chore(deps): bump actions/setup-go from 5.0.1 to 5.0.2 (#3027 )

Bumps [actions/setup-go](https://github.com/actions/setup-go) from 5.0.1 to 5.0.2. - [Release notes](https://github.com/actions/setup-go/releases) - [Commits](https://github.com/actions/setup-go/compare/cdcb36043654635271a94b9a6d1392de5bb323a7...0a12ed9d6a96ab950c8f026ed9f722fe0da7ef32) --- updated-dependencies: - dependency-name: actions/setup-go dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
chore(deps): bump github.com/charmbracelet/lipgloss (#3028 )
2026-10-23 03:22:21 +02:00 · 2024-07-11 10:19:48 -07:00 · 2024-07-11 10:19:14 -07:00 · 2024-07-09 14:24:21 -04:00 · 2024-07-09 09:01:58 -07:00 · 2024-07-09 07:53:04 -07:00
45 changed files with 5799 additions and 424 deletions
@@ -103,7 +103,7 @@ tools:
  # used for running all local and CI tasks
  - name: task
    version:
-      want: v3.37.2
+      want: v3.38.0
    method: github-release
    with:
      repo: go-task/task
@@ -111,7 +111,7 @@ tools:
  # used for triggering a release
  - name: gh
    version:
-      want: v2.51.0
+      want: v2.52.0
    method: github-release
    with:
      repo: cli/cli
@@ -27,14 +27,14 @@ runs:
  using: "composite"
  steps:
    # note: go mod and build is automatically cached on default with v4+
-    - uses: actions/setup-go@cdcb36043654635271a94b9a6d1392de5bb323a7 #v5.0.1
+    - uses: actions/setup-go@cdcb36043654635271a94b9a6d1392de5bb323a7 # v5.0.1
      if: inputs.go-version != ''
      with:
        go-version: ${{ inputs.go-version }}

    - name: Restore tool cache
      id: tool-cache
-      uses: actions/cache@704facf57e6136b1bc63b828d79edcd491f0ee84 #v3.3.2
+      uses: actions/cache@704facf57e6136b1bc63b828d79edcd491f0ee84 # v3.3.2
      with:
        path: ${{ github.workspace }}/.tool
        key: ${{ inputs.cache-key-prefix }}-${{ runner.os }}-tool-${{ hashFiles('.binny.yaml') }}
@@ -17,3 +17,11 @@ updates:
    open-pull-requests-limit: 10
    labels:
      - "dependencies"
+
+  - package-ecosystem: "github-actions"
+    directory: "/.github/actions/boostrap"
+    schedule:
+      interval: "daily"
+    open-pull-requests-limit: 10
+    labels:
+      - "dependencies"
@@ -39,7 +39,7 @@ jobs:
          OUTPUT="${OUTPUT//$'\r'/'%0D'}" # URL encode all '\r' characters
          echo "result=$OUTPUT" >> $GITHUB_OUTPUT

-      - uses: actions/upload-artifact@65462800fd760344b1a7b4382951275a0abb4808 # v4.3.3
+      - uses: actions/upload-artifact@0b2256b8c012f0828dc542b3febcab082c67f72b # v4.3.4
        with:
          name: benchmark-test-results
          path: test/results/**/*
@@ -39,13 +39,13 @@ jobs:
      uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 #v4.1.7

    - name: Install Go
-      uses: actions/setup-go@cdcb36043654635271a94b9a6d1392de5bb323a7 #v5.0.1
+      uses: actions/setup-go@0a12ed9d6a96ab950c8f026ed9f722fe0da7ef32 #v5.0.2
      with:
        go-version-file: go.mod

    # Initializes the CodeQL tools for scanning.
    - name: Initialize CodeQL
-      uses: github/codeql-action/init@23acc5c183826b7a8a97bce3cecc52db901f8251 #v3.25.10
+      uses: github/codeql-action/init@b611370bb5703a7efb587f9d136a52ea24c5c38c #v3.25.11
      with:
        languages: ${{ matrix.language }}
        # If you wish to specify custom queries, you can do so here or in a config file.
@@ -56,7 +56,7 @@ jobs:
    # Autobuild attempts to build any compiled languages  (C/C++, C#, or Java).
    # If this step fails, then you should remove it and run the build manually (see below)
    - name: Autobuild
-      uses: github/codeql-action/autobuild@23acc5c183826b7a8a97bce3cecc52db901f8251 #v3.25.10
+      uses: github/codeql-action/autobuild@b611370bb5703a7efb587f9d136a52ea24c5c38c #v3.25.11

    # ℹ️ Command-line programs to run using the OS shell.
    # 📚 https://git.io/JvXDl
@@ -70,4 +70,4 @@ jobs:
    #   make release

    - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@23acc5c183826b7a8a97bce3cecc52db901f8251 #v3.25.10
+      uses: github/codeql-action/analyze@b611370bb5703a7efb587f9d136a52ea24c5c38c #v3.25.11
@@ -50,7 +50,7 @@ jobs:
          app_id: ${{ secrets.TOKEN_APP_ID }}
          private_key: ${{ secrets.TOKEN_APP_PRIVATE_KEY }}

-      - uses: peter-evans/create-pull-request@6d6857d36972b65feb161a90e484f2984215f83e #v6.0.5
+      - uses: peter-evans/create-pull-request@c5a7806660adbe173f04e3e038b0ccdcd758773c #v6.1.0
        with:
          signoff: true
          delete-branch: true
@@ -33,7 +33,7 @@ jobs:
          app_id: ${{ secrets.TOKEN_APP_ID }}
          private_key: ${{ secrets.TOKEN_APP_PRIVATE_KEY }}

-      - uses: peter-evans/create-pull-request@6d6857d36972b65feb161a90e484f2984215f83e #v6.0.5
+      - uses: peter-evans/create-pull-request@c5a7806660adbe173f04e3e038b0ccdcd758773c #v6.1.0
        with:
          signoff: true
          delete-branch: true
@@ -19,7 +19,7 @@ jobs:
    steps:
      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 #v4.1.7

-      - uses: actions/setup-go@cdcb36043654635271a94b9a6d1392de5bb323a7 #v5.0.1
+      - uses: actions/setup-go@0a12ed9d6a96ab950c8f026ed9f722fe0da7ef32 #v5.0.2
        with:
          go-version: ${{ env.GO_VERSION }}
          stable: ${{ env.GO_STABLE_VERSION }}
@@ -44,7 +44,7 @@ jobs:
          app_id: ${{ secrets.TOKEN_APP_ID }}
          private_key: ${{ secrets.TOKEN_APP_PRIVATE_KEY }}

-      - uses: peter-evans/create-pull-request@6d6857d36972b65feb161a90e484f2984215f83e #v6.0.5
+      - uses: peter-evans/create-pull-request@c5a7806660adbe173f04e3e038b0ccdcd758773c #v6.1.0
        with:
          signoff: true
          delete-branch: true
@@ -105,8 +105,10 @@ syft <image> -o <format>
 Where the `formats` available are:
 - `syft-json`: Use this to get as much information out of Syft as possible!
 - `syft-text`: A row-oriented, human-and-machine-friendly output.
- `cyclonedx-xml`: A XML report conforming to the [CycloneDX 1.4 specification](https://cyclonedx.org/specification/overview/).
- `cyclonedx-json`: A JSON report conforming to the [CycloneDX 1.4 specification](https://cyclonedx.org/specification/overview/).
+- `cyclonedx-xml`: A XML report conforming to the [CycloneDX 1.6 specification](https://cyclonedx.org/specification/overview/).
+- `cyclonedx-xml@1.5`: A XML report conforming to the [CycloneDX 1.5 specification](https://cyclonedx.org/specification/overview/).
+- `cyclonedx-json`: A JSON report conforming to the [CycloneDX 1.6 specification](https://cyclonedx.org/specification/overview/).
+- `cyclonedx-json@1.5`: A JSON report conforming to the [CycloneDX 1.5 specification](https://cyclonedx.org/specification/overview/).
 - `spdx-tag-value`: A tag-value formatted report conforming to the [SPDX 2.3 specification](https://spdx.github.io/spdx-spec/v2.3/).
 - `spdx-tag-value@2.2`: A tag-value formatted report conforming to the [SPDX 2.2 specification](https://spdx.github.io/spdx-spec/v2.2.2/).
 - `spdx-json`: A JSON report conforming to the [SPDX 2.3 JSON Schema](https://github.com/spdx/spdx-spec/blob/v2.3/schemas/spdx-schema.json).
@@ -115,6 +117,8 @@ Where the `formats` available are:
 - `syft-table`: A columnar summary (default).
 - `template`: Lets the user specify the output format. See ["Using templates"](#using-templates) below.

+Note that flags using the @<version> can be used for earlier versions of each specification as well.
+
 ### Supported Ecosystems

 - Alpine (apk)
@@ -10,7 +10,8 @@ import (
 func TestMarinerDistroless(t *testing.T) {
 	sbom, _ := catalogFixtureImage(t, "image-mariner-distroless", source.SquashedScope)

-	expectedPkgs := 12
+	// 12 RPMs + 2 binaries with ELF package notes claiming to be RPMs
+	expectedPkgs := 14
 	actualPkgs := 0
 	for range sbom.Artifacts.Packages.Enumerate(pkg.RpmPkg) {
 		actualPkgs += 1
@@ -17,29 +17,29 @@ require (
 	github.com/anchore/go-testutils v0.0.0-20200925183923-d5f45b0d3c04
 	github.com/anchore/go-version v1.2.2-0.20200701162849-18adb9c92b9b
 	github.com/anchore/packageurl-go v0.1.1-0.20240507183024-848e011fc24f
-	github.com/anchore/stereoscope v0.0.3-0.20240501181043-2e9894674185
+	github.com/anchore/stereoscope v0.0.3-0.20240705165118-e46739e21796
 	github.com/anmitsu/go-shlex v0.0.0-20200514113438-38f4b401e2be
 	// we are hinting brotli to latest due to warning when installing archiver v3:
 	// go: warning: github.com/andybalholm/brotli@v1.0.1: retracted by module author: occasional panics and data corruption
 	github.com/aquasecurity/go-pep440-version v0.0.0-20210121094942-22b2f8951d46
 	github.com/bmatcuk/doublestar/v4 v4.6.1
 	github.com/charmbracelet/bubbles v0.18.0
-	github.com/charmbracelet/bubbletea v0.26.4
-	github.com/charmbracelet/lipgloss v0.11.0
+	github.com/charmbracelet/bubbletea v0.26.6
+	github.com/charmbracelet/lipgloss v0.11.1
 	github.com/dave/jennifer v1.7.0
 	github.com/deitch/magic v0.0.0-20230404182410-1ff89d7342da
 	github.com/distribution/reference v0.6.0
-	github.com/docker/docker v26.1.4+incompatible
+	github.com/docker/docker v27.0.3+incompatible
 	github.com/dustin/go-humanize v1.0.1
 	github.com/elliotchance/phpserialize v1.4.0
 	github.com/facebookincubator/nvdtools v0.1.5
-	github.com/github/go-spdx/v2 v2.2.0
+	github.com/github/go-spdx/v2 v2.3.1
 	github.com/gkampitakis/go-snaps v0.5.4
 	github.com/go-git/go-billy/v5 v5.5.0
 	github.com/go-git/go-git/v5 v5.12.0
-	github.com/go-test/deep v1.1.0
+	github.com/go-test/deep v1.1.1
 	github.com/google/go-cmp v0.6.0
-	github.com/google/go-containerregistry v0.19.1
+	github.com/google/go-containerregistry v0.20.0
 	github.com/google/licensecheck v0.3.1
 	github.com/google/uuid v1.6.0
 	github.com/gookit/color v1.5.4
@@ -60,16 +60,16 @@ require (
 	github.com/opencontainers/go-digest v1.0.0
 	github.com/pelletier/go-toml v1.9.5
 	github.com/quasilyte/go-ruleguard/dsl v0.3.22
-	github.com/saferwall/pe v1.5.3
+	github.com/saferwall/pe v1.5.4
 	github.com/saintfish/chardet v0.0.0-20230101081208-5e3ef4b5456d
 	github.com/sanity-io/litter v1.5.5
 	github.com/sassoftware/go-rpmutils v0.4.0
 	// pinned to pull in 386 arch fix: https://github.com/scylladb/go-set/commit/cc7b2070d91ebf40d233207b633e28f5bd8f03a5
 	github.com/scylladb/go-set v1.0.3-0.20200225121959-cc7b2070d91e
 	github.com/sergi/go-diff v1.3.2-0.20230802210424-5b0b94c5c0d3
-	github.com/spdx/tools-golang v0.5.4
+	github.com/spdx/tools-golang v0.5.5
 	github.com/spf13/afero v1.11.0
-	github.com/spf13/cobra v1.8.0
+	github.com/spf13/cobra v1.8.1
 	github.com/stretchr/testify v1.9.0
 	github.com/vbatts/go-mtree v0.5.4
 	github.com/vifraa/gopom v1.0.0
@@ -78,8 +78,8 @@ require (
 	github.com/xeipuuv/gojsonschema v1.2.0
 	github.com/zyedidia/generic v1.2.2-0.20230320175451-4410d2372cb1
 	go.uber.org/goleak v1.3.0
-	golang.org/x/mod v0.18.0
-	golang.org/x/net v0.26.0
+	golang.org/x/mod v0.19.0
+	golang.org/x/net v0.27.0
 	gopkg.in/yaml.v3 v3.0.1
 	modernc.org/sqlite v1.30.1
 )
@@ -88,7 +88,7 @@ require google.golang.org/genproto v0.0.0-20231106174013-bbf56f31fb17 // indirec

 require (
 	github.com/BurntSushi/toml v1.4.0
-	github.com/adrg/xdg v0.4.0
+	github.com/adrg/xdg v0.5.0
 	github.com/magiconair/properties v1.8.7
 )

@@ -109,7 +109,7 @@ require (
 	github.com/aymanbagabas/go-osc52/v2 v2.0.1 // indirect
 	github.com/becheran/wildmatch-go v1.0.0 // indirect
 	github.com/charmbracelet/harmonica v0.2.0 // indirect
-	github.com/charmbracelet/x/ansi v0.1.2 // indirect
+	github.com/charmbracelet/x/ansi v0.1.3 // indirect
 	github.com/charmbracelet/x/input v0.1.0 // indirect
 	github.com/charmbracelet/x/term v0.1.1 // indirect
 	github.com/charmbracelet/x/windows v0.1.0 // indirect
@@ -124,7 +124,7 @@ require (
 	github.com/containerd/typeurl/v2 v2.1.1 // indirect
 	github.com/cyphar/filepath-securejoin v0.2.4 // indirect
 	github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
-	github.com/docker/cli v24.0.0+incompatible // indirect
+	github.com/docker/cli v27.0.3+incompatible // indirect
 	github.com/docker/distribution v2.8.3+incompatible // indirect
 	github.com/docker/docker-credential-helpers v0.7.0 // indirect
 	github.com/docker/go-connections v0.4.0 // indirect
@@ -182,7 +182,7 @@ require (
 	github.com/muesli/termenv v0.15.2 // indirect
 	github.com/ncruces/go-strftime v0.1.9 // indirect
 	github.com/nwaples/rardecode v1.1.0 // indirect
-	github.com/opencontainers/image-spec v1.1.0-rc3 // indirect
+	github.com/opencontainers/image-spec v1.1.0 // indirect
 	github.com/opencontainers/runc v1.1.12 // indirect
 	github.com/opencontainers/runtime-spec v1.1.0-rc.1 // indirect
 	github.com/opencontainers/selinux v1.11.0 // indirect
@@ -208,7 +208,7 @@ require (
 	github.com/spf13/pflag v1.0.5 // indirect
 	github.com/spf13/viper v1.18.2 // indirect
 	github.com/subosito/gotenv v1.6.0 // indirect
-	github.com/sylabs/sif/v2 v2.11.5 // indirect
+	github.com/sylabs/sif/v2 v2.17.1 // indirect
 	github.com/sylabs/squashfs v0.6.1 // indirect
 	github.com/therootcompany/xz v1.0.1 // indirect
 	github.com/tidwall/gjson v1.17.0 // indirect
@@ -229,11 +229,11 @@ require (
 	go.opentelemetry.io/otel/trace v1.19.0 // indirect
 	go.uber.org/atomic v1.9.0 // indirect
 	go.uber.org/multierr v1.9.0 // indirect
-	golang.org/x/crypto v0.24.0 // indirect
+	golang.org/x/crypto v0.25.0 // indirect
 	golang.org/x/exp v0.0.0-20231108232855-2478ac86f678 // indirect
 	golang.org/x/sync v0.7.0 // indirect
-	golang.org/x/sys v0.21.0 // indirect
-	golang.org/x/term v0.21.0 // indirect
+	golang.org/x/sys v0.22.0 // indirect
+	golang.org/x/term v0.22.0 // indirect
 	golang.org/x/text v0.16.0 // indirect
 	golang.org/x/tools v0.21.1-0.20240508182429-e35e4ccd0d2d // indirect
 	golang.org/x/xerrors v0.0.0-20220907171357-04be3eba64a2 // indirect
@@ -85,8 +85,8 @@ github.com/acarl005/stripansi v0.0.0-20180116102854-5a71ef0e047d h1:licZJFw2RwpH
 github.com/acarl005/stripansi v0.0.0-20180116102854-5a71ef0e047d/go.mod h1:asat636LX7Bqt5lYEZ27JNDcqxfjdBQuJ/MM4CN/Lzo=
 github.com/acobaugh/osrelease v0.1.0 h1:Yb59HQDGGNhCj4suHaFQQfBps5wyoKLSSX/J/+UifRE=
 github.com/acobaugh/osrelease v0.1.0/go.mod h1:4bFEs0MtgHNHBrmHCt67gNisnabCRAlzdVasCEGHTWY=
-github.com/adrg/xdg v0.4.0 h1:RzRqFcjH4nE5C6oTAxhBtoE2IRyjBSa62SCbyPidvls=
-github.com/adrg/xdg v0.4.0/go.mod h1:N6ag73EX4wyxeaoeHctc1mas01KZgsj5tYiAIwqJE/E=
+github.com/adrg/xdg v0.5.0 h1:dDaZvhMXatArP1NPHhnfaQUqWBLBsmx1h1HXQdMoFCY=
+github.com/adrg/xdg v0.5.0/go.mod h1:dDdY4M4DF9Rjy4kHPeNL+ilVF+p2lK8IdM9/rTSGcI4=
 github.com/alecthomas/template v0.0.0-20160405071501-a0175ee3bccc/go.mod h1:LOuyumcjzFXgccqObfd/Ljyb9UuFJ6TxHnclSeseNhc=
 github.com/alecthomas/template v0.0.0-20190718012654-fb15b899a751/go.mod h1:LOuyumcjzFXgccqObfd/Ljyb9UuFJ6TxHnclSeseNhc=
 github.com/alecthomas/units v0.0.0-20151022065526-2efee857e7cf/go.mod h1:ybxpYRFXyAe+OPACYpWeL0wqObRcbAqCMya13uyzqw0=
@@ -113,8 +113,8 @@ github.com/anchore/go-version v1.2.2-0.20200701162849-18adb9c92b9b h1:e1bmaoJfZV
 github.com/anchore/go-version v1.2.2-0.20200701162849-18adb9c92b9b/go.mod h1:Bkc+JYWjMCF8OyZ340IMSIi2Ebf3uwByOk6ho4wne1E=
 github.com/anchore/packageurl-go v0.1.1-0.20240507183024-848e011fc24f h1:B/E9ixKNCasntpoch61NDaQyGPDXLEJlL+B9B/PbdbA=
 github.com/anchore/packageurl-go v0.1.1-0.20240507183024-848e011fc24f/go.mod h1:Blo6OgJNiYF41ufcgHKkbCKF2MDOMlrqhXv/ij6ocR4=
-github.com/anchore/stereoscope v0.0.3-0.20240501181043-2e9894674185 h1:SuViDJ27nZ+joGdKbAkxAlm7tYMt9NTxTZZ05po4hls=
-github.com/anchore/stereoscope v0.0.3-0.20240501181043-2e9894674185/go.mod h1:ckIamHiRMp8iBwWoTtE5Xkt9VQ5QC+6+O4VzwqyZr5Q=
+github.com/anchore/stereoscope v0.0.3-0.20240705165118-e46739e21796 h1:mb2i23zBKaSloS4RHMwBCKTCB3X5HnObcRvjxrvvMr8=
+github.com/anchore/stereoscope v0.0.3-0.20240705165118-e46739e21796/go.mod h1:6r8piaIGsYZuVkFw+fAXYtEGFI58dZuni/jNdvK+IxQ=
 github.com/andreyvit/diff v0.0.0-20170406064948-c7f18ee00883/go.mod h1:rCTlJbsFo29Kk6CurOXKm700vrz8f0KW0JNfpkRJY/8=
 github.com/andybalholm/brotli v1.0.1/go.mod h1:loMXtMfwqflxFJPmdbJO0a3KNoPuLBgiu3qAvBg8x/Y=
 github.com/andybalholm/brotli v1.0.4 h1:V7DdXeJtZscaqfNuAdSRuRFzuiKlHSC/Zh3zl9qY3JY=
@@ -157,14 +157,14 @@ github.com/cespare/xxhash/v2 v2.1.1/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XL
 github.com/cespare/xxhash/v2 v2.1.2/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
 github.com/charmbracelet/bubbles v0.18.0 h1:PYv1A036luoBGroX6VWjQIE9Syf2Wby2oOl/39KLfy0=
 github.com/charmbracelet/bubbles v0.18.0/go.mod h1:08qhZhtIwzgrtBjAcJnij1t1H0ZRjwHyGsy6AL11PSw=
-github.com/charmbracelet/bubbletea v0.26.4 h1:2gDkkzLZaTjMl/dQBpNVtnvcCxsh/FCkimep7FC9c40=
-github.com/charmbracelet/bubbletea v0.26.4/go.mod h1:P+r+RRA5qtI1DOHNFn0otoNwB4rn+zNAzSj/EXz6xU0=
+github.com/charmbracelet/bubbletea v0.26.6 h1:zTCWSuST+3yZYZnVSvbXwKOPRSNZceVeqpzOLN2zq1s=
+github.com/charmbracelet/bubbletea v0.26.6/go.mod h1:dz8CWPlfCCGLFbBlTY4N7bjLiyOGDJEnd2Muu7pOWhk=
 github.com/charmbracelet/harmonica v0.2.0 h1:8NxJWRWg/bzKqqEaaeFNipOu77YR5t8aSwG4pgaUBiQ=
 github.com/charmbracelet/harmonica v0.2.0/go.mod h1:KSri/1RMQOZLbw7AHqgcBycp8pgJnQMYYT8QZRqZ1Ao=
-github.com/charmbracelet/lipgloss v0.11.0 h1:UoAcbQ6Qml8hDwSWs0Y1cB5TEQuZkDPH/ZqwWWYTG4g=
-github.com/charmbracelet/lipgloss v0.11.0/go.mod h1:1UdRTH9gYgpcdNN5oBtjbu/IzNKtzVtb7sqN1t9LNn8=
-github.com/charmbracelet/x/ansi v0.1.2 h1:6+LR39uG8DE6zAmbu023YlqjJHkYXDF1z36ZwzO4xZY=
-github.com/charmbracelet/x/ansi v0.1.2/go.mod h1:dk73KoMTT5AX5BsX0KrqhsTqAnhZZoCBjs7dGWp4Ktw=
+github.com/charmbracelet/lipgloss v0.11.1 h1:a8KgVPHa7kOoP95vm2tQQrjD2AKhbWmfr4uJ2RW6kNk=
+github.com/charmbracelet/lipgloss v0.11.1/go.mod h1:beLlcmkF7MWA+5UrKKIRo/VJ21xGXr7YJ9miWfdMRIU=
+github.com/charmbracelet/x/ansi v0.1.3 h1:RBh/eleNWML5R524mjUF0yVRePTwqN9tPtV+DPgO5Lw=
+github.com/charmbracelet/x/ansi v0.1.3/go.mod h1:dk73KoMTT5AX5BsX0KrqhsTqAnhZZoCBjs7dGWp4Ktw=
 github.com/charmbracelet/x/input v0.1.0 h1:TEsGSfZYQyOtp+STIjyBq6tpRaorH0qpwZUj8DavAhQ=
 github.com/charmbracelet/x/input v0.1.0/go.mod h1:ZZwaBxPF7IG8gWWzPUVqHEtWhc1+HXJPNuerJGRGZ28=
 github.com/charmbracelet/x/term v0.1.1 h1:3cosVAiPOig+EV4X9U+3LDgtwwAoEzJjNdwbXDjF6yI=
@@ -211,7 +211,7 @@ github.com/coreos/go-systemd/v22 v22.3.2/go.mod h1:Y58oyj3AT4RCenI/lSvhwexgC+NSV
 github.com/cpuguy83/go-md2man/v2 v2.0.0-20190314233015-f79a8a8ca69d/go.mod h1:maD7wRr/U5Z6m/iR4s+kqSMx2CaBsrgA7czyZG/E6dU=
 github.com/cpuguy83/go-md2man/v2 v2.0.1/go.mod h1:tgQtvFlXSQOSOSIRvRPT7W67SCa46tRHOmNcaadrF8o=
 github.com/cpuguy83/go-md2man/v2 v2.0.2/go.mod h1:tgQtvFlXSQOSOSIRvRPT7W67SCa46tRHOmNcaadrF8o=
-github.com/cpuguy83/go-md2man/v2 v2.0.3/go.mod h1:tgQtvFlXSQOSOSIRvRPT7W67SCa46tRHOmNcaadrF8o=
+github.com/cpuguy83/go-md2man/v2 v2.0.4/go.mod h1:tgQtvFlXSQOSOSIRvRPT7W67SCa46tRHOmNcaadrF8o=
 github.com/creack/pty v1.1.9/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ33E=
 github.com/cyphar/filepath-securejoin v0.2.4 h1:Ugdm7cg7i6ZK6x3xDF1oEu1nfkyfH53EtKeQYTC3kyg=
 github.com/cyphar/filepath-securejoin v0.2.4/go.mod h1:aPGpWjXOXUn2NCNjFvBE6aRxGGx79pTxQpKOJNYHHl4=
@@ -227,12 +227,12 @@ github.com/deitch/magic v0.0.0-20230404182410-1ff89d7342da/go.mod h1:B3tI9iGHi4i
 github.com/dgrijalva/jwt-go/v4 v4.0.0-preview1/go.mod h1:+hnT3ywWDTAFrW5aE+u2Sa/wT555ZqwoCS+pk3p6ry4=
 github.com/distribution/reference v0.6.0 h1:0IXCQ5g4/QMHHkarYzh5l+u8T3t73zM5QvfrDyIgxBk=
 github.com/distribution/reference v0.6.0/go.mod h1:BbU0aIcezP1/5jX/8MP0YiH4SdvB5Y4f/wlDRiLyi3E=
-github.com/docker/cli v24.0.0+incompatible h1:0+1VshNwBQzQAx9lOl+OYCTCEAD8fKs/qeXMx3O0wqM=
-github.com/docker/cli v24.0.0+incompatible/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8=
+github.com/docker/cli v27.0.3+incompatible h1:usGs0/BoBW8MWxGeEtqPMkzOY56jZ6kYlSN5BLDioCQ=
+github.com/docker/cli v27.0.3+incompatible/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8=
 github.com/docker/distribution v2.8.3+incompatible h1:AtKxIZ36LoNK51+Z6RpzLpddBirtxJnzDrHLEKxTAYk=
 github.com/docker/distribution v2.8.3+incompatible/go.mod h1:J2gT2udsDAN96Uj4KfcMRqY0/ypR+oyYUYmja8H+y+w=
-github.com/docker/docker v26.1.4+incompatible h1:vuTpXDuoga+Z38m1OZHzl7NKisKWaWlhjQk7IDPSLsU=
-github.com/docker/docker v26.1.4+incompatible/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk=
+github.com/docker/docker v27.0.3+incompatible h1:aBGI9TeQ4MPlhquTQKq9XbK79rKFVwXNUAYz9aXyEBE=
+github.com/docker/docker v27.0.3+incompatible/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk=
 github.com/docker/docker-credential-helpers v0.7.0 h1:xtCHsjxogADNZcdv1pKUHXryefjlVRqWqIhk/uXJp0A=
 github.com/docker/docker-credential-helpers v0.7.0/go.mod h1:rETQfLdHNT3foU5kuNkFR1R1V12OJRRO5lzt2D1b5X0=
 github.com/docker/go-connections v0.4.0 h1:El9xVISelRB7BuFusrZozjnkIM5YnzCViNKohAFqRJQ=
@@ -287,8 +287,8 @@ github.com/fsnotify/fsnotify v1.7.0/go.mod h1:40Bi/Hjc2AVfZrqy+aj+yEI+/bRxZnMJyT
 github.com/gabriel-vasile/mimetype v1.4.0 h1:Cn9dkdYsMIu56tGho+fqzh7XmvY2YyGU0FnbhiOsEro=
 github.com/gabriel-vasile/mimetype v1.4.0/go.mod h1:fA8fi6KUiG7MgQQ+mEWotXoEOvmxRtOJlERCzSmRvr8=
 github.com/ghodss/yaml v1.0.0/go.mod h1:4dBDuWmgqj2HViK6kFavaiC9ZROes6MMH2rRYeMEF04=
-github.com/github/go-spdx/v2 v2.2.0 h1:yBBLMasHA70Ujd35OpL/OjJOWWVNXcJGbars0GinGRI=
-github.com/github/go-spdx/v2 v2.2.0/go.mod h1:hMCrsFgT0QnCwn7G8gxy/MxMpy67WgZrwFeISTn0o6w=
+github.com/github/go-spdx/v2 v2.3.1 h1:ffGuHTbHuHzWPt53n8f9o8clGutuLPObo3zB4JAjxU8=
+github.com/github/go-spdx/v2 v2.3.1/go.mod h1:2ZxKsOhvBp+OYBDlsGnUMcchLeo2mrpEBn2L1C+U3IQ=
 github.com/gkampitakis/ciinfo v0.3.0 h1:gWZlOC2+RYYttL0hBqcoQhM7h1qNkVqvRCV1fOvpAv8=
 github.com/gkampitakis/ciinfo v0.3.0/go.mod h1:1NIwaOcFChN4fa/B0hEBdAb6npDlFL8Bwx4dfRLRqAo=
 github.com/gkampitakis/go-diff v1.3.2 h1:Qyn0J9XJSDTgnsgHRdz9Zp24RaJeKMUHg2+PDZZdC4M=
@@ -323,8 +323,8 @@ github.com/go-restruct/restruct v1.2.0-alpha h1:2Lp474S/9660+SJjpVxoKuWX09JsXHSr
 github.com/go-restruct/restruct v1.2.0-alpha/go.mod h1:KqrpKpn4M8OLznErihXTGLlsXFGeLxHUrLRRI/1YjGk=
 github.com/go-sql-driver/mysql v1.6.0/go.mod h1:DCzpHaOWr8IXmIStZouvnhqoel9Qv2LBy8hT2VhHyBg=
 github.com/go-stack/stack v1.8.0/go.mod h1:v0f6uXyyMGvRgIKkXu+yp6POWl0qKG85gN/melR3HDY=
-github.com/go-test/deep v1.1.0 h1:WOcxcdHcvdgThNXjw0t76K42FXTU7HpNQWHpA2HHNlg=
-github.com/go-test/deep v1.1.0/go.mod h1:5C2ZWiW0ErCdrYzpqxLbTX7MG14M9iiw8DgHncVwcsE=
+github.com/go-test/deep v1.1.1 h1:0r/53hagsehfO4bzD2Pgr/+RgHqhmf+k1Bpse2cTu1U=
+github.com/go-test/deep v1.1.1/go.mod h1:5C2ZWiW0ErCdrYzpqxLbTX7MG14M9iiw8DgHncVwcsE=
 github.com/godbus/dbus/v5 v5.0.4/go.mod h1:xhWf0FNVPg57R7Z0UbKHbJfkEywrmjJnf7w5xrFpKfA=
 github.com/gogo/protobuf v1.1.1/go.mod h1:r8qH/GZQm5c6nD/R0oafs1akxWv10x8SbQlK7atdtwQ=
 github.com/gogo/protobuf v1.3.2 h1:Ov1cvc58UF3b5XjBnZv7+opcTcQFZebYjWzi34vdm4Q=
@@ -384,8 +384,8 @@ github.com/google/go-cmp v0.5.6/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/
 github.com/google/go-cmp v0.5.9/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
 github.com/google/go-cmp v0.6.0 h1:ofyhxvXcZhMsU5ulbFiLKl/XBFqE1GSq7atu8tAmTRI=
 github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
-github.com/google/go-containerregistry v0.19.1 h1:yMQ62Al6/V0Z7CqIrrS1iYoA5/oQCm88DeNujc7C1KY=
-github.com/google/go-containerregistry v0.19.1/go.mod h1:YCMFNQeeXeLF+dnhhWkqDItx/JSkH01j1Kis4PsjzFI=
+github.com/google/go-containerregistry v0.20.0 h1:wRqHpOeVh3DnenOrPy9xDOLdnLatiGuuNRVelR2gSbg=
+github.com/google/go-containerregistry v0.20.0/go.mod h1:YCMFNQeeXeLF+dnhhWkqDItx/JSkH01j1Kis4PsjzFI=
 github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
 github.com/google/licensecheck v0.3.1 h1:QoxgoDkaeC4nFrtGN1jV7IPmDCHFNIVh54e5hSt6sPs=
 github.com/google/licensecheck v0.3.1/go.mod h1:ORkR35t/JjW+emNKtfJDII0zlciG9JgbT7SmsohlHmY=
@@ -617,8 +617,8 @@ github.com/onsi/gomega v1.27.10 h1:naR28SdDFlqrG6kScpT8VWpu1xWY5nJRCF3XaYyBjhI=
 github.com/onsi/gomega v1.27.10/go.mod h1:RsS8tutOdbdgzbPtzzATp12yT7kM5I5aElG3evPbQ0M=
 github.com/opencontainers/go-digest v1.0.0 h1:apOUWs51W5PlhuyGyz9FCeeBIOUDA/6nW8Oi/yOhh5U=
 github.com/opencontainers/go-digest v1.0.0/go.mod h1:0JzlMkj0TRzQZfJkVvzbP0HBR3IKzErnv2BNG4W4MAM=
-github.com/opencontainers/image-spec v1.1.0-rc3 h1:fzg1mXZFj8YdPeNkRXMg+zb88BFV0Ys52cJydRwBkb8=
-github.com/opencontainers/image-spec v1.1.0-rc3/go.mod h1:X4pATf0uXsnn3g5aiGIsVnJBR4mxhKzfwmvK/B2NTm8=
+github.com/opencontainers/image-spec v1.1.0 h1:8SG7/vwALn54lVB/0yZ/MMwhFrPYtpEHQb2IpWsCzug=
+github.com/opencontainers/image-spec v1.1.0/go.mod h1:W4s4sFTMaBeK1BQLXbG4AdM2szdn85PY75RI83NrTrM=
 github.com/opencontainers/runc v1.1.12 h1:BOIssBaW1La0/qbNZHXOOa71dZfZEQOzW7dqQf3phss=
 github.com/opencontainers/runc v1.1.12/go.mod h1:S+lQwSfncpBha7XTy/5lBwWgm5+y5Ma/O44Ekby9FK8=
 github.com/opencontainers/runtime-spec v1.1.0-rc.1 h1:wHa9jroFfKGQqFHj0I1fMRKLl0pfj+ynAqBxo3v6u9w=
@@ -684,8 +684,8 @@ github.com/rogpeppe/go-internal v1.12.0/go.mod h1:E+RYuTGaKKdloAfM02xzb0FW3Paa99
 github.com/russross/blackfriday/v2 v2.0.1/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
 github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
 github.com/ryanuber/columnize v0.0.0-20160712163229-9b3edd62028f/go.mod h1:sm1tb6uqfes/u+d4ooFouqFdy9/2g9QGwK3SQygK0Ts=
-github.com/saferwall/pe v1.5.3 h1:tZ2KJWeJK6N2jjJx+B9hm+wq6qe0o56pql2PXUaQ9eI=
-github.com/saferwall/pe v1.5.3/go.mod h1:mJx+PuptmNpoPFBNhWs/uDMFL/kTHVZIkg0d4OUJFbQ=
+github.com/saferwall/pe v1.5.4 h1:tLmMggEMUfeqrpJ25zS/okUQmyFdD5xWKL2+z9njCqg=
+github.com/saferwall/pe v1.5.4/go.mod h1:mJx+PuptmNpoPFBNhWs/uDMFL/kTHVZIkg0d4OUJFbQ=
 github.com/sagikazarmark/crypt v0.3.0/go.mod h1:uD/D+6UF4SrIR1uGEv7bBNkNqLGqUr43MRiaGWX1Nig=
 github.com/sagikazarmark/locafero v0.4.0 h1:HApY1R9zGo4DBgr7dqsTH/JJxLTTsOt7u6keLGt6kNQ=
 github.com/sagikazarmark/locafero v0.4.0/go.mod h1:Pe1W6UlPYUk/+wc/6KFhbORCfqzgYEpgQ3O5fPuL3H4=
@@ -726,8 +726,8 @@ github.com/sourcegraph/conc v0.3.0 h1:OQTbbt6P72L20UqAkXXuLOj79LfEanQ+YQFNpLA9yS
 github.com/sourcegraph/conc v0.3.0/go.mod h1:Sdozi7LEKbFPqYX2/J+iBAM6HpqSLTASQIKqDmF7Mt0=
 github.com/spaolacci/murmur3 v0.0.0-20180118202830-f09979ecbc72/go.mod h1:JwIasOWyU6f++ZhiEuf87xNszmSA2myDM2Kzu9HwQUA=
 github.com/spdx/gordf v0.0.0-20201111095634-7098f93598fb/go.mod h1:uKWaldnbMnjsSAXRurWqqrdyZen1R7kxl8TkmWk2OyM=
-github.com/spdx/tools-golang v0.5.4 h1:fRW4iz16P1ZCUtWStFqS6YiMgnK7WgfTFU/lrsYlvqY=
-github.com/spdx/tools-golang v0.5.4/go.mod h1:MVIsXx8ZZzaRWNQpUDhC4Dud34edUYJYecciXgrw5vE=
+github.com/spdx/tools-golang v0.5.5 h1:61c0KLfAcNqAjlg6UNMdkwpMernhw3zVRwDZ2x9XOmk=
+github.com/spdx/tools-golang v0.5.5/go.mod h1:MVIsXx8ZZzaRWNQpUDhC4Dud34edUYJYecciXgrw5vE=
 github.com/spf13/afero v1.3.3/go.mod h1:5KUK8ByomD5Ti5Artl0RtHeI5pTF7MIDuXL3yY520V4=
 github.com/spf13/afero v1.6.0/go.mod h1:Ai8FlHk4v/PARR026UzYexafAt9roJ7LcLMAmO6Z93I=
 github.com/spf13/afero v1.11.0 h1:WJQKhtpdm3v2IzqG8VMqrr6Rf3UYpEF239Jy9wNepM8=
@@ -737,8 +737,8 @@ github.com/spf13/cast v1.4.1/go.mod h1:Qx5cxh0v+4UWYiBimWS+eyWzqEqokIECu5etghLkU
 github.com/spf13/cast v1.6.0 h1:GEiTHELF+vaR5dhz3VqZfFSzZjYbgeKDpBxQVS4GYJ0=
 github.com/spf13/cast v1.6.0/go.mod h1:ancEpBxwJDODSW/UG4rDrAqiKolqNNh2DX3mk86cAdo=
 github.com/spf13/cobra v1.3.0/go.mod h1:BrRVncBjOJa/eUcVVm9CE+oC6as8k+VYr4NY7WCi9V4=
-github.com/spf13/cobra v1.8.0 h1:7aJaZx1B85qltLMc546zn58BxxfZdR/W22ej9CFoEf0=
-github.com/spf13/cobra v1.8.0/go.mod h1:WXLWApfZ71AjXPya3WOlMsY9yMs7YeiHhFVlvLyhcho=
+github.com/spf13/cobra v1.8.1 h1:e5/vxKd/rZsfSJMUX1agtjeTDf+qv1/JdBF8gg5k9ZM=
+github.com/spf13/cobra v1.8.1/go.mod h1:wHxEcudfqmLYa8iTfL+OuZPbBZkmvliBWKIezN3kD9Y=
 github.com/spf13/jwalterweatherman v1.1.0/go.mod h1:aNWZUN0dPAAO/Ljvb5BEdw96iTZ0EXowPYD95IqWIGo=
 github.com/spf13/pflag v1.0.5 h1:iy+VFUOCP1a+8yFto/drg2CJ5u0yRoB7fZw3DKv/JXA=
 github.com/spf13/pflag v1.0.5/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
@@ -768,8 +768,8 @@ github.com/stretchr/testify v1.9.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8
 github.com/subosito/gotenv v1.2.0/go.mod h1:N0PQaV/YGNqwC0u51sEeR/aUtSLEXKX9iv69rRypqCw=
 github.com/subosito/gotenv v1.6.0 h1:9NlTDc1FTs4qu0DDq7AEtTPNw6SVm7uBMsUCUjABIf8=
 github.com/subosito/gotenv v1.6.0/go.mod h1:Dk4QP5c2W3ibzajGcXpNraDfq2IrhjMIvMSWPKKo0FU=
-github.com/sylabs/sif/v2 v2.11.5 h1:7ssPH3epSonsTrzbS1YxeJ9KuqAN7ISlSM61a7j/mQM=
-github.com/sylabs/sif/v2 v2.11.5/go.mod h1:GBoZs9LU3e4yJH1dcZ3Akf/jsqYgy5SeguJQC+zd75Y=
+github.com/sylabs/sif/v2 v2.17.1 h1:p6Sl0LWyShXBj2SBsS1dMOMIMrZHe8pwBnBrYt6uo4M=
+github.com/sylabs/sif/v2 v2.17.1/go.mod h1:XUGB6AQUXGkms3qPOPdevctT3lBLRLWZNWHVnt5HMKE=
 github.com/sylabs/squashfs v0.6.1 h1:4hgvHnD9JGlYWwT0bPYNt9zaz23mAV3Js+VEgQoRGYQ=
 github.com/sylabs/squashfs v0.6.1/go.mod h1:ZwpbPCj0ocIvMy2br6KZmix6Gzh6fsGQcCnydMF+Kx8=
 github.com/terminalstatic/go-xsd-validate v0.1.5 h1:RqpJnf6HGE2CB/lZB1A8BYguk8uRtcvYAPLCF15qguo=
@@ -877,8 +877,8 @@ golang.org/x/crypto v0.0.0-20220622213112-05595931fe9d/go.mod h1:IxCIyHEi3zRg3s0
 golang.org/x/crypto v0.3.0/go.mod h1:hebNnKkNXi2UzZN1eVRvBB7co0a+JxK6XbPiWVs/3J4=
 golang.org/x/crypto v0.3.1-0.20221117191849-2c476679df9a/go.mod h1:hebNnKkNXi2UzZN1eVRvBB7co0a+JxK6XbPiWVs/3J4=
 golang.org/x/crypto v0.7.0/go.mod h1:pYwdfH91IfpZVANVyUOhSIPZaFoJGxTFbZhFTx+dXZU=
-golang.org/x/crypto v0.24.0 h1:mnl8DM0o513X8fdIkmyFE/5hTYxbwYOjDS/+rK6qpRI=
-golang.org/x/crypto v0.24.0/go.mod h1:Z1PMYSOR5nyMcyAVAIQSKCDwalqy85Aqn1x3Ws4L5DM=
+golang.org/x/crypto v0.25.0 h1:ypSNr+bnYL2YhwoMt2zPxHFmbAN1KZs/njMG3hxUp30=
+golang.org/x/crypto v0.25.0/go.mod h1:T+wALwcMOSE0kXgUAnPAHqTLW+XHgcELELW8VaDgm/M=
 golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
 golang.org/x/exp v0.0.0-20190306152737-a1d7652674e8/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
 golang.org/x/exp v0.0.0-20190510132918-efd6b22b2522/go.mod h1:ZjyILWgesfNpC6sMxTJOJm9Kp84zZh5NQWvqDGG3Qr8=
@@ -919,8 +919,8 @@ golang.org/x/mod v0.4.2/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.5.0/go.mod h1:5OXOZSfqPIIbmVBIIKWRFfZjPR0E5r58TLhUjH0a2Ro=
 golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4=
 golang.org/x/mod v0.8.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
-golang.org/x/mod v0.18.0 h1:5+9lSbEzPSdWkH32vYPBwEpX8KwDbM52Ud9xBUvNlb0=
-golang.org/x/mod v0.18.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=
+golang.org/x/mod v0.19.0 h1:fEdghXQSo20giMthA7cd28ZC+jts4amQ3YMXiP5oMQ8=
+golang.org/x/mod v0.19.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=
 golang.org/x/net v0.0.0-20180724234803-3673e40ba225/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20180826012351-8a410e7b638d/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20181023162649-9b4f9f5ad519/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
@@ -968,8 +968,8 @@ golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug
 golang.org/x/net v0.2.0/go.mod h1:KqCZLdyyvdV855qA2rE3GC2aiw5xGR5TEjj8smXukLY=
 golang.org/x/net v0.6.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=
 golang.org/x/net v0.8.0/go.mod h1:QVkue5JL9kW//ek3r6jTKnTFis1tRmNAW2P1shuFdJc=
-golang.org/x/net v0.26.0 h1:soB7SVo0PWrY4vPW/+ay0jKDNScG2X9wFeYlXIvJsOQ=
-golang.org/x/net v0.26.0/go.mod h1:5YKkiSynbBIh3p6iOc/vibscux0x38BZDkn8sCUPxHE=
+golang.org/x/net v0.27.0 h1:5K3Njcw06/l2y9vpGCSdcxWOYHOUk3dVNGDXN+FvAys=
+golang.org/x/net v0.27.0/go.mod h1:dDi0PyhWNoiUOrAS8uXv/vnScO4wnHQO4mj9fn/RytE=
 golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
 golang.org/x/oauth2 v0.0.0-20190226205417-e64efc72b421/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
 golang.org/x/oauth2 v0.0.0-20190604053449-0f29369cfe45/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
@@ -1081,15 +1081,15 @@ golang.org/x/sys v0.2.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.3.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.21.0 h1:rF+pYz3DAGSQAxAu1CbC7catZg4ebC4UIeIhKxBZvws=
-golang.org/x/sys v0.21.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
+golang.org/x/sys v0.22.0 h1:RI27ohtqKCnwULzJLqkv897zojh5/DwS/ENaMzUOaWI=
+golang.org/x/sys v0.22.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
 golang.org/x/term v0.2.0/go.mod h1:TVmDHMZPmdnySmBfhjOoOdhjzdE1h4u1VwSiw2l1Nuc=
 golang.org/x/term v0.5.0/go.mod h1:jMB1sMXY+tzblOD4FWmEbocvup2/aLOaQEp7JmGp78k=
 golang.org/x/term v0.6.0/go.mod h1:m6U89DPEgQRMq3DNkDClhWw02AUbt2daBVO4cn4Hv9U=
-golang.org/x/term v0.21.0 h1:WVXCp+/EBEHOj53Rvu+7KiT/iElMrO8ACK16SMZ3jaA=
-golang.org/x/term v0.21.0/go.mod h1:ooXLefLobQVslOqselCNF4SxFAaoS6KujMbsGzSDmX0=
+golang.org/x/term v0.22.0 h1:BbsgPEJULsl2fV/AT3v15Mjva5yXKQDyKf+TbDz7QJk=
+golang.org/x/term v0.22.0/go.mod h1:F3qCibpT5AMpCRfhfT53vVJwhLtIVHhB9XDjfFvnMI4=
 golang.org/x/text v0.0.0-20170915032832-14c0d48ead0c/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.1-0.20180807135948-17ff2d5776d2/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
@@ -87,7 +87,7 @@ func subFs(fsys afero.Fs, subDirs ...string) (afero.Fs, error) {
 	if errors.Is(err, afero.ErrFileNotFound) {
 		err = fsys.MkdirAll(dir, dirPermissions)
 		if err != nil {
-			return nil, fmt.Errorf("unable to create directory at '%s/%s': %v", dir, strings.Join(subDirs, "/"), err)
+			return nil, fmt.Errorf("unable to create directory at '%s': %v", dir, err)
 		}
 		stat, err = fsys.Stat(dir)
 		if err != nil {
@@ -1,6 +1,7 @@
 package cache

 import (
+	"fmt"
 	"io"
 	"net/url"
 	"os"
@@ -92,3 +93,14 @@ func Test_makeDiskKey(t *testing.T) {
 		})
 	}
 }
+
+func Test_errors(t *testing.T) {
+	tmp := t.TempDir()
+	cache := filepath.Join(tmp, "cache")
+	// make a non-writable directory
+	require.NoError(t, os.MkdirAll(cache, 0500|os.ModeDir))
+	// attempt to make cache in non-writable directory
+	dir := filepath.Join(cache, "dir")
+	_, err := NewFromDir(dir, time.Hour)
+	require.ErrorContains(t, err, fmt.Sprintf("unable to create directory at '%s':", dir))
+}
@@ -1,6 +1,7 @@
 package relationship

 import (
+	"reflect"
 	"slices"

 	"github.com/anchore/syft/internal/sbomsync"
@@ -21,6 +22,10 @@ var (
 	binaryCatalogerTypes = []pkg.Type{
 		pkg.BinaryPkg,
 	}
+	binaryMetadataTypes = []string{
+		reflect.TypeOf(pkg.ELFBinaryPackageNoteJSONPayload{}).Name(),
+		reflect.TypeOf(pkg.BinarySignature{}).Name(),
+	}
 )

 func ExcludeBinariesByFileOwnershipOverlap(accessor sbomsync.Accessor) {
@@ -60,5 +65,15 @@ func excludeBinaryByFileOwnershipOverlap(r artifact.Relationship, c *pkg.Collect
 		return false
 	}

-	return slices.Contains(binaryCatalogerTypes, child.Type)
+	if slices.Contains(binaryCatalogerTypes, child.Type) {
+		return true
+	}
+
+	if child.Metadata == nil {
+		return false
+	}
+
+	childMetadataType := reflect.TypeOf(child.Metadata)
+
+	return slices.Contains(binaryMetadataTypes, childMetadataType.Name())
 }
@@ -12,7 +12,9 @@ func TestExclude(t *testing.T) {
 	packageB := pkg.Package{Name: "package-a", Type: pkg.PythonPkg}
 	packageC := pkg.Package{Name: "package-a", Type: pkg.BinaryPkg}
 	packageD := pkg.Package{Name: "package-d", Type: pkg.BinaryPkg}
-	for _, p := range []*pkg.Package{&packageA, &packageB, &packageC, &packageD} {
+	packageE := pkg.Package{Name: "package-e", Type: pkg.RpmPkg, Metadata: pkg.ELFBinaryPackageNoteJSONPayload{Type: "rpm"}}
+	packageF := pkg.Package{Name: "package-f", Type: pkg.RpmPkg, Metadata: pkg.BinarySignature{}}
+	for _, p := range []*pkg.Package{&packageA, &packageB, &packageC, &packageD, &packageE, &packageF} {
 		p := p
 		p.SetID()
 	}
@@ -43,6 +45,26 @@ func TestExclude(t *testing.T) {
 			packages:      pkg.NewCollection(packageA, packageC),
 			shouldExclude: true,
 		},
+		{
+			name: "exclusions from os -> elf binary (as RPM)",
+			relationship: artifact.Relationship{
+				Type: artifact.OwnershipByFileOverlapRelationship,
+				From: packageA,
+				To:   packageE,
+			},
+			packages:      pkg.NewCollection(packageA, packageE),
+			shouldExclude: true,
+		},
+		{
+			name: "exclusions from os -> binary (masquerading as RPM)",
+			relationship: artifact.Relationship{
+				Type: artifact.OwnershipByFileOverlapRelationship,
+				From: packageA,
+				To:   packageF,
+			},
+			packages:      pkg.NewCollection(packageA, packageF),
+			shouldExclude: true,
+		},
 		{
 			name: "no exclusions from python -> binary",
 			relationship: artifact.Relationship{
@@ -7,3 +7,12 @@ For this reason we've included a copy of all schemas needed to validate `syft` o
 to reference local copies of dependent schemas.

 You can get the latest schemas from the [CycloneDX specifications repo](https://github.com/CycloneDX/specification/tree/master/schema).
+
+When the spec version is bumped an approach to determining prior modifications is to compare the 
+prior spec version (e.g. if updating to 1.7, compare the files in this directory against the 1.6 
+equivalents). 
+
+One can also update the schemas and observe the errors in order to make the necessary updates. 
+At the time of writing, the cyclonedx.xsd needed modifications to link to the local spdx.xsd, 
+and also to changes the minOccurs for a license tag to 0. (The json schema does not require 
+modification for the generated file to lint properly, but can simply be copy/pasted).   
@@ -2,7 +2,7 @@
 <xs:schema xmlns:xs="http://www.w3.org/2001/XMLSchema"
           elementFormDefault="qualified"
           targetNamespace="http://cyclonedx.org/schema/spdx"
-           version="1.0-3.23">
+           version="1.0-3.24.0">

    <xs:simpleType name="licenseId">
        <xs:restriction base="xs:string">
@@ -12,6 +12,11 @@
                    <xs:documentation>BSD Zero Clause License</xs:documentation>
                </xs:annotation>
            </xs:enumeration>
+            <xs:enumeration value="3D-Slicer-1.0">
+                <xs:annotation>
+                    <xs:documentation>3D Slicer License v1.0</xs:documentation>
+                </xs:annotation>
+            </xs:enumeration>
            <xs:enumeration value="AAL">
                <xs:annotation>
                    <xs:documentation>Attribution Assurance License</xs:documentation>
@@ -117,6 +122,11 @@
                    <xs:documentation>Aladdin Free Public License</xs:documentation>
                </xs:annotation>
            </xs:enumeration>
+            <xs:enumeration value="AMD-newlib">
+                <xs:annotation>
+                    <xs:documentation>AMD newlib License</xs:documentation>
+                </xs:annotation>
+            </xs:enumeration>
            <xs:enumeration value="AMDPLPA">
                <xs:annotation>
                    <xs:documentation>AMD&apos;s plpa_map.c License</xs:documentation>
@@ -147,6 +157,11 @@
                    <xs:documentation>ANTLR Software Rights Notice with license fallback</xs:documentation>
                </xs:annotation>
            </xs:enumeration>
+            <xs:enumeration value="any-OSI">
+                <xs:annotation>
+                    <xs:documentation>Any OSI License</xs:documentation>
+                </xs:annotation>
+            </xs:enumeration>
            <xs:enumeration value="Apache-1.0">
                <xs:annotation>
                    <xs:documentation>Apache License 1.0</xs:documentation>
@@ -322,6 +337,11 @@
                    <xs:documentation>BSD 2-Clause - Ian Darwin variant</xs:documentation>
                </xs:annotation>
            </xs:enumeration>
+            <xs:enumeration value="BSD-2-Clause-first-lines">
+                <xs:annotation>
+                    <xs:documentation>BSD 2-Clause - first lines requirement</xs:documentation>
+                </xs:annotation>
+            </xs:enumeration>
            <xs:enumeration value="BSD-2-Clause-FreeBSD">
                <xs:annotation>
                    <xs:documentation>BSD 2-Clause FreeBSD License</xs:documentation>
@@ -522,6 +542,11 @@
                    <xs:documentation>Caldera License (without preamble)</xs:documentation>
                </xs:annotation>
            </xs:enumeration>
+            <xs:enumeration value="Catharon">
+                <xs:annotation>
+                    <xs:documentation>Catharon License</xs:documentation>
+                </xs:annotation>
+            </xs:enumeration>
            <xs:enumeration value="CATOSL-1.1">
                <xs:annotation>
                    <xs:documentation>Computer Associates Trusted Open Source License 1.1</xs:documentation>
@@ -1002,6 +1027,11 @@
                    <xs:documentation>curl License</xs:documentation>
                </xs:annotation>
            </xs:enumeration>
+            <xs:enumeration value="cve-tou">
+                <xs:annotation>
+                    <xs:documentation>Common Vulnerability Enumeration ToU License</xs:documentation>
+                </xs:annotation>
+            </xs:enumeration>
            <xs:enumeration value="D-FSL-1.0">
                <xs:annotation>
                    <xs:documentation>Deutsche Freie Software Lizenz</xs:documentation>
@@ -1482,6 +1512,11 @@
                    <xs:documentation>gtkbook License</xs:documentation>
                </xs:annotation>
            </xs:enumeration>
+            <xs:enumeration value="Gutmann">
+                <xs:annotation>
+                    <xs:documentation>Gutmann License</xs:documentation>
+                </xs:annotation>
+            </xs:enumeration>
            <xs:enumeration value="HaskellReport">
                <xs:annotation>
                    <xs:documentation>Haskell Language Report License</xs:documentation>
@@ -1532,11 +1567,21 @@
                    <xs:documentation>HPND with US Government export control warning</xs:documentation>
                </xs:annotation>
            </xs:enumeration>
+            <xs:enumeration value="HPND-export-US-acknowledgement">
+                <xs:annotation>
+                    <xs:documentation>HPND with US Government export control warning and acknowledgment</xs:documentation>
+                </xs:annotation>
+            </xs:enumeration>
            <xs:enumeration value="HPND-export-US-modify">
                <xs:annotation>
                    <xs:documentation>HPND with US Government export control warning and modification rqmt</xs:documentation>
                </xs:annotation>
            </xs:enumeration>
+            <xs:enumeration value="HPND-export2-US">
+                <xs:annotation>
+                    <xs:documentation>HPND with US Government export control and 2 disclaimers</xs:documentation>
+                </xs:annotation>
+            </xs:enumeration>
            <xs:enumeration value="HPND-Fenneberg-Livingston">
                <xs:annotation>
                    <xs:documentation>Historical Permission Notice and Disclaimer - Fenneberg-Livingston variant</xs:documentation>
@@ -1547,6 +1592,11 @@
                    <xs:documentation>Historical Permission Notice and Disclaimer    - INRIA-IMAG variant</xs:documentation>
                </xs:annotation>
            </xs:enumeration>
+            <xs:enumeration value="HPND-Intel">
+                <xs:annotation>
+                    <xs:documentation>Historical Permission Notice and Disclaimer - Intel variant</xs:documentation>
+                </xs:annotation>
+            </xs:enumeration>
            <xs:enumeration value="HPND-Kevlin-Henney">
                <xs:annotation>
                    <xs:documentation>Historical Permission Notice and Disclaimer - Kevlin Henney variant</xs:documentation>
@@ -1557,6 +1607,11 @@
                    <xs:documentation>Historical Permission Notice and Disclaimer - Markus Kuhn variant</xs:documentation>
                </xs:annotation>
            </xs:enumeration>
+            <xs:enumeration value="HPND-merchantability-variant">
+                <xs:annotation>
+                    <xs:documentation>Historical Permission Notice and Disclaimer - merchantability variant</xs:documentation>
+                </xs:annotation>
+            </xs:enumeration>
            <xs:enumeration value="HPND-MIT-disclaimer">
                <xs:annotation>
                    <xs:documentation>Historical Permission Notice and Disclaimer with MIT disclaimer</xs:documentation>
@@ -1587,11 +1642,21 @@
                    <xs:documentation>HPND sell variant with MIT disclaimer</xs:documentation>
                </xs:annotation>
            </xs:enumeration>
+            <xs:enumeration value="HPND-sell-variant-MIT-disclaimer-rev">
+                <xs:annotation>
+                    <xs:documentation>HPND sell variant with MIT disclaimer - reverse</xs:documentation>
+                </xs:annotation>
+            </xs:enumeration>
            <xs:enumeration value="HPND-UC">
                <xs:annotation>
                    <xs:documentation>Historical Permission Notice and Disclaimer - University of California variant</xs:documentation>
                </xs:annotation>
            </xs:enumeration>
+            <xs:enumeration value="HPND-UC-export-US">
+                <xs:annotation>
+                    <xs:documentation>Historical Permission Notice and Disclaimer - University of California, US export warning</xs:documentation>
+                </xs:annotation>
+            </xs:enumeration>
            <xs:enumeration value="HTMLTIDY">
                <xs:annotation>
                    <xs:documentation>HTML Tidy License</xs:documentation>
@@ -2027,6 +2092,11 @@
                    <xs:documentation>MIT Festival Variant</xs:documentation>
                </xs:annotation>
            </xs:enumeration>
+            <xs:enumeration value="MIT-Khronos-old">
+                <xs:annotation>
+                    <xs:documentation>MIT Khronos - old variant</xs:documentation>
+                </xs:annotation>
+            </xs:enumeration>
            <xs:enumeration value="MIT-Modern-Variant">
                <xs:annotation>
                    <xs:documentation>MIT License Modern Variant</xs:documentation>
@@ -2162,11 +2232,21 @@
                    <xs:documentation>Net Boolean Public License v1</xs:documentation>
                </xs:annotation>
            </xs:enumeration>
+            <xs:enumeration value="NCBI-PD">
+                <xs:annotation>
+                    <xs:documentation>NCBI Public Domain Notice</xs:documentation>
+                </xs:annotation>
+            </xs:enumeration>
            <xs:enumeration value="NCGL-UK-2.0">
                <xs:annotation>
                    <xs:documentation>Non-Commercial Government Licence</xs:documentation>
                </xs:annotation>
            </xs:enumeration>
+            <xs:enumeration value="NCL">
+                <xs:annotation>
+                    <xs:documentation>NCL Source Code License</xs:documentation>
+                </xs:annotation>
+            </xs:enumeration>
            <xs:enumeration value="NCSA">
                <xs:annotation>
                    <xs:documentation>University of Illinois/NCSA Open Source License</xs:documentation>
@@ -2282,6 +2362,11 @@
                    <xs:documentation>Open Use of Data Agreement v1.0</xs:documentation>
                </xs:annotation>
            </xs:enumeration>
+            <xs:enumeration value="OAR">
+                <xs:annotation>
+                    <xs:documentation>OAR License</xs:documentation>
+                </xs:annotation>
+            </xs:enumeration>
            <xs:enumeration value="OCCT-PL">
                <xs:annotation>
                    <xs:documentation>Open CASCADE Technology Public License</xs:documentation>
@@ -2562,6 +2647,11 @@
                    <xs:documentation>Pixar License</xs:documentation>
                </xs:annotation>
            </xs:enumeration>
+            <xs:enumeration value="pkgconf">
+                <xs:annotation>
+                    <xs:documentation>pkgconf License</xs:documentation>
+                </xs:annotation>
+            </xs:enumeration>
            <xs:enumeration value="Plexus">
                <xs:annotation>
                    <xs:documentation>Plexus Classworlds License</xs:documentation>
@@ -2587,6 +2677,11 @@
                    <xs:documentation>PostgreSQL License</xs:documentation>
                </xs:annotation>
            </xs:enumeration>
+            <xs:enumeration value="PPL">
+                <xs:annotation>
+                    <xs:documentation>Peer Production License</xs:documentation>
+                </xs:annotation>
+            </xs:enumeration>
            <xs:enumeration value="PSF-2.0">
                <xs:annotation>
                    <xs:documentation>Python Software Foundation License 2.0</xs:documentation>
@@ -2862,6 +2957,11 @@
                    <xs:documentation>Sun PPP License</xs:documentation>
                </xs:annotation>
            </xs:enumeration>
+            <xs:enumeration value="Sun-PPP-2000">
+                <xs:annotation>
+                    <xs:documentation>Sun PPP License (2000)</xs:documentation>
+                </xs:annotation>
+            </xs:enumeration>
            <xs:enumeration value="SunPro">
                <xs:annotation>
                    <xs:documentation>SunPro License</xs:documentation>
@@ -2907,6 +3007,11 @@
                    <xs:documentation>Transitive Grace Period Public Licence 1.0</xs:documentation>
                </xs:annotation>
            </xs:enumeration>
+            <xs:enumeration value="threeparttable">
+                <xs:annotation>
+                    <xs:documentation>threeparttable License</xs:documentation>
+                </xs:annotation>
+            </xs:enumeration>
            <xs:enumeration value="TMate">
                <xs:annotation>
                    <xs:documentation>TMate Open Source License</xs:documentation>
@@ -3132,6 +3237,11 @@
                    <xs:documentation>XSkat License</xs:documentation>
                </xs:annotation>
            </xs:enumeration>
+            <xs:enumeration value="xzoom">
+                <xs:annotation>
+                    <xs:documentation>xzoom License</xs:documentation>
+                </xs:annotation>
+            </xs:enumeration>
            <xs:enumeration value="YPL-1.0">
                <xs:annotation>
                    <xs:documentation>Yahoo! Public License v1.0</xs:documentation>
@@ -3203,6 +3313,11 @@
                    <xs:documentation>Asterisk exception</xs:documentation>
                </xs:annotation>
            </xs:enumeration>
+            <xs:enumeration value="Asterisk-linking-protocols-exception">
+                <xs:annotation>
+                    <xs:documentation>Asterisk linking protocols exception</xs:documentation>
+                </xs:annotation>
+            </xs:enumeration>
            <xs:enumeration value="Autoconf-exception-2.0">
                <xs:annotation>
                    <xs:documentation>Autoconf exception 2.0</xs:documentation>
@@ -3438,6 +3553,11 @@
                    <xs:documentation>OpenVPN OpenSSL Exception</xs:documentation>
                </xs:annotation>
            </xs:enumeration>
+            <xs:enumeration value="PCRE2-exception">
+                <xs:annotation>
+                    <xs:documentation>PCRE2 exception</xs:documentation>
+                </xs:annotation>
+            </xs:enumeration>
            <xs:enumeration value="PS-or-PDF-font-exception-20170817">
                <xs:annotation>
                    <xs:documentation>PS/PDF font exception (2017-08-17)</xs:documentation>
@@ -3463,6 +3583,11 @@
                    <xs:documentation>Qwt exception 1.0</xs:documentation>
                </xs:annotation>
            </xs:enumeration>
+            <xs:enumeration value="RRDtool-FLOSS-exception-2.0">
+                <xs:annotation>
+                    <xs:documentation>RRDtool FLOSS exception 2.0</xs:documentation>
+                </xs:annotation>
+            </xs:enumeration>
            <xs:enumeration value="SANE-exception">
                <xs:annotation>
                    <xs:documentation>SANE Exception</xs:documentation>
@@ -64,6 +64,28 @@ func TestBySourceThenSpecificity(t *testing.T) {
 				Must("cpe:2.3:a:some:package:*:*:*:*:*:*:*:*", "some-unknown-source"),
 			},
 		},
+		{
+			name: "lexical sorting on equal sources puts escaped characters later",
+			input: []CPE{
+				Must("cpe:2.3:a:jenkins:pipeline\\\\:_supporting_apis:865.v43e78cc44e0d:*:*:*:*:jenkins:*:*", "nvd-cpe-dictionary"),
+				Must("cpe:2.3:a:jenkins:pipeline_supporting_apis:865.v43e78cc44e0d:*:*:*:*:jenkins:*:*", "nvd-cpe-dictionary"),
+			},
+			want: []CPE{
+				Must("cpe:2.3:a:jenkins:pipeline_supporting_apis:865.v43e78cc44e0d:*:*:*:*:jenkins:*:*", "nvd-cpe-dictionary"),
+				Must("cpe:2.3:a:jenkins:pipeline\\\\:_supporting_apis:865.v43e78cc44e0d:*:*:*:*:jenkins:*:*", "nvd-cpe-dictionary"),
+			},
+		},
+		{
+			name: "lexical sorting on equal sources puts more specific attributes earlier",
+			input: []CPE{
+				Must("cpe:2.3:a:jenkins:mailer:472.vf7c289a_4b_420:*:*:*:*:*:*:*", "nvd-cpe-dictionary"),
+				Must("cpe:2.3:a:jenkins:mailer:472.vf7c289a_4b_420:*:*:*:*:jenkins:*:*", "nvd-cpe-dictionary"),
+			},
+			want: []CPE{
+				Must("cpe:2.3:a:jenkins:mailer:472.vf7c289a_4b_420:*:*:*:*:jenkins:*:*", "nvd-cpe-dictionary"),
+				Must("cpe:2.3:a:jenkins:mailer:472.vf7c289a_4b_420:*:*:*:*:*:*:*", "nvd-cpe-dictionary"),
+			},
+		},
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
@@ -0,0 +1,59 @@
+{
+  "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.6",
+  "serialNumber": "urn:uuid:5208fea9-73dd-4624-b596-69fddccdb9e7",
+  "version": 1,
+  "metadata": {
+    "timestamp": "2023-09-29T12:02:02-04:00",
+    "tools": [
+      {
+        "vendor": "anchore",
+        "name": "syft",
+        "version": "[not provided]"
+      }
+    ],
+    "component": {
+      "bom-ref": "a0ff99a6af10f11f",
+      "type": "file",
+      "name": "go.mod",
+      "version": "sha256:sha256:dc333f342905248a52e424d8dfd061251d01867d01a4f9d7397144a775ff9ebd"
+    }
+  },
+  "components": [
+    {
+      "bom-ref": "pkg:golang/github.com/wagoodman/go-partybus@v0.0.0-20230516145632-8ccac152c651?package-id=2ff71a67fb024c86",
+      "type": "library",
+      "name": "github.com/wagoodman/go-partybus",
+      "version": "v0.0.0-20230516145632-8ccac152c651",
+      "cpe": "cpe:2.3:a:wagoodman:go-partybus:v0.0.0-20230516145632-8ccac152c651:*:*:*:*:*:*:*",
+      "purl": "pkg:golang/github.com/wagoodman/go-partybus@v0.0.0-20230516145632-8ccac152c651",
+      "properties": [
+        {
+          "name": "syft:package:foundBy",
+          "value": "go-module-file-cataloger"
+        },
+        {
+          "name": "syft:package:language",
+          "value": "go"
+        },
+        {
+          "name": "syft:package:metadataType",
+          "value": "GolangModMetadata"
+        },
+        {
+          "name": "syft:package:type",
+          "value": "go-module"
+        },
+        {
+          "name": "syft:cpe23",
+          "value": "cpe:2.3:a:wagoodman:go_partybus:v0.0.0-20230516145632-8ccac152c651:*:*:*:*:*:*:*"
+        },
+        {
+          "name": "syft:location:0:path",
+          "value": "/go.mod"
+        }
+      ]
+    }
+  ]
+}
@@ -0,0 +1,28 @@
+{
+    "bomFormat": "CycloneDX",
+    "specVersion": "1.6",
+    "version": 1,
+    "components": [
+        {
+            "type": "library",
+            "group": "io.netty",
+            "name": "netty-codec-http2",
+            "version": "4.1.73.Final",
+            "properties": [
+                {
+                    "name": "syft:cpe23",
+                    "value": "cpe:2.3:a:codec:codec:4.1.73.Final:*:*:*:*:*:*:*"
+                },
+                {
+                    "name": "syft:cpe23",
+                    "value": "cpe:2.3:a:codec:netty-codec-http2:4.1.73.Final:*:*:*:*:*:*:*"
+                },
+                {
+                    "name": "syft:cpe23",
+                    "value": "cpe:2.3:a:codec:netty_codec_http2:4.1.73.Final:*:*:*:*:*:*:*"
+                }
+            ]
+        }
+    ],
+    "serialNumber": "urn:uuid:3eb5ec7a-cb05-4339-b873-e27b1c1efaba"
+}
@@ -1,7 +1,7 @@
 {
-  "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
+  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
-  "specVersion": "1.5",
+  "specVersion": "1.6",
  "serialNumber": "urn:uuid:redacted",
  "version": 1,
  "metadata": {
@@ -1,7 +1,7 @@
 {
-  "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
+  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
-  "specVersion": "1.5",
+  "specVersion": "1.6",
  "serialNumber": "urn:uuid:redacted",
  "version": 1,
  "metadata": {
@@ -0,0 +1,33 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.6" serialNumber="urn:uuid:098e8516-ecd5-4130-9d5f-c32ba1ddb0dd" version="1">
+  <metadata>
+    <timestamp>2023-09-29T11:48:10-04:00</timestamp>
+    <tools>
+      <tool>
+        <vendor>anchore</vendor>
+        <name>syft</name>
+        <version>[not provided]</version>
+      </tool>
+    </tools>
+    <component bom-ref="a0ff99a6af10f11f" type="file">
+      <name>go.mod</name>
+      <version>sha256:sha256:dc333f342905248a52e424d8dfd061251d01867d01a4f9d7397144a775ff9ebd</version>
+    </component>
+  </metadata>
+  <components>
+    <component bom-ref="pkg:golang/github.com/wagoodman/go-partybus@v0.0.0-20230516145632-8ccac152c651?package-id=2ff71a67fb024c86" type="library">
+      <name>github.com/wagoodman/go-partybus</name>
+      <version>v0.0.0-20230516145632-8ccac152c651</version>
+      <cpe>cpe:2.3:a:wagoodman:go-partybus:v0.0.0-20230516145632-8ccac152c651:*:*:*:*:*:*:*</cpe>
+      <purl>pkg:golang/github.com/wagoodman/go-partybus@v0.0.0-20230516145632-8ccac152c651</purl>
+      <properties>
+        <property name="syft:package:foundBy">go-module-file-cataloger</property>
+        <property name="syft:package:language">go</property>
+        <property name="syft:package:metadataType">GolangModMetadata</property>
+        <property name="syft:package:type">go-module</property>
+        <property name="syft:cpe23">cpe:2.3:a:wagoodman:go_partybus:v0.0.0-20230516145632-8ccac152c651:*:*:*:*:*:*:*</property>
+        <property name="syft:location:0:path">/go.mod</property>
+      </properties>
+    </component>
+  </components>
+</bom>
@@ -1,5 +1,5 @@
 <?xml version="1.0" encoding="UTF-8"?>
-<bom xmlns="http://cyclonedx.org/schema/bom/1.5" serialNumber="redacted" version="1">
+<bom xmlns="http://cyclonedx.org/schema/bom/1.6" serialNumber="redacted" version="1">
  <metadata>
    <timestamp>redacted</timestamp>
    <tools>
@@ -1,5 +1,5 @@
 <?xml version="1.0" encoding="UTF-8"?>
-<bom xmlns="http://cyclonedx.org/schema/bom/1.5" serialNumber="redacted" version="1">
+<bom xmlns="http://cyclonedx.org/schema/bom/1.6" serialNumber="redacted" version="1">
  <metadata>
    <timestamp>redacted</timestamp>
    <tools>
@@ -9,7 +9,7 @@ import (
 	"github.com/anchore/syft/syft/sbom"
 )

-const DefaultVersion = "1.5"
+const DefaultVersion = "1.6"

 type Encoder struct {
 	version cyclonedx.SpecVersion
@@ -19,6 +19,7 @@ func SupportedVersions(id sbom.FormatID) []string {
 		"1.3",
 		"1.4",
 		"1.5",
+		"1.6",
 	}

 	if id != JSONFormatID {
@@ -43,6 +44,8 @@ func SpecVersionFromString(v string) (cyclonedx.SpecVersion, error) {
 		return cyclonedx.SpecVersion1_4, nil
 	case "1.5":
 		return cyclonedx.SpecVersion1_5, nil
+	case "1.6":
+		return cyclonedx.SpecVersion1_6, nil
 	}
 	return -1, fmt.Errorf("unsupported CycloneDX version %q", v)
 }
@@ -61,6 +64,8 @@ func VersionFromSpecVersion(spec cyclonedx.SpecVersion) string {
 		return "1.4"
 	case cyclonedx.SpecVersion1_5:
 		return "1.5"
+	case cyclonedx.SpecVersion1_6:
+		return "1.6"
 	}
 	return ""
 }
@@ -22,6 +22,10 @@ func DownloadLocation(p pkg.Package) string {
 			return NoneIfEmpty(metadata.URL)
 		case pkg.NpmPackageLockEntry:
 			return NoneIfEmpty(metadata.Resolved)
+		case pkg.PhpComposerLockEntry:
+			return NoneIfEmpty(metadata.Dist.URL)
+		case pkg.PhpComposerInstalledEntry:
+			return NoneIfEmpty(metadata.Dist.URL)
 		}
 	}
 	return NOASSERTION
@@ -64,6 +64,50 @@ func Test_DownloadLocation(t *testing.T) {
 			},
 			expected: NONE,
 		},
+		{
+			name: "from php installed.json",
+			input: pkg.Package{
+				Metadata: pkg.PhpComposerInstalledEntry{
+					Dist: pkg.PhpComposerExternalReference{
+						URL: "http://package-lock.test",
+					},
+				},
+			},
+			expected: "http://package-lock.test",
+		},
+		{
+			name: "empty",
+			input: pkg.Package{
+				Metadata: pkg.PhpComposerInstalledEntry{
+					Dist: pkg.PhpComposerExternalReference{
+						URL: "",
+					},
+				},
+			},
+			expected: "NONE",
+		},
+		{
+			name: "from php composer.lock",
+			input: pkg.Package{
+				Metadata: pkg.PhpComposerLockEntry{
+					Dist: pkg.PhpComposerExternalReference{
+						URL: "http://package-lock.test",
+					},
+				},
+			},
+			expected: "http://package-lock.test",
+		},
+		{
+			name: "empty",
+			input: pkg.Package{
+				Metadata: pkg.PhpComposerLockEntry{
+					Dist: pkg.PhpComposerExternalReference{
+						URL: "",
+					},
+				},
+			},
+			expected: "NONE",
+		},
 	}
 	for _, test := range tests {
 		t.Run(test.name, func(t *testing.T) {
@@ -48,6 +48,17 @@ func Test_Cataloger_PositiveCases(t *testing.T) {
 				Metadata:  metadata("arangodb-binary"),
 			},
 		},
+		{
+			logicalFixture: "arangodb/3.12.0-2/linux-amd64",
+			expected: pkg.Package{
+				Name:      "arangodb",
+				Version:   "3.12.0-2",
+				Type:      "binary",
+				PURL:      "pkg:generic/arangodb@3.12.0-2",
+				Locations: locations("arangosh"),
+				Metadata:  metadata("arangodb-binary"),
+			},
+		},
 		{
 			logicalFixture: "postgres/15beta4/linux-amd64",
 			expected: pkg.Package{
@@ -896,6 +907,17 @@ func Test_Cataloger_PositiveCases(t *testing.T) {
 				Metadata:  metadata("erlang-library"),
 			},
 		},
+		{
+			logicalFixture: "erlang/27.0/linux-amd64",
+			expected: pkg.Package{
+				Name:      "erlang",
+				Version:   "27.0",
+				Type:      "binary",
+				PURL:      "pkg:generic/erlang@27.0",
+				Locations: locations("beam.smp"),
+				Metadata:  metadata("erlang-alpine-binary"),
+			},
+		},
 		{
 			logicalFixture: "nginx/1.25.1/linux-amd64",
 			expected: pkg.Package{
@@ -272,7 +272,7 @@ func DefaultClassifiers() []Classifier {
 			Class:    "arangodb-binary",
 			FileGlob: "**/arangosh",
 			EvidenceMatcher: FileContentsVersionMatcher(
-				`(?m)ArangoDB\s\x00*(?P<version>[0-9]+\.[0-9]+\.[0-9]+)\s\[linux\]`),
+				`(?m)\x00*(?P<version>[0-9]+\.[0-9]+\.[0-9]+(-[0-9]+)?)\s\[linux\]`),
 			Package: "arangodb",
 			PURL:    mustPURL("pkg:generic/arangodb@version"),
 			CPEs:    singleCPE("cpe:2.3:a:arangodb:arangodb:*:*:*:*:*:*:*:*"),
@@ -393,6 +393,23 @@ func DefaultClassifiers() []Classifier {
 			PURL:    mustPURL("pkg:generic/erlang@version"),
 			CPEs:    singleCPE("cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"),
 		},
+		{
+			Class:    "erlang-alpine-binary",
+			FileGlob: "**/beam.smp",
+			EvidenceMatcher: evidenceMatchers(
+				FileContentsVersionMatcher(
+					// <artificial>[NUL]/usr/src/otp_src_25.3.2.6/erts/
+					`(?m)/src/otp_src_(?P<version>[0-9]+\.[0-9]+(\.[0-9]+){0,2}(-rc[0-9])?)/erts/`,
+				),
+				FileContentsVersionMatcher(
+					// <artificial>[NUL]/usr/local/src/otp-25.3.2.7/erts/
+					`(?m)/usr/local/src/otp-(?P<version>[0-9]+\.[0-9]+(\.[0-9]+){0,2}(-rc[0-9])?)/erts/`,
+				),
+			),
+			Package: "erlang",
+			PURL:    mustPURL("pkg:generic/erlang@version"),
+			CPEs:    singleCPE("cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"),
+		},
 		{
 			Class:    "erlang-library",
 			FileGlob: "**/liberts_internal.a",
@@ -13,7 +13,7 @@ func newELFPackage(metadata elfBinaryPackageNotes, locations file.LocationSet) p
 		Version:   metadata.Version,
 		Licenses:  pkg.NewLicenseSet(pkg.NewLicense(metadata.License)),
 		PURL:      packageURL(metadata),
-		Type:      pkg.BinaryPkg,
+		Type:      pkgType(metadata.Type),
 		Locations: locations,
 		Metadata:  metadata.ELFBinaryPackageNoteJSONPayload,
 	}
@@ -67,6 +67,8 @@ func packageURL(metadata elfBinaryPackageNotes) string {
 	).ToString()
 }

+const alpmType = "alpm"
+
 func purlDistroType(ty string) string {
 	switch ty {
 	case "rpm":
@@ -75,8 +77,22 @@ func purlDistroType(ty string) string {
 		return packageurl.TypeDebian
 	case "apk":
 		return packageurl.TypeAlpine
-	case "alpm":
-		return "alpm"
+	case alpmType:
+		return alpmType
 	}
 	return packageurl.TypeGeneric
 }
+
+func pkgType(ty string) pkg.Type {
+	switch ty {
+	case "rpm":
+		return pkg.RpmPkg
+	case "deb":
+		return pkg.DebPkg
+	case "apk":
+		return pkg.ApkPkg
+	case alpmType:
+		return pkg.AlpmPkg
+	}
+	return pkg.BinaryPkg
+}
@@ -77,7 +77,7 @@ func Test_ELF_Package_Cataloger(t *testing.T) {
 						file.NewLocation("/sha1sum").WithAnnotation(pkg.EvidenceAnnotationKey, pkg.PrimaryEvidenceAnnotation),
 					),
 					Licenses: pkg.NewLicenseSet(),
-					Type:     pkg.BinaryPkg,
+					Type:     pkg.RpmPkg,
 					Metadata: pkg.ELFBinaryPackageNoteJSONPayload{
 						Type:         "rpm",
 						Architecture: "x86_64",
@@ -99,7 +99,7 @@ func Test_ELF_Package_Cataloger(t *testing.T) {
 						file.NewLocation("/sha1sum").WithAnnotation(pkg.EvidenceAnnotationKey, pkg.PrimaryEvidenceAnnotation),
 					),
 					Licenses: pkg.NewLicenseSet(),
-					Type:     pkg.BinaryPkg,
+					Type:     pkg.RpmPkg,
 					Metadata: pkg.ELFBinaryPackageNoteJSONPayload{
 						Type:         "rpm",
 						Architecture: "arm",
@@ -63,6 +63,14 @@ from-images:
    paths:
      - /usr/local/lib/erlang/erts-14.2.4/lib/internal/liberts_internal.a

+  - name: erlang
+    version: 27.0
+    images:
+      - ref: erlang:27.0.0.0-alpine@sha256:82064a65eb1f9901a479d8ada5f622be3bfac8b474dfc876dc00c28fdef4b1b8
+        platform: linux/amd64
+    paths:
+      - /usr/local/lib/erlang/erts-15.0/bin/beam.smp
+
  - version: 1.21.3
    images:
      - ref: golang:1.21.3@sha256:3ce8313c3513515040870c55e0c041a2b94f3576a58cfd3948633604214aa811
@@ -285,6 +293,13 @@ from-images:
        platform: linux/amd64
    paths:
      - /usr/bin/arangosh
+  - name: arangodb
+    version: 3.12.0-2
+    images:
+      - ref: arangodb:3.12.0.2@sha256:6ba2e4284cd0f4835e3ef034be90fb947c3d61225d65d07e3b2d2d893e47de25
+        platform: linux/amd64
+    paths:
+      - /usr/bin/arangosh
  - version: 15.1
    images:
      - ref: postgres:15.1@sha256:b4140dd3a62f364f16a82c1bd88d28b9887ecb47f07dbe2941237d073574d428
@@ -138,7 +138,15 @@ func (c *goLicenseResolver) getLicensesFromRemote(moduleName, moduleVersion stri

 func (c *goLicenseResolver) findLicensesInFS(urlPrefix string, fsys fs.FS) ([]goLicense, error) {
 	var out []goLicense
-	err := fs.WalkDir(fsys, ".", func(filePath string, d fs.DirEntry, _ error) error {
+	err := fs.WalkDir(fsys, ".", func(filePath string, d fs.DirEntry, err error) error {
+		if err != nil {
+			log.Debugf("error reading %s#%s: %v", urlPrefix, filePath, err)
+			return err
+		}
+		if d == nil {
+			log.Debugf("nil entry for %s#%s", urlPrefix, filePath)
+			return nil
+		}
 		if !c.lowerLicenseFileNames.Has(strings.ToLower(d.Name())) {
 			return nil
 		}
@@ -4,6 +4,7 @@ import (
 	"archive/zip"
 	"bytes"
 	"fmt"
+	"io/fs"
 	"net/http"
 	"net/http/httptest"
 	"os"
@@ -244,3 +245,62 @@ func Test_findVersionPath(t *testing.T) {
 	vp := findVersionPath(f, ".")
 	require.Equal(t, "github.com/someorg/somepkg@version", vp)
 }
+
+func Test_walkDirErrors(t *testing.T) {
+	resolver := newGoLicenseResolver("", CatalogerConfig{})
+	_, err := resolver.findLicensesInFS("somewhere", badFS{})
+	require.Error(t, err)
+}
+
+type badFS struct{}
+
+func (b badFS) Open(_ string) (fs.File, error) {
+	return nil, fmt.Errorf("error")
+}
+
+var _ fs.FS = (*badFS)(nil)
+
+func Test_noLocalGoModDir(t *testing.T) {
+	emptyTmp := t.TempDir()
+
+	validTmp := t.TempDir()
+	require.NoError(t, os.MkdirAll(filepath.Join(validTmp, "mod@ver"), 0700|os.ModeDir))
+
+	tests := []struct {
+		name    string
+		dir     string
+		wantErr require.ErrorAssertionFunc
+	}{
+		{
+			name:    "empty",
+			dir:     "",
+			wantErr: require.Error,
+		},
+		{
+			name:    "invalid dir",
+			dir:     filepath.Join(emptyTmp, "invalid-dir"),
+			wantErr: require.Error,
+		},
+		{
+			name:    "missing mod dir",
+			dir:     emptyTmp,
+			wantErr: require.Error,
+		},
+		{
+			name:    "valid mod dir",
+			dir:     validTmp,
+			wantErr: require.NoError,
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			resolver := newGoLicenseResolver("", CatalogerConfig{
+				SearchLocalModCacheLicenses: true,
+				LocalModCacheDir:            test.dir,
+			})
+			_, err := resolver.getLicensesFromLocal("mod", "ver")
+			test.wantErr(t, err)
+		})
+	}
+}
@@ -64,6 +64,9 @@
      "github.com/hamba/avro/v2": [
        "cpe:2.3:a:avro_project:avro:*:*:*:*:*:go:*:*"
      ],
+      "github.com/hashicorp/go-retryablehttp": [
+        "cpe:2.3:a:hashicorp:retryablehttp:*:*:*:*:*:go:*:*"
+      ],
      "github.com/jumpserver/koko/pkg/koko": [
        "cpe:2.3:a:fit2cloud:koko:*:*:*:*:*:go:*:*"
      ],
@@ -7434,6 +7437,9 @@
      "alfred-click-collect": [
        "cpe:2.3:a:alfred24_click_\\\u0026_collect_project:alfred24_click_\\\u0026_collect:*:*:*:*:*:wordpress:*:*"
      ],
+      "ali2woo-lite": [
+        "cpe:2.3:a:ali2woo:ali2woo:*:*:*:*:lite:wordpress:*:*"
+      ],
      "alipay": [
        "cpe:2.3:a:alipay_project:alipay:*:*:*:*:*:wordpress:*:*"
      ],
@@ -7969,7 +7975,8 @@
      ],
      "better-wp-security": [
        "cpe:2.3:a:ithemes:ithemes_security:*:*:*:*:*:wordpress:*:*",
-        "cpe:2.3:a:ithemes:security:*:*:*:*:*:wordpress:*:*"
+        "cpe:2.3:a:ithemes:security:*:*:*:*:*:wordpress:*:*",
+        "cpe:2.3:a:solidwp:solid_security:*:*:*:*:*:wordpress:*:*"
      ],
      "betterlinks": [
        "cpe:2.3:a:wpdeveloper:betterlinks:*:*:*:*:*:wordpress:*:*"
@@ -8535,7 +8542,8 @@
        "cpe:2.3:a:quantumcloud:ai_chatbot:*:*:*:*:*:wordpress:*:*"
      ],
      "chaty": [
-        "cpe:2.3:a:premio:chaty:*:*:*:*:*:wordpress:*:*"
+        "cpe:2.3:a:premio:chaty:*:*:*:*:*:wordpress:*:*",
+        "cpe:2.3:a:premio:floating_chat_widget:*:*:*:*:*:wordpress:*:*"
      ],
      "check-email": [
        "cpe:2.3:a:check_email_project:check_email:*:*:*:*:*:wordpress:*:*",
@@ -9035,6 +9043,9 @@
      "coru-lfmember": [
        "cpe:2.3:a:marcorulicke:coru_lfmember:*:*:*:*:*:wordpress:*:*"
      ],
+      "cost-calculator-builder": [
+        "cpe:2.3:a:stylemixthemes:cost_calculator_builder:*:*:*:*:*:wordpress:*:*"
+      ],
      "countdown-block": [
        "cpe:2.3:a:wpdeveloper:countdown_block:*:*:*:*:*:wordpress:*:*"
      ],
@@ -9129,6 +9140,9 @@
      "crossslide-jquery-plugin-for-wordpress": [
        "cpe:2.3:a:crossslide_jquery_project:crossslide_jquery:*:*:*:*:*:wordpress:*:*"
      ],
+      "cryout-serious-slider": [
+        "cpe:2.3:a:cryoutcreations:serious_slider:*:*:*:*:*:wordpress:*:*"
+      ],
      "crypto-converter-widget": [
        "cpe:2.3:a:currencyratetoday:crypto_converter_widget:*:*:*:*:*:wordpress:*:*"
      ],
@@ -9352,7 +9366,8 @@
        "cpe:2.3:a:arwebdesign:dashboard_to-do_list:*:*:*:*:*:wordpress:*:*"
      ],
      "dashboard-widgets-suite": [
-        "cpe:2.3:a:plugin-planet:dashboard_widget_suite:*:*:*:*:*:wordpress:*:*"
+        "cpe:2.3:a:plugin-planet:dashboard_widget_suite:*:*:*:*:*:wordpress:*:*",
+        "cpe:2.3:a:plugin-planet:dashboard_widgets_suite:*:*:*:*:*:wordpress:*:*"
      ],
      "dashicons-cpt": [
        "cpe:2.3:a:halgatewood:dashicons_\\+_custom_post_types:*:*:*:*:*:wordpress:*:*"
@@ -9438,10 +9453,11 @@
        "cpe:2.3:a:deny_all_firewall_project:deny_all_firewall:*:*:*:*:*:wordpress:*:*"
      ],
      "depicter": [
-        "cpe:2.3:a:averta:depicter_slider:*:*:*:*:*:wordpress:*:*"
+        "cpe:2.3:a:averta:depicter_slider:*:*:*:*:*:wordpress:*:*",
+        "cpe:2.3:a:depicter:depicter:*:*:*:*:*:wordpress:*:*"
      ],
      "dethemekit-for-elementor": [
-        "cpe:2.3:a:dethemekit_for_elementor_project:dethemekit_for_elementor:*:*:*:*:*:wordpress:*:*"
+        "cpe:2.3:a:detheme:dethemekit_for_elementor:*:*:*:*:*:wordpress:*:*"
      ],
      "diary-availability-calendar": [
        "cpe:2.3:a:roosty:diary-availability-calendar:*:*:*:*:*:wordpress:*:*"
@@ -9665,6 +9681,9 @@
      "easy-accordion-free": [
        "cpe:2.3:a:techearty:easy_accordion:*:*:*:*:*:wordpress:*:*"
      ],
+      "easy-age-verify": [
+        "cpe:2.3:a:5starplugins:easy_age_verify:*:*:*:*:*:wordpress:*:*"
+      ],
      "easy-appointments": [
        "cpe:2.3:a:easy_appointments_project:easy_appointments:*:*:*:*:*:wordpress:*:*"
      ],
@@ -9881,6 +9900,9 @@
      "elementskit-lite": [
        "cpe:2.3:a:wpmet:elements_kit_elementor_addons:*:*:*:*:*:wordpress:*:*"
      ],
+      "elespare": [
+        "cpe:2.3:a:elespare:elespare:*:*:*:*:*:wordpress:*:*"
+      ],
      "emag-marketplace-connector": [
        "cpe:2.3:a:zitec:emag_marketplace_connector:*:*:*:*:*:wordpress:*:*"
      ],
@@ -10539,6 +10561,9 @@
      "forms-for-campaign-monitor": [
        "cpe:2.3:a:campaignmonitor:campaign_monitor:*:*:*:*:*:wordpress:*:*"
      ],
+      "forms-gutenberg": [
+        "cpe:2.3:a:gutenbergforms:gutenberg_forms:*:*:*:*:*:wordpress:*:*"
+      ],
      "formzu-wp": [
        "cpe:2.3:a:formzu:formzu_wp:*:*:*:*:*:wordpress:*:*"
      ],
@@ -11033,6 +11058,9 @@
      "gwyns-imagemap-selector": [
        "cpe:2.3:a:gwyn\\'s_imagemap_selector_project:gwyn\\'s_imagemap_selector:*:*:*:*:*:wordpress:*:*"
      ],
+      "h5p": [
+        "cpe:2.3:a:h5p:h5p:*:*:*:*:*:wordpress:*:*"
+      ],
      "hal": [
        "cpe:2.3:a:cnrs:hal:*:*:*:*:*:wordpress:*:*"
      ],
@@ -11685,6 +11713,9 @@
      "jvm-rich-text-icons": [
        "cpe:2.3:a:jorisvm:jvm_gutenberg_rich_text_icons:*:*:*:*:*:wordpress:*:*"
      ],
+      "kadence-blocks": [
+        "cpe:2.3:a:kadencewp:gutenberg_blocks_with_ai:*:*:*:*:*:wordpress:*:*"
+      ],
      "kadence-starter-templates": [
        "cpe:2.3:a:kadencewp:starter_templates:*:*:*:*:*:wordpress:*:*"
      ],
@@ -12268,6 +12299,9 @@
      "mediavine-control-panel": [
        "cpe:2.3:a:mediavine:mediavine_control_panel:*:*:*:*:*:wordpress:*:*"
      ],
+      "mediavine-create": [
+        "cpe:2.3:a:mediavine:create:*:*:*:*:*:wordpress:*:*"
+      ],
      "meeting-scheduler-by-vcita": [
        "cpe:2.3:a:vcita:online_booking_\\\u0026_scheduling_calendar_for_wordpress:*:*:*:*:*:wordpress:*:*",
        "cpe:2.3:a:vcita:online_booking_\\\u0026_scheduling_calendar_for_wordpress_by_vcita:*:*:*:*:*:wordpress:*:*"
@@ -13683,6 +13717,9 @@
      "pubsubhubbub": [
        "cpe:2.3:a:pubsubhubbub:websub:*:*:*:*:*:wordpress:*:*"
      ],
+      "pure-chat": [
+        "cpe:2.3:a:purechat:pure_chat:*:*:*:*:*:*:*:*"
+      ],
      "purple-xmls-google-product-feed-for-woocommerce": [
        "cpe:2.3:a:dpl:product_feed_on_woocommerce_for_google\\,_awin\\,_shareasale\\,_bing\\,_and_more:*:*:*:*:*:wordpress:*:*"
      ],
@@ -14253,6 +14290,9 @@
      "search-analytics": [
        "cpe:2.3:a:cornelraiu:wp_search_analytics:*:*:*:*:*:wordpress:*:*"
      ],
+      "search-and-replace": [
+        "cpe:2.3:a:wp-media:search_\\\u0026_replace:*:*:*:*:*:wordpress:*:*"
+      ],
      "search-everything": [
        "cpe:2.3:a:search_everything_project:search_everything:*:*:*:*:*:wordpress:*:*"
      ],
@@ -15302,6 +15342,9 @@
      "tabbed": [
        "cpe:2.3:a:rich-web:tab:*:*:*:*:*:wordpress:*:*"
      ],
+      "table-addons-for-elementor": [
+        "cpe:2.3:a:fusionplugin:table_addons_for_elementor:*:*:*:*:*:wordpress:*:*"
+      ],
      "table-of-contents-plus": [
        "cpe:2.3:a:dublue:table_of_contents_plus:*:*:*:*:*:wordpress:*:*"
      ],
@@ -15480,10 +15523,14 @@
      "themesflat-addons-for-elementor": [
        "cpe:2.3:a:themesflat:themesflat_addons_for_elementor:*:*:*:*:*:wordpress:*:*"
      ],
+      "themify-builder": [
+        "cpe:2.3:a:themify:themify_builder:*:*:*:*:*:wordpress:*:*"
+      ],
      "themify-portfolio-post": [
        "cpe:2.3:a:themify:portfolio_post:*:*:*:*:*:wordpress:*:*"
      ],
      "themify-wc-product-filter": [
+        "cpe:2.3:a:themify:product_filter:*:*:*:*:*:wordpress:*:*",
        "cpe:2.3:a:themify:woocommerce_product_filter:*:*:*:*:*:wordpress:*:*"
      ],
      "thesography": [
@@ -15673,6 +15720,9 @@
      "typebot": [
        "cpe:2.3:a:typebot:typebot:*:*:*:*:*:wordpress:*:*"
      ],
+      "typing-text": [
+        "cpe:2.3:a:wpdeveloper:typing_text:*:*:*:*:*:wordpress:*:*"
+      ],
      "typofr": [
        "cpe:2.3:a:typofr_project:typofr:*:*:*:*:*:wordpress:*:*"
      ],
@@ -15712,6 +15762,9 @@
      "ultimate-author-box-lite": [
        "cpe:2.3:a:accesspressthemes:ultimate_author_box_lite:*:*:*:*:*:wordpress:*:*"
      ],
+      "ultimate-blocks": [
+        "cpe:2.3:a:dotcamp:ultimate_blocks:*:*:*:*:*:wordpress:*:*"
+      ],
      "ultimate-carousel-for-elementor": [
        "cpe:2.3:a:topdigitaltrends:ultimate_carousel_for_elementor:*:*:*:*:*:wordpress:*:*"
      ],
@@ -16016,6 +16069,9 @@
      "vikrentcar": [
        "cpe:2.3:a:e4jconnect:vikrentcar:*:*:*:*:*:wordpress:*:*"
      ],
+      "vimeography": [
+        "cpe:2.3:a:davekiss:vimeography:*:*:*:*:*:wordpress:*:*"
+      ],
      "vision": [
        "cpe:2.3:a:vision_interactive_project:vision_interactive:*:*:*:*:*:wordpress:*:*"
      ],
@@ -16829,6 +16885,9 @@
      "wp-chgfontsize": [
        "cpe:2.3:a:wp-chgfontsize_project:wp-chgfontsize:*:*:*:*:*:wordpress:*:*"
      ],
+      "wp-child-theme-generator": [
+        "cpe:2.3:a:wensolutions:wp_child_theme_generator:*:*:*:*:*:wordpress:*:*"
+      ],
      "wp-cirrus": [
        "cpe:2.3:a:wp-cirrus_project:wp-cirrus:*:*:*:*:*:wordpress:*:*"
      ],
@@ -17178,6 +17237,9 @@
      "wp-hide": [
        "cpe:2.3:a:weberge:wp_hide:*:*:*:*:*:wordpress:*:*"
      ],
+      "wp-hide-backed-notices": [
+        "cpe:2.3:a:wprepublic:hide_dashboard_notifications:*:*:*:*:*:wordpress:*:*"
+      ],
      "wp-hide-pages": [
        "cpe:2.3:a:nxsn:wp_hide_pages:*:*:*:*:*:wordpress:*:*"
      ],
@@ -17854,6 +17916,9 @@
      "wp-voting-contest": [
        "cpe:2.3:a:ohiowebtech:wp_voting_contest:*:*:*:*:*:wordpress:*:*"
      ],
+      "wp-whatsapp": [
+        "cpe:2.3:a:ninjateam:wp_chat_app:*:*:*:*:*:wordpress:*:*"
+      ],
      "wp-whatsapp-chat": [
        "cpe:2.3:a:quadlayers:wp_social_chat:*:*:*:*:*:wordpress:*:*"
      ],
@@ -18041,6 +18106,7 @@
        "cpe:2.3:a:wpstream:wpstream:*:*:*:*:*:wordpress:*:*"
      ],
      "wptools": [
+        "cpe:2.3:a:billminozzi:wp_tools:*:*:*:*:*:wordpress:*:*",
        "cpe:2.3:a:wptools_project:wptools:*:*:*:*:*:wordpress:*:*"
      ],
      "wptouch": [
@@ -18058,6 +18124,9 @@
      "wpvr": [
        "cpe:2.3:a:coderex:wp_vr:*:*:*:*:*:wordpress:*:*"
      ],
+      "wpzoom-elementor-addons": [
+        "cpe:2.3:a:wpzoom:wpzoom_elementor_addons:*:*:*:*:*:wordpress:*:*"
+      ],
      "wpzoom-portfolio": [
        "cpe:2.3:a:wpzoom:wpzoom_portfolio:*:*:*:*:*:wordpress:*:*"
      ],
@@ -18356,6 +18425,9 @@
      "bonkers": [
        "cpe:2.3:a:colorlib:bonkers:*:*:*:*:*:wordpress:*:*"
      ],
+      "book-landing-page": [
+        "cpe:2.3:a:rarathemes:book_landing_page:*:*:*:*:*:wordpress:*:*"
+      ],
      "brilliance": [
        "cpe:2.3:a:cpothemes:brilliance:*:*:*:*:*:wordpress:*:*",
        "cpe:2.3:a:wpchill:brilliance:*:*:*:*:*:wordpress:*:*"
@@ -18378,6 +18450,9 @@
      "darcie": [
        "cpe:2.3:a:catchthemes:darcie:*:*:*:*:*:wordpress:*:*"
      ],
+      "digital-newspaper": [
+        "cpe:2.3:a:blazethemes:digital_newspaper:*:*:*:*:*:wordpress:*:*"
+      ],
      "digitally": [
        "cpe:2.3:a:omarfolgheraiter:digitally:*:*:*:*:*:wordpress:*:*"
      ],
@@ -18396,6 +18471,9 @@
      "everest-news": [
        "cpe:2.3:a:everestthemes:everest_news:*:*:*:*:*:wordpress:*:*"
      ],
+      "excellent": [
+        "cpe:2.3:a:themefreesia:excellent:*:*:*:*:*:wordpress:*:*"
+      ],
      "flashy": [
        "cpe:2.3:a:flashy_project:flashy:*:*:*:*:*:wordpress:*:*"
      ],
@@ -18412,12 +18490,18 @@
        "cpe:2.3:a:generatepress:generatepress:*:*:*:*:-:wordpress:*:*",
        "cpe:2.3:a:generatepress:generatepress:*:*:*:*:premium:wordpress:*:*"
      ],
+      "grey-opaque": [
+        "cpe:2.3:a:grey_opaque_project:grey_opaque:*:*:*:*:*:wordpress:*:*"
+      ],
      "hueman": [
        "cpe:2.3:a:presscustomizr:hueman:*:*:*:*:*:wordpress:*:*"
      ],
      "illdy": [
        "cpe:2.3:a:colorlib:illdy:*:*:*:*:*:wordpress:*:*"
      ],
+      "interface": [
+        "cpe:2.3:a:themehorse:interface:*:*:*:*:*:wordpress:*:*"
+      ],
      "kata": [
        "cpe:2.3:a:climaxthemes:kata:*:*:*:*:*:wordpress:*:*",
        "cpe:2.3:a:climaxthemes:kata_apps:*:*:*:*:*:wordpress:*:*",
@@ -18438,6 +18522,9 @@
      "morning-coffee": [
        "cpe:2.3:a:adazing:morning_coffee:*:*:*:*:*:wordpress:*:*"
      ],
+      "mosaic": [
+        "cpe:2.3:a:wildweblab:mosaic:*:*:*:*:*:wordpress:*:*"
+      ],
      "newsmag": [
        "cpe:2.3:a:machothemes:newsmag:*:*:*:*:*:wordpress:*:*"
      ],
@@ -127,6 +127,7 @@ func FromDictionaryFind(p pkg.Package) ([]cpe.CPE, bool) {
 		return []cpe.CPE{}, false
 	}

+	sort.Sort(cpe.BySourceThenSpecificity(parsedCPEs))
 	return parsedCPEs, true
 }

@@ -163,12 +164,12 @@ func FromPackageAttributes(p pkg.Package) []cpe.CPE {
 	// filter out any known combinations that don't accurately represent this package
 	cpes = filter(cpes, p, cpeFilters...)

-	sort.Sort(cpe.BySpecificity(cpes))
 	var result []cpe.CPE
 	for _, c := range cpes {
 		result = append(result, cpe.CPE{Attributes: c, Source: cpe.GeneratedSource})
 	}

+	sort.Sort(cpe.BySourceThenSpecificity(result))
 	return result
 }

@@ -121,7 +121,7 @@ func pinsForVersion(data map[string]interface{}, version float64) ([]packagePin,
 				pin.State.Version,
 			})
 		}
-	case 2:
+	case 2, 3:
 		t := packageResolvedV2{}
 		jsonString, err := json.Marshal(data)
 		if err != nil {
@@ -80,6 +80,40 @@ func TestParsePackageResolved(t *testing.T) {
 	pkgtest.TestFileParser(t, fixture, parsePackageResolved, expectedPkgs, expectedRelationships)
 }

+func TestParsePackageResolvedV3(t *testing.T) {
+	fixture := "test-fixtures/PackageV3.resolved"
+	locations := file.NewLocationSet(file.NewLocation(fixture))
+	expectedPkgs := []pkg.Package{
+		{
+			Name:      "swift-mmio",
+			Version:   "",
+			PURL:      "pkg:swift/github.com/apple/swift-mmio/swift-mmio",
+			Locations: locations,
+			Language:  pkg.Swift,
+			Type:      pkg.SwiftPkg,
+			Metadata: pkg.SwiftPackageManagerResolvedEntry{
+				Revision: "80c109b87511041338a4d8d88064088c8dfc079b",
+			},
+		},
+		{
+			Name:      "swift-syntax",
+			Version:   "509.1.1",
+			PURL:      "pkg:swift/github.com/apple/swift-syntax.git/swift-syntax@509.1.1",
+			Locations: locations,
+			Language:  pkg.Swift,
+			Type:      pkg.SwiftPkg,
+			Metadata: pkg.SwiftPackageManagerResolvedEntry{
+				Revision: "64889f0c732f210a935a0ad7cda38f77f876262d",
+			},
+		},
+	}
+
+	// TODO: no relationships are under test yet
+	var expectedRelationships []artifact.Relationship
+
+	pkgtest.TestFileParser(t, fixture, parsePackageResolved, expectedPkgs, expectedRelationships)
+}
+
 func TestParsePackageResolved_empty(t *testing.T) {
 	// regression for https://github.com/anchore/syft/issues/2225
 	fixture := "test-fixtures/empty-packages.resolved"
@@ -0,0 +1,24 @@
+{
+  "originHash" : "ea83017c944c7850b8f60207e6143eb17cb6b5e6b734b3fa08787a5d920dba7b",
+  "pins" : [
+    {
+      "identity" : "swift-mmio",
+      "kind" : "remoteSourceControl",
+      "location" : "https://github.com/apple/swift-mmio",
+      "state" : {
+        "branch" : "swift-embedded-examples",
+        "revision" : "80c109b87511041338a4d8d88064088c8dfc079b"
+      }
+    },
+    {
+      "identity" : "swift-syntax",
+      "kind" : "remoteSourceControl",
+      "location" : "https://github.com/apple/swift-syntax.git",
+      "state" : {
+        "revision" : "64889f0c732f210a935a0ad7cda38f77f876262d",
+        "version" : "509.1.1"
+      }
+    }
+  ],
+  "version" : 3
+}
Author	SHA1	Message	Date
dependabot[bot]	4e09908ba1	chore(deps): bump actions/setup-go from 5.0.1 to 5.0.2 (#3027 ) Bumps [actions/setup-go](https://github.com/actions/setup-go) from 5.0.1 to 5.0.2. - [Release notes](https://github.com/actions/setup-go/releases) - [Commits](https://github.com/actions/setup-go/compare/cdcb36043654635271a94b9a6d1392de5bb323a7...0a12ed9d6a96ab950c8f026ed9f722fe0da7ef32) --- updated-dependencies: - dependency-name: actions/setup-go dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2024-07-11 10:19:48 -07:00
dependabot[bot]	863793a3cc	chore(deps): bump github.com/charmbracelet/lipgloss (#3028 ) Bumps [github.com/charmbracelet/lipgloss](https://github.com/charmbracelet/lipgloss) from 0.11.0 to 0.11.1. - [Release notes](https://github.com/charmbracelet/lipgloss/releases) - [Changelog](https://github.com/charmbracelet/lipgloss/blob/master/.goreleaser.yml) - [Commits](https://github.com/charmbracelet/lipgloss/compare/v0.11.0...v0.11.1) --- updated-dependencies: - dependency-name: github.com/charmbracelet/lipgloss dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2024-07-11 10:19:14 -07:00
Christopher Angelo Phillips	f7ffcc534f	fix: stabilize cpe sorting during collection sort (#3009 )	2024-07-09 14:24:21 -04:00
Laurent Goderre	b101f44aba	Map the downloadLocation field for PHP Composer packages (#3011 ) Signed-off-by: Laurent Goderre <laurent.goderre@docker.com>	2024-07-09 09:01:58 -07:00
anchore-actions-token-generator[bot]andkzantow	de3313cfb6	chore(deps): update stereoscope to e46739e217969fa67cbe8834b64bb165a10a1548 (#3013 ) Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: kzantow <3009477+kzantow@users.noreply.github.com>	2024-07-09 07:53:04 -07:00
dependabot[bot]	b2f9904d74	chore(deps): bump golang.org/x/net from 0.26.0 to 0.27.0 (#3015 ) Bumps [golang.org/x/net](https://github.com/golang/net) from 0.26.0 to 0.27.0. - [Commits](https://github.com/golang/net/compare/v0.26.0...v0.27.0) --- updated-dependencies: - dependency-name: golang.org/x/net dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2024-07-09 07:52:32 -07:00
dependabot[bot]	13d01ecaff	chore(deps): bump golang.org/x/mod from 0.18.0 to 0.19.0 (#3014 ) Bumps [golang.org/x/mod](https://github.com/golang/mod) from 0.18.0 to 0.19.0. - [Commits](https://github.com/golang/mod/compare/v0.18.0...v0.19.0) --- updated-dependencies: - dependency-name: golang.org/x/mod dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2024-07-09 07:08:25 -07:00
dependabot[bot]	7dc1b1ce27	chore(deps): bump actions/upload-artifact from 4.3.3 to 4.3.4 (#3017 ) Bumps [actions/upload-artifact](https://github.com/actions/upload-artifact) from 4.3.3 to 4.3.4. - [Release notes](https://github.com/actions/upload-artifact/releases) - [Commits](https://github.com/actions/upload-artifact/compare/65462800fd760344b1a7b4382951275a0abb4808...0b2256b8c012f0828dc542b3febcab082c67f72b) --- updated-dependencies: - dependency-name: actions/upload-artifact dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2024-07-09 07:08:12 -07:00
dependabot[bot]	b8dce675fe	chore(deps): bump github.com/google/go-containerregistry (#3019 ) Bumps [github.com/google/go-containerregistry](https://github.com/google/go-containerregistry) from 0.19.2 to 0.20.0. - [Release notes](https://github.com/google/go-containerregistry/releases) - [Changelog](https://github.com/google/go-containerregistry/blob/main/.goreleaser.yml) - [Commits](https://github.com/google/go-containerregistry/compare/v0.19.2...v0.20.0) --- updated-dependencies: - dependency-name: github.com/google/go-containerregistry dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2024-07-09 07:08:02 -07:00
dependabot[bot]	6dda9edd7c	chore(deps): bump github.com/adrg/xdg from 0.4.0 to 0.5.0 (#3020 ) Bumps [github.com/adrg/xdg](https://github.com/adrg/xdg) from 0.4.0 to 0.5.0. - [Release notes](https://github.com/adrg/xdg/releases) - [Commits](https://github.com/adrg/xdg/compare/v0.4.0...v0.5.0) --- updated-dependencies: - dependency-name: github.com/adrg/xdg dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2024-07-09 07:07:53 -07:00
anchore-actions-token-generator[bot]	04c861bf77	chore(deps): update CPE dictionary index (#3016 )	2024-07-08 08:13:17 -04:00
Alex Goodman	573440b7cf	Infer the package type from ELF package notes (#3008 ) * fix ELF package types to be honored Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * prefer OS packages over binary packages when there are duplicates Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> --------- Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>	2024-07-02 16:07:08 -04:00
anchore-actions-token-generator[bot]	c816039e91	chore(deps): update tools to latest versions (#3003 )	2024-07-01 20:04:45 -04:00
anchore-actions-token-generator[bot]	7f3ca65cf6	chore(deps): update CPE dictionary index (#3002 )	2024-07-01 15:02:15 -04:00
dependabot[bot]	43e5b1b45f	chore(deps): bump github.com/docker/docker (#3006 )	2024-07-01 19:01:01 +00:00
dependabot[bot]	a876aaccb2	chore(deps): bump github/codeql-action from 3.25.10 to 3.25.11 (#3004 )	2024-07-01 19:00:35 +00:00
dependabot[bot]	875669bfd1	chore(deps): bump github.com/saferwall/pe from 1.5.3 to 1.5.4 (#3005 )	2024-07-01 19:00:07 +00:00
Danielle Featherstone	5283c4687a	feat: version 3 support for swift package manager of the resolved files (#3001 ) Signed-off-by: Danielle Featherstone <dfeatherstone@fearless.tech>	2024-07-01 14:27:37 -04:00
dependabot[bot]	4d48adfa3f	chore(deps): bump github.com/spdx/tools-golang from 0.5.4 to 0.5.5 (#2999 )	2024-06-26 13:44:52 +00:00
dependabot[bot]	c8b449c92b	chore(deps): bump github.com/docker/docker (#2994 ) Bumps [github.com/docker/docker](https://github.com/docker/docker) from 26.1.4+incompatible to 27.0.1+incompatible. - [Release notes](https://github.com/docker/docker/releases) - [Commits](https://github.com/docker/docker/compare/v26.1.4...v27.0.1) --- updated-dependencies: - dependency-name: github.com/docker/docker dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2024-06-25 14:40:51 -07:00
Laurent Goderre	ceced5eb27	Add detection of Erlang in Alpine linux (#2996 ) Signed-off-by: Laurent Goderre <laurent.goderre@docker.com>	2024-06-25 14:40:40 -07:00
anchore-actions-token-generator[bot]andspiffcs	7da15890eb	chore(deps): update tools to latest versions (#2991 ) Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: spiffcs <32073428+spiffcs@users.noreply.github.com>	2024-06-25 13:41:26 -07:00
anchore-actions-token-generator[bot]andkzantow	580c09b01c	chore(deps): update stereoscope to 753b5576fe42bc007b22108ad7911d1729957a46 (#2992 ) Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: kzantow <3009477+kzantow@users.noreply.github.com>	2024-06-25 13:41:08 -07:00
dependabot[bot]	0dce67872e	chore(deps): bump github.com/charmbracelet/bubbletea (#2995 ) Bumps [github.com/charmbracelet/bubbletea](https://github.com/charmbracelet/bubbletea) from 0.26.5 to 0.26.6. - [Release notes](https://github.com/charmbracelet/bubbletea/releases) - [Changelog](https://github.com/charmbracelet/bubbletea/blob/master/.goreleaser.yml) - [Commits](https://github.com/charmbracelet/bubbletea/compare/v0.26.5...v0.26.6) --- updated-dependencies: - dependency-name: github.com/charmbracelet/bubbletea dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2024-06-25 10:10:26 -07:00
anchore-actions-token-generator[bot]andwagoodman	1eae9333a9	chore(deps): update CPE dictionary index (#2986 ) Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: wagoodman <590471+wagoodman@users.noreply.github.com>	2024-06-24 08:27:29 -07:00
dependabot[bot]	863891f325	chore(deps): bump github.com/go-test/deep from 1.1.0 to 1.1.1 (#2988 ) Bumps [github.com/go-test/deep](https://github.com/go-test/deep) from 1.1.0 to 1.1.1. - [Release notes](https://github.com/go-test/deep/releases) - [Changelog](https://github.com/go-test/deep/blob/master/CHANGES.md) - [Commits](https://github.com/go-test/deep/compare/v1.1.0...v1.1.1) --- updated-dependencies: - dependency-name: github.com/go-test/deep dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2024-06-24 08:27:13 -07:00
Keith Zantow	bd1c1d260c	fix: handle errors reading go licenses (#2985 ) Signed-off-by: Keith Zantow <kzantow@gmail.com>	2024-06-24 10:27:03 -04:00
Christopher Angelo Phillips	f5a917a5a2	docs: update cyclone-dx documentation (#2983 ) * chore: update docs to show 1.6 for cyclone-dx by default * chore: update README showing version information for formats --------- Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com>	2024-06-21 09:32:59 -07:00
Rajan Agaskar	ae0683074e	feat: update syft to generate cyclone-dx 1.6 by default (#2978 ) - Resolves #2974 - add detailed instructions re: updating schemas (a necessary task when a new CycloneDX spec version becomes available). - The DefaultVersion constant has been updated to "1.6" -- it's not clear to me how this is used at this time (it may be redundant given other code), but effectively unless a specific spec version is configured, `syft` will emit the "most recent" spec version available for cyclonedx. Users who wish to pin back to a "older" specVersion (e.g. to preserve compatibilty with utilities that have not yet bumped to latest) can either set this in a syft config file or pass a name@spec_version pair to the output flag (e.g. `-o cyclonedx-json@1.5=some-1.5-spec-bom.cdx.json`) - Regenerate relevant .golden files (there seems to be a way to do this via flags, but I couldn't quite figure out the right set to pass correctly, esp. since (as a relative go novice) I found it difficult to run just a single test file. I ended up "brute-forcing it" by changing the *updateSnapshot val to "true" and running it in Goland. A brief comment giving an example of regenerating fixtures usage would be helpful. Signed-off-by: Rajan Agaskar <ragaskar@gmail.com>	2024-06-21 08:51:27 -07:00
dependabot[bot]	9b178174a7	chore(deps): bump github.com/charmbracelet/bubbletea (#2982 ) Bumps [github.com/charmbracelet/bubbletea](https://github.com/charmbracelet/bubbletea) from 0.26.4 to 0.26.5. - [Release notes](https://github.com/charmbracelet/bubbletea/releases) - [Changelog](https://github.com/charmbracelet/bubbletea/blob/master/.goreleaser.yml) - [Commits](https://github.com/charmbracelet/bubbletea/compare/v0.26.4...v0.26.5) --- updated-dependencies: - dependency-name: github.com/charmbracelet/bubbletea dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2024-06-21 08:46:35 -07:00
dependabot[bot]	e947779886	chore(deps): bump peter-evans/create-pull-request from 6.0.5 to 6.1.0 (#2975 )	2024-06-20 15:12:12 +00:00
Laurent Goderre	7a35de04ee	fix: detection of arangodb 3.12 (#2979 ) Signed-off-by: Laurent Goderre <laurent.goderre@docker.com>	2024-06-20 11:11:03 -04:00
Weston Steimel	246df97ae7	chore: enable dependabot to keep boostrap action updated (#2976 ) Signed-off-by: Weston Steimel <commits@weston.slmail.me>	2024-06-19 20:17:11 +01:00
dependabot[bot]	750d37f075	chore(deps): bump github.com/github/go-spdx/v2 from 2.2.0 to 2.3.1 (#2973 ) Bumps [github.com/github/go-spdx/v2](https://github.com/github/go-spdx) from 2.2.0 to 2.3.1. - [Release notes](https://github.com/github/go-spdx/releases) - [Commits](https://github.com/github/go-spdx/compare/v2.2.0...v2.3.1) --- updated-dependencies: - dependency-name: github.com/github/go-spdx/v2 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2024-06-18 09:46:11 -07:00
dependabot[bot]	5061b905dc	chore(deps): bump github.com/google/go-containerregistry (#2971 ) Bumps [github.com/google/go-containerregistry](https://github.com/google/go-containerregistry) from 0.19.1 to 0.19.2. - [Release notes](https://github.com/google/go-containerregistry/releases) - [Changelog](https://github.com/google/go-containerregistry/blob/main/.goreleaser.yml) - [Commits](https://github.com/google/go-containerregistry/compare/v0.19.1...v0.19.2) --- updated-dependencies: - dependency-name: github.com/google/go-containerregistry dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2024-06-17 08:44:19 -07:00
dependabot[bot]	ed3774afa7	chore(deps): bump github.com/spf13/cobra from 1.8.0 to 1.8.1 (#2972 ) Bumps [github.com/spf13/cobra](https://github.com/spf13/cobra) from 1.8.0 to 1.8.1. - [Release notes](https://github.com/spf13/cobra/releases) - [Commits](https://github.com/spf13/cobra/compare/v1.8.0...v1.8.1) --- updated-dependencies: - dependency-name: github.com/spf13/cobra dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2024-06-17 08:44:10 -07:00