.LinuxDistribution = &linux.Release{ID: "ubuntu"}
+	s.Artifacts.Packages = pkg.NewCollection()
+
+	require.NoError(t, os.DetectFeatures(context.Background(), resolver, sbomsync.NewBuilder(&s)))
+
+	// the apt glob errors, but the status.json signal (esm-infra enabled) should still be consulted
+	require.True(t, s.Artifacts.LinuxDistribution.ExtendedSupport)
+}
+
+// errOnGlobResolver injects a failure for a specific glob to simulate an unreadable apt directory.
+type errOnGlobResolver struct {
+	fixtureResolver
+	errOnGlob string
+}
+
+func (r errOnGlobResolver) FilesByGlob(patterns ...string) ([]file.Location, error) {
+	if slices.Contains(patterns, r.errOnGlob) {
+		return nil, stdos.ErrPermission
+	}
+	return r.fixtureResolver.FilesByGlob(patterns...)
+}
+
+// fixtureResolver maps in-image logical paths to on-disk fixture files so DetectFeatures can be driven
+// without building a container image.
+type fixtureResolver struct {
+	file.Resolver // unused methods; nil is fine since only the three below are called
+	files         map[string]string
+}
+
+func (r fixtureResolver) FilesByGlob(patterns ...string) ([]file.Location, error) {
+	var out []file.Location
+	for logical := range r.files {
+		for _, p := range patterns {
+			if ok, _ := path.Match(p, logical); ok {
+				out = append(out, file.NewLocation(logical))
+				break
+			}
+		}
+	}
+	return out, nil
+}
+
+func (r fixtureResolver) FilesByPath(paths ...string) ([]file.Location, error) {
+	var out []file.Location
+	for _, p := range paths {
+		if _, ok := r.files[p]; ok {
+			out = append(out, file.NewLocation(p))
+		}
+	}
+	return out, nil
+}
+
+func (r fixtureResolver) FileContentsByLocation(l file.Location) (io.ReadCloser, error) {
+	return stdos.Open(r.files[l.RealPath])
+}
+
+func fixtureResolverForDir(t *testing.T, dir string) file.Resolver {
+	t.Helper()
+	files := map[string]string{}
+	require.NoError(t, filepath.WalkDir(dir, func(p string, d stdos.DirEntry, err error) error {
+		if err != nil || d.IsDir() {
+			return err
+		}
+		rel, err := filepath.Rel(dir, p)
+		if err != nil {
+			return err
+		}
+		files["/"+filepath.ToSlash(rel)] = p
+		return nil
+	}))
+	return fixtureResolver{files: files}
+}
@@ -0,0 +1,6 @@
+# Written by ubuntu-advantage-tools
+deb https://esm.ubuntu.com/infra/ubuntu focal-infra-security main
+# deb-src https://esm.ubuntu.com/infra/ubuntu focal-infra-security main
+
+deb https://esm.ubuntu.com/infra/ubuntu focal-infra-updates main
+# deb-src https://esm.ubuntu.com/infra/ubuntu focal-infra-updates main
@@ -0,0 +1,2 @@
+machine esm.ubuntu.com/infra/ubuntu/ login bearer password DUMMYTOKENREDACTED  # ubuntu-pro-client
+machine esm.ubuntu.com/apps/ubuntu/ login bearer password DUMMYTOKENREDACTED  # ubuntu-pro-client
@@ -0,0 +1,5 @@
+Types: deb
+URIs: https://esm.ubuntu.com/infra/ubuntu
+Suites: noble-infra-security noble-infra-updates
+Components: main
+Signed-By: /usr/share/keyrings/ubuntu-pro-esm-infra-keyring.gpg
@@ -0,0 +1,3 @@
+# Written by ubuntu-advantage-tools
+# deb https://esm.ubuntu.com/infra/ubuntu focal-infra-security main
+# deb-src https://esm.ubuntu.com/infra/ubuntu focal-infra-security main
@@ -0,0 +1,18 @@
+{
+  "_schema_version": "0.1",
+  "attached": true,
+  "services": [
+    {
+      "name": "esm-apps",
+      "available": "yes",
+      "entitled": "yes",
+      "status": "disabled"
+    },
+    {
+      "name": "esm-infra",
+      "available": "yes",
+      "entitled": "yes",
+      "status": "disabled"
+    }
+  ]
+}
@@ -0,0 +1,21 @@
+{
+  "_schema_version": "0.1",
+  "attached": true,
+  "execution_status": "success",
+  "services": [
+    {
+      "name": "esm-apps",
+      "description": "Expanded Security Maintenance for Applications",
+      "available": "yes",
+      "entitled": "yes",
+      "status": "disabled"
+    },
+    {
+      "name": "esm-infra",
+      "description": "Expanded Security Maintenance for Infrastructure",
+      "available": "yes",
+      "entitled": "yes",
+      "status": "enabled"
+    }
+  ]
+}
@@ -0,0 +1 @@
+{ this is not valid json
@@ -0,0 +1,28 @@
+{
+  "_doc": "Content provided in json response is currently considered Experimental and may change",
+  "_schema_version": "0.1",
+  "attached": true,
+  "services": [
+    {
+      "name": "esm-apps",
+      "description": "Expanded Security Maintenance for Applications",
+      "available": "yes",
+      "entitled": "yes",
+      "status": "enabled"
+    },
+    {
+      "name": "esm-infra",
+      "description": "Expanded Security Maintenance for Infrastructure",
+      "available": "yes",
+      "entitled": "yes",
+      "status": "enabled"
+    },
+    {
+      "name": "fips",
+      "description": "NIST-certified FIPS crypto packages",
+      "available": "no",
+      "entitled": "no",
+      "status": "n/a"
+    }
+  ]
+}
@@ -0,0 +1,3 @@
+# Written by ubuntu-pro-client
+deb https://esm.ubuntu.com/fips/ubuntu focal main
+# deb-src https://esm.ubuntu.com/fips/ubuntu focal main
@@ -0,0 +1,28 @@
+{
+  "_schema_version": "0.1",
+  "attached": true,
+  "execution_status": "success",
+  "services": [
+    {
+      "name": "esm-apps",
+      "description": "Expanded Security Maintenance for Applications",
+      "available": "yes",
+      "entitled": "yes",
+      "status": "disabled"
+    },
+    {
+      "name": "esm-infra",
+      "description": "Expanded Security Maintenance for Infrastructure",
+      "available": "yes",
+      "entitled": "yes",
+      "status": "disabled"
+    },
+    {
+      "name": "fips",
+      "description": "NIST-certified FIPS crypto packages",
+      "available": "yes",
+      "entitled": "yes",
+      "status": "enabled"
+    }
+  ]
+}
@@ -0,0 +1,5 @@
+Types: deb
+URIs: http://archive.ubuntu.com/ubuntu/
+Suites: noble noble-updates noble-backports
+Components: main restricted universe multiverse
+Signed-By: /usr/share/keyrings/ubuntu-archive-keyring.gpg
@@ -27,6 +27,7 @@ var knownNonMetadataTypeNames = strset.New(
 var knownMetadataTypeNames = strset.New(
 	"DotnetPortableExecutableEntry",
 	"GGUFFileHeader",
+	"SafeTensorsModelInfo",
 )

 func DiscoverTypeNames() ([]string, error) {
@@ -9,6 +9,7 @@ func AllTypes() []any {
 	return []any{
 		pkg.AlpmDBEntry{},
 		pkg.ApkDBEntry{},
+		pkg.AppleAppBundleEntry{},
 		pkg.BinarySignature{},
 		pkg.BitnamiSBOMEntry{},
 		pkg.BunLockEntry{},
@@ -67,10 +68,12 @@ func AllTypes() []any {
 		pkg.RubyGemspec{},
 		pkg.RustBinaryAuditEntry{},
 		pkg.RustCargoLockEntry{},
+		pkg.SafeTensorsModelInfo{},
 		pkg.SnapEntry{},
 		pkg.SwiftPackageManagerResolvedEntry{},
 		pkg.SwiplPackEntry{},
 		pkg.TerraformLockProviderEntry{},
+		pkg.VcpkgManifest{},
 		pkg.WordpressPluginEntry{},
 		pkg.YarnLockEntry{},
 	}
@@ -124,11 +124,14 @@ var jsonTypes = makeJSONTypes(
 	jsonNames(pkg.SnapEntry{}, "snap-entry"),
 	jsonNames(pkg.WordpressPluginEntry{}, "wordpress-plugin-entry", "WordpressMetadata"),
 	jsonNames(pkg.HomebrewFormula{}, "homebrew-formula"),
+	jsonNames(pkg.AppleAppBundleEntry{}, "apple-app-bundle-entry"),
 	jsonNames(pkg.LuaRocksPackage{}, "luarocks-package"),
 	jsonNames(pkg.TerraformLockProviderEntry{}, "terraform-lock-provider-entry"),
 	jsonNames(pkg.DotnetPackagesLockEntry{}, "dotnet-packages-lock-entry"),
 	jsonNames(pkg.CondaMetaPackage{}, "conda-metadata-entry", "CondaPackageMetadata"),
 	jsonNames(pkg.GGUFFileHeader{}, "gguf-file-header"),
+	jsonNames(pkg.SafeTensorsModelInfo{}, "safetensors-model-info"),
+	jsonNames(pkg.VcpkgManifest{}, "vcpkg-manifest"),
 )

 func expandLegacyNameVariants(names ...string) []string {
@@ -0,0 +1,74 @@
+package packagemetadata
+
+import (
+	"reflect"
+	"strings"
+	"testing"
+)
+
+// untypedFieldAllowlist holds package metadata fields that are allowed to carry untyped (interface) values.
+// Values in these fields come straight from whatever a parser decoded, so they are not shaped by syft
+// and can hold anything an encoder or hasher chokes on. Every entry is part of existing SBOM output and
+// cannot be retyped without breaking it; new entries need a reason and a review.
+var untypedFieldAllowlist = map[string]string{
+	"GGUFFileHeader.RemainingKeyValues": "raw GGUF header key-values; retyping changes the header output and metadataHash",
+}
+
+// TestNoUntypedMetadataFields fails when a package metadata type gains a field typed any, []any,
+// map[string]any (or any other interface) that is not on the allowlist.
+func TestNoUntypedMetadataFields(t *testing.T) {
+	var hits []string
+	for _, ty := range AllTypes() {
+		rt := reflect.TypeOf(ty)
+		collectUntyped(rt, rt.Name(), map[reflect.Type]bool{}, &hits)
+	}
+
+	seen := map[string]bool{}
+	for _, h := range hits {
+		seen[h] = true
+		if _, ok := untypedFieldAllowlist[h]; !ok {
+			t.Errorf("untyped field %s: use a concrete type, or add it to untypedFieldAllowlist with a reason", h)
+		}
+	}
+	for k := range untypedFieldAllowlist {
+		if !seen[k] {
+			t.Errorf("stale untypedFieldAllowlist entry %s: field no longer exists or is now typed", k)
+		}
+	}
+}
+
+// collectUntyped records "Struct.Field" for every field whose type reaches an interface, descending
+// through pointers, slices, arrays, maps and nested syft-owned structs.
+func collectUntyped(rt reflect.Type, path string, visited map[reflect.Type]bool, hits *[]string) {
+	switch rt.Kind() {
+	case reflect.Interface:
+		*hits = append(*hits, path)
+	case reflect.Pointer, reflect.Slice, reflect.Array:
+		collectUntyped(rt.Elem(), path, visited, hits)
+	case reflect.Map:
+		collectUntyped(rt.Key(), path, visited, hits)
+		collectUntyped(rt.Elem(), path, visited, hits)
+	case reflect.Struct:
+		if visited[rt] {
+			return
+		}
+		if rt.Name() != "" && !strings.HasPrefix(rt.PkgPath(), "github.com/anchore/syft/") {
+			// a third-party type in the model carries whatever shape the library gives it (the same leak as an
+			// interface field), so it counts as untyped. The standard library is left alone.
+			if strings.Contains(strings.Split(rt.PkgPath(), "/")[0], ".") {
+				*hits = append(*hits, path)
+			}
+			return
+		}
+		visited[rt] = true
+		for i := 0; i < rt.NumField(); i++ {
+			f := rt.Field(i)
+			// unexported embedded structs still promote their exported fields to the encoders and the hasher. A
+			// field is only out of reach when it is neither encoded nor hashed by SetID.
+			if (!f.IsExported() && !f.Anonymous) || (f.Tag.Get("json") == "-" && f.Tag.Get("hash") == "ignore") {
+				continue
+			}
+			collectUntyped(f.Type, rt.Name()+"."+f.Name, visited, hits)
+		}
+	}
+}
@@ -0,0 +1,7 @@
+package internal
+
+// MaxSafeTensorsHeaderSize caps a safetensors header's JSON (excluding its
+// 8-byte length prefix). Shared by the ai cataloger and the OCI model source so
+// dir and OCI scans accept the same headers. Real-world shard headers are well
+// under 1 MB.
+const MaxSafeTensorsHeaderSize = 8 * 1024 * 1024
@@ -44,6 +44,7 @@ type LicenseInfo struct {
 // LicenseByURL returns the license ID and name for a given URL from the SPDX license list.
 // The URL should match one of the URLs in the seeAlso field of an SPDX license.
 // The scheme (http:// or https://) is stripped before lookup, so both schemes match.
+// opensource.org URLs additionally match regardless of the form used (see normalizeOpenSourceOrgURL).
 func LicenseByURL(url string) (LicenseInfo, bool) {
 	url = strings.TrimSpace(url)
 	url = stripScheme(url)
@@ -52,9 +53,51 @@ func LicenseByURL(url string) (LicenseInfo, bool) {
 			ID: id,
 		}, true
 	}
+	if normalized, ok := normalizeOpenSourceOrgURL(url); ok {
+		if id, exists := openSourceOrgURLToLicense[normalized]; exists {
+			return LicenseInfo{
+				ID: id,
+			}, true
+		}
+	}
 	return LicenseInfo{}, false
 }

+// openSourceOrgURLToLicense indexes the opensource.org entries of urlToLicense by normalized URL.
+var openSourceOrgURLToLicense = buildOpenSourceOrgURLToLicense(urlToLicense)
+
+func buildOpenSourceOrgURLToLicense(urls map[string]string) map[string]string {
+	index := make(map[string]string)
+	ambiguous := make(map[string]bool)
+	for url, id := range urls {
+		normalized, ok := normalizeOpenSourceOrgURL(url)
+		if !ok || ambiguous[normalized] {
+			continue
+		}
+		if existing, exists := index[normalized]; exists && existing != id {
+			// don't guess between licenses that only differ by URL form
+			delete(index, normalized)
+			ambiguous[normalized] = true
+			continue
+		}
+		index[normalized] = id
+	}
+	return index
+}
+
+// normalizeOpenSourceOrgURL reduces a scheme-less opensource.org URL to a canonical form.
+// SPDX has changed these URLs over time (e.g. 3.29.0 replaced opensource.org/licenses/MIT and
+// opensource.org/license/mit/ with opensource.org/license/MIT), while package metadata in the wild
+// still uses the older forms. The www. prefix, /licenses/ vs /license/, case, and trailing slash are ignored.
+func normalizeOpenSourceOrgURL(url string) (string, bool) {
+	url = strings.TrimPrefix(strings.ToLower(url), "www.")
+	if !strings.HasPrefix(url, "opensource.org/") {
+		return "", false
+	}
+	url = strings.Replace(url, "opensource.org/licenses/", "opensource.org/license/", 1)
+	return strings.TrimSuffix(url, "/"), true
+}
+
 // stripScheme removes http:// or https:// prefix from a URL.
 // This allows a single map entry to match both schemes.
 func stripScheme(url string) string {
@@ -2,7 +2,7 @@
 // This file was generated using data from https://spdx.org/licenses/licenses.json
 package spdxlicense

-const Version = "3.28.0"
+const Version = "3.29.0"

 var licenseIDs = map[string]string{
 	"0bsd":                                  "0BSD",
@@ -116,6 +116,7 @@ var licenseIDs = map[string]string{
 	"aswfdigitalassets1.0.0":                "ASWF-Digital-Assets-1.0",
 	"aswfdigitalassets1.1":                  "ASWF-Digital-Assets-1.1",
 	"aswfdigitalassets1.1.0":                "ASWF-Digital-Assets-1.1",
+	"atcgame":                               "atc-game",
 	"baekmuk":                               "Baekmuk",
 	"bahyph":                                "Bahyph",
 	"barr":                                  "Barr",
@@ -142,8 +143,11 @@ var licenseIDs = map[string]string{
 	"briangladman2.0clause":                 "Brian-Gladman-2-Clause",
 	"briangladman2clause":                   "Brian-Gladman-2-Clause",
 	"briangladman3.0.0clause":               "Brian-Gladman-3-Clause",
+	"briangladman3.0.0clausenoconversion":   "Brian-Gladman-3-Clause-no-conversion",
 	"briangladman3.0clause":                 "Brian-Gladman-3-Clause",
+	"briangladman3.0clausenoconversion":     "Brian-Gladman-3-Clause-no-conversion",
 	"briangladman3clause":                   "Brian-Gladman-3-Clause",
+	"briangladman3clausenoconversion":       "Brian-Gladman-3-Clause-no-conversion",
 	"bsd1.0.0clause":                        "BSD-1-Clause",
 	"bsd1.0clause":                          "BSD-1-Clause",
 	"bsd1clause":                            "BSD-1-Clause",
@@ -154,6 +158,7 @@ var licenseIDs = map[string]string{
 	"bsd2.0.0clausenetbsd":                  "BSD-2-Clause",
 	"bsd2.0.0clausepatent":                  "BSD-2-Clause-Patent",
 	"bsd2.0.0clausepkgconfdisclaimer":       "BSD-2-Clause-pkgconf-disclaimer",
+	"bsd2.0.0clauseposunchanged":            "BSD-2-Clause-pos-unchanged",
 	"bsd2.0.0clauseviews":                   "BSD-2-Clause-Views",
 	"bsd2.0clause":                          "BSD-2-Clause",
 	"bsd2.0clausedarwin":                    "BSD-2-Clause-Darwin",
@@ -162,6 +167,7 @@ var licenseIDs = map[string]string{
 	"bsd2.0clausenetbsd":                    "BSD-2-Clause",
 	"bsd2.0clausepatent":                    "BSD-2-Clause-Patent",
 	"bsd2.0clausepkgconfdisclaimer":         "BSD-2-Clause-pkgconf-disclaimer",
+	"bsd2.0clauseposunchanged":              "BSD-2-Clause-pos-unchanged",
 	"bsd2.0clauseviews":                     "BSD-2-Clause-Views",
 	"bsd2clause":                            "BSD-2-Clause",
 	"bsd2clausedarwin":                      "BSD-2-Clause-Darwin",
@@ -170,6 +176,7 @@ var licenseIDs = map[string]string{
 	"bsd2clausenetbsd":                      "BSD-2-Clause",
 	"bsd2clausepatent":                      "BSD-2-Clause-Patent",
 	"bsd2clausepkgconfdisclaimer":           "BSD-2-Clause-pkgconf-disclaimer",
+	"bsd2clauseposunchanged":                "BSD-2-Clause-pos-unchanged",
 	"bsd2clauseviews":                       "BSD-2-Clause-Views",
 	"bsd3.0.0clause":                        "BSD-3-Clause",
 	"bsd3.0.0clauseacpica":                  "BSD-3-Clause-acpica",
@@ -184,6 +191,7 @@ var licenseIDs = map[string]string{
 	"bsd3.0.0clausenonuclearlicense2014":    "BSD-3-Clause-No-Nuclear-License-2014",
 	"bsd3.0.0clausenonuclearwarranty":       "BSD-3-Clause-No-Nuclear-Warranty",
 	"bsd3.0.0clauseopenmpi":                 "BSD-3-Clause-Open-MPI",
+	"bsd3.0.0clauseopenwebui":               "BSD-3-Clause-OpenWebUI",
 	"bsd3.0.0clausesun":                     "BSD-3-Clause-Sun",
 	"bsd3.0.0clausetso":                     "BSD-3-Clause-Tso",
 	"bsd3.0clause":                          "BSD-3-Clause",
@@ -199,6 +207,7 @@ var licenseIDs = map[string]string{
 	"bsd3.0clausenonuclearlicense2014":      "BSD-3-Clause-No-Nuclear-License-2014",
 	"bsd3.0clausenonuclearwarranty":         "BSD-3-Clause-No-Nuclear-Warranty",
 	"bsd3.0clauseopenmpi":                   "BSD-3-Clause-Open-MPI",
+	"bsd3.0clauseopenwebui":                 "BSD-3-Clause-OpenWebUI",
 	"bsd3.0clausesun":                       "BSD-3-Clause-Sun",
 	"bsd3.0clausetso":                       "BSD-3-Clause-Tso",
 	"bsd3clause":                            "BSD-3-Clause",
@@ -214,6 +223,7 @@ var licenseIDs = map[string]string{
 	"bsd3clausenonuclearlicense2014":        "BSD-3-Clause-No-Nuclear-License-2014",
 	"bsd3clausenonuclearwarranty":           "BSD-3-Clause-No-Nuclear-Warranty",
 	"bsd3clauseopenmpi":                     "BSD-3-Clause-Open-MPI",
+	"bsd3clauseopenwebui":                   "BSD-3-Clause-OpenWebUI",
 	"bsd3clausesun":                         "BSD-3-Clause-Sun",
 	"bsd3clausetso":                         "BSD-3-Clause-Tso",
 	"bsd4.0.0clause":                        "BSD-4-Clause",
@@ -232,12 +242,15 @@ var licenseIDs = map[string]string{
 	"bsd4reno":                              "BSD-4.3RENO",
 	"bsd4tahoe":                             "BSD-4.3TAHOE",
 	"bsdadvertisingacknowledgement":         "BSD-Advertising-Acknowledgement",
+	"bsdasktoendorse":                       "BSD-ask-to-endorse",
 	"bsdattributionhpnddisclaimer":          "BSD-Attribution-HPND-disclaimer",
 	"bsdinfernonettverk":                    "BSD-Inferno-Nettverk",
 	"bsdmarkmodifications":                  "BSD-Mark-Modifications",
 	"bsdprotection":                         "BSD-Protection",
+	"bsdsourcealtgpl":                       "BSD-Source-alt-GPL",
 	"bsdsourcebeginningfile":                "BSD-Source-beginning-file",
 	"bsdsourcecode":                         "BSD-Source-Code",
+	"bsdsourcecodenodisclaimer":             "BSD-Source-Code-no-disclaimer",
 	"bsdsystemics":                          "BSD-Systemics",
 	"bsdsystemicsw3.0.0works":               "BSD-Systemics-W3Works",
 	"bsdsystemicsw3.0works":                 "BSD-Systemics-W3Works",
@@ -246,6 +259,7 @@ var licenseIDs = map[string]string{
 	"bsl1.0":                                "BSL-1.0",
 	"bsl1.0.0":                              "BSL-1.0",
 	"buddy":                                 "Buddy",
+	"bugroff":                               "Bugroff",
 	"busl1":                                 "BUSL-1.1",
 	"busl1.1":                               "BUSL-1.1",
 	"busl1.1.0":                             "BUSL-1.1",
@@ -316,8 +330,11 @@ var licenseIDs = map[string]string{
 	"ccbync3.0":                             "CC-BY-NC-3.0",
 	"ccbync3.0.0":                           "CC-BY-NC-3.0",
 	"ccbync3.0.0de":                         "CC-BY-NC-3.0-DE",
+	"ccbync3.0.0igo":                        "CC-BY-NC-3.0-IGO",
 	"ccbync3.0de":                           "CC-BY-NC-3.0-DE",
+	"ccbync3.0igo":                          "CC-BY-NC-3.0-IGO",
 	"ccbync3de":                             "CC-BY-NC-3.0-DE",
+	"ccbync3igo":                            "CC-BY-NC-3.0-IGO",
 	"ccbync4":                               "CC-BY-NC-4.0",
 	"ccbync4.0":                             "CC-BY-NC-4.0",
 	"ccbync4.0.0":                           "CC-BY-NC-4.0",
@@ -592,6 +609,7 @@ var licenseIDs = map[string]string{
 	"fair":                                  "Fair",
 	"fbm":                                   "FBM",
 	"fdkaac":                                "FDK-AAC",
+	"fdkmpegh":                              "FDK-MPEG-H",
 	"fergusontwofish":                       "Ferguson-Twofish",
 	"frameworx1":                            "Frameworx-1.0",
 	"frameworx1.0":                          "Frameworx-1.0",
@@ -767,6 +785,9 @@ var licenseIDs = map[string]string{
 	"hippocratic2":                          "Hippocratic-2.1",
 	"hippocratic2.1":                        "Hippocratic-2.1",
 	"hippocratic2.1.0":                      "Hippocratic-2.1",
+	"hippocratic3.0.0core":                  "Hippocratic-3.0-core",
+	"hippocratic3.0core":                    "Hippocratic-3.0-core",
+	"hippocratic3core":                      "Hippocratic-3.0-core",
 	"hp1986":                                "HP-1986",
 	"hp1986.0":                              "HP-1986",
 	"hp1986.0.0":                            "HP-1986",
@@ -813,6 +834,7 @@ var licenseIDs = map[string]string{
 	"imlib2":                                "Imlib2",
 	"imlib2.0":                              "Imlib2",
 	"imlib2.0.0":                            "Imlib2",
+	"informatica":                           "Informatica",
 	"infozip":                               "Info-ZIP",
 	"innernet2":                             "Inner-Net-2.0",
 	"innernet2.0":                           "Inner-Net-2.0",
@@ -1011,6 +1033,9 @@ var licenseIDs = map[string]string{
 	"mulanpsl2.0.0":                         "MulanPSL-2.0",
 	"multics":                               "Multics",
 	"mup":                                   "Mup",
+	"mvt1":                                  "MVT-1.1",
+	"mvt1.1":                                "MVT-1.1",
+	"mvt1.1.0":                              "MVT-1.1",
 	"naist2003":                             "NAIST-2003",
 	"naist2003.0":                           "NAIST-2003",
 	"naist2003.0.0":                         "NAIST-2003",
@@ -1489,6 +1514,8 @@ var urlToLicense = map[string]string{
 	"cdla.io/permissive-1-0":                                                                                       "CDLA-Permissive-1.0",
 	"cdla.io/sharing-1-0":                                                                                          "CDLA-Sharing-1.0",
 	"celestrak.org/publications/AIAA/2006-6753/faq.php":                                                            "SGP4",
+	"cgit.freebsd.org/src/plain/sys/dev/aic7xxx/aic7xxx_osm.c":                                                     "BSD-Source-alt-GPL",
+	"cgit.freebsd.org/src/tree/usr.bin/sockstat/sockstat.c":                                                        "BSD-2-Clause-pos-unchanged",
 	"cgit.freedesktop.org/libbsd/tree/man/setproctitle.3bsd":                                                       "libutil-David-Nugent",
 	"coil.apotheon.org/plaintext/01.0.txt":                                                                         "COIL-1.0",
 	"core.tcl-lang.org/tk/file?name=compat/unistd.h":                                                               "HPND-UC",
@@ -1512,6 +1539,7 @@ var urlToLicense = map[string]string{
 	"creativecommons.org/licenses/by-nc/2.0/legalcode":                                                             "CC-BY-NC-2.0",
 	"creativecommons.org/licenses/by-nc/2.5/legalcode":                                                             "CC-BY-NC-2.5",
 	"creativecommons.org/licenses/by-nc/3.0/de/legalcode":                                                          "CC-BY-NC-3.0-DE",
+	"creativecommons.org/licenses/by-nc/3.0/igo/legalcode":                                                         "CC-BY-NC-3.0-IGO",
 	"creativecommons.org/licenses/by-nc/3.0/legalcode":                                                             "CC-BY-NC-3.0",
 	"creativecommons.org/licenses/by-nc/4.0/legalcode":                                                             "CC-BY-NC-4.0",
 	"creativecommons.org/licenses/by-nd-nc/1.0/legalcode":                                                          "CC-BY-NC-ND-1.0",
@@ -1564,6 +1592,7 @@ var urlToLicense = map[string]string{
 	"directory.fsf.org/wiki/License:Fdk":                                                                           "FDK-AAC",
 	"doc.qt.io/archives/3.3/license.html":                                                                          "QPL-1.0",
 	"doc.qt.nokia.com/3.3/license.html":                                                                            "QPL-1.0",
+	"docs.mvt.re/en/latest/license/":                                                                               "MVT-1.1",
 	"docs.omniverse.nvidia.com/install-guide/latest/common/licenses.html":                                          "AML-glslang",
 	"docs.oracle.com/cd/E81115_01/html/E81116/licenses.html":                                                       "man2html",
 	"docs.python.org/3/license.html":                                                                               "Python-2.0.1",
@@ -1669,6 +1698,7 @@ var urlToLicense = map[string]string{
 	"fedoraproject.org/wiki/Licensing:Mplus?rd=Licensing/mplus":                                                    "mplus",
 	"fedoraproject.org/wiki/Licensing:ThorPublicLicense":                                                           "TPL-1.0",
 	"firstdonoharm.dev/version/2/1/license.html":                                                                   "Hippocratic-2.1",
+	"firstdonoharm.dev/version/3/0/core.txt":                                                                       "Hippocratic-3.0-core",
 	"forge.gouv.qc.ca/licence/fr/liliq-v1-1/":                                                                      "LiLiQ-P-1.1",
 	"forge.gouv.qc.ca/licence/liliq-p":                                                                             "LiLiQ-R-1.1",
 	"forge.gouv.qc.ca/licence/liliq-p/":                                                                            "LiLiQ-P-1.1",
@@ -1686,68 +1716,70 @@ var urlToLicense = map[string]string{
 	"ftp://ftp.tin.org/pub/news/utils/newsx/newsx-1.6.tar.gz":                                                      "Zeeff",
 	"gianluca.dellavedova.org/2011/01/03/clarified-artistic-license/":                                              "ClArtistic",
 	"git.denx.de/?p=u-boot.git;a=blob;f=arch/powerpc/cpu/ppc4xx/miiphy.c;h=297155fdafa064b955e53e9832de93bfb0cfb85b;hb=9fab4bf4cc077c21e43941866f3f2c196f28670d": "IBM-pibs",
-	"git.enlightenment.org/legacy/imlib2.git/tree/COPYING":                                                               "Imlib2",
-	"git.kernel.org/pub/scm/docs/man-pages/man-pages.git/tree/man2/getcpu.2#n4":                                          "Linux-man-pages-1-para",
-	"git.kernel.org/pub/scm/docs/man-pages/man-pages.git/tree/man2/migrate_pages.2#n8":                                   "Linux-man-pages-copyleft-2-para",
-	"git.kernel.org/pub/scm/docs/man-pages/man-pages.git/tree/man2/move_pages.2#n5":                                      "Linux-man-pages-copyleft-2-para",
-	"git.kernel.org/pub/scm/docs/man-pages/man-pages.git/tree/man2/set_mempolicy.2#n5":                                   "Linux-man-pages-copyleft-var",
-	"git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/drivers/infiniband/core/sa.h":                       "Linux-OpenIB",
-	"git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/net/sunrpc/auth_gss/gss_generic_token.c?h=v4.19":    "HPND-sell-variant",
-	"git.openldap.org/openldap/openldap/-/blob/master/COPYRIGHT#L55-63":                                                  "BSD-4.3RENO",
-	"git.openldap.org/openldap/openldap/-/blob/master/COPYRIGHT?ref_type=heads#L39-51":                                   "Furuseth",
-	"git.openldap.org/openldap/openldap/-/blob/master/libraries/libldap/os-local.c?ref_type=heads#L19-23":                "PADL",
-	"git.savannah.gnu.org/cgit/freetype/freetype2.git/tree/docs/FTL.TXT":                                                 "FTL",
-	"git.savannah.gnu.org/cgit/gcl.git/tree/gcl/lsp/gcl_loop.lsp?h=Version_2_6_13pre":                                    "LOOP",
-	"git.savannah.gnu.org/cgit/gnulib.git/tree/modules/COPYING?id=7b08932179d0d6b017f7df01a2ddf6e096b038e3":              "FSFULLRSD",
-	"git.savannah.gnu.org/cgit/indent.git/tree/doc/indent.texi?id=a74c6b4ee49397cf330b333da1042bffa60ed14f#n1788":        "BSD-4.3TAHOE",
-	"git.savannah.gnu.org/cgit/indent.git/tree/doc/indent.texi?id=a74c6b4ee49397cf330b333da1042bffa60ed14f#n74":          "Latex2e-translated-notice",
-	"git.savannah.gnu.org/cgit/kazlib.git/tree/except.c?id=0062df360c2d17d57f6af19b0e444c51feb99036":                     "Kazlib",
-	"git.savannah.gnu.org/cgit/wget.git/tree/util/trunc.c?h=v1.21.3&id=40747a11e44ced5a8ac628a41f879ced3e2ebce9#n6":      "FSFAP-no-warranty-disclaimer",
-	"git.sr.ht/~nabijaczleweli/ossp-var":                                                                                 "OSSP",
-	"github.com/389ds/389-ds-base/blob/main/ldap/include/sysexits-compat.h#L15":                                          "BSD-4.3TAHOE",
-	"github.com/AcademySoftwareFoundation/foundation/blob/main/digital_assets/aswf_digital_assets_license_v1.0.txt":      "ASWF-Digital-Assets-1.0",
-	"github.com/AcademySoftwareFoundation/foundation/blob/main/digital_assets/aswf_digital_assets_license_v1.1.txt":      "ASWF-Digital-Assets-1.1",
-	"github.com/AdaCore/gnatcoll-core/blob/master/docs/index.rst":                                                        "AdaCore-doc",
-	"github.com/AdaCore/gnatcoll-db/blob/master/docs/index.rst":                                                          "AdaCore-doc",
-	"github.com/AdaCore/xmlada/blob/master/docs/index.rst":                                                               "AdaCore-doc",
-	"github.com/BuildCraft/BuildCraft/blob/623d323b1868712f29f4a8b0979a02e8d1835131/LICENSE":                             "MMPL-1.0.1",
-	"github.com/CommunitySpecification/1.0/blob/master/1._Community_Specification_License-v1.md":                         "Community-Spec-1.0",
-	"github.com/CorsixTH/deps/blob/fd339a9f526d1d9c9f01ccf39e438a015da50035/licences/libgsm.txt":                         "TU-Berlin-2.0",
-	"github.com/Cyan4973/xxHash/blob/dev/doc/xxhash_spec.md":                                                             "LPD-document",
-	"github.com/DISIC/politique-de-contribution-open-source/blob/master/LICENSE.pdf":                                     "etalab-2.0",
-	"github.com/Distrotech/hdparm/blob/4517550db29a91420fb2b020349523b1b4512df2/LICENSE.TXT":                             "hdparm",
-	"github.com/Distrotech/transfig/blob/master/transfig/transfig.c":                                                     "Xfig",
-	"github.com/DrItanium/maya/blob/master/LICENSE.CLIPS":                                                                "Clips",
-	"github.com/Dual-Life/mime-base64/blob/master/Base64.xs#L12":                                                         "metamail",
-	"github.com/EthicalSource/hippocratic-license/blob/58c0e646d64ff6fbee275bfe2b9492f914e3ab2a/LICENSE.txt":             "Hippocratic-2.1",
-	"github.com/FreeRADIUS/freeradius-client/blob/master/COPYRIGHT#L32":                                                  "HPND-Fenneberg-Livingston",
-	"github.com/GNOME/gcr/blob/master/docs/COPYING":                                                                      "GCR-docs",
-	"github.com/GNOME/libxml2/blob/master/dict.c":                                                                        "ISC-Veillard",
-	"github.com/HDFGroup/hdf5/?tab=License-1-ov-file#readme":                                                             "HDF5",
-	"github.com/KhronosGroup/SPIRV-Cross/blob/main/LICENSES/LicenseRef-KhronosFreeUse.txt":                               "MIT-Khronos-old",
-	"github.com/KhronosGroup/glslang/blob/main/LICENSE.txt#L949":                                                         "AML-glslang",
-	"github.com/MariaDB/server/blob/11.6/libmysqld/lib_sql.cc":                                                           "Boehm-GC-without-fee",
-	"github.com/Neo23x0/sigma/blob/master/LICENSE.Detection.Rules.md":                                                    "DRL-1.0",
-	"github.com/OGRECave/ogre/blob/master/OgreMain/include/OgreSingleton.h#L28C3-L35C46":                                 "Game-Programming-Gems",
-	"github.com/Perl/perl5/blob/blead/util.c#L6136":                                                                      "Martin-Birgmeier",
-	"github.com/PixarAnimationStudios/OpenSubdiv/blob/v3_5_0/opensubdiv/version.cpp#L2-L22":                              "Pixar",
-	"github.com/PixarAnimationStudios/OpenSubdiv/raw/v3_5_0/LICENSE.txt":                                                 "Pixar",
-	"github.com/RTimothyEdwards/magic/blob/master/LICENSE":                                                               "HPND-UC-export-US",
-	"github.com/SELinuxProject/selinux/blob/master/libselinux/LICENSE":                                                   "libselinux-1.0",
-	"github.com/SWI-Prolog/packages-clib/blob/master/sha1/brg_endian.h":                                                  "Brian-Gladman-3-Clause",
-	"github.com/SWI-Prolog/packages-xpce/blob/161a40cd82004f731ba48024f9d30af388a7edf5/src/img/gifwrite.c#L21-L26":       "FBM",
-	"github.com/SWI-Prolog/swipl-devel/blob/master/src/os/dtoa.c":                                                        "dtoa",
-	"github.com/SigmaHQ/Detection-Rule-License/blob/6ec7fbde6101d101b5b5d1fcb8f9b69fbc76c04a/LICENSE.Detection.Rules.md": "DRL-1.1",
-	"github.com/Slicer/Slicer/blob/main/License.txt":                                                                     "3D-Slicer-1.0",
-	"github.com/Unidata/UDUNITS-2/blob/master/COPYRIGHT":                                                                 "UCAR",
-	"github.com/acpica/acpica/blob/master/source/common/acfileio.c#L119":                                                 "BSD-3-Clause-acpica",
-	"github.com/adaptivecomputing/torque/blob/master/PBS_License.txt":                                                    "OpenPBS-2.3",
-	"github.com/adversary-org/wtfnmf/raw/3f2cd8235a64350a57a51b9739715edaea63ec1a/COPYING.WTFNMFPL-utf8":                 "WTFNMFPL",
-	"github.com/adversary-org/wtfnmf/raw/refs/tags/1.0/COPYING.WTFNMFPL":                                                 "WTFNMFPL",
-	"github.com/ap/Text-Tabs/blob/master/lib.modern/Text/Tabs.pm#L148":                                                   "TTWL",
-	"github.com/apache/apr/blob/trunk/LICENSE#L298C6-L298C29":                                                            "Caldera-no-preamble",
-	"github.com/audacious-media-player/audacious/blob/master/COPYING":                                                    "BSD-2-Clause-pkgconf-disclaimer",
-	"github.com/audacious-media-player/audacious/blob/master/src/audacious/main.cc":                                      "BSD-2-Clause-pkgconf-disclaimer",
+	"git.enlightenment.org/legacy/imlib2.git/tree/COPYING":                                                                                   "Imlib2",
+	"git.kernel.org/pub/scm/docs/man-pages/man-pages.git/tree/man2/getcpu.2#n4":                                                              "Linux-man-pages-1-para",
+	"git.kernel.org/pub/scm/docs/man-pages/man-pages.git/tree/man2/migrate_pages.2#n8":                                                       "Linux-man-pages-copyleft-2-para",
+	"git.kernel.org/pub/scm/docs/man-pages/man-pages.git/tree/man2/move_pages.2#n5":                                                          "Linux-man-pages-copyleft-2-para",
+	"git.kernel.org/pub/scm/docs/man-pages/man-pages.git/tree/man2/set_mempolicy.2#n5":                                                       "Linux-man-pages-copyleft-var",
+	"git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/drivers/infiniband/core/sa.h":                                           "Linux-OpenIB",
+	"git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/net/sunrpc/auth_gss/gss_generic_token.c?h=v4.19":                        "HPND-sell-variant",
+	"git.openldap.org/openldap/openldap/-/blob/master/COPYRIGHT#L55-63":                                                                      "BSD-4.3RENO",
+	"git.openldap.org/openldap/openldap/-/blob/master/COPYRIGHT?ref_type=heads#L39-51":                                                       "Furuseth",
+	"git.openldap.org/openldap/openldap/-/blob/master/libraries/libldap/os-local.c?ref_type=heads#L19-23":                                    "PADL",
+	"git.savannah.gnu.org/cgit/freetype/freetype2.git/tree/docs/FTL.TXT":                                                                     "FTL",
+	"git.savannah.gnu.org/cgit/gcl.git/tree/gcl/lsp/gcl_loop.lsp?h=Version_2_6_13pre":                                                        "LOOP",
+	"git.savannah.gnu.org/cgit/gnulib.git/tree/modules/COPYING?id=7b08932179d0d6b017f7df01a2ddf6e096b038e3":                                  "FSFULLRSD",
+	"git.savannah.gnu.org/cgit/indent.git/tree/doc/indent.texi?id=a74c6b4ee49397cf330b333da1042bffa60ed14f#n1788":                            "BSD-4.3TAHOE",
+	"git.savannah.gnu.org/cgit/indent.git/tree/doc/indent.texi?id=a74c6b4ee49397cf330b333da1042bffa60ed14f#n74":                              "Latex2e-translated-notice",
+	"git.savannah.gnu.org/cgit/kazlib.git/tree/except.c?id=0062df360c2d17d57f6af19b0e444c51feb99036":                                         "Kazlib",
+	"git.savannah.gnu.org/cgit/wget.git/tree/util/trunc.c?h=v1.21.3&id=40747a11e44ced5a8ac628a41f879ced3e2ebce9#n6":                          "FSFAP-no-warranty-disclaimer",
+	"git.sr.ht/~nabijaczleweli/ossp-var":                                                                                                     "OSSP",
+	"github.com/389ds/389-ds-base/blob/main/ldap/include/sysexits-compat.h#L15":                                                              "BSD-4.3TAHOE",
+	"github.com/AcademySoftwareFoundation/foundation/blob/main/digital_assets/aswf_digital_assets_license_v1.0.txt":                          "ASWF-Digital-Assets-1.0",
+	"github.com/AcademySoftwareFoundation/foundation/blob/main/digital_assets/aswf_digital_assets_license_v1.1.txt":                          "ASWF-Digital-Assets-1.1",
+	"github.com/AdaCore/gnatcoll-core/blob/master/docs/index.rst":                                                                            "AdaCore-doc",
+	"github.com/AdaCore/gnatcoll-db/blob/master/docs/index.rst":                                                                              "AdaCore-doc",
+	"github.com/AdaCore/xmlada/blob/master/docs/index.rst":                                                                                   "AdaCore-doc",
+	"github.com/BuildCraft/BuildCraft/blob/623d323b1868712f29f4a8b0979a02e8d1835131/LICENSE":                                                 "MMPL-1.0.1",
+	"github.com/CommunitySpecification/1.0/blob/master/1._Community_Specification_License-v1.md":                                             "Community-Spec-1.0",
+	"github.com/CorsixTH/deps/blob/fd339a9f526d1d9c9f01ccf39e438a015da50035/licences/libgsm.txt":                                             "TU-Berlin-2.0",
+	"github.com/Cyan4973/xxHash/blob/dev/doc/xxhash_spec.md":                                                                                 "LPD-document",
+	"github.com/DISIC/politique-de-contribution-open-source/blob/master/LICENSE.pdf":                                                         "etalab-2.0",
+	"github.com/Distrotech/hdparm/blob/4517550db29a91420fb2b020349523b1b4512df2/LICENSE.TXT":                                                 "hdparm",
+	"github.com/Distrotech/transfig/blob/master/transfig/transfig.c":                                                                         "Xfig",
+	"github.com/DrItanium/maya/blob/master/LICENSE.CLIPS":                                                                                    "Clips",
+	"github.com/Dual-Life/mime-base64/blob/master/Base64.xs#L12":                                                                             "metamail",
+	"github.com/EthicalSource/hippocratic-license/blob/58c0e646d64ff6fbee275bfe2b9492f914e3ab2a/LICENSE.txt":                                 "Hippocratic-2.1",
+	"github.com/Fraunhofer-IIS/mpeghdec/blob/main/LICENSE.txt":                                                                               "FDK-MPEG-H",
+	"github.com/FreeRADIUS/freeradius-client/blob/master/COPYRIGHT#L32":                                                                      "HPND-Fenneberg-Livingston",
+	"github.com/GNOME/gcr/blob/master/docs/COPYING":                                                                                          "GCR-docs",
+	"github.com/GNOME/libxml2/blob/master/dict.c":                                                                                            "ISC-Veillard",
+	"github.com/HDFGroup/hdf5/?tab=License-1-ov-file#readme":                                                                                 "HDF5",
+	"github.com/KhronosGroup/SPIRV-Cross/blob/main/LICENSES/LicenseRef-KhronosFreeUse.txt":                                                   "MIT-Khronos-old",
+	"github.com/KhronosGroup/glslang/blob/main/LICENSE.txt#L949":                                                                             "AML-glslang",
+	"github.com/MariaDB/server/blob/11.6/libmysqld/lib_sql.cc":                                                                               "Boehm-GC-without-fee",
+	"github.com/Neo23x0/sigma/blob/master/LICENSE.Detection.Rules.md":                                                                        "DRL-1.0",
+	"github.com/OGRECave/ogre/blob/master/OgreMain/include/OgreSingleton.h#L28C3-L35C46":                                                     "Game-Programming-Gems",
+	"github.com/Perl/perl5/blob/blead/util.c#L6136":                                                                                          "Martin-Birgmeier",
+	"github.com/PicoEFI/PicoEFI/blob/2263ac1a2bc98e5534d64a4896d3cfbbae00745a/LICENSES/LicenseRef-scancode-bsd-no-disclaimer-unmodified.txt": "BSD-Source-Code-no-disclaimer",
+	"github.com/PixarAnimationStudios/OpenSubdiv/blob/v3_5_0/opensubdiv/version.cpp#L2-L22":                                                  "Pixar",
+	"github.com/PixarAnimationStudios/OpenSubdiv/raw/v3_5_0/LICENSE.txt":                                                                     "Pixar",
+	"github.com/RTimothyEdwards/magic/blob/master/LICENSE":                                                                                   "HPND-UC-export-US",
+	"github.com/SELinuxProject/selinux/blob/master/libselinux/LICENSE":                                                                       "libselinux-1.0",
+	"github.com/SWI-Prolog/packages-clib/blob/master/sha1/brg_endian.h":                                                                      "Brian-Gladman-3-Clause",
+	"github.com/SWI-Prolog/packages-xpce/blob/161a40cd82004f731ba48024f9d30af388a7edf5/src/img/gifwrite.c#L21-L26":                           "FBM",
+	"github.com/SWI-Prolog/swipl-devel/blob/master/src/os/dtoa.c":                                                                            "dtoa",
+	"github.com/SigmaHQ/Detection-Rule-License/blob/6ec7fbde6101d101b5b5d1fcb8f9b69fbc76c04a/LICENSE.Detection.Rules.md":                     "DRL-1.1",
+	"github.com/Slicer/Slicer/blob/main/License.txt":                                                                                         "3D-Slicer-1.0",
+	"github.com/Unidata/UDUNITS-2/blob/master/COPYRIGHT":                                                                                     "UCAR",
+	"github.com/acpica/acpica/blob/master/source/common/acfileio.c#L119":                                                                     "BSD-3-Clause-acpica",
+	"github.com/adaptivecomputing/torque/blob/master/PBS_License.txt":                                                                        "OpenPBS-2.3",
+	"github.com/adversary-org/wtfnmf/raw/3f2cd8235a64350a57a51b9739715edaea63ec1a/COPYING.WTFNMFPL-utf8":                                     "WTFNMFPL",
+	"github.com/adversary-org/wtfnmf/raw/refs/tags/1.0/COPYING.WTFNMFPL":                                                                     "WTFNMFPL",
+	"github.com/ap/Text-Tabs/blob/master/lib.modern/Text/Tabs.pm#L148":                                                                       "TTWL",
+	"github.com/apache/apr/blob/trunk/LICENSE#L298C6-L298C29":                                                                                "Caldera-no-preamble",
+	"github.com/audacious-media-player/audacious/blob/master/COPYING":                                                                        "BSD-2-Clause-pkgconf-disclaimer",
+	"github.com/audacious-media-player/audacious/blob/master/src/audacious/main.cc":                                                          "BSD-2-Clause-pkgconf-disclaimer",
 	"github.com/aws/mit-0": "MIT-0",
 	"github.com/awsdocs/aws-cloud9-user-guide/blob/master/LICENSE-SAMPLECODE":                                                 "MIT-0",
 	"github.com/bagder/curl/blob/master/COPYING":                                                                              "curl",
@@ -1772,6 +1804,7 @@ var urlToLicense = map[string]string{
 	"github.com/file/file/blob/master/COPYING":                                                                                                                            "BSD-2-Clause-Darwin",
 	"github.com/freebsd/freebsd-src/blob/main/lib/msun/src/e_acosh.c":                                                                                                     "SunPro",
 	"github.com/freebsd/freebsd-src/blob/main/lib/msun/src/e_lgammal.c":                                                                                                   "SunPro",
+	"github.com/freebsd/pkg/blob/main/src/add.c":                                                                                                                          "BSD-2-Clause-pos-unchanged",
 	"github.com/gabegundy/atlserver/blob/master/License.txt":                                                                                                              "MS-LPL",
 	"github.com/greymass/swift-eosio/blob/master/LICENSE":                                                                                                                 "BSD-3-Clause-No-Military-License",
 	"github.com/hamano/man2html/blob/master/man2html.c":                                                                                                                   "man2html",
@@ -1784,6 +1817,7 @@ var urlToLicense = map[string]string{
 	"github.com/jsommers/pytricia/blob/master/patricia.c#L33-L67":                                                                                                         "BSD-4-Clause",
 	"github.com/kfish/xsel/blob/master/COPYING":                                                                                                                           "HPND-sell-variant",
 	"github.com/kohler/t1utils/blob/master/LICENSE":                                                                                                                       "MIT-Click",
+	"github.com/krb5/krb5/blob/kfw-4.0.1-beta1/src/lib/crypto/builtin/aes/aesopt.h":                                                                                       "Brian-Gladman-3-Clause-no-conversion",
 	"github.com/krb5/krb5/blob/krb5-1.21.2-final/NOTICE#L111-L133":                                                                                                        "HPND-export2-US",
 	"github.com/krb5/krb5/blob/krb5-1.21.2-final/NOTICE#L1157-L1182":                                                                                                      "HPND-export-US-modify",
 	"github.com/krb5/krb5/blob/krb5-1.21.2-final/NOTICE#L140-L156":                                                                                                        "Brian-Gladman-2-Clause",
@@ -1793,6 +1827,7 @@ var urlToLicense = map[string]string{
 	"github.com/krb5/krb5/blob/krb5-1.21.2-final/NOTICE#L831-L852":                                                                                                        "HPND-export-US-acknowledgement",
 	"github.com/krzyzanowskim/CryptoSwift/blob/main/LICENSE":                                                                                                              "CryptoSwift",
 	"github.com/lattera/freebsd/blob/master/sys/cam/cam.c#L4":                                                                                                             "BSD-Source-beginning-file",
+	"github.com/libarchive/libarchive/blob/master/libarchive_fe/line_reader.c":                                                                                            "BSD-2-Clause-pos-unchanged",
 	"github.com/libcheck/check/blob/master/checkmk/checkmk.in":                                                                                                            "checkmk",
 	"github.com/libjpeg-turbo/libjpeg-turbo/blob/main/README.ijg#L117-L161":                                                                                               "IJG",
 	"github.com/lsof-org/lsof/blob/master/COPYING":                                                                                                                        "lsof",
@@ -1805,6 +1840,7 @@ var urlToLicense = map[string]string{
 	"github.com/mm2/Little-CMS/blob/master/src/cmssm.c#L207":                                                                                                              "softSurfer",
 	"github.com/mruby/mruby/blob/83d12f8d52522cdb7c8cc46fad34821359f453e6/mrbgems/mruby-dir/src/Win/dirent.c#L127-L140":                                                   "HPND-Kevlin-Henney",
 	"github.com/mtoyoda/sl/blob/master/LICENSE":                                                                                                                           "SL",
+	"github.com/mvt-project/mvt/blob/main/LICENSE":                                                                                                                        "MVT-1.1",
 	"github.com/n8n-io/n8n/blob/master/LICENSE.md":                                                                                                                        "SUL-1.0",
 	"github.com/ncbi/datasets/blob/0ea4cd16b61e5b799d9cc55aecfa016d6c9bd2bf/LICENSE.md":                                                                                   "NCBI-PD",
 	"github.com/ncbi/datasets/blob/master/LICENSE.md":                                                                                                                     "NCBI-PD",
@@ -1815,6 +1851,7 @@ var urlToLicense = map[string]string{
 	"github.com/novnc/noVNC/blob/master/core/crypto/des.js#L24":                                                                                                           "Widget-Workshop",
 	"github.com/oetiker/rrdtool-1.x/blob/master/src/plbasename.c#L8-L11":                                                                                                  "gtkbook",
 	"github.com/open-quantum-safe/liboqs/blob/40b01fdbb270f8614fde30e65d30e9da18c02393/src/common/rand/rand_nist.c#L1-L15":                                                "NIST-Software",
+	"github.com/open-webui/open-webui/blob/main/LICENSE":                                                                                                                  "BSD-3-Clause-OpenWebUI",
 	"github.com/openjdk/jdk/blob/6162e2c5213c5dd7c1127fd9616b543efa898962/LICENSE":                                                                                        "GPL-2.0-or-later",
 	"github.com/openssh/openssh-portable/blob/1b11ea7c58cd5c59838b5fa574cd456d6047b2d4/LICENCE#L10":                                                                       "SSH-OpenSSH",
 	"github.com/openssh/openssh-portable/blob/1b11ea7c58cd5c59838b5fa574cd456d6047b2d4/pathnames.h":                                                                       "SSH-short",
@@ -1846,6 +1883,7 @@ var urlToLicense = map[string]string{
 	"github.com/sigmavirus24/x11-ssh-askpass/blob/master/dynlist.c":                                                                                                       "HPND-sell-variant-MIT-disclaimer-rev",
 	"github.com/signal11/hidapi/blob/master/LICENSE-orig.txt":                                                                                                             "HIDAPI",
 	"github.com/slogan621/gtkbook":                                                                                                                                        "gtkbook",
+	"github.com/sudo-project/sudo/blob/c1307ea9ff340ce0538779f8e456501461fc44b7/plugins/sudoers/redblack.c#L24-L43":                                                       "BSD-ask-to-endorse",
 	"github.com/swh/ladspa/blob/7bf6f3799fdba70fda297c2d8fd9f526803d9680/gsm/COPYRIGHT":                                                                                   "TU-Berlin-1.0",
 	"github.com/tats/w3m/blob/master/COPYING":                                                                                                                             "w3m",
 	"github.com/tcheneau/Routing/blob/f09f46fcfe636107f22f2c98348188a65a135d98/README.md":                                                                                 "NIST-PD",
@@ -1856,6 +1894,7 @@ var urlToLicense = map[string]string{
 	"github.com/uim/libgcroots/blob/master/COPYING":                                                                                                                       "Boehm-GC",
 	"github.com/usnistgov/fipy/blob/86aaa5c2ba2c6f1be19593c5986071cf6568cc34/LICENSE.rst":                                                                                 "NIST-PD-fallback",
 	"github.com/usnistgov/jsip/blob/59700e6926cbe96c5cdae897d9a7d2656b42abe3/LICENSE":                                                                                     "NIST-PD-fallback",
+	"github.com/vattam/BSDGames/blob/master/atc/extern.c#L36":                                                                                                             "atc-game",
 	"github.com/vixie/cron/tree/545b3f5246824a9cda5905eeb7cf019c95e66995":                                                                                                 "Vixie-Cron",
 	"github.com/vstroebel/jpeg-encoder/blob/main/src/fdct.rs#L1-L72":                                                                                                      "IJG",
 	"github.com/wernerd/ZRTPCPP/blob/6b3cd8e6783642292bad0c21e3e5e5ce45ff3e03/cryptcommon/twofish.c#L113C3-L127":                                                          "Ferguson-Twofish",
@@ -1869,6 +1908,7 @@ var urlToLicense = map[string]string{
 	"gitlab.com/embeddable-common-lisp/ecl/-/blob/develop/src/lsp/loop.lsp":                                                                                               "LOOP",
 	"gitlab.com/libeigen/eigen/-/blob/master/COPYING.MINPACK":                                                                                                             "Minpack",
 	"gitlab.common-lisp.net/cmucl/cmucl/-/blob/master/src/code/loop.lisp":                                                                                                 "LOOP",
+	"gitlab.freedesktop.org/dbus/dbus/-/blob/789d97ad53044f94351a958e785c2923643b346a/COPYING#L11-207":                                                                    "AFL-2.1",
 	"gitlab.freedesktop.org/freetype/freetype/-/raw/master/docs/FTL.TXT":                                                                                                  "FTL",
 	"gitlab.freedesktop.org/libopenraw/libopenraw/blob/master/lib/ljpegdecompressor.cpp#L32":                                                                              "Cornell-Lossless-JPEG",
 	"gitlab.freedesktop.org/mesa/glw/-/blob/master/README?ref_type=heads":                                                                                                 "SGI-OpenGL",
@@ -1892,6 +1932,7 @@ var urlToLicense = map[string]string{
 	"gitlab.freedesktop.org/xorg/lib/libxinerama/-/blob/cc22c2f60c3862482562955116d5455263b443dc/COPYING#L44-66":                                                          "X11-no-permit-persons",
 	"gitlab.freedesktop.org/xorg/lib/libxtst/-/blob/master/COPYING?ref_type=heads#L108-117":                                                                               "HPND-doc-sell",
 	"gitlab.freedesktop.org/xorg/lib/libxtst/-/blob/master/COPYING?ref_type=heads#L70-77":                                                                                 "HPND-doc",
+	"gitlab.freedesktop.org/xorg/xserver/-/blob/dd5c2595a42d3ff0c4f18d9b53d1f6c3fd934fd4/COPYING#L365-389":                                                                "MIT",
 	"gitlab.freedesktop.org/xorg/xserver/-/blob/master/COPYING?ref_type=heads#L1781":                                                                                      "HPND-sell-MIT-disclaimer-xserver",
 	"gitlab.freedesktop.org/xorg/xserver/-/blob/master/COPYING?ref_type=heads#L239":                                                                                       "DEC-3-Clause",
 	"gitlab.freedesktop.org/xorg/xserver/-/blob/master/COPYING?ref_type=heads#L752":                                                                                       "Adobe-Display-PostScript",
@@ -1906,6 +1947,7 @@ var urlToLicense = map[string]string{
 	"heasarc.gsfc.nasa.gov/docs/software/ftools/fv/doc/license.html":                                                                                                      "CFITSIO",
 	"helixcommunity.org/content/rpsl":                                                                                                                                     "RPSL-1.0",
 	"hstechdocs.helpsystems.com/manuals/globalscape/archive/cuteftp6/open_ssl_license_agreement.htm":                                                                      "OpenSSL-standalone",
+	"interoperable-europe.ec.europa.eu/sites/default/files/inline-files/EUPL%20v1_2%20EN(1).txt":                                                                          "EUPL-1.2",
 	"java.net/projects/javaeetutorial/pages/BerkeleyLicense":                                                                                                              "BSD-3-Clause-No-Nuclear-License-2014",
 	"javaee.github.io/glassfish/LICENSE":                                                                                                                                  "CDDL-1.1",
 	"jogamp.org/git/?p=gluegen.git;a=blob_plain;f=LICENSE.txt":                                                                                                            "BSD-3-Clause-No-Nuclear-Warranty",
@@ -1924,6 +1966,7 @@ var urlToLicense = map[string]string{
 	"library.netapp.com/ecm/ecm_download_file/ECMP1196395":                                                                                                                "OpenSSL-standalone",
 	"license.coscl.org.cn/MulanPSL/":                                                                                                                                      "MulanPSL-1.0",
 	"license.coscl.org.cn/MulanPSL2":                                                                                                                                      "MulanPSL-2.0",
+	"license.mvt.re/1.1/":                                                                                                                                                 "MVT-1.1",
 	"lists.gnu.org/archive/html/autoconf/2012-04/msg00061.html":                                                                                                           "FSFULLRWD",
 	"lists.opensource.org/pipermail/license-discuss_lists.opensource.org/2002-November/006304.html":                                                                       "HPND",
 	"mariadb.com/bsl11/":                                                                                             "BUSL-1.1",
@@ -1965,99 +2008,105 @@ var urlToLicense = map[string]string{
 	"opensource.linux-mirror.org/licenses/afl-1.1.txt":                                                               "AFL-1.1",
 	"opensource.linux-mirror.org/licenses/afl-1.2.txt":                                                               "AFL-1.2",
 	"opensource.linux-mirror.org/licenses/afl-2.1.txt":                                                               "AFL-2.1",
-	"opensource.org/license/apache-2-0":                                                                              "Apache-2.0",
-	"opensource.org/license/mit/":                                                                                    "MIT",
-	"opensource.org/license/olfl-1-3/":                                                                               "OLFL-1.3",
-	"opensource.org/license/osc-license-1-0":                                                                         "OSC-1.0",
-	"opensource.org/licenses/0BSD":                                                                                   "0BSD",
-	"opensource.org/licenses/AGPL-3.0":                                                                               "AGPL-3.0-or-later",
-	"opensource.org/licenses/APL-1.0":                                                                                "APL-1.0",
-	"opensource.org/licenses/Apache-1.1":                                                                             "Apache-1.1",
-	"opensource.org/licenses/Apache-2.0":                                                                             "Apache-2.0",
-	"opensource.org/licenses/Artistic-1.0":                                                                           "Artistic-1.0-cl8",
-	"opensource.org/licenses/BSD-2-Clause":                                                                           "BSD-2-Clause",
-	"opensource.org/licenses/BSD-3-Clause":                                                                           "BSD-3-Clause",
-	"opensource.org/licenses/BSDplusPatent":                                                                          "BSD-2-Clause-Patent",
-	"opensource.org/licenses/BSL-1.0":                                                                                "BSL-1.0",
-	"opensource.org/licenses/CAL-1.0":                                                                                "CAL-1.0-Combined-Work-Exception",
-	"opensource.org/licenses/CATOSL-1.1":                                                                             "CATOSL-1.1",
-	"opensource.org/licenses/CNRI-Python":                                                                            "CNRI-Python",
-	"opensource.org/licenses/CPAL-1.0":                                                                               "CPAL-1.0",
-	"opensource.org/licenses/CPL-1.0":                                                                                "CPL-1.0",
-	"opensource.org/licenses/CUA-OPL-1.0":                                                                            "CUA-OPL-1.0",
-	"opensource.org/licenses/ECL-1.0":                                                                                "ECL-1.0",
-	"opensource.org/licenses/ECL-2.0":                                                                                "ECL-2.0",
-	"opensource.org/licenses/EFL-1.0":                                                                                "EFL-1.0",
-	"opensource.org/licenses/EFL-2.0":                                                                                "EFL-2.0",
-	"opensource.org/licenses/EPL-1.0":                                                                                "EPL-1.0",
-	"opensource.org/licenses/EUDatagrid":                                                                             "EUDatagrid",
-	"opensource.org/licenses/EUPL-1.1":                                                                               "EUPL-1.1",
-	"opensource.org/licenses/EUPL-1.2":                                                                               "EUPL-1.2",
-	"opensource.org/licenses/Entessa":                                                                                "Entessa",
-	"opensource.org/licenses/Fair":                                                                                   "Fair",
-	"opensource.org/licenses/Frameworx-1.0":                                                                          "Frameworx-1.0",
-	"opensource.org/licenses/GPL-2.0":                                                                                "GPL-2.0-or-later",
-	"opensource.org/licenses/GPL-3.0":                                                                                "GPL-3.0-or-later",
-	"opensource.org/licenses/HPND":                                                                                   "HPND",
-	"opensource.org/licenses/IPA":                                                                                    "IPA",
-	"opensource.org/licenses/IPL-1.0":                                                                                "IPL-1.0",
-	"opensource.org/licenses/ISC":                                                                                    "ISC",
-	"opensource.org/licenses/Intel":                                                                                  "Intel",
-	"opensource.org/licenses/LGPL-2.1":                                                                               "LGPL-2.1-or-later",
-	"opensource.org/licenses/LGPL-3.0":                                                                               "LGPL-3.0-or-later",
-	"opensource.org/licenses/LPL-1.0":                                                                                "LPL-1.0",
-	"opensource.org/licenses/LPL-1.02":                                                                               "LPL-1.02",
-	"opensource.org/licenses/LPPL-1.3c":                                                                              "LPPL-1.3c",
-	"opensource.org/licenses/LiLiQ-P-1.1":                                                                            "LiLiQ-P-1.1",
-	"opensource.org/licenses/LiLiQ-R-1.1":                                                                            "LiLiQ-R-1.1",
-	"opensource.org/licenses/LiLiQ-Rplus-1.1":                                                                        "LiLiQ-Rplus-1.1",
-	"opensource.org/licenses/MIT":                                                                                    "MIT",
-	"opensource.org/licenses/MPL-1.0":                                                                                "MPL-1.0",
-	"opensource.org/licenses/MPL-1.1":                                                                                "MPL-1.1",
-	"opensource.org/licenses/MPL-2.0":                                                                                "MPL-2.0-no-copyleft-exception",
-	"opensource.org/licenses/MS-PL":                                                                                  "MS-PL",
-	"opensource.org/licenses/MS-RL":                                                                                  "MS-RL",
-	"opensource.org/licenses/MirOS":                                                                                  "MirOS",
-	"opensource.org/licenses/Motosoto":                                                                               "Motosoto",
-	"opensource.org/licenses/Multics":                                                                                "Multics",
-	"opensource.org/licenses/NASA-1.3":                                                                               "NASA-1.3",
-	"opensource.org/licenses/NCSA":                                                                                   "NCSA",
-	"opensource.org/licenses/NGPL":                                                                                   "NGPL",
-	"opensource.org/licenses/NOSL3.0":                                                                                "NPOSL-3.0",
-	"opensource.org/licenses/NTP":                                                                                    "NTP",
-	"opensource.org/licenses/Naumen":                                                                                 "Naumen",
-	"opensource.org/licenses/OCLC-2.0":                                                                               "OCLC-2.0",
-	"opensource.org/licenses/OFL-1.1":                                                                                "OFL-1.1-no-RFN",
-	"opensource.org/licenses/OGTSL":                                                                                  "OGTSL",
-	"opensource.org/licenses/OPL-2.1":                                                                                "OSET-PL-2.1",
-	"opensource.org/licenses/OSL-1.0":                                                                                "OSL-1.0",
-	"opensource.org/licenses/OSL-2.1":                                                                                "OSL-2.1",
-	"opensource.org/licenses/OSL-3.0":                                                                                "OSL-3.0",
-	"opensource.org/licenses/PHP-3.0":                                                                                "PHP-3.0",
-	"opensource.org/licenses/PostgreSQL":                                                                             "PostgreSQL",
-	"opensource.org/licenses/Python-2.0":                                                                             "Python-2.0",
-	"opensource.org/licenses/QPL-1.0":                                                                                "QPL-1.0",
-	"opensource.org/licenses/RPL-1.1":                                                                                "RPL-1.1",
-	"opensource.org/licenses/RPL-1.5":                                                                                "RPL-1.5",
-	"opensource.org/licenses/RPSL-1.0":                                                                               "RPSL-1.0",
-	"opensource.org/licenses/RSCPL":                                                                                  "RSCPL",
-	"opensource.org/licenses/SISSL":                                                                                  "SISSL",
-	"opensource.org/licenses/SPL-1.0":                                                                                "SPL-1.0",
-	"opensource.org/licenses/SimPL-2.0":                                                                              "SimPL-2.0",
-	"opensource.org/licenses/Sleepycat":                                                                              "Sleepycat",
-	"opensource.org/licenses/UCL-1.0":                                                                                "UCL-1.0",
-	"opensource.org/licenses/UPL":                                                                                    "UPL-1.0",
-	"opensource.org/licenses/VSL-1.0":                                                                                "VSL-1.0",
-	"opensource.org/licenses/W3C":                                                                                    "W3C",
-	"opensource.org/licenses/Watcom-1.0":                                                                             "Watcom-1.0",
-	"opensource.org/licenses/Xnet":                                                                                   "Xnet",
-	"opensource.org/licenses/ZPL-2.0":                                                                                "ZPL-2.0",
-	"opensource.org/licenses/Zlib":                                                                                   "Zlib",
-	"opensource.org/licenses/afl-3.0":                                                                                "AFL-3.0",
-	"opensource.org/licenses/artistic-license-2.0":                                                                   "Artistic-2.0",
-	"opensource.org/licenses/attribution":                                                                            "AAL",
-	"opensource.org/licenses/cddl1":                                                                                  "CDDL-1.0",
-	"opensource.org/licenses/nokia":                                                                                  "Nokia",
+	"opensource.org/license/0BSD":                                                                                    "0BSD",
+	"opensource.org/license/AAL":                                                                                     "AAL",
+	"opensource.org/license/AFL-3.0":                                                                                 "AFL-3.0",
+	"opensource.org/license/AGPL-3.0":                                                                                "AGPL-3.0-or-later",
+	"opensource.org/license/AGPL-3.0-only":                                                                           "AGPL-3.0-only",
+	"opensource.org/license/APL-1.0":                                                                                 "APL-1.0",
+	"opensource.org/license/Artistic-1.0":                                                                            "Artistic-1.0-cl8",
+	"opensource.org/license/Artistic-2.0":                                                                            "Artistic-2.0",
+	"opensource.org/license/BSD-2-Clause":                                                                            "BSD-2-Clause",
+	"opensource.org/license/BSD-2-Clause-Patent":                                                                     "BSD-2-Clause-Patent",
+	"opensource.org/license/BSD-3-Clause":                                                                            "BSD-3-Clause",
+	"opensource.org/license/BSL-1.0":                                                                                 "BSL-1.0",
+	"opensource.org/license/CAL-1.0":                                                                                 "CAL-1.0-Combined-Work-Exception",
+	"opensource.org/license/CATOSL-1.1":                                                                              "CATOSL-1.1",
+	"opensource.org/license/CDDL-1.0":                                                                                "CDDL-1.0",
+	"opensource.org/license/CNRI-Python":                                                                             "CNRI-Python",
+	"opensource.org/license/CNRI-Python-GPL-Compatible":                                                              "CNRI-Python-GPL-Compatible",
+	"opensource.org/license/CPAL-1.0":                                                                                "CPAL-1.0",
+	"opensource.org/license/CPL-1.0":                                                                                 "CPL-1.0",
+	"opensource.org/license/CUA-OPL-1.0":                                                                             "CUA-OPL-1.0",
+	"opensource.org/license/ECL-1.0":                                                                                 "ECL-1.0",
+	"opensource.org/license/ECL-2.0":                                                                                 "ECL-2.0",
+	"opensource.org/license/EFL-1.0":                                                                                 "EFL-1.0",
+	"opensource.org/license/EFL-2.0":                                                                                 "EFL-2.0",
+	"opensource.org/license/EPL-1.0":                                                                                 "EPL-1.0",
+	"opensource.org/license/EUDatagrid":                                                                              "EUDatagrid",
+	"opensource.org/license/EUPL-1.1":                                                                                "EUPL-1.1",
+	"opensource.org/license/EUPL-1.2":                                                                                "EUPL-1.2",
+	"opensource.org/license/Entessa":                                                                                 "Entessa",
+	"opensource.org/license/Fair":                                                                                    "Fair",
+	"opensource.org/license/Frameworx-1.0":                                                                           "Frameworx-1.0",
+	"opensource.org/license/GPL-2.0":                                                                                 "GPL-2.0-or-later",
+	"opensource.org/license/GPL-2.0-only":                                                                            "GPL-2.0-only",
+	"opensource.org/license/GPL-3.0":                                                                                 "GPL-3.0-or-later",
+	"opensource.org/license/GPL-3.0-only":                                                                            "GPL-3.0-only",
+	"opensource.org/license/HPND":                                                                                    "HPND",
+	"opensource.org/license/IPA":                                                                                     "IPA",
+	"opensource.org/license/IPL-1.0":                                                                                 "IPL-1.0",
+	"opensource.org/license/ISC":                                                                                     "ISC",
+	"opensource.org/license/Intel":                                                                                   "Intel",
+	"opensource.org/license/LGPL-2.1":                                                                                "LGPL-2.1-or-later",
+	"opensource.org/license/LGPL-2.1-only":                                                                           "LGPL-2.1-only",
+	"opensource.org/license/LGPL-3.0":                                                                                "LGPL-3.0-or-later",
+	"opensource.org/license/LPL-1.0":                                                                                 "LPL-1.0",
+	"opensource.org/license/LPL-1.02":                                                                                "LPL-1.02",
+	"opensource.org/license/LPPL-1.3c":                                                                               "LPPL-1.3c",
+	"opensource.org/license/LiLiQ-P-1.1":                                                                             "LiLiQ-P-1.1",
+	"opensource.org/license/LiLiQ-R-1.1":                                                                             "LiLiQ-R-1.1",
+	"opensource.org/license/LiLiQ-Rplus-1.1":                                                                         "LiLiQ-Rplus-1.1",
+	"opensource.org/license/MIT":                                                                                     "MIT",
+	"opensource.org/license/MPL-1.0":                                                                                 "MPL-1.0",
+	"opensource.org/license/MPL-1.1":                                                                                 "MPL-1.1",
+	"opensource.org/license/MPL-2.0":                                                                                 "MPL-2.0-no-copyleft-exception",
+	"opensource.org/license/MS-PL":                                                                                   "MS-PL",
+	"opensource.org/license/MS-RL":                                                                                   "MS-RL",
+	"opensource.org/license/MirOS":                                                                                   "MirOS",
+	"opensource.org/license/Motosoto":                                                                                "Motosoto",
+	"opensource.org/license/Multics":                                                                                 "Multics",
+	"opensource.org/license/NASA-1.3":                                                                                "NASA-1.3",
+	"opensource.org/license/NCSA":                                                                                    "NCSA",
+	"opensource.org/license/NGPL":                                                                                    "NGPL",
+	"opensource.org/license/NPOSL-3.0":                                                                               "NPOSL-3.0",
+	"opensource.org/license/NTP":                                                                                     "NTP",
+	"opensource.org/license/Naumen":                                                                                  "Naumen",
+	"opensource.org/license/Nokia":                                                                                   "Nokia",
+	"opensource.org/license/OCLC-2.0":                                                                                "OCLC-2.0",
+	"opensource.org/license/OFL-1.1":                                                                                 "OFL-1.1-no-RFN",
+	"opensource.org/license/OGTSL":                                                                                   "OGTSL",
+	"opensource.org/license/OLFL-1.3":                                                                                "OLFL-1.3",
+	"opensource.org/license/OSC-1.0":                                                                                 "OSC-1.0",
+	"opensource.org/license/OSET-PL-2.1":                                                                             "OSET-PL-2.1",
+	"opensource.org/license/OSL-1.0":                                                                                 "OSL-1.0",
+	"opensource.org/license/OSL-2.1":                                                                                 "OSL-2.1",
+	"opensource.org/license/OSL-3.0":                                                                                 "OSL-3.0",
+	"opensource.org/license/PHP-3.0":                                                                                 "PHP-3.0",
+	"opensource.org/license/PSF-2-0":                                                                                 "PSF-2.0",
+	"opensource.org/license/PostgreSQL":                                                                              "PostgreSQL",
+	"opensource.org/license/Python-2.0":                                                                              "Python-2.0",
+	"opensource.org/license/Python-2.0.1":                                                                            "Python-2.0.1",
+	"opensource.org/license/QPL-1.0":                                                                                 "QPL-1.0",
+	"opensource.org/license/RPL-1.1":                                                                                 "RPL-1.1",
+	"opensource.org/license/RPL-1.5":                                                                                 "RPL-1.5",
+	"opensource.org/license/RPSL-1.0":                                                                                "RPSL-1.0",
+	"opensource.org/license/RSCPL":                                                                                   "RSCPL",
+	"opensource.org/license/SISSL":                                                                                   "SISSL",
+	"opensource.org/license/SPL-1.0":                                                                                 "SPL-1.0",
+	"opensource.org/license/SiMPL-2.0":                                                                               "SimPL-2.0",
+	"opensource.org/license/Sleepycat":                                                                               "Sleepycat",
+	"opensource.org/license/UCL-1.0":                                                                                 "UCL-1.0",
+	"opensource.org/license/UPL-1.0":                                                                                 "UPL-1.0",
+	"opensource.org/license/VSL-1.0":                                                                                 "VSL-1.0",
+	"opensource.org/license/W3C":                                                                                     "W3C",
+	"opensource.org/license/Watcom-1.0":                                                                              "Watcom-1.0",
+	"opensource.org/license/Xnet":                                                                                    "Xnet",
+	"opensource.org/license/ZPL-2.0":                                                                                 "ZPL-2.0",
+	"opensource.org/license/Zlib":                                                                                    "Zlib",
+	"opensource.org/license/apache-1.1":                                                                              "Apache-1.1",
+	"opensource.org/license/apache-2.0":                                                                              "Apache-2.0",
+	"opensource.org/license/curl":                                                                                    "curl",
 	"oss.sgi.com/projects/FreeB/":                                                                                    "SGI-B-1.1",
 	"oss.sgi.com/projects/FreeB/SGIFreeSWLicB.1.0.html":                                                              "SGI-B-1.0",
 	"oss.sgi.com/projects/FreeB/SGIFreeSWLicB.2.0.pdf":                                                               "SGI-B-2.0",
@@ -2082,37 +2131,40 @@ var urlToLicense = map[string]string{
 	"raw.githubusercontent.com/NTIA/scos-sensor/refs/heads/master/LICENSE.md":                                        "NTIA-PD",
 	"raw.githubusercontent.com/OpenMDW/OpenMDW/refs/heads/main/1.0/LICENSE.openmdw":                                  "OpenMDW-1.0",
 	"raw.githubusercontent.com/blackhole89/notekit/master/data/fonts/Charter%20license.txt":                          "Bitstream-Charter",
-	"rc.quest.com/topics/openssh/license.php#tcpwrappers":                                                            "TCP-wrappers",
-	"research.cs.wisc.edu/condor/license.html#condor":                                                                "Condor-1.1",
-	"research.scea.com/scea_shared_source_license.html":                                                              "SCEA",
-	"romanrm.net/mit-zero":                                                                                           "MIT-0",
-	"sam.zoy.org/wtfpl/COPYING":                                                                                      "WTFPL",
-	"scripts.sil.org/cms/scripts/page.php?item_id=OFL10_web":                                                         "OFL-1.0-no-RFN",
-	"scripts.sil.org/cms/scripts/page.php?item_id=OFL_web":                                                           "OFL-1.1-no-RFN",
-	"slicer.org/LICENSE":                                                                                             "3D-Slicer-1.0",
-	"solderpad.org/licenses/SHL-0.5/":                                                                                "SHL-0.5",
-	"solderpad.org/licenses/SHL-0.51/":                                                                               "SHL-0.51",
-	"source.icu-project.org/repos/icu/icu/trunk/license.html":                                                        "ICU",
-	"sourceforge.net/p/buddy/gitcode/ci/master/tree/README":                                                          "Buddy",
-	"sourceforge.net/p/ctrio/git/ci/master/tree/README":                                                              "ISC-Veillard",
-	"sourceforge.net/p/mcj/xfig/ci/master/tree/src/Makefile.am":                                                      "Xfig",
-	"sourceforge.net/p/netpbm/code/HEAD/tree/super_stable/converter/other/pnmtorle.c":                                "URT-RLE",
-	"sourceforge.net/p/netpbm/code/HEAD/tree/super_stable/converter/other/rletopnm.c":                                "URT-RLE",
-	"sourceforge.net/p/netpbm/code/HEAD/tree/super_stable/converter/ppm/ppmtompeg/jrevdct.c#l1189":                   "MPEG-SSG",
-	"sourceforge.net/p/netpbm/code/HEAD/tree/super_stable/editor/pnmstitch.c#l2":                                     "pnmstitch",
-	"sourceforge.net/p/netpbm/code/HEAD/tree/super_stable/netpbm.c#l8":                                               "HPND-Pbmplus",
-	"sourceforge.net/p/sbcl/sbcl/ci/master/tree/src/code/loop.lisp":                                                  "LOOP",
-	"sourceforge.net/p/trustedqsl/tqsl/ci/master/tree/LICENSE.txt":                                                   "TrustedQSL",
-	"sourceforge.net/p/xmedcon/code/ci/master/tree/libs/dicom/README":                                                "OFFIS",
-	"sourceforge.net/p/xmedcon/code/ci/master/tree/libs/ljpg/":                                                       "IJG-short",
-	"sourceforge.net/projects/sevenzip/files/LZMA%20SDK/":                                                            "LZMA-SDK-9.22",
-	"sources.debian.org/copyright/license/debianutils/4.11.2/":                                                       "SMAIL-GPL",
-	"sources.debian.org/src/openmpi/4.1.0-10/ompi/debuggers/msgq_interface.h/?hl=19#L19":                             "mpi-permissive",
-	"sources.gentoo.org/cgi-bin/viewvc.cgi/gentoo-x86/licenses/BitTorrent?r1=1.1&r2=1.1.1.1&diff_format=s":           "BitTorrent-1.0",
-	"sourceware.org/bzip2/1.0.5/bzip2-manual-1.0.5.html":                                                             "bzip2-1.0.6",
-	"sourceware.org/cgit/binutils-gdb/tree/include/coff/sym.h#n11":                                                   "MIPS",
-	"sourceware.org/cgit/binutils-gdb/tree/include/coff/symconst.h#n11":                                              "ThirdEye",
-	"sourceware.org/cgit/valgrind/tree/mpi/libmpiwrap.c":                                                             "bzip2-1.0.6",
+	"raw.githubusercontent.com/landtuna/open-mtools/6c04c2882eca7c4313ec267766ea53ac9bfe129b/mdump.c": "Informatica",
+	"raw.githubusercontent.com/landtuna/open-mtools/6c04c2882eca7c4313ec267766ea53ac9bfe129b/msend.c": "Informatica",
+	"rc.quest.com/topics/openssh/license.php#tcpwrappers":                                             "TCP-wrappers",
+	"research.cs.wisc.edu/condor/license.html#condor":                                                 "Condor-1.1",
+	"research.scea.com/scea_shared_source_license.html":                                               "SCEA",
+	"romanrm.net/mit-zero":                                                                                                                       "MIT-0",
+	"sam.zoy.org/wtfpl/COPYING":                                                                                                                  "WTFPL",
+	"scancode-licensedb.aboutcode.org/bsd-unchanged":                                                                                             "BSD-2-Clause-pos-unchanged",
+	"scripts.sil.org/cms/scripts/page.php?item_id=OFL10_web":                                                                                     "OFL-1.0-no-RFN",
+	"scripts.sil.org/cms/scripts/page.php?item_id=OFL_web":                                                                                       "OFL-1.1-no-RFN",
+	"slicer.org/LICENSE":                                                                                                                         "3D-Slicer-1.0",
+	"solderpad.org/licenses/SHL-0.5/":                                                                                                            "SHL-0.5",
+	"solderpad.org/licenses/SHL-0.51/":                                                                                                           "SHL-0.51",
+	"source.icu-project.org/repos/icu/icu/trunk/license.html":                                                                                    "ICU",
+	"sourceforge.net/p/buddy/gitcode/ci/master/tree/README":                                                                                      "Buddy",
+	"sourceforge.net/p/ctrio/git/ci/master/tree/README":                                                                                          "ISC-Veillard",
+	"sourceforge.net/p/mcj/xfig/ci/master/tree/src/Makefile.am":                                                                                  "Xfig",
+	"sourceforge.net/p/netpbm/code/HEAD/tree/super_stable/converter/other/pnmtorle.c":                                                            "URT-RLE",
+	"sourceforge.net/p/netpbm/code/HEAD/tree/super_stable/converter/other/rletopnm.c":                                                            "URT-RLE",
+	"sourceforge.net/p/netpbm/code/HEAD/tree/super_stable/converter/ppm/ppmtompeg/jrevdct.c#l1189":                                               "MPEG-SSG",
+	"sourceforge.net/p/netpbm/code/HEAD/tree/super_stable/editor/pnmstitch.c#l2":                                                                 "pnmstitch",
+	"sourceforge.net/p/netpbm/code/HEAD/tree/super_stable/netpbm.c#l8":                                                                           "HPND-Pbmplus",
+	"sourceforge.net/p/sbcl/sbcl/ci/master/tree/src/code/loop.lisp":                                                                              "LOOP",
+	"sourceforge.net/p/trustedqsl/tqsl/ci/master/tree/LICENSE.txt":                                                                               "TrustedQSL",
+	"sourceforge.net/p/xmedcon/code/ci/master/tree/libs/dicom/README":                                                                            "OFFIS",
+	"sourceforge.net/p/xmedcon/code/ci/master/tree/libs/ljpg/":                                                                                   "IJG-short",
+	"sourceforge.net/projects/sevenzip/files/LZMA%20SDK/":                                                                                        "LZMA-SDK-9.22",
+	"sources.debian.org/copyright/license/debianutils/4.11.2/":                                                                                   "SMAIL-GPL",
+	"sources.debian.org/src/openmpi/4.1.0-10/ompi/debuggers/msgq_interface.h/?hl=19#L19":                                                         "mpi-permissive",
+	"sources.gentoo.org/cgi-bin/viewvc.cgi/gentoo-x86/licenses/BitTorrent?r1=1.1&r2=1.1.1.1&diff_format=s":                                       "BitTorrent-1.0",
+	"sourceware.org/bzip2/1.0.5/bzip2-manual-1.0.5.html":                                                                                         "bzip2-1.0.6",
+	"sourceware.org/cgit/binutils-gdb/tree/include/coff/sym.h#n11":                                                                               "MIPS",
+	"sourceware.org/cgit/binutils-gdb/tree/include/coff/symconst.h#n11":                                                                          "ThirdEye",
+	"sourceware.org/cgit/valgrind/tree/mpi/libmpiwrap.c":                                                                                         "bzip2-1.0.6",
 	"sourceware.org/git/?p=binutils-gdb.git;a=blob;f=libiberty/strcasecmp.c;h=131d81c2ce7881fa48c363dc5bf5fb302c61ce0b;hb=HEAD":                  "BSD-4.3RENO",
 	"sourceware.org/git/?p=binutils-gdb.git;a=blob;f=readline/readline/support/wcwidth.c;h=0f5ec995796f4813abbcf4972aec0378ab74722a;hb=HEAD#l55": "HPND-Markus-Kuhn",
 	"sourceware.org/git/?p=bzip2.git;a=blob;f=LICENSE;hb=bzip2-1.0.6":                                                                            "bzip2-1.0.6",
@@ -2129,6 +2181,7 @@ var urlToLicense = map[string]string{
 	"tahoe-lafs.org/trac/tahoe-lafs/browser/trunk/COPYING.TGPPL.rst":                                                      "TGPPL-1.0",
 	"ti.arc.nasa.gov/opensource/nosa/":                                                                                    "NASA-1.3",
 	"trac.enlightenment.org/e/browser/trunk/imlib2/COPYING":                                                               "Imlib2",
+	"tunes.org/legalese/bugroff.html":                                                                                     "Bugroff",
 	"ubuntu.com/legal/font-licence":                                                                                       "Ubuntu-font-1.0",
 	"unlicense.org/":                                                                                                      "Unlicense",
 	"vimdoc.sourceforge.net/htmldoc/uganda.html":                                                                          "Vim",
@@ -2139,6 +2192,7 @@ var urlToLicense = map[string]string{
 	"web.archive.org/web/20041020171434/http://www.rosenlaw.com/osl2.0.html":                                              "OSL-2.0",
 	"web.archive.org/web/20050212003940/http://www.rosenlaw.com/osl21.htm":                                                "OSL-2.1",
 	"web.archive.org/web/20060319014854/http://info.borland.com/devsupport/interbase/opensource/IPL.html":                 "Interbase-1.0",
+	"web.archive.org/web/20061013013632/http://opensource.linux-mirror.org/licenses/afl-2.1.txt":                          "AFL-2.1",
 	"web.archive.org/web/20080207013128/http://www.gnome.org/fonts/":                                                      "Bitstream-Vera",
 	"web.archive.org/web/20100302225219/http://www.zimbra.com/license/zimbra-public-license-1-3.html":                     "Zimbra-1.3",
 	"web.archive.org/web/20111123062036/http://research.cs.wisc.edu/condor/license.html#condor":                           "Condor-1.1",
@@ -2243,11 +2297,11 @@ var urlToLicense = map[string]string{
 	"www.jython.org/license.html":                                                         "CNRI-Jython",
 	"www.kermitproject.org/ck90.html#source":                                              "HPND-export-US",
 	"www.kernel.org/doc/man-pages/licenses.html":                                          "Linux-man-pages-copyleft",
+	"www.latex-project.org/lppl/LPPL-1.3c.txt":                                            "LPPL-1.3c",
 	"www.latex-project.org/lppl/lppl-1-0.txt":                                             "LPPL-1.0",
 	"www.latex-project.org/lppl/lppl-1-1.txt":                                             "LPPL-1.1",
 	"www.latex-project.org/lppl/lppl-1-2.txt":                                             "LPPL-1.2",
 	"www.latex-project.org/lppl/lppl-1-3a.txt":                                            "LPPL-1.3a",
-	"www.latex-project.org/lppl/lppl-1-3c.txt":                                            "LPPL-1.3c",
 	"www.lemis.com/grog/UNIX/ancient-source-all.pdf":                                      "Caldera",
 	"www.libpng.org/pub/png/src/libpng-LICENSE.txt":                                       "libpng-2.0",
 	"www.mail-archive.com/debian-bugs-rc@lists.debian.org/msg11494.html":                  "Symlinks",
@@ -2269,16 +2323,17 @@ var urlToLicense = map[string]string{
 	"www.netlib.org/lapack/LICENSE.txt":                                                   "BSD-3-Clause-Open-MPI",
 	"www.netlib.org/minpack/disclaimer":                                                   "Minpack",
 	"www.networkcultures.org/_uploads/%233notebook_telekommunist.pdf":                     "PPL",
-	"www.oclc.org/research/activities/software/license/v2final.htm":                       "OCLC-2.0",
-	"www.ogc.org/ogc/software/1.0":                                                        "OGC-1.0",
-	"www.ohwr.org/project/cernohl/wikis/Documents/CERN-OHL-version-2":                     "CERN-OHL-W-2.0",
-	"www.ohwr.org/project/licenses/wikis/cern-ohl-v1.1":                                   "CERN-OHL-1.1",
-	"www.ohwr.org/project/licenses/wikis/cern-ohl-v1.2":                                   "CERN-OHL-1.2",
-	"www.open-mpi.org/community/license.php":                                              "BSD-3-Clause-Open-MPI",
-	"www.opencascade.com/content/occt-public-license":                                     "OCCT-PL",
-	"www.opendatacommons.org/licenses/odbl/1.0/":                                          "ODbL-1.0",
-	"www.opengroup.org/testing/downloads/The_Open_Group_TSL.txt":                          "OGTSL",
-	"www.openhub.net/licenses/mslpl":                                                      "MS-LPL",
+	"www.nist.gov/open/copyright-fair-use-and-licensing-statements-srd-data-software-and-technical-series-publications": "NIST-Software",
+	"www.oclc.org/research/activities/software/license/v2final.htm":                                                     "OCLC-2.0",
+	"www.ogc.org/ogc/software/1.0":                                                                                  "OGC-1.0",
+	"www.ohwr.org/project/cernohl/wikis/Documents/CERN-OHL-version-2":                                               "CERN-OHL-W-2.0",
+	"www.ohwr.org/project/licenses/wikis/cern-ohl-v1.1":                                                             "CERN-OHL-1.1",
+	"www.ohwr.org/project/licenses/wikis/cern-ohl-v1.2":                                                             "CERN-OHL-1.2",
+	"www.open-mpi.org/community/license.php":                                                                        "BSD-3-Clause-Open-MPI",
+	"www.opencascade.com/content/occt-public-license":                                                               "OCCT-PL",
+	"www.opendatacommons.org/licenses/odbl/1.0/":                                                                    "ODbL-1.0",
+	"www.opengroup.org/testing/downloads/The_Open_Group_TSL.txt":                                                    "OGTSL",
+	"www.openhub.net/licenses/mslpl":                                                                                "MS-LPL",
 	"www.openldap.org/devel/gitweb.cgi?p=openldap.git;a=blob;f=LICENSE;hb=1cae062821881f41b73012ba816434897abf4205": "OLDAP-2.6",
 	"www.openldap.org/devel/gitweb.cgi?p=openldap.git;a=blob;f=LICENSE;hb=37b4b3f6cc4bf34e1d3dec61e69914b9819d8894": "NBPL-1.0",
 	"www.openldap.org/devel/gitweb.cgi?p=openldap.git;a=blob;f=LICENSE;hb=42b0383c50c299977b5893ee695cf4e486fb0dc7": "OLDAP-1.2",
@@ -2301,7 +2356,7 @@ var urlToLicense = map[string]string{
 	"www.opensource.apple.com/license/apsl/":                                                             "APSL-2.0",
 	"www.opensource.apple.com/source/IOSerialFamily/IOSerialFamily-7/APPLE_LICENSE":                      "APSL-1.1",
 	"www.opensource.apple.com/source/tcl/tcl-5/tcl/generic/regfronts.c":                                  "Spencer-99",
-	"www.opensource.org/licenses/EPL-2.0":                                                                "EPL-2.0",
+	"www.opensource.org/license/EPL-2.0":                                                                 "EPL-2.0",
 	"www.openssl.org/source/license.html":                                                                "OpenSSL",
 	"www.osetfoundation.org/public-license":                                                              "OSET-PL-2.1",
 	"www.parliament.uk/site-information/copyright-parliament/open-parliament-licence/":                   "OPL-UK-3.0",
@@ -123,6 +123,96 @@ func TestLicenseByURL_AlternateScheme(t *testing.T) {
 	}
 }

+func TestLicenseByURL_OpenSourceOrgVariants(t *testing.T) {
+	// SPDX has changed the form of opensource.org URLs across list versions (e.g. 3.29.0 moved
+	// opensource.org/licenses/MIT to opensource.org/license/MIT); every form should keep resolving.
+	tests := []struct {
+		name   string
+		url    string
+		wantID string
+	}{
+		{name: "old plural path", url: "http://opensource.org/licenses/MIT", wantID: "MIT"},
+		{name: "new singular path", url: "https://opensource.org/license/MIT", wantID: "MIT"},
+		{name: "lowercase with trailing slash", url: "https://opensource.org/license/mit/", wantID: "MIT"},
+		{name: "plural path with trailing slash", url: "https://opensource.org/licenses/MIT/", wantID: "MIT"},
+		{name: "www prefix", url: "https://www.opensource.org/licenses/MIT", wantID: "MIT"},
+		{name: "uppercase host", url: "https://WWW.OpenSource.org/licenses/MIT", wantID: "MIT"},
+		{name: "old plural path BSD-3-Clause", url: "https://opensource.org/licenses/BSD-3-Clause", wantID: "BSD-3-Clause"},
+		{name: "new singular path BSD-3-Clause", url: "https://opensource.org/license/BSD-3-Clause", wantID: "BSD-3-Clause"},
+		{name: "lowercase BSD-3-Clause", url: "https://opensource.org/licenses/bsd-3-clause", wantID: "BSD-3-Clause"},
+		{name: "old plural path Apache-2.0", url: "http://opensource.org/licenses/Apache-2.0", wantID: "Apache-2.0"},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			info, found := LicenseByURL(tt.url)
+			if !found {
+				t.Fatalf("LicenseByURL(%q) found = false, want true", tt.url)
+			}
+			if info.ID != tt.wantID {
+				t.Errorf("LicenseByURL(%q) ID = %v, want %v", tt.url, info.ID, tt.wantID)
+			}
+		})
+	}
+}
+
+func TestLicenseByURL_NonOpenSourceOrgStaysExact(t *testing.T) {
+	// the relaxed matching is scoped to opensource.org; other hosts may have case-sensitive paths
+	if _, found := LicenseByURL("https://www.apache.org/licenses/license-2.0"); found {
+		t.Errorf("LicenseByURL() found = true for case-altered non-opensource.org URL, want false")
+	}
+	if _, found := LicenseByURL("https://opensource.org/licenses/not-a-real-license"); found {
+		t.Errorf("LicenseByURL() found = true for unknown opensource.org URL, want false")
+	}
+}
+
+func TestNormalizeOpenSourceOrgURL(t *testing.T) {
+	tests := []struct {
+		url    string
+		want   string
+		wantOK bool
+	}{
+		{url: "opensource.org/licenses/MIT", want: "opensource.org/license/mit", wantOK: true},
+		{url: "opensource.org/license/mit/", want: "opensource.org/license/mit", wantOK: true},
+		{url: "www.opensource.org/licenses/EPL-2.0", want: "opensource.org/license/epl-2.0", wantOK: true},
+		{url: "lists.opensource.org/pipermail/license-discuss", wantOK: false},
+		{url: "www.apache.org/licenses/LICENSE-2.0", wantOK: false},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.url, func(t *testing.T) {
+			got, ok := normalizeOpenSourceOrgURL(tt.url)
+			if ok != tt.wantOK {
+				t.Fatalf("normalizeOpenSourceOrgURL(%q) ok = %v, want %v", tt.url, ok, tt.wantOK)
+			}
+			if got != tt.want {
+				t.Errorf("normalizeOpenSourceOrgURL(%q) = %q, want %q", tt.url, got, tt.want)
+			}
+		})
+	}
+}
+
+func TestBuildOpenSourceOrgURLToLicense(t *testing.T) {
+	index := buildOpenSourceOrgURLToLicense(map[string]string{
+		"opensource.org/licenses/MIT": "MIT",
+		"opensource.org/license/mit/": "MIT",
+		"opensource.org/licenses/Foo": "Foo-1.0",
+		"opensource.org/license/foo":  "Foo-2.0",
+		"opensource.org/license/FOO/": "Foo-1.0",
+		"www.apache.org/licenses/Bar": "Bar",
+	})
+
+	if got := index["opensource.org/license/mit"]; got != "MIT" {
+		t.Errorf("index[mit] = %q, want MIT", got)
+	}
+	if got, exists := index["opensource.org/license/foo"]; exists {
+		t.Errorf("index[foo] = %q, want no entry for URL forms mapping to different licenses", got)
+	}
+	if len(index) != 1 {
+		t.Errorf("len(index) = %d, want 1 (non-opensource.org URLs excluded): %v", len(index), index)
+	}
+}
+
 func TestStripScheme(t *testing.T) {
 	tests := []struct {
 		name string
@@ -0,0 +1,330 @@
+// Package spillbuf provides a sparse, offset-addressed byte buffer that keeps a bounded amount in memory
+// and spills the rest to a temp file.
+//
+// It exists for the shape where output arrives out of order, at offsets the input itself declares: a
+// decompressor placing extents, an archive rebuilding a file from chunks. A plain []byte cannot do that
+// without either pre-sizing to a length the input claims or growing to the furthest offset it names, and
+// both hand a hostile input an allocation knob.
+//
+// The buffer reports only what it actually stored. Size is the contiguous run written from offset zero,
+// and a read past it is io.EOF rather than the zeros an unwritten region would otherwise hand back. That
+// distinction is the whole point: sparse storage serves holes as zeros for free, so a reader that reported
+// a length covering them would let a write offset stand in for real output. Anything sizing an allocation
+// against this reader (debug/elf's saferio does exactly that) would then allocate bytes nothing produced.
+//
+// Allocation is bounded by the memory limit rather than by how much is written: filling 1MB and filling
+// 64MB cost about the same, because everything past the limit goes to the file. Only memory is bounded
+// here: how much ends up on disk is whatever the caller writes, so bounding that stays the caller's job.
+package spillbuf
+
+import (
+	"errors"
+	"fmt"
+	"io"
+	"math"
+	"os"
+	"slices"
+
+	"github.com/anchore/syft/internal/tmpdir"
+)
+
+// DefaultMemLimit is how much a buffer keeps in memory before it spills, when the caller does not say.
+// Small on purpose: the memory tier saves a temp file for the common small case, it is not a place to
+// hold output. A limit large enough to matter is a limit large enough to be an amplification path.
+const DefaultMemLimit int64 = 1 << 20 // 1MB
+
+// ErrNoTempDir is returned when a buffer needs to spill and has nowhere to spill to.
+var ErrNoTempDir = errors.New("no temp dir available to spill to")
+
+// Buffer is a sparse, offset-addressed buffer. The zero value is not usable; call New.
+//
+// Storage is two tiers with a fixed boundary: bytes below memLimit live in mem, bytes at or past it live
+// in file. Nothing ever moves between them, so an offset belongs to exactly one tier for the life of the
+// buffer and the only case needing care is a range that straddles the boundary.
+//
+// Not safe for concurrent use. Every consumer writes from a single goroutine, and guarding it would cost
+// each write an uncontended lock for no reader.
+type Buffer struct {
+	td       *tmpdir.TempDir
+	memLimit int64
+
+	// mem holds [0, memLimit). Grown geometrically to fit what has been written, never past the limit.
+	mem []byte
+
+	// file holds [memLimit, ...), created on the first write that reaches there, so a buffer that stays
+	// small never touches disk. remove deletes it on Close.
+	file   *os.File
+	remove func()
+
+	// written is the set of ranges stored, sorted by start and merged, so runs of adjacent writes collapse
+	// to one entry rather than growing per call. Everything the buffer reports comes from it.
+	written []extent
+
+	closed bool
+}
+
+// extent is a half-open byte range that has been written.
+//
+// Unexported on purpose. What a caller needs to know about the contents is answered by Size and FirstGap;
+// handing out the bookkeeping invites re-deriving those at the call site and getting them subtly wrong,
+// which is the bug this package exists to prevent.
+type extent struct {
+	start, end int64
+}
+
+// Option configures a Buffer.
+type Option func(*Buffer)
+
+// WithMemLimit sets how many bytes are held in memory before the buffer spills to disk. Zero sends every
+// write to the temp file. Negative is treated as zero.
+//
+// Peak allocation is a small multiple of this, since growing the tier holds the old copy alongside the
+// new one and the new one may be rounded up past what was asked for.
+func WithMemLimit(n int64) Option {
+	return func(b *Buffer) {
+		b.memLimit = max(n, 0)
+	}
+}
+
+// New returns a buffer that spills into td.
+//
+// td may be nil only when every write is known to stay inside the memory limit; a write past it then
+// fails with ErrNoTempDir rather than allocating. Nothing is created on disk until a write needs it.
+func New(td *tmpdir.TempDir, opts ...Option) *Buffer {
+	b := &Buffer{td: td, memLimit: DefaultMemLimit}
+	for _, opt := range opts {
+		opt(b)
+	}
+	return b
+}
+
+// split divides a range of n bytes starting at off across the two tiers, reporting how many bytes fall in
+// each. The file portion starts at off+inMem.
+func (b *Buffer) split(off, n int64) (inMem, inFile int64) {
+	if off >= b.memLimit {
+		return 0, n
+	}
+	inMem = min(n, b.memLimit-off)
+	return inMem, n - inMem
+}
+
+// fileOffset translates a buffer offset at or past the limit into an offset within the spill file.
+func (b *Buffer) fileOffset(off int64) int64 { return off - b.memLimit }
+
+// WriteAt stores p at off. Writes may land anywhere, in any order, and may overlap. A write that fails
+// leaves the buffer as it was.
+func (b *Buffer) WriteAt(p []byte, off int64) (int, error) {
+	if b.closed {
+		return 0, fmt.Errorf("spillbuf: write to a closed buffer: %w", os.ErrClosed)
+	}
+	if off < 0 {
+		return 0, fmt.Errorf("spillbuf: negative offset %d", off)
+	}
+	if len(p) == 0 {
+		return 0, nil
+	}
+	// subtraction form so off+len(p) cannot wrap into a small in-range end
+	if off > math.MaxInt64-int64(len(p)) {
+		return 0, fmt.Errorf("spillbuf: write of %d bytes at %d overflows", len(p), off)
+	}
+
+	inMem, inFile := b.split(off, int64(len(p)))
+	// the fallible half goes first: once the memory tier is stamped the old bytes are gone, so a file
+	// write that fails afterward would report failure over a buffer it had already changed
+	if inFile > 0 {
+		if err := b.writeFile(p[inMem:], b.fileOffset(off+inMem)); err != nil {
+			return 0, err
+		}
+	}
+	if inMem > 0 {
+		b.writeMem(p[:inMem], off)
+	}
+
+	b.record(extent{start: off, end: off + int64(len(p))})
+	return len(p), nil
+}
+
+func (b *Buffer) writeMem(p []byte, off int64) {
+	if need := off + int64(len(p)); int64(len(b.mem)) < need {
+		// geometric, capped at the limit. Sizing to exactly what each write needs looks tidier and is
+		// quadratic: a caller streaming a block in 32KB chunks reallocates and copies the whole tier every
+		// chunk, so filling 1MB costs ~16MB of allocation.
+		grown := min(b.memLimit, max(need, 2*int64(len(b.mem))))
+		// sized to exactly the geometric target rather than grown through append: append rounds the new
+		// capacity up past what was asked for, and the tier is already capped, so the slack is pure waste
+		mem := make([]byte, grown)
+		copy(mem, b.mem)
+		b.mem = mem
+	}
+	copy(b.mem[off:], p)
+}
+
+func (b *Buffer) writeFile(p []byte, off int64) error {
+	if b.file == nil {
+		if b.td == nil {
+			return ErrNoTempDir
+		}
+		f, remove, err := b.td.NewFile("syft-spill-*.bin") //nolint:gocritic // removal happens in Close
+		if err != nil {
+			return fmt.Errorf("spillbuf: unable to create spill file: %w", err)
+		}
+		b.file, b.remove = f, remove
+	}
+	if _, err := b.file.WriteAt(p, off); err != nil {
+		return fmt.Errorf("spillbuf: unable to write to spill file: %w", err)
+	}
+	return nil
+}
+
+// ReadAt returns bytes this buffer actually stored. A read starting at or past Size is io.EOF, and one
+// running past it is short, because everything beyond is a hole the buffer never held.
+func (b *Buffer) ReadAt(p []byte, off int64) (int, error) {
+	if b.closed {
+		return 0, fmt.Errorf("spillbuf: read from a closed buffer: %w", os.ErrClosed)
+	}
+	if off < 0 {
+		return 0, fmt.Errorf("spillbuf: negative offset %d", off)
+	}
+	if len(p) == 0 {
+		return 0, nil
+	}
+	size := b.Size()
+	if off >= size {
+		return 0, io.EOF
+	}
+
+	// bounded by Size, so every byte in [off, off+want) was written and both tiers really hold theirs
+	want := min(int64(len(p)), size-off)
+	inMem, inFile := b.split(off, want)
+
+	// guarded rather than relying on a zero-length copy: when off is past the limit the slice expression
+	// itself is out of range, since mem is only as long as what was written into it
+	if inMem > 0 {
+		copy(p[:inMem], b.mem[off:off+inMem])
+	}
+	if inFile > 0 {
+		if err := readFullAt(b.file, p[inMem:want], b.fileOffset(off+inMem)); err != nil {
+			return int(inMem), fmt.Errorf("spillbuf: unable to read spill file: %w", err)
+		}
+	}
+
+	if want < int64(len(p)) {
+		return int(want), io.EOF
+	}
+	return int(want), nil
+}
+
+// readFullAt fills p from r. A short read is an error rather than a short return: the caller has already
+// bounded the range by what was written, so the file failing to deliver means it is not what we left.
+func readFullAt(r io.ReaderAt, p []byte, off int64) error {
+	for read := 0; read < len(p); {
+		n, err := r.ReadAt(p[read:], off+int64(read))
+		read += n
+		if err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+// Size reports the contiguous run written from offset zero, which is the length this buffer is willing to
+// stand behind. Deliberately not the furthest offset written: see the package doc for why the two are not
+// interchangeable.
+//
+// record keeps the set merged and sorted, so the run from zero is at most the first two entries and the
+// loop stops there: the cost this adds to every ReadAt is effectively constant, not a scan of the set.
+func (b *Buffer) Size() int64 {
+	var covered int64
+	for _, e := range b.written {
+		if e.start > covered {
+			break
+		}
+		covered = max(covered, e.end)
+	}
+	return covered
+}
+
+// FirstGap returns the offset of the earliest unwritten run of at least size bytes lying entirely within
+// [0, within), and whether there is one. Callers that place output at offsets of their own choosing use it
+// to fill what they left behind, without needing the buffer's bookkeeping.
+//
+// The arithmetic is in subtraction form throughout: within comes from caller input and the result is used
+// as a write offset, so a wrap here would be a write nobody bounded.
+func (b *Buffer) FirstGap(size, within int64) (int64, bool) {
+	if b.closed || size < 0 || within < 0 {
+		return 0, false
+	}
+
+	var at int64
+	for _, e := range b.written {
+		// once the cursor is at the bound there is nothing left to offer, and it only moves forward
+		if at >= within {
+			return 0, false
+		}
+		// the gap ahead of this extent ends at whichever comes first, the extent or the bound
+		end := min(e.start, within)
+		if end > at && end-at >= size {
+			return at, true
+		}
+		at = max(at, e.end)
+	}
+	if at <= within && within-at >= size {
+		return at, true
+	}
+	return 0, false
+}
+
+// record merges e into the written set, keeping it sorted by start with no overlapping or adjacent pairs.
+func (b *Buffer) record(e extent) {
+	if e.end <= e.start {
+		return
+	}
+
+	// inserted in place rather than appended and re-sorted: the set is already ordered, so a run of
+	// ascending writes (the common case) stays linear
+	i, _ := slices.BinarySearchFunc(b.written, e, func(x, y extent) int {
+		return cmpInt64(x.start, y.start)
+	})
+	b.written = slices.Insert(b.written, i, e)
+
+	merged := b.written[:1]
+	for _, cur := range b.written[1:] {
+		last := &merged[len(merged)-1]
+		if cur.start <= last.end {
+			last.end = max(last.end, cur.end)
+			continue
+		}
+		merged = append(merged, cur)
+	}
+	b.written = merged
+}
+
+func cmpInt64(x, y int64) int {
+	switch {
+	case x < y:
+		return -1
+	case x > y:
+		return 1
+	}
+	return 0
+}
+
+// Close releases the spill file, if one was ever created, and drops the memory tier. Safe on a nil
+// receiver and safe to call more than once. Reads and writes after it fail with os.ErrClosed.
+func (b *Buffer) Close() error {
+	if b == nil {
+		return nil
+	}
+	b.mem = nil
+	b.written = nil
+	b.closed = true
+	if b.file == nil {
+		return nil
+	}
+	err := b.file.Close()
+	if b.remove != nil {
+		b.remove()
+	}
+	b.file, b.remove = nil, nil
+	return err
+}
@@ -0,0 +1,864 @@
+package spillbuf
+
+import (
+	"bytes"
+	"errors"
+	"io"
+	"math"
+	"math/rand"
+	"os"
+	"path/filepath"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/anchore/syft/internal/testutils"
+	"github.com/anchore/syft/internal/tmpdir"
+)
+
+func newTestBuffer(t *testing.T, opts ...Option) *Buffer {
+	t.Helper()
+	b := New(tmpdir.FromPath(t.TempDir()), opts...)
+	t.Cleanup(func() { _ = b.Close() })
+	return b
+}
+
+func mustWrite(t *testing.T, b *Buffer, off int64, p []byte) {
+	t.Helper()
+	n, err := b.WriteAt(p, off)
+	require.NoError(t, err)
+	require.Equal(t, len(p), n, "WriteAt must report the full write")
+}
+
+// readAll returns everything the buffer is willing to hand back.
+func readAll(t *testing.T, b *Buffer) []byte {
+	t.Helper()
+	out := make([]byte, b.Size())
+	if len(out) == 0 {
+		return nil
+	}
+	n, err := b.ReadAt(out, 0)
+	require.NoError(t, err, "a read of exactly Size bytes is not short")
+	require.Equal(t, len(out), n)
+	return out
+}
+
+func repeat(b byte, n int) []byte { return bytes.Repeat([]byte{b}, n) }
+
+// --- the core property: report only what was stored -------------------------------------------------
+
+// TestSizeIsTheContiguousPrefix is the property the package exists for. A sparse buffer hands its holes
+// back as zeros it never stored, so reporting a length that covers them lets a write offset stand in for
+// real output: whatever sizes an allocation against this reader then allocates bytes nothing produced.
+func TestSizeIsTheContiguousPrefix(t *testing.T) {
+	tests := []struct {
+		name     string
+		writes   []extent // start is the offset, end-start the length
+		wantSize int64
+	}{
+		{
+			name:     "nothing written",
+			wantSize: 0,
+		},
+		{
+			name:     "one run from zero",
+			writes:   []extent{{0, 100}},
+			wantSize: 100,
+		},
+		{
+			name:     "a run that does not start at zero covers nothing",
+			writes:   []extent{{10, 100}},
+			wantSize: 0,
+		},
+		{
+			name:     "adjacent runs join",
+			writes:   []extent{{0, 50}, {50, 100}},
+			wantSize: 100,
+		},
+		{
+			name:     "a hole stops the prefix",
+			writes:   []extent{{0, 50}, {60, 100}},
+			wantSize: 50,
+		},
+		{
+			name:     "the hole is filled later",
+			writes:   []extent{{0, 50}, {60, 100}, {50, 60}},
+			wantSize: 100,
+		},
+		{
+			name:     "out of order still resolves",
+			writes:   []extent{{60, 100}, {0, 50}, {50, 60}},
+			wantSize: 100,
+		},
+		{
+			name:     "overlapping runs",
+			writes:   []extent{{0, 60}, {40, 100}},
+			wantSize: 100,
+		},
+		{
+			name:     "a run fully inside another",
+			writes:   []extent{{0, 100}, {20, 40}},
+			wantSize: 100,
+		},
+		{
+			name:     "far placement is not coverage",
+			writes:   []extent{{0, 64}, {1 << 20, 1<<20 + 64}},
+			wantSize: 64,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			b := newTestBuffer(t)
+			for _, w := range tt.writes {
+				mustWrite(t, b, w.start, repeat('x', int(w.end-w.start)))
+			}
+			assert.Equal(t, tt.wantSize, b.Size(), "Size is the contiguous prefix")
+		})
+	}
+}
+
+// TestReadPastSizeIsEOFNotZeros is the other half of the same property. Sparse storage returns zeros for
+// a hole for free; handing those out would make the hole indistinguishable from real content.
+func TestReadPastSizeIsEOFNotZeros(t *testing.T) {
+	b := newTestBuffer(t)
+	mustWrite(t, b, 0, repeat('A', 64))
+	mustWrite(t, b, 4096, repeat('B', 64)) // past a hole
+
+	require.Equal(t, int64(64), b.Size())
+
+	t.Run("a read starting in the hole is EOF", func(t *testing.T) {
+		p := make([]byte, 16)
+		n, err := b.ReadAt(p, 100)
+		assert.Zero(t, n)
+		assert.ErrorIs(t, err, io.EOF)
+	})
+
+	t.Run("a read starting at the far extent is EOF, not the bytes there", func(t *testing.T) {
+		p := make([]byte, 64)
+		n, err := b.ReadAt(p, 4096)
+		assert.Zero(t, n)
+		assert.ErrorIs(t, err, io.EOF)
+		assert.Equal(t, make([]byte, 64), p, "nothing may be copied out")
+	})
+
+	t.Run("a read running off the end is short and says so", func(t *testing.T) {
+		p := make([]byte, 128)
+		n, err := b.ReadAt(p, 0)
+		assert.Equal(t, 64, n, "only the stored prefix comes back")
+		assert.ErrorIs(t, err, io.EOF)
+		assert.Equal(t, repeat('A', 64), p[:64])
+		assert.Equal(t, make([]byte, 64), p[64:], "the rest is untouched")
+	})
+}
+
+// TestSparsePlacementIsNotAnAllocationKnob pins the amplification directly: a tiny payload parked at a
+// huge offset must not cost memory proportional to the offset.
+func TestSparsePlacementIsNotAnAllocationKnob(t *testing.T) {
+	const far = 512 << 20 // 512MB out
+
+	b := newTestBuffer(t, WithMemLimit(1<<20))
+	mustWrite(t, b, 0, repeat('A', 64))
+
+	allocated := testutils.MeasureAlloc(t, func() {
+		mustWrite(t, b, far, repeat('B', 64))
+	})
+	t.Logf("writing 64 bytes at offset %d allocated %d bytes", far, allocated)
+	assert.Less(t, allocated, uint64(1<<20),
+		"a far placement must cost its own bytes, not its offset")
+	assert.Equal(t, int64(64), b.Size(), "and it must not count toward what the buffer will deliver")
+}
+
+// --- tiers ------------------------------------------------------------------------------------------
+
+func TestMemoryTierNeverTouchesDisk(t *testing.T) {
+	dir := t.TempDir()
+	b := New(tmpdir.FromPath(dir), WithMemLimit(4096))
+	t.Cleanup(func() { _ = b.Close() })
+
+	mustWrite(t, b, 0, repeat('A', 4096)) // exactly the limit
+
+	assert.Equal(t, repeat('A', 4096), readAll(t, b))
+	assert.Nil(t, b.file, "a buffer that stays inside the limit must not create a file")
+	assert.Empty(t, dirEntries(t, dir), "and must leave nothing on disk")
+}
+
+func TestSpillCreatesTheFileOnlyWhenNeeded(t *testing.T) {
+	dir := t.TempDir()
+	b := New(tmpdir.FromPath(dir), WithMemLimit(4096))
+	t.Cleanup(func() { _ = b.Close() })
+
+	mustWrite(t, b, 0, repeat('A', 4096))
+	require.Empty(t, dirEntries(t, dir))
+
+	mustWrite(t, b, 4096, repeat('B', 1)) // one byte past the limit
+	assert.NotNil(t, b.file)
+	assert.Len(t, dirEntries(t, dir), 1, "exactly one spill file")
+}
+
+func TestWriteStraddlingTheLimit(t *testing.T) {
+	const limit = 1024
+	b := newTestBuffer(t, WithMemLimit(limit))
+
+	payload := make([]byte, 2048)
+	for i := range payload {
+		payload[i] = byte(i % 251)
+	}
+	// starts below the limit and ends well past it, so the write is split across both tiers
+	mustWrite(t, b, limit-512, payload)
+
+	require.Equal(t, int64(0), b.Size(), "nothing was written at zero yet")
+	mustWrite(t, b, 0, repeat('Z', limit-512))
+
+	got := readAll(t, b)
+	require.Len(t, got, limit-512+2048)
+	assert.Equal(t, repeat('Z', limit-512), got[:limit-512], "the memory-only part")
+	assert.Equal(t, payload, got[limit-512:], "the straddling part reads back whole")
+}
+
+func TestMemLimitZeroSendsEverythingToDisk(t *testing.T) {
+	dir := t.TempDir()
+	b := New(tmpdir.FromPath(dir), WithMemLimit(0))
+	t.Cleanup(func() { _ = b.Close() })
+
+	mustWrite(t, b, 0, repeat('A', 16))
+	assert.Equal(t, repeat('A', 16), readAll(t, b))
+	assert.Len(t, dirEntries(t, dir), 1, "with no memory tier the first byte spills")
+	assert.Nil(t, b.mem)
+}
+
+func TestNegativeMemLimitIsTreatedAsZero(t *testing.T) {
+	b := newTestBuffer(t, WithMemLimit(-1))
+	mustWrite(t, b, 0, repeat('A', 8))
+	assert.Equal(t, repeat('A', 8), readAll(t, b))
+}
+
+func TestDefaultMemLimitApplies(t *testing.T) {
+	b := New(nil)
+	t.Cleanup(func() { _ = b.Close() })
+	assert.Equal(t, DefaultMemLimit, b.memLimit)
+}
+
+// --- no temp dir ------------------------------------------------------------------------------------
+
+func TestNoTempDir(t *testing.T) {
+	t.Run("a write inside the memory limit needs no temp dir", func(t *testing.T) {
+		b := New(nil, WithMemLimit(4096))
+		t.Cleanup(func() { _ = b.Close() })
+
+		mustWrite(t, b, 0, repeat('A', 4096))
+		assert.Equal(t, repeat('A', 4096), readAll(t, b))
+	})
+
+	t.Run("a write past it fails rather than allocating", func(t *testing.T) {
+		b := New(nil, WithMemLimit(4096))
+		t.Cleanup(func() { _ = b.Close() })
+
+		_, err := b.WriteAt(repeat('B', 1), 4096)
+		require.Error(t, err)
+		assert.ErrorIs(t, err, ErrNoTempDir)
+	})
+}
+
+// --- input validation -------------------------------------------------------------------------------
+
+func TestWriteAtRejectsBadInput(t *testing.T) {
+	b := newTestBuffer(t)
+
+	t.Run("negative offset", func(t *testing.T) {
+		_, err := b.WriteAt([]byte("x"), -1)
+		assert.Error(t, err)
+	})
+
+	t.Run("an offset plus length that would overflow", func(t *testing.T) {
+		_, err := b.WriteAt(repeat('x', 16), math.MaxInt64-8)
+		require.Error(t, err)
+		assert.Contains(t, err.Error(), "overflow",
+			"the check must be a subtraction, not off+len wrapping into an in-range end")
+	})
+
+	t.Run("an empty write is a no-op, not an extent", func(t *testing.T) {
+		n, err := b.WriteAt(nil, 500)
+		require.NoError(t, err)
+		assert.Zero(t, n)
+		assert.Empty(t, b.written, "a zero-length write records nothing")
+	})
+}
+
+func TestReadAtRejectsBadInput(t *testing.T) {
+	b := newTestBuffer(t)
+	mustWrite(t, b, 0, repeat('A', 16))
+
+	t.Run("negative offset", func(t *testing.T) {
+		_, err := b.ReadAt(make([]byte, 4), -1)
+		assert.Error(t, err)
+	})
+
+	t.Run("empty read", func(t *testing.T) {
+		n, err := b.ReadAt(nil, 0)
+		assert.NoError(t, err)
+		assert.Zero(t, n)
+	})
+
+	t.Run("read from an empty buffer", func(t *testing.T) {
+		empty := newTestBuffer(t)
+		n, err := empty.ReadAt(make([]byte, 4), 0)
+		assert.Zero(t, n)
+		assert.ErrorIs(t, err, io.EOF)
+	})
+}
+
+// TestReadAtHonorsTheReaderAtContract pins what io.ReaderAt requires: a short read must come with a
+// non-nil error, and a full read must not invent one. Parsers built on io.ReaderAt (debug/elf among them)
+// rely on this to tell "the file ends here" from "try again".
+func TestReadAtHonorsTheReaderAtContract(t *testing.T) {
+	b := newTestBuffer(t, WithMemLimit(64))
+	mustWrite(t, b, 0, repeat('A', 200)) // spans both tiers
+
+	for _, size := range []int{1, 63, 64, 65, 199, 200} {
+		p := make([]byte, size)
+		n, err := b.ReadAt(p, 0)
+		assert.Equal(t, size, n, "size=%d", size)
+		assert.NoError(t, err, "a read fully inside the buffer must not report EOF (size=%d)", size)
+	}
+
+	p := make([]byte, 201)
+	n, err := b.ReadAt(p, 0)
+	assert.Equal(t, 200, n)
+	assert.ErrorIs(t, err, io.EOF, "one byte past the end is short and must say so")
+}
+
+func TestReadAtEveryOffsetAndLength(t *testing.T) {
+	const limit = 32
+	b := newTestBuffer(t, WithMemLimit(limit))
+
+	want := make([]byte, 100)
+	for i := range want {
+		want[i] = byte(i)
+	}
+	mustWrite(t, b, 0, want)
+
+	// every offset x length pair, so a tier-boundary off-by-one cannot hide
+	for off := 0; off <= len(want); off++ {
+		for l := 0; l <= len(want)-off+2; l++ {
+			p := make([]byte, l)
+			n, err := b.ReadAt(p, int64(off))
+
+			expected := len(want) - off
+			if l < expected {
+				expected = l
+			}
+			assert.Equal(t, expected, n, "off=%d len=%d", off, l)
+			assert.Equal(t, want[off:off+expected], p[:expected], "off=%d len=%d", off, l)
+
+			switch {
+			case l == 0:
+				assert.NoError(t, err, "off=%d len=0", off)
+			case off >= len(want):
+				assert.ErrorIs(t, err, io.EOF, "off=%d len=%d", off, l)
+			case l > expected:
+				assert.ErrorIs(t, err, io.EOF, "off=%d len=%d", off, l)
+			default:
+				assert.NoError(t, err, "off=%d len=%d", off, l)
+			}
+		}
+	}
+}
+
+// --- overwrite semantics ----------------------------------------------------------------------------
+
+func TestOverwrite(t *testing.T) {
+	tests := []struct {
+		name     string
+		memLimit int64
+	}{
+		{"in memory", 1 << 20},
+		{"on disk", 0},
+		{"across the boundary", 8},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			b := newTestBuffer(t, WithMemLimit(tt.memLimit))
+			mustWrite(t, b, 0, repeat('A', 16))
+			mustWrite(t, b, 4, repeat('B', 8))
+
+			want := append(append(repeat('A', 4), repeat('B', 8)...), repeat('A', 4)...)
+			assert.Equal(t, want, readAll(t, b), "the later write wins over the range it covers")
+			assert.Equal(t, int64(16), b.Size(), "an overwrite does not extend the buffer")
+		})
+	}
+}
+
+// --- extents ----------------------------------------------------------------------------------------
+
+func TestWrittenExtentsAreSortedAndMerged(t *testing.T) {
+	tests := []struct {
+		name   string
+		writes []extent
+		want   []extent
+	}{
+		{
+			name:   "disjoint stay separate, in order",
+			writes: []extent{{100, 150}, {0, 50}},
+			want:   []extent{{0, 50}, {100, 150}},
+		},
+		{
+			name:   "adjacent merge",
+			writes: []extent{{0, 50}, {50, 100}},
+			want:   []extent{{0, 100}},
+		},
+		{
+			name:   "overlapping merge",
+			writes: []extent{{0, 60}, {40, 100}},
+			want:   []extent{{0, 100}},
+		},
+		{
+			name:   "a write bridging two runs collapses all three",
+			writes: []extent{{0, 20}, {80, 100}, {20, 80}},
+			want:   []extent{{0, 100}},
+		},
+		{
+			name:   "a contained write changes nothing",
+			writes: []extent{{0, 100}, {20, 40}},
+			want:   []extent{{0, 100}},
+		},
+		{
+			name:   "identical writes collapse",
+			writes: []extent{{0, 10}, {0, 10}, {0, 10}},
+			want:   []extent{{0, 10}},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			b := newTestBuffer(t)
+			for _, w := range tt.writes {
+				mustWrite(t, b, w.start, repeat('x', int(w.end-w.start)))
+			}
+			assert.Equal(t, tt.want, b.written)
+		})
+	}
+}
+
+func TestWrittenExtentsStayCompactUnderManyAdjacentWrites(t *testing.T) {
+	b := newTestBuffer(t)
+	for i := int64(0); i < 1000; i++ {
+		mustWrite(t, b, i*8, repeat('A', 8))
+	}
+	assert.Len(t, b.written, 1, "a run of adjacent writes must collapse to one extent, not 1000")
+	assert.Equal(t, int64(8000), b.Size())
+}
+
+// --- lifecycle --------------------------------------------------------------------------------------
+
+func TestCloseRemovesTheSpillFile(t *testing.T) {
+	dir := t.TempDir()
+	b := New(tmpdir.FromPath(dir), WithMemLimit(0))
+	mustWrite(t, b, 0, repeat('A', 32))
+	require.Len(t, dirEntries(t, dir), 1)
+
+	require.NoError(t, b.Close())
+	assert.Empty(t, dirEntries(t, dir), "Close must take the spill file with it")
+}
+
+func TestCloseIsIdempotent(t *testing.T) {
+	b := New(tmpdir.FromPath(t.TempDir()), WithMemLimit(0))
+	mustWrite(t, b, 0, repeat('A', 32))
+
+	require.NoError(t, b.Close())
+	assert.NoError(t, b.Close(), "a second Close is a no-op, not a double-close")
+	assert.NoError(t, b.Close())
+}
+
+func TestCloseOnNilReceiver(t *testing.T) {
+	var b *Buffer
+	assert.NotPanics(t, func() {
+		assert.NoError(t, b.Close())
+	})
+}
+
+func TestCloseWithoutASpillFile(t *testing.T) {
+	b := New(nil, WithMemLimit(1<<20))
+	mustWrite(t, b, 0, repeat('A', 32))
+	assert.NoError(t, b.Close(), "a memory-only buffer closes cleanly with no file to remove")
+}
+
+func TestWriteAfterCloseFails(t *testing.T) {
+	b := New(tmpdir.FromPath(t.TempDir()))
+	mustWrite(t, b, 0, repeat('A', 8))
+	require.NoError(t, b.Close())
+
+	_, err := b.WriteAt(repeat('B', 8), 0)
+	require.Error(t, err, "a closed buffer must refuse writes rather than resurrect its file")
+	assert.ErrorIs(t, err, os.ErrClosed)
+}
+
+// TestReadAfterCloseFails pins that a closed buffer reads as closed rather than as empty. Close drops the
+// extents, so without the check every read would come back io.EOF and a caller could not tell a buffer it
+// still owns from one somebody already released.
+func TestReadAfterCloseFails(t *testing.T) {
+	b := New(tmpdir.FromPath(t.TempDir()))
+	mustWrite(t, b, 0, repeat('A', 8))
+	require.NoError(t, b.Close())
+
+	n, err := b.ReadAt(make([]byte, 8), 0)
+	assert.Zero(t, n)
+	assert.ErrorIs(t, err, os.ErrClosed)
+
+	at, ok := b.FirstGap(8, 100)
+	assert.False(t, ok, "and a closed buffer offers nowhere to write")
+	assert.Zero(t, at)
+}
+
+// TestWriteFailureLeavesTheBufferUnchanged pins the ordering inside WriteAt: the fallible half runs first,
+// so a spill file that cannot be created does not take the memory tier down with it.
+func TestWriteFailureLeavesTheBufferUnchanged(t *testing.T) {
+	// FromPath takes the directory as given, so a path that does not exist makes file creation fail
+	b := New(tmpdir.FromPath(filepath.Join(t.TempDir(), "no-such-dir")), WithMemLimit(16))
+	t.Cleanup(func() { _ = b.Close() })
+
+	mustWrite(t, b, 0, repeat('A', 8))
+
+	_, err := b.WriteAt(repeat('B', 32), 0) // straddles the limit, so it needs the spill file
+	require.Error(t, err)
+
+	assert.Equal(t, int64(8), b.Size(), "a failed write records nothing")
+	assert.Nil(t, b.file, "and leaves no half-made spill file behind")
+
+	p := make([]byte, 8)
+	n, err := b.ReadAt(p, 0)
+	require.NoError(t, err)
+	require.Equal(t, 8, n)
+	assert.Equal(t, repeat('A', 8), p, "the memory tier still holds what it held")
+
+	mustWrite(t, b, 8, repeat('C', 8)) // inside the limit, so it still needs no file
+	assert.Equal(t, append(repeat('A', 8), repeat('C', 8)...), readAll(t, b))
+}
+
+// --- interface compliance ---------------------------------------------------------------------------
+
+func TestBufferSatisfiesTheStandardInterfaces(t *testing.T) {
+	b := newTestBuffer(t)
+	var (
+		_ io.WriterAt = b
+		_ io.ReaderAt = b
+		_ io.Closer   = b
+	)
+	assert.Implements(t, (*io.ReaderAt)(nil), b)
+	assert.Implements(t, (*io.WriterAt)(nil), b)
+}
+
+// TestWorksThroughIOOffsetWriter pins the composition every consumer uses: stream a decoded block into
+// the buffer at a chosen offset without the writer knowing where it lands.
+func TestWorksThroughIOOffsetWriter(t *testing.T) {
+	b := newTestBuffer(t, WithMemLimit(16))
+
+	w := io.NewOffsetWriter(b, 8)
+	n, err := io.Copy(w, bytes.NewReader(repeat('B', 32)))
+	require.NoError(t, err)
+	require.Equal(t, int64(32), n)
+
+	mustWrite(t, b, 0, repeat('A', 8))
+
+	got := readAll(t, b)
+	assert.Equal(t, append(repeat('A', 8), repeat('B', 32)...), got)
+}
+
+// TestWorksWithIOSectionReader pins the other direction: parsers wrap an io.ReaderAt in a SectionReader,
+// and it must see a consistent length.
+func TestWorksWithIOSectionReader(t *testing.T) {
+	b := newTestBuffer(t)
+	mustWrite(t, b, 0, repeat('A', 100))
+
+	sr := io.NewSectionReader(b, 0, b.Size())
+	got, err := io.ReadAll(sr)
+	require.NoError(t, err)
+	assert.Equal(t, repeat('A', 100), got)
+}
+
+// --- model-based randomized testing -----------------------------------------------------------------
+
+// TestAgainstAReferenceModel drives random writes through the buffer and a dumb reference at the same
+// time, then compares every readable byte. This is what catches tier-boundary and merge bugs that
+// hand-written cases miss.
+func TestAgainstAReferenceModel(t *testing.T) {
+	const universe = 8192
+
+	for _, limit := range []int64{0, 1, 64, 1000, 4096, universe * 2} {
+		t.Run("memLimit="+itoa(limit), func(t *testing.T) {
+			for seed := int64(0); seed < 40; seed++ {
+				rng := rand.New(rand.NewSource(seed)) //nolint:gosec // deterministic test input, not crypto
+				b := newTestBuffer(t, WithMemLimit(limit))
+
+				model := make([]byte, universe)
+				written := make([]bool, universe)
+
+				for op := 0; op < 40; op++ {
+					off := rng.Int63n(universe)
+					l := rng.Int63n(256) + 1
+					if off+l > universe {
+						l = universe - off
+					}
+					payload := make([]byte, l)
+					for i := range payload {
+						payload[i] = byte(rng.Intn(256))
+					}
+
+					mustWrite(t, b, off, payload)
+					copy(model[off:], payload)
+					for i := off; i < off+l; i++ {
+						written[i] = true
+					}
+				}
+
+				// the reference contiguous prefix
+				var want int64
+				for want < universe && written[want] {
+					want++
+				}
+
+				require.Equal(t, want, b.Size(), "seed=%d limit=%d", seed, limit)
+				if want == 0 {
+					continue
+				}
+				assert.Equal(t, model[:want], readAll(t, b), "seed=%d limit=%d", seed, limit)
+			}
+		})
+	}
+}
+
+// TestRandomReadsMatchTheModel checks partial reads at arbitrary offsets, which the whole-buffer
+// comparison above cannot reach.
+func TestRandomReadsMatchTheModel(t *testing.T) {
+	rng := rand.New(rand.NewSource(7)) //nolint:gosec // deterministic test input, not crypto
+	b := newTestBuffer(t, WithMemLimit(97))
+
+	model := make([]byte, 1000)
+	for i := range model {
+		model[i] = byte(rng.Intn(256))
+	}
+	// written in random-sized chunks, in order, so the whole range is covered
+	for off := 0; off < len(model); {
+		l := rng.Intn(50) + 1
+		if off+l > len(model) {
+			l = len(model) - off
+		}
+		mustWrite(t, b, int64(off), model[off:off+l])
+		off += l
+	}
+	require.Equal(t, int64(len(model)), b.Size())
+
+	for i := 0; i < 500; i++ {
+		off := rng.Intn(len(model))
+		l := rng.Intn(len(model)-off) + 1
+		p := make([]byte, l)
+		n, err := b.ReadAt(p, int64(off))
+		require.NoError(t, err)
+		require.Equal(t, l, n)
+		require.Equal(t, model[off:off+l], p, "off=%d len=%d", off, l)
+	}
+}
+
+// --- helpers ----------------------------------------------------------------------------------------
+
+func dirEntries(t *testing.T, dir string) []os.DirEntry {
+	t.Helper()
+	entries, err := os.ReadDir(dir)
+	if errors.Is(err, os.ErrNotExist) {
+		return nil
+	}
+	require.NoError(t, err)
+
+	// tmpdir.NewFile creates the spill file inside the root it is given
+	var files []os.DirEntry
+	for _, e := range entries {
+		if e.IsDir() {
+			sub, err := os.ReadDir(filepath.Join(dir, e.Name()))
+			require.NoError(t, err)
+			for _, s := range sub {
+				files = append(files, s)
+			}
+			continue
+		}
+		files = append(files, e)
+	}
+	return files
+}
+
+func itoa(n int64) string {
+	if n == 0 {
+		return "0"
+	}
+	var digits []byte
+	for n > 0 {
+		digits = append([]byte{byte('0' + n%10)}, digits...)
+		n /= 10
+	}
+	return string(digits)
+}
+
+// TestMemoryTierGrowsAmortized is the regression test for quadratic growth. Sizing the tier to exactly
+// what each write needs reallocates and copies the whole thing per call, so a caller streaming a block in
+// small chunks (which is what io.Copy through an OffsetWriter does) pays O(n^2): filling a 1MB tier in
+// 32KB chunks cost ~16MB of allocation and showed up as a 19MB spike decompressing a 16MB payload.
+func TestMemoryTierGrowsAmortized(t *testing.T) {
+	const (
+		limit = 1 << 20
+		chunk = 32 << 10
+	)
+	b := newTestBuffer(t, WithMemLimit(limit))
+
+	allocated := testutils.MeasureAlloc(t, func() {
+		for off := int64(0); off < limit; off += chunk {
+			mustWrite(t, b, off, repeat('A', chunk))
+		}
+	})
+	t.Logf("filling a %d byte tier in %d byte chunks allocated %d bytes", limit, chunk, allocated)
+	assert.Less(t, allocated, uint64(4*limit),
+		"growth has to be amortized, not a fresh copy of the whole tier per write")
+	assert.Equal(t, int64(limit), b.Size())
+}
+
+// TestMemoryTierNeverExceedsTheLimit pins the cap that geometric growth could otherwise overshoot.
+func TestMemoryTierNeverExceedsTheLimit(t *testing.T) {
+	const limit = 1000
+	b := newTestBuffer(t, WithMemLimit(limit))
+
+	for off := int64(0); off < 4*limit; off += 100 {
+		mustWrite(t, b, off, repeat('A', 100))
+		assert.LessOrEqual(t, int64(len(b.mem)), int64(limit),
+			"the memory tier may never grow past its own limit (off=%d)", off)
+	}
+	assert.Equal(t, int64(4*limit), b.Size())
+}
+
+// TestFirstGap covers the placement question a caller writing at offsets of its own choosing has to ask.
+// It moved here from the UPX cataloger, which used to walk an exported extent list to answer it itself.
+func TestFirstGap(t *testing.T) {
+	tests := []struct {
+		name   string
+		writes []extent
+		size   int64
+		within int64
+		wantAt int64
+		wantOK bool
+	}{
+		{
+			name:   "an empty buffer starts at zero",
+			size:   16,
+			within: 100,
+			wantAt: 0, wantOK: true,
+		},
+		{
+			name:   "the gap between two runs comes first",
+			writes: []extent{{0, 1000}, {1016, 2000}},
+			size:   16,
+			within: 3000,
+			wantAt: 1000, wantOK: true,
+		},
+		{
+			name:   "with the gap filled the tail is what is left",
+			writes: []extent{{0, 2000}},
+			size:   1000,
+			within: 3000,
+			wantAt: 2000, wantOK: true,
+		},
+		{
+			name:   "a gap too small is skipped for a later one",
+			writes: []extent{{0, 100}, {108, 200}},
+			size:   50,
+			within: 1000,
+			wantAt: 200, wantOK: true,
+		},
+		{
+			name:   "nowhere left to fit is reported rather than squeezed in",
+			writes: []extent{{0, 1000}, {1016, 2000}},
+			size:   1001,
+			within: 3000,
+			wantOK: false,
+		},
+		{
+			name:   "a run past the declared total must not wrap the remaining-space subtraction",
+			writes: []extent{{0, 200}},
+			size:   8,
+			within: 100,
+			wantOK: false,
+		},
+		{
+			name:   "exactly filling the tail is allowed",
+			writes: []extent{{0, 900}},
+			size:   100,
+			within: 1000,
+			wantAt: 900, wantOK: true,
+		},
+		{
+			name:   "a gap between two runs is still cut off by the bound",
+			writes: []extent{{0, 10}, {1000, 1010}},
+			size:   45,
+			within: 50,
+			wantOK: false,
+		},
+		{
+			name:   "a gap between two runs that the bound still leaves room in",
+			writes: []extent{{0, 10}, {1000, 1010}},
+			size:   30,
+			within: 50,
+			wantAt: 10, wantOK: true,
+		},
+		{
+			name:   "a negative size is refused rather than treated as zero",
+			size:   -1,
+			within: 100,
+			wantOK: false,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			b := newTestBuffer(t)
+			for _, w := range tt.writes {
+				mustWrite(t, b, w.start, repeat('x', int(w.end-w.start)))
+			}
+
+			at, ok := b.FirstGap(tt.size, tt.within)
+			assert.Equal(t, tt.wantOK, ok)
+			if tt.wantOK {
+				assert.Equal(t, tt.wantAt, at)
+			}
+		})
+	}
+}
+
+// TestFirstGapNeverOverlapsWhatWasWritten is the property behind the table: whatever offset comes back has
+// to be usable, so writing size bytes there must not land on top of anything already stored.
+func TestFirstGapNeverOverlapsWhatWasWritten(t *testing.T) {
+	rng := rand.New(rand.NewSource(11)) //nolint:gosec // deterministic test input, not crypto
+	const universe = 4096
+
+	for seed := 0; seed < 200; seed++ {
+		b := newTestBuffer(t)
+		occupied := make([]bool, universe)
+
+		for op := 0; op < 6; op++ {
+			// deliberately reaches past universe too, so the bound has to cut a between-extents gap short
+			off := rng.Int63n(2 * universe)
+			l := rng.Int63n(200) + 1
+			mustWrite(t, b, off, repeat('x', int(l)))
+			for i := off; i < off+l && i < universe; i++ {
+				occupied[i] = true
+			}
+		}
+
+		size := rng.Int63n(100) + 1
+		at, ok := b.FirstGap(size, universe)
+		if !ok {
+			continue
+		}
+		require.LessOrEqual(t, at+size, int64(universe), "the result must fit inside the declared total")
+		for i := at; i < at+size; i++ {
+			require.False(t, occupied[i], "FirstGap returned %d for %d bytes, but %d is taken", at, size, i)
+		}
+	}
+}
@@ -51,7 +51,8 @@ func runTaskSafely(ctx context.Context, t Task, resolver file.Resolver, s sbomsy
 	// handle individual cataloger panics
 	defer func() {
 		if e := recover(); e != nil {
-			err = fmt.Errorf("%v at:\n%s", e, string(debug.Stack()))
+			log.WithFields("task", t.Name()).Debugf("task panic stack:\n%s", debug.Stack())
+			err = fmt.Errorf("panic in task %q: %v", t.Name(), e)
 		}
 	}()

@@ -8,8 +8,12 @@ import (
 	"github.com/wagoodman/go-progress"

 	"github.com/anchore/syft/internal/sbomsync"
+	"github.com/anchore/syft/syft/artifact"
 	"github.com/anchore/syft/syft/event/monitor"
 	"github.com/anchore/syft/syft/file"
+	"github.com/anchore/syft/syft/pkg"
+	"github.com/anchore/syft/syft/pkg/cataloger/generic"
+	"github.com/anchore/syft/syft/sbom"
 )

 func Test_TaskExecutor_PanicHandling(t *testing.T) {
@@ -21,6 +25,20 @@ func Test_TaskExecutor_PanicHandling(t *testing.T) {
 		Manual: progress.NewManual(-1),
 	})

-	require.Error(t, err)
-	require.Contains(t, err.Error(), "executor_test.go")
+	require.EqualError(t, err, `panic in task "panicking-cataloger": something bad happened`)
+}
+
+func Test_RunTask_GenericParserPanicBecomesUnknown(t *testing.T) {
+	c := generic.NewCataloger("panicking-cataloger").
+		WithParserByPath(func(context.Context, file.Resolver, *generic.Environment, file.LocationReadCloser) ([]pkg.Package, []artifact.Relationship, error) {
+			panic("boom")
+		}, "executor_test.go")
+	s := &sbom.SBOM{}
+
+	err := RunTask(context.Background(), NewPackageTask(DefaultCatalogingFactoryConfig(), c), file.NewMockResolverForPaths("executor_test.go"), sbomsync.NewBuilder(s), &monitor.TaskProgress{
+		Manual: progress.NewManual(-1),
+	})
+
+	require.NoError(t, err)
+	require.Len(t, s.Artifacts.Unknowns, 1)
 }
@@ -5,6 +5,7 @@ import (
 	"github.com/anchore/syft/syft/pkg"
 	"github.com/anchore/syft/syft/pkg/cataloger/ai"
 	"github.com/anchore/syft/syft/pkg/cataloger/alpine"
+	"github.com/anchore/syft/syft/pkg/cataloger/apple"
 	"github.com/anchore/syft/syft/pkg/cataloger/arch"
 	"github.com/anchore/syft/syft/pkg/cataloger/binary"
 	bitnamiSbomCataloger "github.com/anchore/syft/syft/pkg/cataloger/bitnami"
@@ -56,6 +57,10 @@ const (

 	// Python ecosystem labels
 	Python = "python"
+
+	// C/C++ ecosystem labels
+	Cpp   = "cpp"
+	Vcpkg = "vcpkg"
 )

 //nolint:funlen
@@ -82,6 +87,11 @@ func DefaultPackageTaskFactories() Factories {

 		// language-specific package declared catalogers ///////////////////////////////////////////////////////////////////////////
 		newSimplePackageTaskFactory(cpp.NewConanCataloger, pkgcataloging.DeclaredTag, pkgcataloging.DirectoryTag, pkgcataloging.LanguageTag, "cpp", "conan"),
+		newPackageTaskFactory(
+			func(cfg CatalogingFactoryConfig) pkg.Cataloger {
+				return cpp.NewVcpkgManifestCataloger(cfg.PackagesConfig.Cpp)
+			},
+			pkgcataloging.DeclaredTag, pkgcataloging.DirectoryTag, pkgcataloging.LanguageTag, Cpp, Vcpkg),
 		newSimplePackageTaskFactory(dart.NewPubspecLockCataloger, pkgcataloging.DeclaredTag, pkgcataloging.DirectoryTag, pkgcataloging.LanguageTag, "dart"),
 		newSimplePackageTaskFactory(dart.NewPubspecCataloger, pkgcataloging.DeclaredTag, pkgcataloging.DirectoryTag, pkgcataloging.LanguageTag, "dart"),
 		newSimplePackageTaskFactory(elixir.NewMixLockCataloger, pkgcataloging.DeclaredTag, pkgcataloging.DirectoryTag, pkgcataloging.LanguageTag, "elixir"),
@@ -177,9 +187,11 @@ func DefaultPackageTaskFactories() Factories {
 		newSimplePackageTaskFactory(wordpress.NewWordpressPluginCataloger, pkgcataloging.DirectoryTag, pkgcataloging.ImageTag, "wordpress"),
 		newSimplePackageTaskFactory(terraform.NewLockCataloger, pkgcataloging.DeclaredTag, pkgcataloging.DirectoryTag, "terraform"),
 		newSimplePackageTaskFactory(homebrew.NewCataloger, pkgcataloging.DirectoryTag, pkgcataloging.InstalledTag, pkgcataloging.ImageTag, "homebrew"),
+		newSimplePackageTaskFactory(apple.NewAppBundleCataloger, pkgcataloging.DirectoryTag, pkgcataloging.InstalledTag, pkgcataloging.ImageTag, "apple"),
 		newSimplePackageTaskFactory(conda.NewCondaMetaCataloger, pkgcataloging.DirectoryTag, pkgcataloging.InstalledTag, pkgcataloging.PackageTag, "conda"),
 		newSimplePackageTaskFactory(snap.NewCataloger, pkgcataloging.DirectoryTag, pkgcataloging.InstalledTag, pkgcataloging.ImageTag, "snap"),
 		newSimplePackageTaskFactory(ai.NewGGUFCataloger, pkgcataloging.DirectoryTag, pkgcataloging.ImageTag, "ai", "model", "gguf", "ml"),
+		newSimplePackageTaskFactory(ai.NewSafeTensorsCataloger, pkgcataloging.DirectoryTag, pkgcataloging.ImageTag, "ai", "model", "safetensors", "ml"),

 		// deprecated catalogers ////////////////////////////////////////
 		// these are catalogers that should not be selectable other than specific inclusion via name or "deprecated" tag (to remain backwards compatible)
@@ -0,0 +1,31 @@
+package testutils
+
+import (
+	"runtime"
+	"testing"
+)
+
+// MeasureAlloc reports the bytes allocated while fn ran.
+//
+// This exists for guards whose whole point is "a small input cannot make us reserve a large buffer".
+// Only a byte count states that property: asserting that an error comes back would keep passing if the
+// allocation were hoisted above the check, which is the bug these guards were written for.
+//
+// Two things to know when using it:
+//
+//   - TotalAlloc is process-wide, so a test calling this must not call t.Parallel. Another test's
+//     allocations would land in the measurement.
+//   - a budget assertion is only meaningful if the fixture would really blow past it unguarded. Prefer
+//     measuring the unguarded path too and asserting it exceeds the declared size, so a fixture that
+//     quietly stops being a bomb fails instead of passing.
+func MeasureAlloc(t testing.TB, fn func()) uint64 {
+	t.Helper()
+
+	var before, after runtime.MemStats
+	runtime.GC()
+	runtime.ReadMemStats(&before)
+	fn()
+	runtime.ReadMemStats(&after)
+
+	return after.TotalAlloc - before.TotalAlloc
+}
@@ -183,6 +183,10 @@ func visitErrors(err error, fn func(error) error) error {
 	// unwrap singly wrapped errors
 	if e, ok := err.(interface{ Unwrap() error }); ok {
 		wrapped := e.Unwrap()
+		if wrapped == nil {
+			// nothing is wrapped (e.g. a sync.PanicError with a non-error value), so this is a leaf
+			return fn(err)
+		}
 		got := visitErrors(wrapped, fn)
 		if got == nil {
 			return nil
@@ -8,6 +8,7 @@ import (

 	"github.com/stretchr/testify/require"

+	"github.com/anchore/go-sync"
 	"github.com/anchore/syft/syft/file"
 )

@@ -234,3 +235,11 @@ func Test_Append(t *testing.T) {
 	e3 = Appendf(e2, file.NewLocation("l3"), "%s", "e3")
 	require.Equal(t, "l1: e1\nl3: e3", e3.Error())
 }
+
+func Test_ExtractCoordinateErrors_keepsNilUnwrap(t *testing.T) {
+	// sync.PanicError unwraps to nil when the panic value is not an error
+	err := sync.PanicError{Value: "x"}
+	unknowns, remaining := ExtractCoordinateErrors(err)
+	require.Empty(t, unknowns)
+	require.Equal(t, err, remaining)
+}
@@ -35,3 +35,24 @@ Create the new schema by running `make generate-json-schema` from the root of th
 - If there is an existing schema for the given version and the new schema **does not** match the existing schema, an error is shown indicating to increment the version appropriately (see the "Versioning" section)

 ***Note: never delete a JSON schema and never change an existing JSON schema once it has been published in a release!*** Only add new schemas with a newly incremented version. All previous schema files must be stored in the `schema/json/` directory.
+
+### Exception: `description`-only corrections
+
+A published schema may be amended in place for one narrow case: the change touches only `description` text and leaves the data shape identical. Descriptions are documentation carried alongside the schema rather than constraints a validator evaluates, so correcting one cannot invalidate a document that already validated against that version. Minting a new version instead would leave the old one permanently describing the tool incorrectly, and spend a version number on no semantic change.
+
+This applies when **every** one of the following holds:
+
+- the only differences are `description` values
+- no field, type, enum, `required` entry, or `$ref` is added, removed, or altered
+- the `$id` version is unchanged
+
+Anything else, including adding a field that happens to be optional, is a schema change and needs a version bump per the "Versioning" section above.
+
+The generator blocks an in-place edit by design, since it refuses to overwrite a file that differs from what it would produce. To amend one, delete the schema file and regenerate so it is rewritten from the current Go doc comments:
+
+```bash
+rm schema/json/schema-$VERSION.json
+make generate-json-schema
+```
+
+The result is byte-identical to what the generator produces, so do not hand-edit the JSON. Re-running `make generate-json-schema` afterwards should report `No change to the existing schema!`, and `make check-json-schema-drift` should pass. Confirm with `git diff` that the only changes are the intended description lines.
@@ -1,6 +1,6 @@
 {
  "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "$id": "anchore.io/schema/syft/json/16.1.5/document",
+  "$id": "anchore.io/schema/syft/json/16.1.10/document",
  "$ref": "#/$defs/Document",
  "$defs": {
    "AlpmDbEntry": {
@@ -249,6 +249,67 @@
      ],
      "description": "ApkFileRecord represents a single file listing and metadata from a APK DB entry (which may have many of these file records)."
    },
+    "AppleAppBundleEntry": {
+      "properties": {
+        "bundleIdentifier": {
+          "type": "string",
+          "description": "BundleIdentifier is the unique identifier for the bundle (e.g. \"com.apple.Safari\")"
+        },
+        "name": {
+          "type": "string",
+          "description": "Name is the short name of the bundle"
+        },
+        "displayName": {
+          "type": "string",
+          "description": "DisplayName is the user-facing name of the bundle"
+        },
+        "executable": {
+          "type": "string",
+          "description": "Executable is the name of the executable within the bundle"
+        },
+        "shortVersion": {
+          "type": "string",
+          "description": "ShortVersion is the release (marketing) version of the bundle"
+        },
+        "version": {
+          "type": "string",
+          "description": "Version is the build version of the bundle, which often differs from the short version"
+        },
+        "packageType": {
+          "type": "string",
+          "description": "PackageType is the four-letter type code (e.g. \"APPL\" for apps, \"FMWK\" for frameworks, \"BNDL\" for bundles)"
+        },
+        "supportedPlatforms": {
+          "items": {
+            "type": "string"
+          },
+          "type": "array",
+          "description": "SupportedPlatforms lists the platforms the bundle targets (e.g. \"MacOSX\", \"iPhoneOS\")"
+        },
+        "minimumSystemVersion": {
+          "type": "string",
+          "description": "MinimumSystemVersion is the minimum macOS version required to run the bundle"
+        },
+        "minimumOSVersion": {
+          "type": "string",
+          "description": "MinimumOSVersion is the minimum OS version required for non-macOS platforms (e.g. iOS)"
+        },
+        "copyright": {
+          "type": "string",
+          "description": "Copyright is the human-readable copyright notice for the bundle"
+        },
+        "platformName": {
+          "type": "string",
+          "description": "PlatformName is the platform name of the SDK used to build the bundle (e.g. \"macosx\")"
+        },
+        "sdkName": {
+          "type": "string",
+          "description": "SDKName is the name of the SDK used to build the bundle (e.g. \"macosx14.0\")"
+        }
+      },
+      "type": "object",
+      "description": "AppleAppBundleEntry represents metadata about an Apple application bundle (CFBundle) extracted from Info.plist files."
+    },
    "BinarySignature": {
      "properties": {
        "matches": {
@@ -1267,6 +1328,13 @@
        "pkgHashExt": {
          "type": "string",
          "description": "PkgHashExt is the extended package hash format (inner checksum is deprecated - SHA-256 of concatenated file contents excluding CHECKSUM file, now replaced by outer checksum)"
+        },
+        "dependencies": {
+          "items": {
+            "type": "string"
+          },
+          "type": "array",
+          "description": "Dependencies are the names of the packages this entry depends on, as\ndeclared in the entry's dependency list within mix.lock. Used to derive\ndependency-of relationships between locked packages."
        }
      },
      "type": "object",
@@ -1585,6 +1653,16 @@
          },
          "type": "array",
          "description": "GoExperiments lists experimental Go features enabled during compilation (e.g., \"arenas\", \"cgocheck2\")."
+        },
+        "symbols": {
+          "additionalProperties": {
+            "items": {
+              "type": "string"
+            },
+            "type": "array"
+          },
+          "type": "object",
+          "description": "Symbols are the function symbols from this module that are compiled into the binary, extracted from\nthe binary symbol table (pclntab) and grouped by the import path of the package that owns them. Each\nvalue is the sorted, deduplicated list of symbol names local to that package, i.e. with the import\npath prefix stripped (e.g. import path \"github.com/foo/bar\" -\u003e \"(*Type).Method\"). The fully qualified\nname is the import path, a \".\", and the local name. One exception: the binary's main package appears\nunder the key \"main\" (the name the linker assigns), not its original source import path, which is not\nrecoverable from the binary. Populated only when the golang cataloger's capture-symbols scope covers\nthis package: the \"all\" scope populates every module package plus the synthetic stdlib package, the\n\"extended-stdlib\" scope populates the stdlib package plus every module under golang.org/x/, and the\n\"stdlib\" scope populates only the stdlib package. The capture-symbols-modules glob patterns populate\nany additional modules they match."
        }
      },
      "type": "object",
@@ -2667,6 +2745,9 @@
            {
              "$ref": "#/$defs/ApkDbEntry"
            },
+            {
+              "$ref": "#/$defs/AppleAppBundleEntry"
+            },
            {
              "$ref": "#/$defs/BinarySignature"
            },
@@ -2844,6 +2925,9 @@
            {
              "$ref": "#/$defs/RustCargoLockEntry"
            },
+            {
+              "$ref": "#/$defs/SafetensorsModelInfo"
+            },
            {
              "$ref": "#/$defs/SnapEntry"
            },
@@ -2856,6 +2940,9 @@
            {
              "$ref": "#/$defs/TerraformLockProviderEntry"
            },
+            {
+              "$ref": "#/$defs/VcpkgManifest"
+            },
            {
              "$ref": "#/$defs/WordpressPluginEntry"
            }
@@ -4132,6 +4219,55 @@
      ],
      "description": "RustCargoLockEntry represents a locked dependency from a Cargo.lock file with precise version and checksum information."
    },
+    "SafetensorsModelInfo": {
+      "properties": {
+        "format": {
+          "type": "string",
+          "description": "Format is the source format label (always \"safetensors\" for this metadata type).\nPresent because the Docker AI model config blob carries an explicit format field"
+        },
+        "architecture": {
+          "type": "string",
+          "description": "Architecture is the model architecture (e.g., \"LlamaForCausalLM\",\n\"Qwen3MoeForConditionalGeneration\"). It is not present in the SafeTensors\nheader itself; it is enriched from the companion config.json\n\"architectures\" array when one is found alongside the model."
+        },
+        "quantization": {
+          "type": "string",
+          "description": "Quantization describes tensor precision (e.g., \"BF16\", \"F16\", \"F32\", \"INT8\")."
+        },
+        "parameters": {
+          "type": "integer",
+          "description": "Parameters is the total number of model parameters, computed from the tensor\nshapes in the SafeTensors header(s). For a sharded model it is the sum across\nevery shard."
+        },
+        "tensorCount": {
+          "type": "integer",
+          "description": "TensorCount is the number of tensor entries in the file header."
+        },
+        "totalSize": {
+          "type": "string",
+          "description": "TotalSize is the total byte size of tensor data across all shards when known\n(from the Docker AI model config \"size\" field)."
+        },
+        "shardCount": {
+          "type": "integer",
+          "description": "ShardCount is the number of .safetensors shards for a sharded model (1 for a\nsingle-file model)."
+        },
+        "userMetadata": {
+          "$ref": "#/$defs/KeyValues",
+          "description": "UserMetadata is the optional \"__metadata__\" map from a .safetensors file header\n(string-to-string key/values set by the producer)."
+        },
+        "metadataHash": {
+          "type": "string",
+          "description": "MetadataHash is an xxhash over the on-disk SafeTensors header (sorted tensor\nentries + __metadata__). It is derived ONLY from the safetensors file bytes."
+        },
+        "parts": {
+          "items": {
+            "$ref": "#/$defs/SafetensorsModelInfo"
+          },
+          "type": "array",
+          "description": "Parts contains metadata from additional SafeTensors shards or OCI layers that\nwere merged into this package during post-processing."
+        }
+      },
+      "type": "object",
+      "description": "SafeTensorsModelInfo holds the model details extracted from SafeTensors content."
+    },
    "Schema": {
      "properties": {
        "version": {
@@ -4314,6 +4450,94 @@
      ],
      "description": "TerraformLockProviderEntry represents a single provider entry in a Terraform dependency lock file (.terraform.lock.hcl)."
    },
+    "VcpkgManifest": {
+      "properties": {
+        "description": {
+          "items": {
+            "type": "string"
+          },
+          "type": "array",
+          "description": "Description is the human-readable description of the package (may be a single string or a list of paragraphs in the manifest)."
+        },
+        "documentation": {
+          "type": "string",
+          "description": "Documentation is the URL to the package's documentation."
+        },
+        "full-version": {
+          "type": "string",
+          "description": "FullVersion is the complete version string including the port-version suffix (e.g. \"1.2.3#2\")."
+        },
+        "version": {
+          "type": "string",
+          "description": "Version is the upstream package version without the port-version suffix (e.g. \"1.2.3\")."
+        },
+        "port-version": {
+          "type": "integer",
+          "description": "PortVersion is the vcpkg-specific packaging revision for a given upstream version."
+        },
+        "maintainers": {
+          "items": {
+            "type": "string"
+          },
+          "type": "array",
+          "description": "Maintainers are the people responsible for maintaining the vcpkg port."
+        },
+        "name": {
+          "type": "string",
+          "description": "Name is the package name as declared in the manifest."
+        },
+        "supports": {
+          "type": "string",
+          "description": "Supports is the platform expression describing which triplets the package can be built for (e.g. \"!windows\")."
+        },
+        "registry": {
+          "$ref": "#/$defs/VcpkgRegistryEntry",
+          "description": "Registry indicates where the package definition came from."
+        },
+        "triplet": {
+          "type": "string",
+          "description": "Triplet is the build target discovered from the build folder (e.g. \"x64-linux\")."
+        }
+      },
+      "type": "object",
+      "required": [
+        "full-version",
+        "version",
+        "port-version",
+        "name"
+      ],
+      "description": "VcpkgManifest summarizes the data found in a vcpkg manifest (vcpkg.json) relevant to a single vcpkg package."
+    },
+    "VcpkgRegistryEntry": {
+      "properties": {
+        "baseline": {
+          "type": "string"
+        },
+        "kind": {
+          "type": "string"
+        },
+        "packages": {
+          "items": {
+            "type": "string"
+          },
+          "type": "array"
+        },
+        "path": {
+          "type": "string"
+        },
+        "reference": {
+          "type": "string"
+        },
+        "repository": {
+          "type": "string"
+        }
+      },
+      "type": "object",
+      "required": [
+        "kind"
+      ],
+      "description": "Matches definition of Vcpkg \"Registry\"."
+    },
    "WordpressPluginEntry": {
      "properties": {
        "pluginInstallDirectory": {
@@ -2,6 +2,7 @@ package pkgcataloging

 import (
 	"github.com/anchore/syft/syft/pkg/cataloger/binary"
+	"github.com/anchore/syft/syft/pkg/cataloger/cpp"
 	"github.com/anchore/syft/syft/pkg/cataloger/dotnet"
 	"github.com/anchore/syft/syft/pkg/cataloger/golang"
 	"github.com/anchore/syft/syft/pkg/cataloger/java"
@@ -13,6 +14,7 @@ import (

 type Config struct {
 	Binary      binary.ClassifierCatalogerConfig  `yaml:"binary" json:"binary" mapstructure:"binary"`
+	Cpp         cpp.CatalogerConfig               `yaml:"cpp" json:"cpp" mapstructure:"cpp"`
 	Dotnet      dotnet.CatalogerConfig            `yaml:"dotnet" json:"dotnet" mapstructure:"dotnet"`
 	Golang      golang.CatalogerConfig            `yaml:"golang" json:"golang" mapstructure:"golang"`
 	JavaArchive java.ArchiveCatalogerConfig       `yaml:"java-archive" json:"java-archive" mapstructure:"java-archive"`
@@ -25,6 +27,7 @@ type Config struct {
 func DefaultConfig() Config {
 	return Config{
 		Binary:      binary.DefaultClassifierCatalogerConfig(),
+		Cpp:         cpp.DefaultCatalogerConfig(),
 		Dotnet:      dotnet.DefaultCatalogerConfig(),
 		Golang:      golang.DefaultCatalogerConfig(),
 		JavaArchive: java.DefaultArchiveCatalogerConfig(),
@@ -44,6 +47,11 @@ func (c Config) WithBinaryConfig(cfg binary.ClassifierCatalogerConfig) Config {
 	return c
 }

+func (c Config) WithCppConfig(cfg cpp.CatalogerConfig) Config {
+	c.Cpp = cfg
+	return c
+}
+
 func (c Config) WithDotnetConfig(cfg dotnet.CatalogerConfig) Config {
 	c.Dotnet = cfg
 	return c
@@ -0,0 +1,34 @@
+package cataloging
+
+import "strings"
+
+// SymbolScope controls which packages get function symbols (from a binary's symbol table) attached to their metadata.
+type SymbolScope string
+
+const (
+	// SymbolScopeNone disables symbol capture entirely.
+	SymbolScopeNone SymbolScope = "none"
+
+	// SymbolScopeStdlib captures symbols only for the synthetic "stdlib" package, leaving module packages without symbols.
+	SymbolScopeStdlib SymbolScope = "stdlib"
+
+	// SymbolScopeExtendedStdlib captures symbols for the synthetic "stdlib" package as well as every module
+	// under golang.org/x/ (the extended standard library).
+	SymbolScopeExtendedStdlib SymbolScope = "extended-stdlib"
+
+	// SymbolScopeAll captures symbols for all module packages as well as the synthetic "stdlib" package.
+	SymbolScopeAll SymbolScope = "all"
+)
+
+// Parse normalizes a SymbolScope, treating empty (unset) and unrecognized values as SymbolScopeNone.
+func (s SymbolScope) Parse() SymbolScope {
+	switch strings.ToLower(strings.TrimSpace(string(s))) {
+	case string(SymbolScopeAll):
+		return SymbolScopeAll
+	case string(SymbolScopeExtendedStdlib):
+		return SymbolScopeExtendedStdlib
+	case string(SymbolScopeStdlib):
+		return SymbolScopeStdlib
+	}
+	return SymbolScopeNone
+}
@@ -0,0 +1,35 @@
+package cataloging
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func Test_SymbolScope_Parse(t *testing.T) {
+	tests := []struct {
+		input    string
+		expected SymbolScope
+	}{
+		{"all", SymbolScopeAll},
+		{"ALL", SymbolScopeAll},
+		{"  all  ", SymbolScopeAll},
+		{"stdlib", SymbolScopeStdlib},
+		{"Stdlib", SymbolScopeStdlib},
+		{"extended-stdlib", SymbolScopeExtendedStdlib},
+		{"Extended-Stdlib", SymbolScopeExtendedStdlib},
+		{"EXTENDED-STDLIB", SymbolScopeExtendedStdlib},
+		{"  extended-stdlib  ", SymbolScopeExtendedStdlib},
+		{"extended_stdlib", SymbolScopeNone},
+		{"none", SymbolScopeNone},
+		{"", SymbolScopeNone},
+		{"true", SymbolScopeNone},
+		{"false", SymbolScopeNone},
+		{"bogus", SymbolScopeNone},
+	}
+	for _, test := range tests {
+		t.Run(test.input, func(t *testing.T) {
+			assert.Equal(t, test.expected, SymbolScope(test.input).Parse())
+		})
+	}
+}
@@ -201,7 +201,7 @@ func (c Attributes) String() string {

 // sanitize is a modified version of WFNize function from nvdtools
 // that quotes all the allowed punctation chars with a slash and replaces
-// spaces with underscores. It differs from the upstream implmentation as
+// spaces with underscores. It differs from the upstream implementation as
 // it does not use the buggy nvdtools implementation, specifically the "addSlashesAt" part of the
 // function which stops the loop as soon as it encounters ":" a valid
 // character for a WFN attribute after quoting, but the way nvdtools
@@ -7,6 +7,7 @@ import (
 	"debug/macho"
 	"encoding/binary"
 	"fmt"
+	"runtime/debug"
 	"sort"

 	"github.com/bmatcuk/doublestar/v4"
@@ -89,7 +90,7 @@ func (i *Cataloger) CatalogCtx(ctx context.Context, resolver file.Resolver) (map
 	return results, errs
 }

-func processExecutableLocation(loc file.Location, resolver file.Resolver) (*file.Executable, error) {
+func processExecutableLocation(loc file.Location, resolver file.Resolver) (exec *file.Executable, err error) {
 	reader, err := resolver.FileContentsByLocation(loc)
 	if err != nil {
 		log.WithFields("error", err, "path", loc.RealPath).Debug("unable to get file contents")
@@ -97,6 +98,15 @@ func processExecutableLocation(loc file.Location, resolver file.Resolver) (*file
 	}
 	defer internal.CloseAndLogError(reader, loc.RealPath)

+	defer func() {
+		if r := recover(); r != nil {
+			// a malformed binary must not take down the whole SBOM; the caller records this as an unknown
+			log.WithFields("path", loc.RealPath, "panic", r).Debug("recovered from panic while reading executable")
+			log.Tracef("executable panic stack:\n%s", debug.Stack())
+			exec, err = nil, fmt.Errorf("recovered from panic while reading executable: %v", r)
+		}
+	}()
+
 	uReader, err := unionreader.GetUnionReader(reader)
 	if err != nil {
 		log.WithFields("error", err, "path", loc.RealPath).Debug("unable to get union reader")
@@ -0,0 +1,40 @@
+package executable
+
+import (
+	"context"
+	"io"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+
+	"github.com/anchore/syft/internal/unknown"
+	"github.com/anchore/syft/syft/file"
+)
+
+type panicReader struct{}
+
+func (panicReader) Read([]byte) (int, error) { panic("boom") }
+
+type panickingContentsResolver struct {
+	*file.MockResolver
+}
+
+func (r panickingContentsResolver) FilesByMIMEType(...string) ([]file.Location, error) {
+	return r.FilesByPath("cataloger_test.go")
+}
+
+func (r panickingContentsResolver) FileContentsByLocation(file.Location) (io.ReadCloser, error) {
+	return io.NopCloser(panicReader{}), nil
+}
+
+func TestCatalogCtx_panicBecomesUnknown(t *testing.T) {
+	resolver := panickingContentsResolver{file.NewMockResolverForPaths("cataloger_test.go")}
+
+	results, err := NewCataloger(DefaultConfig()).CatalogCtx(context.Background(), resolver)
+
+	require.Empty(t, results)
+	unknowns, remaining := unknown.ExtractCoordinateErrors(err)
+	require.NoError(t, remaining)
+	require.Len(t, unknowns, 1)
+	require.ErrorContains(t, unknowns[0].Reason, "recovered from panic while reading executable: boom")
+}
@@ -10,11 +10,12 @@ import (
 	"github.com/anchore/syft/internal/log"
 	"github.com/anchore/syft/internal/unknown"
 	"github.com/anchore/syft/syft/file"
+	"github.com/anchore/syft/syft/internal/elfutil"
 	"github.com/anchore/syft/syft/internal/unionreader"
 )

 func findELFFeatures(data *file.Executable, reader unionreader.UnionReader) error {
-	f, err := elf.NewFile(reader)
+	f, err := elfutil.NewFile(reader)
 	if err != nil {
 		return err
 	}
@@ -155,32 +156,12 @@ func hasElfDynFlag1(f *elf.File, flag elf.DynFlag1) bool {
 }

 func hasElfDynTag(f *elf.File, tag elf.DynTag) bool {
-	// source https://github.com/golang/go/blob/9b4b3e5acca2dabe107fa2c3ed963097d78a4562/src/cmd/cgo/internal/testshared/shared_test.go#L280
-
-	ds := f.SectionByType(elf.SHT_DYNAMIC)
-	if ds == nil {
-		return false
-	}
-	d, err := ds.Data()
+	vals, err := f.DynValue(tag)
 	if err != nil {
+		log.WithFields("error", err).Trace("unable to read dynamic section from elf file")
 		return false
 	}
-
-	for len(d) > 0 {
-		var t elf.DynTag
-		switch f.Class {
-		case elf.ELFCLASS32:
-			t = elf.DynTag(f.ByteOrder.Uint32(d[0:4]))
-			d = d[8:]
-		case elf.ELFCLASS64:
-			t = elf.DynTag(f.ByteOrder.Uint64(d[0:8]))
-			d = d[16:]
-		}
-		if t == tag {
-			return true
-		}
-	}
-	return false
+	return len(vals) > 0
 }

 func isELFPIE(f *elf.File) bool {
@@ -1,7 +1,9 @@
 package executable

 import (
+	"bytes"
 	"debug/elf"
+	"encoding/binary"
 	"os"
 	"path/filepath"
 	"testing"
@@ -226,3 +228,89 @@ func Test_elfHasExports(t *testing.T) {
 		})
 	}
 }
+
+func Test_hasElfDynTag(t *testing.T) {
+	dynEntry := func(class elf.Class, tag elf.DynTag) []byte {
+		if class == elf.ELFCLASS32 {
+			return binary.LittleEndian.AppendUint32(binary.LittleEndian.AppendUint32(nil, uint32(tag)), 0)
+		}
+		return binary.LittleEndian.AppendUint64(binary.LittleEndian.AppendUint64(nil, uint64(tag)), 0)
+	}
+
+	tests := []struct {
+		name    string
+		class   elf.Class
+		dynamic []byte
+		want    bool
+	}{
+		{
+			name:    "32-bit tag present",
+			class:   elf.ELFCLASS32,
+			dynamic: dynEntry(elf.ELFCLASS32, elf.DT_BIND_NOW),
+			want:    true,
+		},
+		{
+			name:    "64-bit tag present",
+			class:   elf.ELFCLASS64,
+			dynamic: dynEntry(elf.ELFCLASS64, elf.DT_BIND_NOW),
+			want:    true,
+		},
+		{
+			name:    "64-bit tag absent",
+			class:   elf.ELFCLASS64,
+			dynamic: dynEntry(elf.ELFCLASS64, elf.DT_NULL),
+			want:    false,
+		},
+		{
+			name:    "32-bit truncated dynamic section",
+			class:   elf.ELFCLASS32,
+			dynamic: dynEntry(elf.ELFCLASS32, elf.DT_BIND_NOW)[:4],
+			want:    false,
+		},
+		{
+			name:    "64-bit truncated dynamic section",
+			class:   elf.ELFCLASS64,
+			dynamic: dynEntry(elf.ELFCLASS64, elf.DT_BIND_NOW)[:12],
+			want:    false,
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			f, err := elf.NewFile(bytes.NewReader(elfWithDynamicSection(t, tt.class, tt.dynamic)))
+			require.NoError(t, err)
+			assert.Equal(t, tt.want, hasElfDynTag(f, elf.DT_BIND_NOW))
+		})
+	}
+}
+
+// elfWithDynamicSection builds a little-endian ELF holding only a null section and a SHT_DYNAMIC section.
+func elfWithDynamicSection(t *testing.T, class elf.Class, dynamic []byte) []byte {
+	t.Helper()
+	ident := [elf.EI_NIDENT]byte{0x7f, 'E', 'L', 'F', byte(class), byte(elf.ELFDATA2LSB), byte(elf.EV_CURRENT)}
+	var buf bytes.Buffer
+	write := func(v any) {
+		require.NoError(t, binary.Write(&buf, binary.LittleEndian, v))
+	}
+
+	if class == elf.ELFCLASS32 {
+		ehsize, shentsize := binary.Size(elf.Header32{}), binary.Size(elf.Section32{})
+		dataOff := ehsize + 2*shentsize
+		write(elf.Header32{
+			Ident: ident, Type: uint16(elf.ET_DYN), Machine: uint16(elf.EM_386), Version: uint32(elf.EV_CURRENT),
+			Shoff: uint32(ehsize), Ehsize: uint16(ehsize), Shentsize: uint16(shentsize), Shnum: 2,
+		})
+		write(elf.Section32{})
+		write(elf.Section32{Type: uint32(elf.SHT_DYNAMIC), Off: uint32(dataOff), Size: uint32(len(dynamic)), Addralign: 1})
+	} else {
+		ehsize, shentsize := binary.Size(elf.Header64{}), binary.Size(elf.Section64{})
+		dataOff := ehsize + 2*shentsize
+		write(elf.Header64{
+			Ident: ident, Type: uint16(elf.ET_DYN), Machine: uint16(elf.EM_X86_64), Version: uint32(elf.EV_CURRENT),
+			Shoff: uint64(ehsize), Ehsize: uint16(ehsize), Shentsize: uint16(shentsize), Shnum: 2,
+		})
+		write(elf.Section64{})
+		write(elf.Section64{Type: uint32(elf.SHT_DYNAMIC), Off: uint64(dataOff), Size: uint64(len(dynamic)), Addralign: 1})
+	}
+	buf.Write(dynamic)
+	return buf.Bytes()
+}
@@ -1,6 +1,12 @@
 FROM gcc:9.5.0

-RUN apt update -y && apt install -y clang cmake git make m4 pkg-config zlib1g-dev
+# bullseye is EOL: deb.debian.org dropped it, so pull from archive.debian.org (whose Release files are
+# permanently expired, hence Check-Valid-Until). bullseye-security is deliberately omitted -- its index is
+# still served but the pool behind it 404s, and it has not been moved to the archive yet. These are throwaway
+# fixture build tools, so base bullseye package versions are fine.
+RUN printf 'deb http://archive.debian.org/debian bullseye main\ndeb http://archive.debian.org/debian bullseye-updates main\n' > /etc/apt/sources.list \
+    && apt -o Acquire::Check-Valid-Until=false update -y \
+    && apt install -y clang cmake git make m4 pkg-config zlib1g-dev

 ## from https://github.com/runsafesecurity/selfrando/blob/tb-v0.4.2/docs/linux-build-instructions.md
 #RUN git clone https://github.com/runsafesecurity/selfrando.git && \
@@ -13,4 +19,4 @@ RUN apt update -y && apt install -y clang cmake git make m4 pkg-config zlib1g-de
 #RUN cd selfrando && make -j`nprocs --all`
 #RUN cd selfrando && make install

-RUN curl -o /bin/checksec https://raw.githubusercontent.com/slimm609/checksec.sh/2.6.0/checksec && chmod +x /bin/checksec
+RUN curl -f -o /bin/checksec https://raw.githubusercontent.com/slimm609/checksec.sh/2.6.0/checksec && chmod +x /bin/checksec
@@ -5,6 +5,7 @@ import (
 	"crypto"
 	"errors"
 	"fmt"
+	"runtime/debug"

 	"github.com/dustin/go-humanize"

@@ -87,7 +88,7 @@ func (i *Cataloger) Catalog(ctx context.Context, resolver file.Resolver, coordin
 	return results, err
 }

-func (i *Cataloger) catalogLocation(ctx context.Context, resolver file.Resolver, location file.Location) ([]file.Digest, error) {
+func (i *Cataloger) catalogLocation(ctx context.Context, resolver file.Resolver, location file.Location) (digests []file.Digest, err error) {
 	meta, err := resolver.FileMetadataByLocation(location)
 	if err != nil {
 		return nil, err
@@ -104,7 +105,16 @@ func (i *Cataloger) catalogLocation(ctx context.Context, resolver file.Resolver,
 	}
 	defer internal.CloseAndLogError(contentReader, location.AccessPath)

-	digests, err := intFile.NewDigestsFromFile(ctx, contentReader, i.hashes)
+	defer func() {
+		if r := recover(); r != nil {
+			// the caller records this as an unknown for the location instead of failing the whole SBOM
+			log.WithFields("path", location.RealPath, "panic", r).Debug("recovered from panic while digesting file")
+			log.Tracef("file digest panic stack:\n%s", debug.Stack())
+			digests, err = nil, fmt.Errorf("recovered from panic while digesting file: %v", r)
+		}
+	}()
+
+	digests, err = intFile.NewDigestsFromFile(ctx, contentReader, i.hashes)
 	if err != nil {
 		return nil, internal.ErrPath{Context: "digests-cataloger", Path: location.RealPath, Err: err}
 	}
@@ -15,6 +15,7 @@ import (
 	stereoscopeFile "github.com/anchore/stereoscope/pkg/file"
 	"github.com/anchore/stereoscope/pkg/imagetest"
 	intFile "github.com/anchore/syft/internal/file"
+	"github.com/anchore/syft/internal/unknown"
 	"github.com/anchore/syft/syft/file"
 	"github.com/anchore/syft/syft/source"
 	"github.com/anchore/syft/syft/source/directorysource"
@@ -202,3 +203,27 @@ func TestFileDigestCataloger_GivenCoordinates(t *testing.T) {
 	}

 }
+
+type panicReader struct{}
+
+func (panicReader) Read([]byte) (int, error) { panic("boom") }
+
+type panickingContentsResolver struct {
+	*file.MockResolver
+}
+
+func (r panickingContentsResolver) FileContentsByLocation(file.Location) (io.ReadCloser, error) {
+	return io.NopCloser(panicReader{}), nil
+}
+
+func TestDigestsCataloger_panicBecomesUnknown(t *testing.T) {
+	resolver := panickingContentsResolver{file.NewMockResolverForPaths("cataloger_test.go")}
+
+	results, err := NewCataloger([]crypto.Hash{crypto.SHA256}).Catalog(context.Background(), resolver, file.NewLocation("cataloger_test.go").Coordinates)
+
+	require.Empty(t, results)
+	unknowns, remaining := unknown.ExtractCoordinateErrors(err)
+	require.NoError(t, remaining)
+	require.Len(t, unknowns, 1)
+	require.ErrorContains(t, unknowns[0].Reason, "recovered from panic while digesting file: boom")
+}
@@ -152,6 +152,26 @@ func NewLocationFromImage(accessPath string, ref file.Reference, img *image.Imag
 	}
 }

+// NewVirtualLocationFromImage creates a new Location surfaced at realPath but whose contents and metadata are
+// described by the given reference. Note that RealPath may differ from ref.RealPath; callers must not assume the two
+// agree for these locations. The FileSystemID comes from the given ref's layer.
+func NewVirtualLocationFromImage(realPath, accessPath string, ref file.Reference, img *image.Image) Location {
+	layer := img.FileCatalog.Layer(ref)
+	return Location{
+		LocationData: LocationData{
+			Coordinates: Coordinates{
+				RealPath:     realPath,
+				FileSystemID: layer.Metadata.Digest,
+			},
+			AccessPath: accessPath,
+			ref:        ref,
+		},
+		LocationMetadata: LocationMetadata{
+			Annotations: map[string]string{},
+		},
+	}
+}
+
 // NewLocationFromDirectory creates a new Location representing the given path (extracted from the Reference) relative to the given directory.
 func NewLocationFromDirectory(responsePath string, fd string, ref file.Reference) Location {
 	return Location{
--- a/Show More
+++ b/Show More