remove benchmark utils (#3982 )

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
fix: exclude packages with SPDX GENERATED_FROM source package indication (#3981 )
2026-10-16 16:17:25 +02:00 · 2025-06-09 18:24:49 +00:00 · 2025-06-09 14:12:23 -04:00 · 2025-06-09 10:31:10 -04:00 · 2025-06-09 10:26:47 -04:00 · 2025-06-09 08:56:36 -04:00
58 changed files with 5014 additions and 1069 deletions
@@ -34,7 +34,7 @@ tools:
  # used for showing the changelog at release
  - name: glow
    version:
-      want: v2.1.0
+      want: v2.1.1
    method: github-release
    with:
      repo: charmbracelet/glow
@@ -58,7 +58,7 @@ tools:
  # used to release all artifacts
  - name: goreleaser
    version:
-      want: v2.9.0
+      want: v2.10.2
    method: github-release
    with:
      repo: goreleaser/goreleaser
@@ -87,23 +87,10 @@ tools:
    with:
      repo: wagoodman/go-bouncer

-  # used for showing benchmark testing
-  - name: benchstat
-    version:
-      want: latest
-      method: go-proxy
-      with:
-        module: golang.org/x/perf
-        allow-unresolved-version: true
-    method: go-install
-    with:
-      entrypoint: cmd/benchstat
-      module: golang.org/x/perf
-
  # used for running all local and CI tasks
  - name: task
    version:
-      want: v3.43.3
+      want: v3.44.0
    method: github-release
    with:
      repo: go-task/task
@@ -111,7 +98,7 @@ tools:
  # used for triggering a release
  - name: gh
    version:
-      want: v2.72.0
+      want: v2.74.0
    method: github-release
    with:
      repo: cli/cli
@@ -45,7 +45,7 @@ jobs:

    # Initializes the CodeQL tools for scanning.
    - name: Initialize CodeQL
-      uses: github/codeql-action/init@ff0a06e83cb2de871e5a09832bc6a81e7276941f #v3.28.18
+      uses: github/codeql-action/init@fca7ace96b7d713c7035871441bd52efbe39e27e #v3.28.19
      with:
        languages: ${{ matrix.language }}
        # If you wish to specify custom queries, you can do so here or in a config file.
@@ -56,7 +56,7 @@ jobs:
    # Autobuild attempts to build any compiled languages  (C/C++, C#, or Java).
    # If this step fails, then you should remove it and run the build manually (see below)
    - name: Autobuild
-      uses: github/codeql-action/autobuild@ff0a06e83cb2de871e5a09832bc6a81e7276941f #v3.28.18
+      uses: github/codeql-action/autobuild@fca7ace96b7d713c7035871441bd52efbe39e27e #v3.28.19

    # ℹ️ Command-line programs to run using the OS shell.
    # 📚 https://git.io/JvXDl
@@ -70,4 +70,4 @@ jobs:
    #   make release

    - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@ff0a06e83cb2de871e5a09832bc6a81e7276941f #v3.28.18
+      uses: github/codeql-action/analyze@fca7ace96b7d713c7035871441bd52efbe39e27e #v3.28.19
@@ -76,6 +76,9 @@ jobs:
      - name: Build snapshot artifacts
        run: make snapshot

+      - name: Smoke test snapshot build
+        run: make snapshot-smoke-test
+
      # why not use actions/upload-artifact? It is very slow (3 minutes to upload ~600MB of data, vs 10 seconds with this approach).
      # see https://github.com/actions/upload-artifact/issues/199 for more info
      - name: Upload snapshot artifacts
@@ -1,11 +1,11 @@
 version: 2
+project_name: syft

 release:
  prerelease: auto
  draft: false

 env:
-  # required to support multi architecture docker builds
  - DOCKER_CLI_EXPERIMENTAL=enabled
  - CGO_ENABLED=0

@@ -13,14 +13,8 @@ builds:
  - id: linux-build
    dir: ./cmd/syft
    binary: syft
-    goos:
-      - linux
-    goarch:
-      - amd64
-      - arm64
-      - ppc64le
-      - s390x
-    # set the modified timestamp on the output binary to the git timestamp to ensure a reproducible build
+    goos: [linux]
+    goarch: [amd64, arm64, ppc64le, s390x]
    mod_timestamp: &build-timestamp '{{ .CommitTimestamp }}'
    ldflags: &build-ldflags |
      -w
@@ -34,11 +28,8 @@ builds:
  - id: darwin-build
    dir: ./cmd/syft
    binary: syft
-    goos:
-      - darwin
-    goarch:
-      - amd64
-      - arm64
+    goos: [darwin]
+    goarch: [amd64, arm64]
    mod_timestamp: *build-timestamp
    ldflags: *build-ldflags
    hooks:
@@ -50,115 +41,42 @@ builds:
  - id: windows-build
    dir: ./cmd/syft
    binary: syft
-    goos:
-      - windows
-    goarch:
-      - amd64
+    goos: [windows]
+    goarch: [amd64]
    mod_timestamp: *build-timestamp
    ldflags: *build-ldflags

 archives:
  - id: linux-archives
-    builds:
-      - linux-build
-
-  # note: the signing process is depending on tar.gz archives. If this format changes then .github/scripts/apple-signing/*.sh will need to be adjusted
+    builds: [linux-build]
  - id: darwin-archives
-    builds:
-      - darwin-build
-
+    builds: [darwin-build]
  - id: windows-archives
    format: zip
-    builds:
-      - windows-build
+    builds: [windows-build]

 nfpms:
  - license: "Apache 2.0"
    maintainer: "Anchore, Inc"
    homepage: &website "https://github.com/anchore/syft"
    description: &description "A tool that generates a Software Bill Of Materials (SBOM) from container images and filesystems"
-    formats:
-      - rpm
-      - deb
+    formats: [rpm, deb]

 brews:
  - repository:
      owner: anchore
      name: homebrew-syft
      token: "{{.Env.GITHUB_BREW_TOKEN}}"
-    ids:
-      - darwin-archives
-      - linux-archives
+    ids: [darwin-archives, linux-archives]
    homepage: *website
    description: *description
    license: "Apache License 2.0"

 dockers:
+  # production images...
  - image_templates:
-      - anchore/syft:debug
-      - anchore/syft:{{.Tag}}-debug
-      - ghcr.io/anchore/syft:debug
-      - ghcr.io/anchore/syft:{{.Tag}}-debug
-    goarch: amd64
-    dockerfile: Dockerfile.debug
-    use: buildx
-    build_flag_templates:
-      - "--platform=linux/amd64"
-      - "--build-arg=BUILD_DATE={{.Date}}"
-      - "--build-arg=BUILD_VERSION={{.Version}}"
-      - "--build-arg=VCS_REF={{.FullCommit}}"
-      - "--build-arg=VCS_URL={{.GitURL}}"
-
-  - image_templates:
-      - anchore/syft:debug-arm64v8
-      - anchore/syft:{{.Tag}}-debug-arm64v8
-      - ghcr.io/anchore/syft:debug-arm64v8
-      - ghcr.io/anchore/syft:{{.Tag}}-debug-arm64v8
-    goarch: arm64
-    dockerfile: Dockerfile.debug
-    use: buildx
-    build_flag_templates:
-      - "--platform=linux/arm64/v8"
-      - "--build-arg=BUILD_DATE={{.Date}}"
-      - "--build-arg=BUILD_VERSION={{.Version}}"
-      - "--build-arg=VCS_REF={{.FullCommit}}"
-      - "--build-arg=VCS_URL={{.GitURL}}"
-
-  - image_templates:
-      - anchore/syft:debug-ppc64le
-      - anchore/syft:{{.Tag}}-debug-ppc64le
-      - ghcr.io/anchore/syft:debug-ppc64le
-      - ghcr.io/anchore/syft:{{.Tag}}-debug-ppc64le
-    goarch: ppc64le
-    dockerfile: Dockerfile.debug
-    use: buildx
-    build_flag_templates:
-      - "--platform=linux/ppc64le"
-      - "--build-arg=BUILD_DATE={{.Date}}"
-      - "--build-arg=BUILD_VERSION={{.Version}}"
-      - "--build-arg=VCS_REF={{.FullCommit}}"
-      - "--build-arg=VCS_URL={{.GitURL}}"
-
-  - image_templates:
-      - anchore/syft:debug-s390x
-      - anchore/syft:{{.Tag}}-debug-s390x
-      - ghcr.io/anchore/syft:debug-s390x
-      - ghcr.io/anchore/syft:{{.Tag}}-debug-s390x
-    goarch: s390x
-    dockerfile: Dockerfile.debug
-    use: buildx
-    build_flag_templates:
-      - "--platform=linux/s390x"
-      - "--build-arg=BUILD_DATE={{.Date}}"
-      - "--build-arg=BUILD_VERSION={{.Version}}"
-      - "--build-arg=VCS_REF={{.FullCommit}}"
-      - "--build-arg=VCS_URL={{.GitURL}}"
-
-  - image_templates:
-      - anchore/syft:latest
-      - anchore/syft:{{.Tag}}
-      - ghcr.io/anchore/syft:latest
-      - ghcr.io/anchore/syft:{{.Tag}}
+      - anchore/syft:{{.Tag}}-amd64
+      - ghcr.io/anchore/syft:{{.Tag}}-amd64
    goarch: amd64
    dockerfile: Dockerfile
    use: buildx
@@ -208,51 +126,120 @@ dockers:
      - "--build-arg=VCS_REF={{.FullCommit}}"
      - "--build-arg=VCS_URL={{.GitURL}}"

+  # debug images...
+  - image_templates:
+      - anchore/syft:{{.Tag}}-debug-amd64
+      - ghcr.io/anchore/syft:{{.Tag}}-debug-amd64
+    goarch: amd64
+    dockerfile: Dockerfile.debug
+    use: buildx
+    build_flag_templates:
+      - "--platform=linux/amd64"
+      - "--build-arg=BUILD_DATE={{.Date}}"
+      - "--build-arg=BUILD_VERSION={{.Version}}"
+      - "--build-arg=VCS_REF={{.FullCommit}}"
+      - "--build-arg=VCS_URL={{.GitURL}}"
+
+  - image_templates:
+      - anchore/syft:{{.Tag}}-debug-arm64v8
+      - ghcr.io/anchore/syft:{{.Tag}}-debug-arm64v8
+    goarch: arm64
+    dockerfile: Dockerfile.debug
+    use: buildx
+    build_flag_templates:
+      - "--platform=linux/arm64/v8"
+      - "--build-arg=BUILD_DATE={{.Date}}"
+      - "--build-arg=BUILD_VERSION={{.Version}}"
+      - "--build-arg=VCS_REF={{.FullCommit}}"
+      - "--build-arg=VCS_URL={{.GitURL}}"
+
+  - image_templates:
+      - anchore/syft:{{.Tag}}-debug-ppc64le
+      - ghcr.io/anchore/syft:{{.Tag}}-debug-ppc64le
+    goarch: ppc64le
+    dockerfile: Dockerfile.debug
+    use: buildx
+    build_flag_templates:
+      - "--platform=linux/ppc64le"
+      - "--build-arg=BUILD_DATE={{.Date}}"
+      - "--build-arg=BUILD_VERSION={{.Version}}"
+      - "--build-arg=VCS_REF={{.FullCommit}}"
+      - "--build-arg=VCS_URL={{.GitURL}}"
+
+  - image_templates:
+      - anchore/syft:{{.Tag}}-debug-s390x
+      - ghcr.io/anchore/syft:{{.Tag}}-debug-s390x
+    goarch: s390x
+    dockerfile: Dockerfile.debug
+    use: buildx
+    build_flag_templates:
+      - "--platform=linux/s390x"
+      - "--build-arg=BUILD_DATE={{.Date}}"
+      - "--build-arg=BUILD_VERSION={{.Version}}"
+      - "--build-arg=VCS_REF={{.FullCommit}}"
+      - "--build-arg=VCS_URL={{.GitURL}}"
+
 docker_manifests:
+  # anchore/syft manifests...
  - name_template: anchore/syft:latest
    image_templates:
-      - anchore/syft:{{.Tag}}
+      - anchore/syft:{{.Tag}}-amd64
+      - anchore/syft:{{.Tag}}-arm64v8
+      - anchore/syft:{{.Tag}}-ppc64le
+      - anchore/syft:{{.Tag}}-s390x
+
+  - name_template: anchore/syft:{{.Tag}}
+    image_templates:
+      - anchore/syft:{{.Tag}}-amd64
      - anchore/syft:{{.Tag}}-arm64v8
      - anchore/syft:{{.Tag}}-ppc64le
      - anchore/syft:{{.Tag}}-s390x

  - name_template: anchore/syft:debug
-      - anchore/syft:{{.Tag}}-debug
+    image_templates:
+      - anchore/syft:{{.Tag}}-debug-amd64
      - anchore/syft:{{.Tag}}-debug-arm64v8
      - anchore/syft:{{.Tag}}-debug-ppc64le
      - anchore/syft:{{.Tag}}-debug-s390x

-  - name_template: anchore/syft:{{.Tag}}
+  - name_template: anchore/syft:{{.Tag}}-debug
    image_templates:
-      - anchore/syft:{{.Tag}}
-      - anchore/syft:{{.Tag}}-arm64v8
-      - anchore/syft:{{.Tag}}-ppc64le
-      - anchore/syft:{{.Tag}}-s390x
+      - anchore/syft:{{.Tag}}-debug-amd64
+      - anchore/syft:{{.Tag}}-debug-arm64v8
+      - anchore/syft:{{.Tag}}-debug-ppc64le
+      - anchore/syft:{{.Tag}}-debug-s390x

+  # ghcr.io/anchore/syft manifests...
  - name_template: ghcr.io/anchore/syft:latest
    image_templates:
-      - ghcr.io/anchore/syft:{{.Tag}}
+      - ghcr.io/anchore/syft:{{.Tag}}-amd64
+      - ghcr.io/anchore/syft:{{.Tag}}-arm64v8
+      - ghcr.io/anchore/syft:{{.Tag}}-ppc64le
+      - ghcr.io/anchore/syft:{{.Tag}}-s390x
+
+  - name_template: ghcr.io/anchore/syft:{{.Tag}}
+    image_templates:
+      - ghcr.io/anchore/syft:{{.Tag}}-amd64
      - ghcr.io/anchore/syft:{{.Tag}}-arm64v8
      - ghcr.io/anchore/syft:{{.Tag}}-ppc64le
      - ghcr.io/anchore/syft:{{.Tag}}-s390x

  - name_template: ghcr.io/anchore/syft:debug
    image_templates:
-      - ghcr.io/anchore/syft:{{.Tag}}-debug
+      - ghcr.io/anchore/syft:{{.Tag}}-debug-amd64
      - ghcr.io/anchore/syft:{{.Tag}}-debug-arm64v8
      - ghcr.io/anchore/syft:{{.Tag}}-debug-ppc64le
      - ghcr.io/anchore/syft:{{.Tag}}-debug-s390x

-  - name_template: ghcr.io/anchore/syft:{{.Tag}}
+  - name_template: ghcr.io/anchore/syft:{{.Tag}}-debug
    image_templates:
-      - ghcr.io/anchore/syft:{{.Tag}}
-      - ghcr.io/anchore/syft:{{.Tag}}-arm64v8
-      - ghcr.io/anchore/syft:{{.Tag}}-ppc64le
-      - ghcr.io/anchore/syft:{{.Tag}}-s390x
+      - ghcr.io/anchore/syft:{{.Tag}}-debug-amd64
+      - ghcr.io/anchore/syft:{{.Tag}}-debug-arm64v8
+      - ghcr.io/anchore/syft:{{.Tag}}-debug-ppc64le
+      - ghcr.io/anchore/syft:{{.Tag}}-debug-s390x

 sboms:
  - artifacts: archive
-    # this is relative to the snapshot/dist directory, not the root of the repo
    cmd: ../.tool/syft
    documents:
      - "{{ .Binary }}_{{ .Version }}_{{ .Os }}_{{ .Arch }}.sbom"
@@ -1,14 +1,12 @@
-FROM gcr.io/distroless/static-debian12:latest AS build
-
-FROM scratch
-# needed for version check HTTPS request
-COPY --from=build /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/ca-certificates.crt
+FROM gcr.io/distroless/static-debian12:nonroot

 # create the /tmp dir, which is needed for image content cache
 WORKDIR /tmp

 COPY syft /

+USER nonroot
+
 ARG BUILD_DATE
 ARG BUILD_VERSION
 ARG VCS_REF
@@ -1,10 +1,12 @@
-FROM gcr.io/distroless/static-debian12:debug
+FROM gcr.io/distroless/static-debian12:debug-nonroot

 # create the /tmp dir, which is needed for image content cache
 WORKDIR /tmp

 COPY syft /

+USER nonroot
+
 ARG BUILD_DATE
 ARG BUILD_VERSION
 ARG VCS_REF
@@ -27,10 +27,12 @@ vars:
    sh: uname -s | tr '[:upper:]' '[:lower:]'
  ARCH:
    sh: |
-      [ "$(uname -m)" = "x86_64" ] && echo "amd64_v1" || { [ "$(uname -m)" = "aarch64" ] && echo "arm64_v8.0" || echo $(uname -m); }
+      [ "$(uname -m)" = "x86_64" ] && echo "amd64_v1" || { [ "$(uname -m)" = "aarch64" ] && echo "arm64_v8.0" || [ "$(uname -m)" = "arm64" ] && echo "arm64_v8.0" || echo $(uname -m); }
  PROJECT_ROOT:
    sh: echo $PWD
+
  # note: the snapshot dir must be a relative path starting with ./
+  # e.g. when installing snapshot debs from a local path, ./ forces the deb to be installed in the current working directory instead of referencing a package name
  SNAPSHOT_DIR: ./snapshot
  SNAPSHOT_BIN: "{{ .PROJECT_ROOT }}/{{ .SNAPSHOT_DIR }}/{{ .OS }}-build_{{ .OS }}_{{ .ARCH }}/{{ .PROJECT }}"
  SNAPSHOT_CMD: "{{ .TOOL_DIR }}/goreleaser release --config {{ .TMP_DIR }}/goreleaser.yaml --clean --snapshot --skip=publish --skip=sign"
@@ -230,10 +232,7 @@ tasks:

  cli:
    desc: Run CLI tests
-    # note: we don't want to regenerate the snapshot unless we have to. In CI it's probable
-    # that the cache being restored with the correct binary will be rebuilt since the timestamps
-    # and local checksums will not line up.
-    deps: [tools, snapshot]
+    deps: [tools]
    cmds:
      - cmd: "echo 'testing binary: {{ .SNAPSHOT_BIN }}'"
        silent: true
@@ -250,27 +249,6 @@ tasks:
      - cmd: .github/scripts/labeler_test.py


-  ## Benchmark test targets #################################
-
-  benchmark:
-    deps: [tmpdir]
-    generates:
-      - "{{ .TMP_DIR }}/benchmark-main.txt"
-    cmds:
-      - "go test -p 1 -run=^Benchmark -bench=. -count=7 -benchmem ./... | tee {{ .TMP_DIR }}/benchmark-{{ .VERSION }}.txt"
-      - |
-        bash -c "(test -s {{ .TMP_DIR }}/benchmark-main.txt && \
-        {{ .TOOL_DIR }}/benchstat {{ .TMP_DIR }}/benchmark-main.txt {{ .TMP_DIR }}/benchmark-{{ .VERSION }}.txt || \
-        {{ .TOOL_DIR }}/benchstat {{ .TMP_DIR }}/benchmark-{{ .VERSION }}.txt) \
-        | tee {{ .TMP_DIR }}/benchstat.txt"
-
-  show-benchstat:
-    deps: [benchmark, tmpdir]
-    cmds:
-      - cmd: "cat {{ .TMP_DIR }}/benchstat.txt"
-        silent: true
-
-
  ## Test-fixture-related targets #################################

  fingerprints:
@@ -573,6 +551,18 @@ tasks:

      - "{{ .SNAPSHOT_CMD }}"

+  snapshot-smoke-test:
+    desc: Run a smoke test on the snapshot builds + docker images
+    cmds:
+      - cmd: "echo 'testing snapshot binary: {{ .SNAPSHOT_BIN }}'"
+        silent: true
+      - cmd: "test -f {{ .SNAPSHOT_BIN }} || (find {{ .SNAPSHOT_DIR }} && echo '\nno snapshot found for {{ .SNAPSHOT_BIN }}' && false)"
+        silent: true
+      - "{{ .SNAPSHOT_BIN }} version"
+      - "{{ .SNAPSHOT_BIN }} scan alpine:latest"
+      - docker run --rm anchore/syft:latest version
+      - docker run --rm anchore/syft:latest scan alpine:latest
+
  changelog:
    desc: Generate a changelog
    deps: [tools]
@@ -10,6 +10,7 @@ import (
 	"github.com/anchore/clio"
 	"github.com/anchore/syft/cmd/syft/internal"
 	"github.com/anchore/syft/cmd/syft/internal/commands"
+	constants "github.com/anchore/syft/internal"
 )

 // Application constructs the `syft packages` command and aliases the root command to `syft packages`.
@@ -47,7 +48,7 @@ func create(id clio.Identification, out io.Writer) (clio.Application, *cobra.Com
 		commands.Cataloger(app),
 		commands.Attest(app),
 		commands.Convert(app),
-		clio.VersionCommand(id),
+		clio.VersionCommand(id, schemaVersion),
 		clio.ConfigCommand(app, nil),
 		cranecmd.NewCmdAuthLogin(id.Name), // syft login uses the same command as crane
 	)
@@ -59,3 +60,7 @@ func create(id clio.Identification, out io.Writer) (clio.Application, *cobra.Com

 	return app, rootCmd
 }
+
+func schemaVersion() (string, any) {
+	return "SchemaVersion", constants.JSONSchemaVersion
+}
@@ -24,7 +24,7 @@ require (
 	github.com/anchore/go-testutils v0.0.0-20200925183923-d5f45b0d3c04
 	github.com/anchore/go-version v1.2.2-0.20200701162849-18adb9c92b9b
 	github.com/anchore/packageurl-go v0.1.1-0.20250220190351-d62adb6e1115
-	github.com/anchore/stereoscope v0.1.4
+	github.com/anchore/stereoscope v0.1.5-0.20250604132324-344e29f37f05
 	github.com/anmitsu/go-shlex v0.0.0-20200514113438-38f4b401e2be
 	github.com/aquasecurity/go-pep440-version v0.0.1
 	github.com/bitnami/go-version v0.0.0-20250131085805-b1f57a8634ef
@@ -40,14 +40,14 @@ require (
 	github.com/elliotchance/phpserialize v1.4.0
 	github.com/facebookincubator/nvdtools v0.1.5
 	github.com/github/go-spdx/v2 v2.3.3
-	github.com/gkampitakis/go-snaps v0.5.11
+	github.com/gkampitakis/go-snaps v0.5.13
 	github.com/go-git/go-billy/v5 v5.6.2
-	github.com/go-git/go-git/v5 v5.16.0
+	github.com/go-git/go-git/v5 v5.16.2
 	github.com/go-test/deep v1.1.1
 	github.com/go-viper/mapstructure/v2 v2.2.1
 	github.com/gohugoio/hashstructure v0.5.0
 	github.com/google/go-cmp v0.7.0
-	github.com/google/go-containerregistry v0.20.3
+	github.com/google/go-containerregistry v0.20.5
 	github.com/google/licensecheck v0.3.1
 	github.com/google/uuid v1.6.0
 	github.com/gookit/color v1.5.4
@@ -72,7 +72,7 @@ require (
 	github.com/sassoftware/go-rpmutils v0.4.0
 	// pinned to pull in 386 arch fix: https://github.com/scylladb/go-set/commit/cc7b2070d91ebf40d233207b633e28f5bd8f03a5
 	github.com/scylladb/go-set v1.0.3-0.20200225121959-cc7b2070d91e
-	github.com/sergi/go-diff v1.3.2-0.20230802210424-5b0b94c5c0d3
+	github.com/sergi/go-diff v1.4.0
 	github.com/spdx/gordf v0.0.0-20201111095634-7098f93598fb
 	github.com/spdx/tools-golang v0.5.5
 	github.com/spf13/afero v1.14.0
@@ -85,11 +85,11 @@ require (
 	github.com/xeipuuv/gojsonschema v1.2.0
 	github.com/zyedidia/generic v1.2.2-0.20230320175451-4410d2372cb1
 	go.uber.org/goleak v1.3.0
-	golang.org/x/exp v0.0.0-20250305212735-054e65f0b394
-	golang.org/x/mod v0.24.0
-	golang.org/x/net v0.40.0
+	golang.org/x/exp v0.0.0-20250408133849-7e4ce0ab07d0
+	golang.org/x/mod v0.25.0
+	golang.org/x/net v0.41.0
 	gopkg.in/yaml.v3 v3.0.1
-	modernc.org/sqlite v1.37.0
+	modernc.org/sqlite v1.38.0
 )

 require (
@@ -133,10 +133,10 @@ require (
 	github.com/containerd/typeurl/v2 v2.1.1 // indirect
 	github.com/cyphar/filepath-securejoin v0.4.1 // indirect
 	github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
-	github.com/docker/cli v28.1.1+incompatible // indirect
+	github.com/docker/cli v28.2.2+incompatible // indirect
 	github.com/docker/distribution v2.8.3+incompatible // indirect
 	github.com/docker/docker v28.1.1+incompatible // indirect
-	github.com/docker/docker-credential-helpers v0.8.2 // indirect
+	github.com/docker/docker-credential-helpers v0.9.3 // indirect
 	github.com/docker/go-connections v0.5.0 // indirect
 	github.com/docker/go-events v0.0.0-20190806004212-e31b211e4f1c // indirect
 	github.com/docker/go-units v0.5.0 // indirect
@@ -147,13 +147,13 @@ require (
 	github.com/felixge/httpsnoop v1.0.4 // indirect
 	github.com/fsnotify/fsnotify v1.8.0 // indirect
 	github.com/gabriel-vasile/mimetype v1.4.9 // indirect
-	github.com/gkampitakis/ciinfo v0.3.1 // indirect
+	github.com/gkampitakis/ciinfo v0.3.2 // indirect
 	github.com/gkampitakis/go-diff v1.3.2 // indirect
 	github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376 // indirect
 	github.com/go-logr/logr v1.4.2 // indirect
 	github.com/go-logr/stdr v1.2.2 // indirect
 	github.com/go-restruct/restruct v1.2.0-alpha // indirect
-	github.com/goccy/go-yaml v1.15.13 // indirect
+	github.com/goccy/go-yaml v1.18.0 // indirect
 	github.com/gogo/protobuf v1.3.2 // indirect
 	github.com/golang/groupcache v0.0.0-20241129210726-2c02b8208cf8 // indirect
 	github.com/golang/snappy v0.0.4 // indirect
@@ -226,7 +226,7 @@ require (
 	github.com/tidwall/pretty v1.2.1 // indirect
 	github.com/tidwall/sjson v1.2.5 // indirect
 	github.com/ulikunitz/xz v0.5.12 // indirect
-	github.com/vbatts/tar-split v0.11.6 // indirect
+	github.com/vbatts/tar-split v0.12.1 // indirect
 	github.com/xanzy/ssh-agent v0.3.3 // indirect
 	github.com/xeipuuv/gojsonpointer v0.0.0-20190905194746-02993c407bfb // indirect
 	github.com/xeipuuv/gojsonreference v0.0.0-20180127040603-bd5ef7bd5415 // indirect
@@ -235,28 +235,28 @@ require (
 	github.com/zclconf/go-cty v1.13.0 // indirect
 	go.opencensus.io v0.24.0 // indirect
 	go.opentelemetry.io/auto/sdk v1.1.0 // indirect
-	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.58.0 // indirect
-	go.opentelemetry.io/otel v1.33.0 // indirect
-	go.opentelemetry.io/otel/metric v1.33.0 // indirect
-	go.opentelemetry.io/otel/trace v1.33.0 // indirect
+	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.60.0 // indirect
+	go.opentelemetry.io/otel v1.35.0 // indirect
+	go.opentelemetry.io/otel/metric v1.35.0 // indirect
+	go.opentelemetry.io/otel/trace v1.35.0 // indirect
 	go.uber.org/atomic v1.9.0 // indirect
 	go.uber.org/multierr v1.9.0 // indirect
 	go4.org v0.0.0-20230225012048-214862532bf5 // indirect
-	golang.org/x/crypto v0.38.0 // indirect
-	golang.org/x/sync v0.14.0 // indirect
+	golang.org/x/crypto v0.39.0 // indirect
+	golang.org/x/sync v0.15.0 // indirect
 	golang.org/x/sys v0.33.0 // indirect
 	golang.org/x/term v0.32.0 // indirect
-	golang.org/x/text v0.25.0 // indirect
-	golang.org/x/tools v0.31.0 // indirect
+	golang.org/x/text v0.26.0 // indirect
+	golang.org/x/tools v0.33.0 // indirect
 	golang.org/x/xerrors v0.0.0-20231012003039-104605ab7028 // indirect
 	google.golang.org/genproto v0.0.0-20241118233622-e639e219e697 // indirect
 	google.golang.org/genproto/googleapis/rpc v0.0.0-20241223144023-3abc09e42ca8 // indirect
 	google.golang.org/grpc v1.67.3 // indirect
 	google.golang.org/protobuf v1.36.4 // indirect
 	gopkg.in/warnings.v0 v0.1.2 // indirect
-	modernc.org/libc v1.62.1 // indirect
+	modernc.org/libc v1.65.10 // indirect
 	modernc.org/mathutil v1.7.1 // indirect
-	modernc.org/memory v1.9.1 // indirect
+	modernc.org/memory v1.11.0 // indirect
 )

 retract (
@@ -122,8 +122,8 @@ github.com/anchore/go-version v1.2.2-0.20200701162849-18adb9c92b9b h1:e1bmaoJfZV
 github.com/anchore/go-version v1.2.2-0.20200701162849-18adb9c92b9b/go.mod h1:Bkc+JYWjMCF8OyZ340IMSIi2Ebf3uwByOk6ho4wne1E=
 github.com/anchore/packageurl-go v0.1.1-0.20250220190351-d62adb6e1115 h1:ZyRCmiEjnoGJZ1+Ah0ZZ/mKKqNhGcUZBl0s7PTTDzvY=
 github.com/anchore/packageurl-go v0.1.1-0.20250220190351-d62adb6e1115/go.mod h1:KoYIv7tdP5+CC9VGkeZV4/vGCKsY55VvoG+5dadg4YI=
-github.com/anchore/stereoscope v0.1.4 h1:e+iT9UdUzLBabWGe84hn5sTHDRioY+4IHsVzJXuJlek=
-github.com/anchore/stereoscope v0.1.4/go.mod h1:omWgXDEp/XfqCJlZXIByEo1c3ArZg/qTJ5LBKVLAIdw=
+github.com/anchore/stereoscope v0.1.5-0.20250604132324-344e29f37f05 h1:MKTDwRrC7A+eRZvGFJ8TzLiKytFH1GBpPdjLTlcoO4A=
+github.com/anchore/stereoscope v0.1.5-0.20250604132324-344e29f37f05/go.mod h1:S5xxMIo1BK+V+p+6SF/wzS4pZ2cTnpk6L+UJbf5IjsQ=
 github.com/andreyvit/diff v0.0.0-20170406064948-c7f18ee00883/go.mod h1:rCTlJbsFo29Kk6CurOXKm700vrz8f0KW0JNfpkRJY/8=
 github.com/andybalholm/brotli v1.1.2-0.20250424173009-453214e765f3 h1:8PmGpDEZl9yDpcdEr6Odf23feCxK3LNUNMxjXg41pZQ=
 github.com/andybalholm/brotli v1.1.2-0.20250424173009-453214e765f3/go.mod h1:05ib4cKhjx3OQYUY22hTVd34Bc8upXjOLL2rKwwZBoA=
@@ -264,14 +264,14 @@ github.com/deitch/magic v0.0.0-20230404182410-1ff89d7342da/go.mod h1:B3tI9iGHi4i
 github.com/dgrijalva/jwt-go/v4 v4.0.0-preview1/go.mod h1:+hnT3ywWDTAFrW5aE+u2Sa/wT555ZqwoCS+pk3p6ry4=
 github.com/distribution/reference v0.6.0 h1:0IXCQ5g4/QMHHkarYzh5l+u8T3t73zM5QvfrDyIgxBk=
 github.com/distribution/reference v0.6.0/go.mod h1:BbU0aIcezP1/5jX/8MP0YiH4SdvB5Y4f/wlDRiLyi3E=
-github.com/docker/cli v28.1.1+incompatible h1:eyUemzeI45DY7eDPuwUcmDyDj1pM98oD5MdSpiItp8k=
-github.com/docker/cli v28.1.1+incompatible/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8=
+github.com/docker/cli v28.2.2+incompatible h1:qzx5BNUDFqlvyq4AHzdNB7gSyVTmU4cgsyN9SdInc1A=
+github.com/docker/cli v28.2.2+incompatible/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8=
 github.com/docker/distribution v2.8.3+incompatible h1:AtKxIZ36LoNK51+Z6RpzLpddBirtxJnzDrHLEKxTAYk=
 github.com/docker/distribution v2.8.3+incompatible/go.mod h1:J2gT2udsDAN96Uj4KfcMRqY0/ypR+oyYUYmja8H+y+w=
 github.com/docker/docker v28.1.1+incompatible h1:49M11BFLsVO1gxY9UX9p/zwkE/rswggs8AdFmXQw51I=
 github.com/docker/docker v28.1.1+incompatible/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk=
-github.com/docker/docker-credential-helpers v0.8.2 h1:bX3YxiGzFP5sOXWc3bTPEXdEaZSeVMrFgOr3T+zrFAo=
-github.com/docker/docker-credential-helpers v0.8.2/go.mod h1:P3ci7E3lwkZg6XiHdRKft1KckHiO9a2rNtyFbZ/ry9M=
+github.com/docker/docker-credential-helpers v0.9.3 h1:gAm/VtF9wgqJMoxzT3Gj5p4AqIjCBS4wrsOh9yRqcz8=
+github.com/docker/docker-credential-helpers v0.9.3/go.mod h1:x+4Gbw9aGmChi3qTLZj8Dfn0TD20M/fuWy0E5+WDeCo=
 github.com/docker/go-connections v0.5.0 h1:USnMq7hx7gwdVZq1L49hLXaFtUdTADjXGp+uj1Br63c=
 github.com/docker/go-connections v0.5.0/go.mod h1:ov60Kzw0kKElRwhNs9UlUHAE/F9Fe6GLaXnqyDdmEXc=
 github.com/docker/go-events v0.0.0-20190806004212-e31b211e4f1c h1:+pKlWGMw7gf6bQ+oDZB4KHQFypsfjYlq/C4rfL7D3g8=
@@ -325,12 +325,12 @@ github.com/gabriel-vasile/mimetype v1.4.9/go.mod h1:WnSQhFKJuBlRyLiKohA/2DtIlPFA
 github.com/ghodss/yaml v1.0.0/go.mod h1:4dBDuWmgqj2HViK6kFavaiC9ZROes6MMH2rRYeMEF04=
 github.com/github/go-spdx/v2 v2.3.3 h1:QI7evnHWEfWkT54eJwkoV/f3a0xD3gLlnVmT5wQG6LE=
 github.com/github/go-spdx/v2 v2.3.3/go.mod h1:2ZxKsOhvBp+OYBDlsGnUMcchLeo2mrpEBn2L1C+U3IQ=
-github.com/gkampitakis/ciinfo v0.3.1 h1:lzjbemlGI4Q+XimPg64ss89x8Mf3xihJqy/0Mgagapo=
-github.com/gkampitakis/ciinfo v0.3.1/go.mod h1:1NIwaOcFChN4fa/B0hEBdAb6npDlFL8Bwx4dfRLRqAo=
+github.com/gkampitakis/ciinfo v0.3.2 h1:JcuOPk8ZU7nZQjdUhctuhQofk7BGHuIy0c9Ez8BNhXs=
+github.com/gkampitakis/ciinfo v0.3.2/go.mod h1:1NIwaOcFChN4fa/B0hEBdAb6npDlFL8Bwx4dfRLRqAo=
 github.com/gkampitakis/go-diff v1.3.2 h1:Qyn0J9XJSDTgnsgHRdz9Zp24RaJeKMUHg2+PDZZdC4M=
 github.com/gkampitakis/go-diff v1.3.2/go.mod h1:LLgOrpqleQe26cte8s36HTWcTmMEur6OPYerdAAS9tk=
-github.com/gkampitakis/go-snaps v0.5.11 h1:LFG0ggUKR+KEiiaOvFCmLgJ5NO2zf93AxxddkBn3LdQ=
-github.com/gkampitakis/go-snaps v0.5.11/go.mod h1:PcKmy8q5Se7p48ywpogN5Td13reipz1Iivah4wrTIvY=
+github.com/gkampitakis/go-snaps v0.5.13 h1:Hhjmvv1WboSCxkR9iU2mj5PQ8tsz/y8ECGrIbjjPF8Q=
+github.com/gkampitakis/go-snaps v0.5.13/go.mod h1:HNpx/9GoKisdhw9AFOBT1N7DBs9DiHo/hGheFGBZ+mc=
 github.com/glebarez/go-sqlite v1.20.3 h1:89BkqGOXR9oRmG58ZrzgoY/Fhy5x0M+/WV48U5zVrZ4=
 github.com/glebarez/go-sqlite v1.20.3/go.mod h1:u3N6D/wftiAzIOJtZl6BmedqxmmkDfH3q+ihjqxC9u0=
 github.com/gliderlabs/ssh v0.3.8 h1:a4YXD1V7xMF9g5nTkdfnja3Sxy1PVDCj1Zg4Wb8vY6c=
@@ -341,8 +341,8 @@ github.com/go-git/go-billy/v5 v5.6.2 h1:6Q86EsPXMa7c3YZ3aLAQsMA0VlWmy43r6FHqa/UN
 github.com/go-git/go-billy/v5 v5.6.2/go.mod h1:rcFC2rAsp/erv7CMz9GczHcuD0D32fWzH+MJAU+jaUU=
 github.com/go-git/go-git-fixtures/v4 v4.3.2-0.20231010084843-55a94097c399 h1:eMje31YglSBqCdIqdhKBW8lokaMrL3uTkpGYlE2OOT4=
 github.com/go-git/go-git-fixtures/v4 v4.3.2-0.20231010084843-55a94097c399/go.mod h1:1OCfN199q1Jm3HZlxleg+Dw/mwps2Wbk9frAWm+4FII=
-github.com/go-git/go-git/v5 v5.16.0 h1:k3kuOEpkc0DeY7xlL6NaaNg39xdgQbtH5mwCafHO9AQ=
-github.com/go-git/go-git/v5 v5.16.0/go.mod h1:4Ge4alE/5gPs30F2H1esi2gPd69R0C39lolkucHBOp8=
+github.com/go-git/go-git/v5 v5.16.2 h1:fT6ZIOjE5iEnkzKyxTHK1W4HGAsPhqEqiSAssSO77hM=
+github.com/go-git/go-git/v5 v5.16.2/go.mod h1:4Ge4alE/5gPs30F2H1esi2gPd69R0C39lolkucHBOp8=
 github.com/go-gl/glfw v0.0.0-20190409004039-e6da0acd62b1/go.mod h1:vR7hzQXu2zJy9AVAgeJqvqgH9Q5CA+iKCZ2gyEVpxRU=
 github.com/go-gl/glfw/v3.3/glfw v0.0.0-20191125211704-12ad95a8df72/go.mod h1:tQ2UAYgL5IevRw8kRxooKSPJfGvJ9fJQFa0TUsXzTg8=
 github.com/go-gl/glfw/v3.3/glfw v0.0.0-20200222043503-6f7a984d4dc4/go.mod h1:tQ2UAYgL5IevRw8kRxooKSPJfGvJ9fJQFa0TUsXzTg8=
@@ -366,8 +366,8 @@ github.com/go-viper/mapstructure/v2 v2.2.1/go.mod h1:oJDH3BJKyqBA2TXFhDsKDGDTlnd
 github.com/gobwas/httphead v0.1.0/go.mod h1:O/RXo79gxV8G+RqlR/otEwx4Q36zl9rqC5u12GKvMCM=
 github.com/gobwas/pool v0.2.1/go.mod h1:q8bcK0KcYlCgd9e7WYLm9LpyS+YeLd8JVDW6WezmKEw=
 github.com/gobwas/ws v1.2.1/go.mod h1:hRKAFb8wOxFROYNsT1bqfWnhX+b5MFeJM9r2ZSwg/KY=
-github.com/goccy/go-yaml v1.15.13 h1:Xd87Yddmr2rC1SLLTm2MNDcTjeO/GYo0JGiww6gSTDg=
-github.com/goccy/go-yaml v1.15.13/go.mod h1:XBurs7gK8ATbW4ZPGKgcbrY1Br56PdM69F7LkFRi1kA=
+github.com/goccy/go-yaml v1.18.0 h1:8W7wMFS12Pcas7KU+VVkaiCng+kG8QiFeFwzFb+rwuw=
+github.com/goccy/go-yaml v1.18.0/go.mod h1:XBurs7gK8ATbW4ZPGKgcbrY1Br56PdM69F7LkFRi1kA=
 github.com/godbus/dbus/v5 v5.0.4/go.mod h1:xhWf0FNVPg57R7Z0UbKHbJfkEywrmjJnf7w5xrFpKfA=
 github.com/gogo/protobuf v1.1.1/go.mod h1:r8qH/GZQm5c6nD/R0oafs1akxWv10x8SbQlK7atdtwQ=
 github.com/gogo/protobuf v1.3.2 h1:Ov1cvc58UF3b5XjBnZv7+opcTcQFZebYjWzi34vdm4Q=
@@ -428,8 +428,8 @@ github.com/google/go-cmp v0.5.9/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeN
 github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
 github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
 github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
-github.com/google/go-containerregistry v0.20.3 h1:oNx7IdTI936V8CQRveCjaxOiegWwvM7kqkbXTpyiovI=
-github.com/google/go-containerregistry v0.20.3/go.mod h1:w00pIgBRDVUDFM6bq+Qx8lwNWK+cxgCuX1vd3PIBDNI=
+github.com/google/go-containerregistry v0.20.5 h1:4RnlYcDs5hoA++CeFjlbZ/U9Yp1EuWr+UhhTyYQjOP0=
+github.com/google/go-containerregistry v0.20.5/go.mod h1:Q14vdOOzug02bwnhMkZKD4e30pDaD9W65qzXpyzF49E=
 github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
 github.com/google/licensecheck v0.3.1 h1:QoxgoDkaeC4nFrtGN1jV7IPmDCHFNIVh54e5hSt6sPs=
 github.com/google/licensecheck v0.3.1/go.mod h1:ORkR35t/JjW+emNKtfJDII0zlciG9JgbT7SmsohlHmY=
@@ -751,8 +751,8 @@ github.com/sebdah/goldie/v2 v2.5.5 h1:rx1mwF95RxZ3/83sdS4Yp7t2C5TCokvWP4TBRbAyEW
 github.com/sebdah/goldie/v2 v2.5.5/go.mod h1:oZ9fp0+se1eapSRjfYbsV/0Hqhbuu3bJVvKI/NNtssI=
 github.com/sergi/go-diff v1.1.0/go.mod h1:STckp+ISIX8hZLjrqAeVduY0gWCT9IjLuqbuNXdaHfM=
 github.com/sergi/go-diff v1.2.0/go.mod h1:STckp+ISIX8hZLjrqAeVduY0gWCT9IjLuqbuNXdaHfM=
-github.com/sergi/go-diff v1.3.2-0.20230802210424-5b0b94c5c0d3 h1:n661drycOFuPLCN3Uc8sB6B/s6Z4t2xvBgU1htSHuq8=
-github.com/sergi/go-diff v1.3.2-0.20230802210424-5b0b94c5c0d3/go.mod h1:A0bzQcvG0E7Rwjx0REVgAGH58e96+X0MeOfepqsbeW4=
+github.com/sergi/go-diff v1.4.0 h1:n/SP9D5ad1fORl+llWyN+D6qoUETXNZARKjyY2/KVCw=
+github.com/sergi/go-diff v1.4.0/go.mod h1:A0bzQcvG0E7Rwjx0REVgAGH58e96+X0MeOfepqsbeW4=
 github.com/shopspring/decimal v1.4.0 h1:bxl37RwXBklmTi0C79JfXCEBD1cqqHt0bbgBAGFp81k=
 github.com/shopspring/decimal v1.4.0/go.mod h1:gawqmDU56v4yIKSwfBSFip1HdCCXN8/+DMd9qYNcwME=
 github.com/sirupsen/logrus v1.2.0/go.mod h1:LxeOpSwHxABJmUn/MG1IvRgCAasNZTLOkJPxbbu5VWo=
@@ -836,8 +836,8 @@ github.com/ulikunitz/xz v0.5.12 h1:37Nm15o69RwBkXM0J6A5OlE67RZTfzUxTj8fB3dfcsc=
 github.com/ulikunitz/xz v0.5.12/go.mod h1:nbz6k7qbPmH4IRqmfOplQw/tblSgqTqBwxkY0oWt/14=
 github.com/vbatts/go-mtree v0.5.4 h1:OMAb8jaCyiFA7zXj0Zc/oARcxBDBoeu2LizjB8BVJl0=
 github.com/vbatts/go-mtree v0.5.4/go.mod h1:5GqJbVhm9BBiCc4K5uc/c42FPgXulHaQs4sFUEfIWMo=
-github.com/vbatts/tar-split v0.11.6 h1:4SjTW5+PU11n6fZenf2IPoV8/tz3AaYHMWjf23envGs=
-github.com/vbatts/tar-split v0.11.6/go.mod h1:dqKNtesIOr2j2Qv3W/cHjnvk9I8+G7oAkFDFN6TCBEI=
+github.com/vbatts/tar-split v0.12.1 h1:CqKoORW7BUWBe7UL/iqTVvkTBOF8UvOMKOIZykxnnbo=
+github.com/vbatts/tar-split v0.12.1/go.mod h1:eF6B6i6ftWQcDqEn3/iGFRFRo8cBIMSJVOpnNdfTMFA=
 github.com/vifraa/gopom v1.0.0 h1:L9XlKbyvid8PAIK8nr0lihMApJQg/12OBvMA28BcWh0=
 github.com/vifraa/gopom v1.0.0/go.mod h1:oPa1dcrGrtlO37WPDBm5SqHAT+wTgF8An1Q71Z6Vv4o=
 github.com/wagoodman/go-partybus v0.0.0-20230516145632-8ccac152c651 h1:jIVmlAFIqV3d+DOxazTR9v+zgj8+VYuQBzPgBZvWBHA=
@@ -885,20 +885,22 @@ go.opencensus.io v0.24.0 h1:y73uSU6J157QMP2kn2r30vwW1A2W2WFwSCGnAVxeaD0=
 go.opencensus.io v0.24.0/go.mod h1:vNK8G9p7aAivkbmorf4v+7Hgx+Zs0yY+0fOtgBfjQKo=
 go.opentelemetry.io/auto/sdk v1.1.0 h1:cH53jehLUN6UFLY71z+NDOiNJqDdPRaXzTel0sJySYA=
 go.opentelemetry.io/auto/sdk v1.1.0/go.mod h1:3wSPjt5PWp2RhlCcmmOial7AvC4DQqZb7a7wCow3W8A=
-go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.58.0 h1:yd02MEjBdJkG3uabWP9apV+OuWRIXGDuJEUJbOHmCFU=
-go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.58.0/go.mod h1:umTcuxiv1n/s/S6/c2AT/g2CQ7u5C59sHDNmfSwgz7Q=
-go.opentelemetry.io/otel v1.33.0 h1:/FerN9bax5LoK51X/sI0SVYrjSE0/yUL7DpxW4K3FWw=
-go.opentelemetry.io/otel v1.33.0/go.mod h1:SUUkR6csvUQl+yjReHu5uM3EtVV7MBm5FHKRlNx4I8I=
+go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.60.0 h1:sbiXRNDSWJOTobXh5HyQKjq6wUC5tNybqjIqDpAY4CU=
+go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.60.0/go.mod h1:69uWxva0WgAA/4bu2Yy70SLDBwZXuQ6PbBpbsa5iZrQ=
+go.opentelemetry.io/otel v1.35.0 h1:xKWKPxrxB6OtMCbmMY021CqC45J+3Onta9MqjhnusiQ=
+go.opentelemetry.io/otel v1.35.0/go.mod h1:UEqy8Zp11hpkUrL73gSlELM0DupHoiq72dR+Zqel/+Y=
 go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.19.0 h1:Mne5On7VWdx7omSrSSZvM4Kw7cS7NQkOOmLcgscI51U=
 go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.19.0/go.mod h1:IPtUMKL4O3tH5y+iXVyAXqpAwMuzC1IrxVS81rummfE=
 go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.33.0 h1:wpMfgF8E1rkrT1Z6meFh1NDtownE9Ii3n3X2GJYjsaU=
 go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.33.0/go.mod h1:wAy0T/dUbs468uOlkT31xjvqQgEVXv58BRFWEgn5v/0=
-go.opentelemetry.io/otel/metric v1.33.0 h1:r+JOocAyeRVXD8lZpjdQjzMadVZp2M4WmQ+5WtEnklQ=
-go.opentelemetry.io/otel/metric v1.33.0/go.mod h1:L9+Fyctbp6HFTddIxClbQkjtubW6O9QS3Ann/M82u6M=
-go.opentelemetry.io/otel/sdk v1.33.0 h1:iax7M131HuAm9QkZotNHEfstof92xM+N8sr3uHXc2IM=
-go.opentelemetry.io/otel/sdk v1.33.0/go.mod h1:A1Q5oi7/9XaMlIWzPSxLRWOI8nG3FnzHJNbiENQuihM=
-go.opentelemetry.io/otel/trace v1.33.0 h1:cCJuF7LRjUFso9LPnEAHJDB2pqzp+hbO8eu1qqW2d/s=
-go.opentelemetry.io/otel/trace v1.33.0/go.mod h1:uIcdVUZMpTAmz0tI1z04GoVSezK37CbGV4fr1f2nBck=
+go.opentelemetry.io/otel/metric v1.35.0 h1:0znxYu2SNyuMSQT4Y9WDWej0VpcsxkuklLa4/siN90M=
+go.opentelemetry.io/otel/metric v1.35.0/go.mod h1:nKVFgxBZ2fReX6IlyW28MgZojkoAkJGaE8CpgeAU3oE=
+go.opentelemetry.io/otel/sdk v1.35.0 h1:iPctf8iprVySXSKJffSS79eOjl9pvxV9ZqOWT0QejKY=
+go.opentelemetry.io/otel/sdk v1.35.0/go.mod h1:+ga1bZliga3DxJ3CQGg3updiaAJoNECOgJREo9KHGQg=
+go.opentelemetry.io/otel/sdk/metric v1.35.0 h1:1RriWBmCKgkeHEhM7a2uMjMUfP7MsOF5JpUCaEqEI9o=
+go.opentelemetry.io/otel/sdk/metric v1.35.0/go.mod h1:is6XYCUMpcKi+ZsOvfluY5YstFnhW0BidkR+gL+qN+w=
+go.opentelemetry.io/otel/trace v1.35.0 h1:dPpEfJu1sDIqruz7BHFG3c7528f6ddfSWfFDVt/xgMs=
+go.opentelemetry.io/otel/trace v1.35.0/go.mod h1:WUk7DtFp1Aw2MkvqGdwiXYDZZNvA/1J8o6xRXLrIkyc=
 go.opentelemetry.io/proto/otlp v0.7.0/go.mod h1:PqfVotwruBrMGOCsRd/89rSnXhoiJIqeYNgFYFoEGnI=
 go.opentelemetry.io/proto/otlp v1.0.0 h1:T0TX0tmXU8a3CbNXzEKGeU5mIVOdf0oykP+u2lIVU/I=
 go.opentelemetry.io/proto/otlp v1.0.0/go.mod h1:Sy6pihPLfYHkr3NkUbEhGHFhINUSI/v80hjKIs5JXpM=
@@ -925,8 +927,8 @@ golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPh
 golang.org/x/crypto v0.0.0-20210817164053-32db794688a5/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
 golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
 golang.org/x/crypto v0.0.0-20220622213112-05595931fe9d/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=
-golang.org/x/crypto v0.38.0 h1:jt+WWG8IZlBnVbomuhg2Mdq0+BBQaHbtqHEFEigjUV8=
-golang.org/x/crypto v0.38.0/go.mod h1:MvrbAqul58NNYPKnOra203SB9vpuZW0e+RRZV+Ggqjw=
+golang.org/x/crypto v0.39.0 h1:SHs+kF4LP+f+p14esP5jAoDpHU8Gu/v9lFRK6IT5imM=
+golang.org/x/crypto v0.39.0/go.mod h1:L+Xg3Wf6HoL4Bn4238Z6ft6KfEpN0tJGo53AAPC632U=
 golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
 golang.org/x/exp v0.0.0-20190306152737-a1d7652674e8/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
 golang.org/x/exp v0.0.0-20190510132918-efd6b22b2522/go.mod h1:ZjyILWgesfNpC6sMxTJOJm9Kp84zZh5NQWvqDGG3Qr8=
@@ -937,8 +939,8 @@ golang.org/x/exp v0.0.0-20191227195350-da58074b4299/go.mod h1:2RIsYlXP63K8oxa1u0
 golang.org/x/exp v0.0.0-20200119233911-0405dc783f0a/go.mod h1:2RIsYlXP63K8oxa1u096TMicItID8zy7Y6sNkU49FU4=
 golang.org/x/exp v0.0.0-20200207192155-f17229e696bd/go.mod h1:J/WKrq2StrnmMY6+EHIKF9dgMWnmCNThgcyBT1FY9mM=
 golang.org/x/exp v0.0.0-20200224162631-6cc2880d07d6/go.mod h1:3jZMyOhIsHpP37uCMkUooju7aAi5cS1Q23tOzKc+0MU=
-golang.org/x/exp v0.0.0-20250305212735-054e65f0b394 h1:nDVHiLt8aIbd/VzvPWN6kSOPE7+F/fNFDSXLVYkE/Iw=
-golang.org/x/exp v0.0.0-20250305212735-054e65f0b394/go.mod h1:sIifuuw/Yco/y6yb6+bDNfyeQ/MdPUy/hKEMYQV17cM=
+golang.org/x/exp v0.0.0-20250408133849-7e4ce0ab07d0 h1:R84qjqJb5nVJMxqWYb3np9L5ZsaDtB+a39EqjV0JSUM=
+golang.org/x/exp v0.0.0-20250408133849-7e4ce0ab07d0/go.mod h1:S9Xr4PYopiDyqSyp5NjCrhFrqg6A5zA2E/iPHPhqnS8=
 golang.org/x/image v0.0.0-20190227222117-0694c2d4d067/go.mod h1:kZ7UVZpmo3dzQBMxlp+ypCbDeSB+sBbTgSJuh5dn5js=
 golang.org/x/image v0.0.0-20190802002840-cff245a6509b/go.mod h1:FeLwcggjj3mMvU+oOTbSwawSJRM1uh48EjtB4UJZlP0=
 golang.org/x/lint v0.0.0-20181026193005-c67002cb31c3/go.mod h1:UVdnD1Gm6xHRNCYTkRU2/jEulfH38KcIWyp/GAMgvoE=
@@ -966,8 +968,8 @@ golang.org/x/mod v0.4.1/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.4.2/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.5.0/go.mod h1:5OXOZSfqPIIbmVBIIKWRFfZjPR0E5r58TLhUjH0a2Ro=
 golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4=
-golang.org/x/mod v0.24.0 h1:ZfthKaKaT4NrhGVZHO1/WDTwGES4De8KtWO0SIbNJMU=
-golang.org/x/mod v0.24.0/go.mod h1:IXM97Txy2VM4PJ3gI61r1YEk/gAj6zAHN3AdZt6S9Ww=
+golang.org/x/mod v0.25.0 h1:n7a+ZbQKQA/Ysbyb0/6IbB1H/X41mKgbhfv7AfG/44w=
+golang.org/x/mod v0.25.0/go.mod h1:IXM97Txy2VM4PJ3gI61r1YEk/gAj6zAHN3AdZt6S9Ww=
 golang.org/x/net v0.0.0-20180724234803-3673e40ba225/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20180826012351-8a410e7b638d/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20181023162649-9b4f9f5ad519/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
@@ -1012,8 +1014,8 @@ golang.org/x/net v0.0.0-20210813160813-60bc85c4be6d/go.mod h1:9nx3DQGgdP8bBQD5qx
 golang.org/x/net v0.0.0-20211112202133-69e39bad7dc2/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
 golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
 golang.org/x/net v0.7.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=
-golang.org/x/net v0.40.0 h1:79Xs7wF06Gbdcg4kdCCIQArK11Z1hr5POQ6+fIYHNuY=
-golang.org/x/net v0.40.0/go.mod h1:y0hY0exeL2Pku80/zKK7tpntoX23cqL3Oa6njdgRtds=
+golang.org/x/net v0.41.0 h1:vBTly1HeNPEn3wtREYfy4GZ/NECgw2Cnl+nK6Nz3uvw=
+golang.org/x/net v0.41.0/go.mod h1:B/K4NNqkfmg07DQYrbwvSluqCJOOXwUjeb/5lOisjbA=
 golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
 golang.org/x/oauth2 v0.0.0-20190226205417-e64efc72b421/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
 golang.org/x/oauth2 v0.0.0-20190604053449-0f29369cfe45/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
@@ -1043,8 +1045,8 @@ golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJ
 golang.org/x/sync v0.0.0-20201207232520-09787c993a3a/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20210220032951-036812b2e83c/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.14.0 h1:woo0S4Yywslg6hp4eUFjTVOyKt0RookbpAHG4c1HmhQ=
-golang.org/x/sync v0.14.0/go.mod h1:1dzgHSNfp02xaA81J2MS99Qcpr2w7fw1gpm99rleRqA=
+golang.org/x/sync v0.15.0 h1:KWH3jNZsfyT6xfAfKiz6MRNmd46ByHDYaZ7KSkCtdW8=
+golang.org/x/sync v0.15.0/go.mod h1:1dzgHSNfp02xaA81J2MS99Qcpr2w7fw1gpm99rleRqA=
 golang.org/x/sys v0.0.0-20180823144017-11551d06cbcc/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20180830151530-49385e6e1522/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20180905080454-ebe1bf3edb33/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
@@ -1137,8 +1139,8 @@ golang.org/x/text v0.3.5/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
 golang.org/x/text v0.7.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
-golang.org/x/text v0.25.0 h1:qVyWApTSYLk/drJRO5mDlNYskwQznZmkpV2c8q9zls4=
-golang.org/x/text v0.25.0/go.mod h1:WEdwpYrmk1qmdHvhkSTNPm3app7v4rsT8F2UD6+VHIA=
+golang.org/x/text v0.26.0 h1:P42AVeLghgTYr4+xUnTRKDMqpar+PtX7KWuNQL21L8M=
+golang.org/x/text v0.26.0/go.mod h1:QK15LZJUUQVJxhz7wXgxSy/CJaTFjd0G+YLonydOVQA=
 golang.org/x/time v0.0.0-20181108054448-85acf8d2951c/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.0.0-20190308202827-9d24e82272b4/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.0.0-20191024005414-555d28b269f0/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
@@ -1199,8 +1201,8 @@ golang.org/x/tools v0.1.3/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk=
 golang.org/x/tools v0.1.4/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk=
 golang.org/x/tools v0.1.5/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk=
 golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc=
-golang.org/x/tools v0.31.0 h1:0EedkvKDbh+qistFTd0Bcwe/YLh4vHwWEkiI0toFIBU=
-golang.org/x/tools v0.31.0/go.mod h1:naFTU+Cev749tSJRXJlna0T3WxKvb1kWEx15xA4SdmQ=
+golang.org/x/tools v0.33.0 h1:4qz2S3zmRxbGIhDIAgjxvFutSvH5EfnsYrRBj0UI0bc=
+golang.org/x/tools v0.33.0/go.mod h1:CIJMaWEY88juyUfo7UbgPqbC8rU2OqfAV1h2Qp0oMYI=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
@@ -1390,26 +1392,26 @@ honnef.co/go/tools v0.0.0-20190523083050-ea95bdfd59fc/go.mod h1:rf3lG4BRIbNafJWh
 honnef.co/go/tools v0.0.1-2019.2.3/go.mod h1:a3bituU0lyd329TUQxRnasdCoJDkEUEAqEt0JzvZhAg=
 honnef.co/go/tools v0.0.1-2020.1.3/go.mod h1:X/FiERA/W4tHapMX5mGpAtMSVEeEUOyHaw9vFzvIQ3k=
 honnef.co/go/tools v0.0.1-2020.1.4/go.mod h1:X/FiERA/W4tHapMX5mGpAtMSVEeEUOyHaw9vFzvIQ3k=
-modernc.org/cc/v4 v4.25.2 h1:T2oH7sZdGvTaie0BRNFbIYsabzCxUQg8nLqCdQ2i0ic=
-modernc.org/cc/v4 v4.25.2/go.mod h1:uVtb5OGqUKpoLWhqwNQo/8LwvoiEBLvZXIQ/SmO6mL0=
-modernc.org/ccgo/v4 v4.25.1 h1:TFSzPrAGmDsdnhT9X2UrcPMI3N/mJ9/X9ykKXwLhDsU=
-modernc.org/ccgo/v4 v4.25.1/go.mod h1:njjuAYiPflywOOrm3B7kCB444ONP5pAVr8PIEoE0uDw=
-modernc.org/fileutil v1.3.0 h1:gQ5SIzK3H9kdfai/5x41oQiKValumqNTDXMvKo62HvE=
-modernc.org/fileutil v1.3.0/go.mod h1:XatxS8fZi3pS8/hKG2GH/ArUogfxjpEKs3Ku3aK4JyQ=
+modernc.org/cc/v4 v4.26.1 h1:+X5NtzVBn0KgsBCBe+xkDC7twLb/jNVj9FPgiwSQO3s=
+modernc.org/cc/v4 v4.26.1/go.mod h1:uVtb5OGqUKpoLWhqwNQo/8LwvoiEBLvZXIQ/SmO6mL0=
+modernc.org/ccgo/v4 v4.28.0 h1:rjznn6WWehKq7dG4JtLRKxb52Ecv8OUGah8+Z/SfpNU=
+modernc.org/ccgo/v4 v4.28.0/go.mod h1:JygV3+9AV6SmPhDasu4JgquwU81XAKLd3OKTUDNOiKE=
+modernc.org/fileutil v1.3.3 h1:3qaU+7f7xxTUmvU1pJTZiDLAIoJVdUSSauJNHg9yXoA=
+modernc.org/fileutil v1.3.3/go.mod h1:HxmghZSZVAz/LXcMNwZPA/DRrQZEVP9VX0V4LQGQFOc=
 modernc.org/gc/v2 v2.6.5 h1:nyqdV8q46KvTpZlsw66kWqwXRHdjIlJOhG6kxiV/9xI=
 modernc.org/gc/v2 v2.6.5/go.mod h1:YgIahr1ypgfe7chRuJi2gD7DBQiKSLMPgBQe9oIiito=
-modernc.org/libc v1.62.1 h1:s0+fv5E3FymN8eJVmnk0llBe6rOxCu/DEU+XygRbS8s=
-modernc.org/libc v1.62.1/go.mod h1:iXhATfJQLjG3NWy56a6WVU73lWOcdYVxsvwCgoPljuo=
+modernc.org/libc v1.65.10 h1:ZwEk8+jhW7qBjHIT+wd0d9VjitRyQef9BnzlzGwMODc=
+modernc.org/libc v1.65.10/go.mod h1:StFvYpx7i/mXtBAfVOjaU0PWZOvIRoZSgXhrwXzr8Po=
 modernc.org/mathutil v1.7.1 h1:GCZVGXdaN8gTqB1Mf/usp1Y/hSqgI2vAGGP4jZMCxOU=
 modernc.org/mathutil v1.7.1/go.mod h1:4p5IwJITfppl0G4sUEDtCr4DthTaT47/N3aT6MhfgJg=
-modernc.org/memory v1.9.1 h1:V/Z1solwAVmMW1yttq3nDdZPJqV1rM05Ccq6KMSZ34g=
-modernc.org/memory v1.9.1/go.mod h1:/JP4VbVC+K5sU2wZi9bHoq2MAkCnrt2r98UGeSK7Mjw=
+modernc.org/memory v1.11.0 h1:o4QC8aMQzmcwCK3t3Ux/ZHmwFPzE6hf2Y5LbkRs+hbI=
+modernc.org/memory v1.11.0/go.mod h1:/JP4VbVC+K5sU2wZi9bHoq2MAkCnrt2r98UGeSK7Mjw=
 modernc.org/opt v0.1.4 h1:2kNGMRiUjrp4LcaPuLY2PzUfqM/w9N23quVwhKt5Qm8=
 modernc.org/opt v0.1.4/go.mod h1:03fq9lsNfvkYSfxrfUhZCWPk1lm4cq4N+Bh//bEtgns=
 modernc.org/sortutil v1.2.1 h1:+xyoGf15mM3NMlPDnFqrteY07klSFxLElE2PVuWIJ7w=
 modernc.org/sortutil v1.2.1/go.mod h1:7ZI3a3REbai7gzCLcotuw9AC4VZVpYMjDzETGsSMqJE=
-modernc.org/sqlite v1.37.0 h1:s1TMe7T3Q3ovQiK2Ouz4Jwh7dw4ZDqbebSDTlSJdfjI=
-modernc.org/sqlite v1.37.0/go.mod h1:5YiWv+YviqGMuGw4V+PNplcyaJ5v+vQd7TQOgkACoJM=
+modernc.org/sqlite v1.38.0 h1:+4OrfPQ8pxHKuWG4md1JpR/EYAh3Md7TdejuuzE7EUI=
+modernc.org/sqlite v1.38.0/go.mod h1:1Bj+yES4SVvBZ4cBOpVZ6QgesMCKpJZDq0nxYzOpmNE=
 modernc.org/strutil v1.2.1 h1:UneZBkQA+DX2Rp35KcM69cSsNES9ly8mQWD71HKlOA0=
 modernc.org/strutil v1.2.1/go.mod h1:EHkiggD70koQxjVdSBM3JKM7k6L0FbGE5eymy9i3B9A=
 modernc.org/token v1.1.0 h1:Xl7Ap9dKaEs5kLoOQeQmPWevfnk/DM5qcLcYlA8ys6Y=
@@ -3,5 +3,5 @@ package internal
 const (
 	// JSONSchemaVersion is the current schema version output by the JSON encoder
 	// This is roughly following the "SchemaVer" guidelines for versioning the JSON schema. Please see schema/json/README.md for details on how to increment.
-	JSONSchemaVersion = "16.0.33"
+	JSONSchemaVersion = "16.0.34"
 )
@@ -92,6 +92,12 @@ func findOwnershipByFilesRelationships(resolver file.Resolver, catalog *pkg.Coll
 		return relationships
 	}

+	// Build a map of real paths to packages that directly own them. We'll use this
+	// to check if a file is already owned by the same type of package when we're
+	// determining ownership via symlink.
+	directOwnership := directOwnersByPath(catalog)
+
+	// Now establish relationships, considering symlinks
 	for _, candidateOwnerPkg := range catalog.Sorted() {
 		id := candidateOwnerPkg.ID()
 		if candidateOwnerPkg.Metadata == nil {
@@ -105,16 +111,34 @@ func findOwnershipByFilesRelationships(resolver file.Resolver, catalog *pkg.Coll
 		}

 		for _, ownedFilePath := range pkgFileOwner.OwnedFiles() {
-			// find the first path that results in a hit
-			for _, ownedPath := range allPaths(ownedFilePath, resolver) {
-				if matchesAny(ownedPath, globsForbiddenFromBeingOwned) {
+			if ownedFilePath == "" {
+				continue
+			}
+
+			// find paths that result in a hit (includes resolving symlinks)
+			resolvedPaths := resolvePaths(ownedFilePath, resolver)
+
+			for _, resolvedPath := range resolvedPaths {
+				if matchesAny(resolvedPath, globsForbiddenFromBeingOwned) {
 					// we skip over known exceptions to file ownership, such as the RPM package owning
 					// the RPM DB path, otherwise the RPM package would "own" all RPMs, which is not intended
 					continue
 				}

+				// Skip claiming ownership via symlink if another package of the same type
+				// directly owns this real path. This is the specific fix for the issue where a
+				// symlink shouldn't allow a package to claim ownership when another package of
+				// the same type directly owns the real file.
+				if resolvedPath != ownedFilePath { // This is a resolved symlink path
+					// Check if another package of the same type directly owns this path
+					if paths := directOwnership[candidateOwnerPkg.Type]; paths != nil && paths.Has(resolvedPath) {
+						// Skip this path - a package of the same type directly owns it
+						continue
+					}
+				}
+
 				// look for package(s) in the catalog that may be owned by this package and mark the relationship
-				for _, subPackage := range catalog.PackagesByPath(ownedPath) {
+				for _, subPackage := range catalog.PackagesByPath(resolvedPath) {
 					subID := subPackage.ID()
 					if subID == id {
 						continue
@@ -126,7 +150,7 @@ func findOwnershipByFilesRelationships(resolver file.Resolver, catalog *pkg.Coll
 					if _, exists := relationships[id][subID]; !exists {
 						relationships[id][subID] = strset.New()
 					}
-					relationships[id][subID].Add(ownedPath)
+					relationships[id][subID].Add(resolvedPath)
 				}
 			}
 		}
@@ -135,7 +159,40 @@ func findOwnershipByFilesRelationships(resolver file.Resolver, catalog *pkg.Coll
 	return relationships
 }

-func allPaths(ownedFilePath string, resolver file.Resolver) []string {
+func directOwnersByPath(catalog *pkg.Collection) map[pkg.Type]*strset.Set {
+	directOwnership := map[pkg.Type]*strset.Set{}
+
+	// First, identify direct ownership of all files
+	for _, p := range catalog.Sorted() {
+		if p.Metadata == nil {
+			continue
+		}
+
+		// check to see if this is a file owner
+		pkgFileOwner, ok := p.Metadata.(pkg.FileOwner)
+		if !ok {
+			continue
+		}
+
+		for _, ownedFilePath := range pkgFileOwner.OwnedFiles() {
+			if ownedFilePath == "" {
+				continue
+			}
+
+			// Register direct ownership
+			paths := directOwnership[p.Type]
+			if paths == nil {
+				paths = strset.New()
+				directOwnership[p.Type] = paths
+			}
+			paths.Add(ownedFilePath)
+		}
+	}
+
+	return directOwnership
+}
+
+func resolvePaths(ownedFilePath string, resolver file.Resolver) []string {
 	// though we have a string path, we need to resolve symlinks and other filesystem oddities since we cannot assume this is a real path
 	var locs []file.Location
 	var err error
@@ -78,6 +78,64 @@ func TestOwnershipByFilesRelationship(t *testing.T) {
 				return []pkg.Package{parent, child}, []artifact.Relationship{relationship}
 			},
 		},
+		{
+			name: "only-real-file-owner-gets-ownership-relationship-not-symlink-owner",
+			resolver: mockFR{
+				translate: map[string]string{
+					"/usr/bin/jenkins.war-symlink": "/usr/share/jenkins/jenkins.war", // symlink to the real file
+				},
+			},
+			setup: func(t testing.TB) ([]pkg.Package, []artifact.Relationship) {
+				// Package that owns the symlink
+				symlinkOwner := pkg.Package{
+					Type: pkg.ApkPkg,
+					Metadata: pkg.ApkDBEntry{
+						Package: "jenkins-symlink-pkg",
+						Files: []pkg.ApkFileRecord{
+							{Path: "/usr/bin/jenkins.war-symlink"}, // this symlinks to the real file
+						},
+					},
+				}
+				symlinkOwner.SetID()
+
+				// Package that owns the real file
+				realFileOwner := pkg.Package{
+					Type: pkg.ApkPkg,
+					Metadata: pkg.ApkDBEntry{
+						Package: "jenkins-real-pkg",
+						Files: []pkg.ApkFileRecord{
+							{Path: "/usr/share/jenkins/jenkins.war"}, // the real file
+						},
+					},
+				}
+				realFileOwner.SetID()
+
+				// A third package that is "located at" the real file path
+				// This simulates a package being discovered at the jenkins.war location
+				consumerPackage := pkg.Package{
+					Type: pkg.JavaPkg,
+					Locations: file.NewLocationSet(
+						file.NewVirtualLocation("/usr/share/jenkins/jenkins.war", "/usr/share/jenkins/jenkins.war"),
+					),
+				}
+				consumerPackage.SetID()
+
+				// Only the real file owner should have an ownership relationship with the consumer package
+				// The symlink owner should NOT have a relationship with the consumer
+				relationship := artifact.Relationship{
+					From: realFileOwner,
+					To:   consumerPackage,
+					Type: artifact.OwnershipByFileOverlapRelationship,
+					Data: ownershipByFilesMetadata{
+						Files: []string{
+							"/usr/share/jenkins/jenkins.war",
+						},
+					},
+				}
+
+				return []pkg.Package{symlinkOwner, realFileOwner, consumerPackage}, []artifact.Relationship{relationship}
+			},
+		},
 		{
 			name: "misses-by-dead-symlink",
 			resolver: mockFR{
@@ -154,7 +154,8 @@ func DefaultPackageTaskFactories() Factories {
 			},
 			pkgcataloging.DeclaredTag, pkgcataloging.DirectoryTag, pkgcataloging.InstalledTag, pkgcataloging.ImageTag, "binary",
 		),
-		newSimplePackageTaskFactory(binary.NewELFPackageCataloger, pkgcataloging.DeclaredTag, pkgcataloging.DirectoryTag, pkgcataloging.InstalledTag, pkgcataloging.ImageTag, "binary", "elf-package"),
+		newSimplePackageTaskFactory(binary.NewELFPackageCataloger, pkgcataloging.DeclaredTag, pkgcataloging.DirectoryTag, pkgcataloging.InstalledTag, pkgcataloging.ImageTag, "binary", "elf-package", "elf"),
+		newSimplePackageTaskFactory(binary.NewPEPackageCataloger, pkgcataloging.DeclaredTag, pkgcataloging.DirectoryTag, pkgcataloging.InstalledTag, pkgcataloging.ImageTag, "binary", "pe-package", "pe", "dll", "exe"),
 		newSimplePackageTaskFactory(githubactions.NewActionUsageCataloger, pkgcataloging.DeclaredTag, pkgcataloging.DirectoryTag, "github", "github-actions"),
 		newSimplePackageTaskFactory(githubactions.NewWorkflowUsageCataloger, pkgcataloging.DeclaredTag, pkgcataloging.DirectoryTag, "github", "github-actions"),
 		newSimplePackageTaskFactory(java.NewJvmDistributionCataloger, pkgcataloging.DeclaredTag, pkgcataloging.DirectoryTag, pkgcataloging.InstalledTag, pkgcataloging.ImageTag, "java", "jvm", "jdk", "jre"),
@@ -1,6 +1,6 @@
 {
  "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "$id": "anchore.io/schema/syft/json/16.0.33/document",
+  "$id": "anchore.io/schema/syft/json/16.0.34/document",
  "$ref": "#/$defs/Document",
  "$defs": {
    "AlpmDbEntry": {
@@ -1971,6 +1971,9 @@
            {
              "$ref": "#/$defs/OpamPackage"
            },
+            {
+              "$ref": "#/$defs/PeBinary"
+            },
            {
              "$ref": "#/$defs/PhpComposerInstalledEntry"
            },
@@ -2045,6 +2048,17 @@
        "purl"
      ]
    },
+    "PeBinary": {
+      "properties": {
+        "VersionResources": {
+          "$ref": "#/$defs/KeyValues"
+        }
+      },
+      "type": "object",
+      "required": [
+        "VersionResources"
+      ]
+    },
    "PhpComposerAuthors": {
      "properties": {
        "name": {
@@ -10,6 +10,7 @@ import (
 	"strconv"
 	"strings"

+	"github.com/scylladb/go-set/strset"
 	"github.com/spdx/tools-golang/spdx"
 	"github.com/spdx/tools-golang/spdx/v2/common"

@@ -45,7 +46,7 @@ func ToSyftModel(doc *spdx.Document) (*sbom.SBOM, error) {
 		},
 	}

-	collectSyftPackages(s, spdxIDMap, doc.Packages)
+	collectSyftPackages(s, spdxIDMap, doc)

 	collectSyftFiles(s, spdxIDMap, doc)

@@ -279,8 +280,12 @@ func findLinuxReleaseByPURL(doc *spdx.Document) *linux.Release {
 	return nil
 }

-func collectSyftPackages(s *sbom.SBOM, spdxIDMap map[string]any, packages []*spdx.Package) {
-	for _, p := range packages {
+func collectSyftPackages(s *sbom.SBOM, spdxIDMap map[string]any, doc *spdx.Document) {
+	skipIDs := packageIDsToSkip(doc)
+	for _, p := range doc.Packages {
+		if p == nil || skipIDs.Has(string(p.PackageSPDXIdentifier)) {
+			continue
+		}
 		syftPkg := toSyftPackage(p)
 		spdxIDMap[string(p.PackageSPDXIdentifier)] = syftPkg
 		s.Artifacts.Packages.Add(syftPkg)
@@ -657,3 +662,15 @@ func extractCPEs(p *spdx.Package) (cpes []cpe.CPE) {
 	}
 	return cpes
 }
+
+// packageIDsToSkip returns a set of packageIDs that should not be imported
+func packageIDsToSkip(doc *spdx.Document) *strset.Set {
+	skipIDs := strset.New()
+	for i := 0; i < len(doc.Relationships); i++ {
+		r := doc.Relationships[i]
+		if r != nil && r.Relationship == spdx.RelationshipGeneratedFrom {
+			skipIDs.Add(string(r.RefB.ElementRefID))
+		}
+	}
+	return skipIDs
+}
@@ -759,3 +759,37 @@ func Test_useSPDXIdentifierOverDerivedSyftArtifactID(t *testing.T) {
 	assert.Nil(t, err)
 	assert.NotNil(t, s.Artifacts.Packages.Package("1"))
 }
+
+func Test_skipsPackagesWithGeneratedFromRelationship(t *testing.T) {
+	doc := &spdx.Document{
+		SPDXVersion: "SPDX-2.3",
+		Packages: []*spdx.Package{
+			{
+				PackageName:           "package-1",
+				PackageSPDXIdentifier: "1",
+				PackageVersion:        "1.0.5",
+			},
+			{
+				PackageName:           "package-1-src",
+				PackageSPDXIdentifier: "1-src",
+				PackageVersion:        "1.0.5-src",
+			},
+		},
+		Relationships: []*spdx.Relationship{
+			{
+				Relationship: spdx.RelationshipGeneratedFrom,
+				RefA: common.DocElementID{ // package 1
+					ElementRefID: spdx.ElementID("1"),
+				},
+				RefB: common.DocElementID{ // generated from package 1-src
+					ElementRefID: spdx.ElementID("1-src"),
+				},
+			},
+		},
+	}
+	s, err := ToSyftModel(doc)
+
+	assert.Nil(t, err)
+	assert.NotNil(t, s.Artifacts.Packages.Package("1"))
+	assert.Nil(t, s.Artifacts.Packages.Package("1-src"))
+}
@@ -71,31 +71,14 @@ func Backfill(p *pkg.Package) {
 	}
 }

-func setJavaMetadataFromPurl(p *pkg.Package, purl packageurl.PackageURL) {
+func setJavaMetadataFromPurl(p *pkg.Package, _ packageurl.PackageURL) {
 	if p.Type != pkg.JavaPkg {
 		return
 	}
-	if purl.Namespace != "" {
-		if p.Metadata == nil {
-			p.Metadata = pkg.JavaArchive{}
-		}
-		meta, got := p.Metadata.(pkg.JavaArchive)
-		if got && meta.PomProperties == nil {
-			meta.PomProperties = &pkg.JavaPomProperties{}
-			p.Metadata = meta
-		}
-		if meta.PomProperties != nil {
-			// capture the group id from the purl if it is not already set
-			if meta.PomProperties.ArtifactID == "" {
-				meta.PomProperties.ArtifactID = purl.Name
-			}
-			if meta.PomProperties.GroupID == "" {
-				meta.PomProperties.GroupID = purl.Namespace
-			}
-			if meta.PomProperties.Version == "" {
-				meta.PomProperties.Version = purl.Version
-			}
-		}
+	if p.Metadata == nil {
+		// since we don't know if the purl elements directly came from pom properties or the manifest,
+		// we can only go as far as to set the type to JavaArchive, but not fill in the group id and artifact id
+		p.Metadata = pkg.JavaArchive{}
 	}
 }

@@ -101,13 +101,9 @@ func Test_Backfill(t *testing.T) {
 				Language: pkg.Java,
 				Name:     "some-thing",
 				Version:  "1.2.3",
-				Metadata: pkg.JavaArchive{
-					PomProperties: &pkg.JavaPomProperties{
-						GroupID:    "org.apache",
-						ArtifactID: "some-thing",
-						Version:    "1.2.3",
-					},
-				},
+				// we intentionally don't claim we found a pom properties file with a groupID from the purl.
+				// but we do claim that we found java data with an empty type.
+				Metadata: pkg.JavaArchive{},
 			},
 		},
 	}
@@ -3,6 +3,7 @@ package helpers
 import (
 	"fmt"
 	"reflect"
+	"strings"

 	"github.com/CycloneDX/cyclonedx-go"

@@ -90,15 +91,19 @@ func decodeComponent(c *cyclonedx.Component) *pkg.Package {
 		Locations: decodeLocations(values),
 		Licenses:  pkg.NewLicenseSet(decodeLicenses(c)...),
 		CPEs:      decodeCPEs(c),
-		PURL:      c.PackageURL,
 	}

+	// note: this may write in syft package type information
 	DecodeInto(p, values, "syft:package", CycloneDXFields)

 	metadataType := values["syft:package:metadataType"]

 	p.Metadata = decodePackageMetadata(values, c, metadataType)

+	// this will either use the purl from the component or generate a new one based off of any type information
+	// that was decoded above.
+	p.PURL = getPURL(c, p.Type)
+
 	if p.Type == "" {
 		p.Type = pkg.TypeFromPURL(p.PURL)
 	}
@@ -111,6 +116,41 @@ func decodeComponent(c *cyclonedx.Component) *pkg.Package {
 	return p
 }

+func getPURL(c *cyclonedx.Component, ty pkg.Type) string {
+	if c.PackageURL != "" {
+		// if there is a purl that where the namespace does not match the group information, we may
+		// accidentally drop group. We should consider adding group as a top-level syft package field.
+		return c.PackageURL
+	}
+
+	if strings.HasPrefix(c.BOMRef, "pkg:") {
+		// the bomref is a purl, so try to use that as the purl
+		_, err := packageurl.FromString(c.BOMRef)
+		if err == nil {
+			return c.BOMRef
+		}
+	}
+
+	if ty == "" {
+		return ""
+	}
+
+	tyStr := ty.PackageURLType()
+	switch tyStr {
+	case "", packageurl.TypeGeneric:
+		return ""
+	}
+
+	purl := packageurl.PackageURL{
+		Type:      tyStr,
+		Namespace: c.Group,
+		Name:      c.Name,
+		Version:   c.Version,
+	}
+
+	return purl.ToString()
+}
+
 func setPackageName(p *pkg.Package, c *cyclonedx.Component) {
 	name := c.Name
 	if c.Group != "" {
@@ -275,6 +275,7 @@ func Test_decodeComponent(t *testing.T) {
 		component    cyclonedx.Component
 		wantLanguage pkg.Language
 		wantMetadata any
+		wantPURL     string
 	}{
 		{
 			name: "derive language from pURL if missing",
@@ -286,6 +287,18 @@ func Test_decodeComponent(t *testing.T) {
 				BOMRef:     "pkg:maven/ch.qos.logback/logback-classic@1.2.3",
 			},
 			wantLanguage: pkg.Java,
+			wantPURL:     "pkg:maven/ch.qos.logback/logback-classic@1.2.3",
+		},
+		{
+			name: "derive language from bomref if missing",
+			component: cyclonedx.Component{
+				Name:    "ch.qos.logback/logback-classic",
+				Version: "1.2.3",
+				Type:    "library",
+				BOMRef:  "pkg:maven/ch.qos.logback/logback-classic@1.2.3",
+			},
+			wantLanguage: pkg.Java,
+			wantPURL:     "pkg:maven/ch.qos.logback/logback-classic@1.2.3",
 		},
 		{
 			name: "handle RpmdbMetadata type without properties",
@@ -303,6 +316,7 @@ func Test_decodeComponent(t *testing.T) {
 				},
 			},
 			wantMetadata: pkg.RpmDBEntry{},
+			wantPURL:     "pkg:rpm/centos/acl@2.2.53-1.el8?arch=x86_64&upstream=acl-2.2.53-1.el8.src.rpm&distro=centos-8",
 		},
 		{
 			name: "handle RpmdbMetadata type with properties",
@@ -326,6 +340,24 @@ func Test_decodeComponent(t *testing.T) {
 			wantMetadata: pkg.RpmDBEntry{
 				Release: "some-release",
 			},
+			wantPURL: "pkg:rpm/centos/acl@2.2.53-1.el8?arch=x86_64&upstream=acl-2.2.53-1.el8.src.rpm&distro=centos-8",
+		},
+		{
+			name: "generate a purl from package type",
+			component: cyclonedx.Component{
+				Name:    "log4j",
+				Group:   "org.apache.logging.log4j",
+				Version: "2.0.4",
+				Type:    "library",
+				BOMRef:  "log4j",
+				Properties: &[]cyclonedx.Property{
+					{
+						Name:  "syft:package:type",
+						Value: "java-archive",
+					},
+				},
+			},
+			wantPURL: "pkg:maven/org.apache.logging.log4j/log4j@2.0.4",
 		},
 	}

@@ -338,9 +370,122 @@ func Test_decodeComponent(t *testing.T) {
 			if tt.wantMetadata != nil {
 				assert.Truef(t, reflect.DeepEqual(tt.wantMetadata, p.Metadata), "metadata should match: %+v != %+v", tt.wantMetadata, p.Metadata)
 			}
-			if tt.wantMetadata == nil && tt.wantLanguage == "" {
+
+			if tt.wantPURL != "" {
+				assert.Equal(t, tt.wantPURL, p.PURL, "purl should match")
+			}
+
+			if tt.wantMetadata == nil && tt.wantLanguage == "" && tt.wantPURL == "" {
 				t.Fatal("this is a useless test, please remove it")
 			}
 		})
 	}
 }
+
+func TestGetPURL(t *testing.T) {
+	tests := []struct {
+		name      string
+		component *cyclonedx.Component
+		pkgType   pkg.Type
+		expected  string
+	}{
+		{
+			name: "component with PackageURL",
+			component: &cyclonedx.Component{
+				PackageURL: "pkg:npm/lodash@4.17.21",
+				Name:       "lodash",
+				Version:    "4.17.20", // different version to verify PackageURL is used
+				Group:      "npm",
+			},
+			pkgType:  pkg.NpmPkg,
+			expected: "pkg:npm/lodash@4.17.21",
+		},
+		{
+			name: "component with BOMRef as valid PURL",
+			component: &cyclonedx.Component{
+				BOMRef:  "pkg:maven/org.apache.commons/commons-lang3@3.12.0",
+				Name:    "commons-lang3",
+				Version: "3.11.0", // different version to verify BOMRef is used
+				Group:   "org.apache.commons",
+			},
+			pkgType:  pkg.JavaPkg,
+			expected: "pkg:maven/org.apache.commons/commons-lang3@3.12.0",
+		},
+		{
+			name: "component with BOMRef not a valid PURL",
+			component: &cyclonedx.Component{
+				BOMRef:  "not-a-purl-ref",
+				Name:    "commons-lang3",
+				Version: "3.12.0",
+				Group:   "org.apache.commons",
+			},
+			pkgType:  pkg.JavaPkg,
+			expected: "pkg:maven/org.apache.commons/commons-lang3@3.12.0",
+		},
+		{
+			name: "component with unknown package type",
+			component: &cyclonedx.Component{
+				Name:    "some-component",
+				Version: "1.0.0",
+				Group:   "org.example",
+			},
+			pkgType:  pkg.UnknownPkg,
+			expected: "",
+		},
+		{
+			name: "component with empty package type",
+			component: &cyclonedx.Component{
+				Name:    "some-component",
+				Version: "1.0.0",
+				Group:   "org.example",
+			},
+			pkgType:  "",
+			expected: "",
+		},
+		{
+			name: "component with generic package type",
+			component: &cyclonedx.Component{
+				Name:    "some-component",
+				Version: "1.0.0",
+				Group:   "org.example",
+			},
+			pkgType:  pkg.LinuxKernelModulePkg,
+			expected: "",
+		},
+		{
+			name: "component with valid package type",
+			component: &cyclonedx.Component{
+				Name:    "react",
+				Version: "18.2.0",
+				Group:   "facebook",
+			},
+			pkgType:  pkg.NpmPkg,
+			expected: "pkg:npm/facebook/react@18.2.0",
+		},
+		{
+			name: "component with no group",
+			component: &cyclonedx.Component{
+				Name:    "express",
+				Version: "4.18.2",
+			},
+			pkgType:  pkg.NpmPkg,
+			expected: "pkg:npm/express@4.18.2",
+		},
+		{
+			name: "component with no version",
+			component: &cyclonedx.Component{
+				Name:  "express",
+				Group: "npm",
+			},
+			pkgType:  pkg.NpmPkg,
+			expected: "pkg:npm/npm/express",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			result := getPURL(tt.component, tt.pkgType)
+			assert.Equal(t, tt.expected, result)
+		})
+	}
+}
@@ -50,6 +50,14 @@ func Originator(p pkg.Package) (typ string, author string) { //nolint: gocyclo,f
 	case pkg.DotnetPortableExecutableEntry:
 		typ = orgType
 		author = metadata.CompanyName
+	case pkg.PEBinary:
+		// this is a known common keyword used in version resources
+		// for more info see: https://learn.microsoft.com/en-us/windows/win32/menurc/versioninfo-resource
+		val, ok := metadata.VersionResources.Get("CompanyName")
+		if ok {
+			typ = orgType
+			author = val
+		}

 	case pkg.DpkgDBEntry:
 		author = metadata.Maintainer
@@ -112,6 +112,21 @@ func Test_OriginatorSupplier(t *testing.T) {
 			originator: "Organization: Microsoft Corporation",
 			supplier:   "Organization: Microsoft Corporation",
 		},
+		{
+			name: "from PE binary",
+			input: pkg.Package{
+				Metadata: pkg.PEBinary{
+					VersionResources: pkg.KeyValues{
+						{
+							Key:   "CompanyName",
+							Value: "Microsoft Corporation",
+						},
+					},
+				},
+			},
+			originator: "Organization: Microsoft Corporation",
+			supplier:   "Organization: Microsoft Corporation",
+		},
 		{
 			name: "from dpkg DB",
 			input: pkg.Package{
@@ -165,13 +165,9 @@ func TestDecoder_Decode(t *testing.T) {
 					Type:     pkg.JavaPkg,
 					PURL:     "pkg:maven/org.apache/some-pkg@4.11.3",
 					Language: pkg.Java,
-					Metadata: pkg.JavaArchive{
-						PomProperties: &pkg.JavaPomProperties{
-							GroupID:    "org.apache",
-							ArtifactID: "some-pkg",
-							Version:    "4.11.3",
-						},
-					},
+					// we intentionally do not claim we found a pom properties file (don't derive this from the purl).
+					// but we need a metadata allocated since all Java packages have a this metadata type (a consistency point)
+					Metadata: pkg.JavaArchive{},
 				},
 			},
 		},
@@ -1451,7 +1451,7 @@ func TestFileResolver_FilesByGlob(t *testing.T) {

 	resolver, err := NewFromFile(parentPath, filePath)
 	assert.NoError(t, err)
-	refs, err := resolver.FilesByGlob("*.txt")
+	refs, err := resolver.FilesByGlob("**/*.txt")
 	assert.NoError(t, err)

 	assert.Len(t, refs, 1)
@@ -42,6 +42,7 @@ func AllTypes() []any {
 		pkg.NpmPackage{},
 		pkg.NpmPackageLockEntry{},
 		pkg.OpamPackage{},
+		pkg.PEBinary{},
 		pkg.PhpComposerInstalledEntry{},
 		pkg.PhpComposerLockEntry{},
 		pkg.PhpPearEntry{},
@@ -94,6 +94,7 @@ var jsonTypes = makeJSONTypes(
 	jsonNames(pkg.NpmPackage{}, "javascript-npm-package", "NpmPackageJsonMetadata"),
 	jsonNames(pkg.NpmPackageLockEntry{}, "javascript-npm-package-lock-entry", "NpmPackageLockJsonMetadata"),
 	jsonNames(pkg.YarnLockEntry{}, "javascript-yarn-lock-entry", "YarnLockJsonMetadata"),
+	jsonNames(pkg.PEBinary{}, "pe-binary"),
 	jsonNames(pkg.PhpComposerLockEntry{}, "php-composer-lock-entry", "PhpComposerJsonMetadata"),
 	jsonNamesWithoutLookup(pkg.PhpComposerInstalledEntry{}, "php-composer-installed-entry", "PhpComposerJsonMetadata"), // the legacy value is split into two types, where the other is preferred
 	jsonNames(pkg.PhpPeclEntry{}, "php-pecl-entry", "PhpPeclMetadata"),
@@ -46,3 +46,8 @@ type ELFBinaryPackageNoteJSONPayload struct {
 	// Commit is the commit hash of the source repository for which the binary was built from
 	Commit string `json:"commit,omitempty"`
 }
+
+// PEBinary represents metadata captured from a Portable Executable formatted binary (dll, exe, etc.)
+type PEBinary struct {
+	VersionResources KeyValues
+}
@@ -15,7 +15,7 @@ func newELFPackage(ctx context.Context, metadata elfBinaryPackageNotes, location
 		Name:      metadata.Name,
 		Version:   metadata.Version,
 		Licenses:  pkg.NewLicenseSet(pkg.NewLicenseWithContext(ctx, metadata.License)),
-		PURL:      packageURL(metadata),
+		PURL:      elfPackageURL(metadata),
 		Type:      pkgType(metadata.Type),
 		Locations: locations,
 		Metadata:  metadata.ELFBinaryPackageNoteJSONPayload,
@@ -26,7 +26,7 @@ func newELFPackage(ctx context.Context, metadata elfBinaryPackageNotes, location
 	return p
 }

-func packageURL(metadata elfBinaryPackageNotes) string {
+func elfPackageURL(metadata elfBinaryPackageNotes) string {
 	var qualifiers []packageurl.Qualifier

 	os, osVersion := osNameAndVersionFromMetadata(metadata)
@@ -10,7 +10,7 @@ import (
 	"github.com/anchore/syft/syft/pkg/cataloger/internal/pkgtest"
 )

-func Test_ELF_Package_Cataloger(t *testing.T) {
+func Test_ELFPackageCataloger(t *testing.T) {

 	cases := []struct {
 		name     string
@@ -130,7 +130,7 @@ func Test_packageURL(t *testing.T) {

 	for _, test := range tests {
 		t.Run(test.name, func(t *testing.T) {
-			assert.Equal(t, test.want, packageURL(test.metadata))
+			assert.Equal(t, test.want, elfPackageURL(test.metadata))
 		})
 	}
 }
@@ -0,0 +1,134 @@
+package binary
+
+import (
+	"path"
+	"regexp"
+	"sort"
+	"strings"
+
+	"github.com/anchore/syft/syft/file"
+	"github.com/anchore/syft/syft/pkg"
+)
+
+var (
+	// spaceRegex includes nbsp (#160) considered to be a space character
+	spaceRegex  = regexp.MustCompile(`[\s\xa0]+`)
+	numberRegex = regexp.MustCompile(`\d`)
+)
+
+func newPEPackage(versionResources map[string]string, f file.Location) pkg.Package {
+	name := findNameFromVR(versionResources)
+
+	if name == "" {
+		// it's possible that the version resources are empty, so we fall back to the file name
+		name = strings.TrimSuffix(strings.TrimSuffix(path.Base(f.RealPath), ".exe"), ".dll")
+	}
+
+	p := pkg.Package{
+		Name:      name,
+		Version:   findVersionFromVR(versionResources),
+		Locations: file.NewLocationSet(f.WithAnnotation(pkg.EvidenceAnnotationKey, pkg.PrimaryEvidenceAnnotation)),
+		Type:      pkg.BinaryPkg,
+		Metadata:  newPEBinaryVersionResourcesFromMap(versionResources),
+	}
+
+	p.SetID()
+
+	return p
+}
+
+func newPEBinaryVersionResourcesFromMap(vr map[string]string) pkg.PEBinary {
+	var kvs pkg.KeyValues
+	for k, v := range vr {
+		if v == "" {
+			continue
+		}
+		kvs = append(kvs, pkg.KeyValue{
+			Key:   k,
+			Value: spaceNormalize(v),
+		})
+	}
+
+	sort.Slice(kvs, func(i, j int) bool {
+		return kvs[i].Key < kvs[j].Key
+	})
+
+	return pkg.PEBinary{
+		VersionResources: kvs,
+	}
+}
+
+func findNameFromVR(versionResources map[string]string) string {
+	// PE files not authored by Microsoft tend to use ProductName as an identifier.
+	nameFields := []string{"ProductName", "FileDescription", "InternalName", "OriginalFilename"}
+
+	if isMicrosoftVR(versionResources) {
+		// for Microsoft files, prioritize FileDescription.
+		nameFields = []string{"FileDescription", "InternalName", "OriginalFilename", "ProductName"}
+	}
+
+	var name string
+	for _, field := range nameFields {
+		value := spaceNormalize(versionResources[field])
+		if value == "" {
+			continue
+		}
+		name = value
+		break
+	}
+
+	return name
+}
+func isMicrosoftVR(versionResources map[string]string) bool {
+	return strings.Contains(strings.ToLower(versionResources["CompanyName"]), "microsoft") ||
+		strings.Contains(strings.ToLower(versionResources["ProductName"]), "microsoft")
+}
+
+// spaceNormalize trims and normalizes whitespace in a string.
+func spaceNormalize(value string) string {
+	value = strings.TrimSpace(value)
+	if value == "" {
+		return ""
+	}
+	// ensure valid UTF-8.
+	value = strings.ToValidUTF8(value, "")
+	// consolidate all whitespace.
+	value = spaceRegex.ReplaceAllString(value, " ")
+	// remove non-printable characters.
+	value = regexp.MustCompile(`[\x00-\x1f]`).ReplaceAllString(value, "")
+	// consolidate again and trim.
+	value = spaceRegex.ReplaceAllString(value, " ")
+	value = strings.TrimSpace(value)
+	return value
+}
+
+func findVersionFromVR(versionResources map[string]string) string {
+	productVersion := extractVersionFromResourcesValue(versionResources["ProductVersion"])
+	fileVersion := extractVersionFromResourcesValue(versionResources["FileVersion"])
+
+	if productVersion != "" {
+		return productVersion
+	}
+
+	return fileVersion
+}
+
+func extractVersionFromResourcesValue(version string) string {
+	version = strings.TrimSpace(version)
+	out := ""
+	for i, f := range strings.Fields(version) {
+		if containsNumber(out) && !containsNumber(f) {
+			return out
+		}
+		if i == 0 {
+			out = f
+		} else {
+			out += " " + f
+		}
+	}
+	return out
+}
+
+func containsNumber(s string) bool {
+	return numberRegex.MatchString(s)
+}
@@ -0,0 +1,39 @@
+package binary
+
+import (
+	"context"
+	"fmt"
+
+	"github.com/anchore/syft/internal/unknown"
+	"github.com/anchore/syft/syft/artifact"
+	"github.com/anchore/syft/syft/file"
+	"github.com/anchore/syft/syft/pkg"
+	"github.com/anchore/syft/syft/pkg/cataloger/generic"
+	"github.com/anchore/syft/syft/pkg/cataloger/internal/pe"
+)
+
+// NewPEPackageCataloger returns a cataloger that interprets packages from DLL and EXE files.
+func NewPEPackageCataloger() pkg.Cataloger {
+	return generic.NewCataloger("pe-binary-package-cataloger").
+		WithParserByGlobs(parsePE, "**/*.dll", "**/*.exe")
+}
+
+func parsePE(_ context.Context, _ file.Resolver, _ *generic.Environment, reader file.LocationReadCloser) ([]pkg.Package, []artifact.Relationship, error) {
+	f, err := pe.Read(reader)
+	if err != nil {
+		return nil, nil, fmt.Errorf("failed to parse PE file %q: %w", reader.RealPath, err)
+	}
+
+	if f == nil {
+		return nil, nil, unknown.Newf(reader, "unable to determine packages")
+	}
+
+	if f.CLR.HasEvidenceOfCLR() {
+		// this is for a .NET application, which is covered by other catalogers already
+		return nil, nil, nil
+	}
+
+	p := newPEPackage(f.VersionResources, f.Location)
+
+	return []pkg.Package{p}, nil, nil
+}
@@ -0,0 +1,64 @@
+package binary
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/require"
+
+	"github.com/anchore/syft/syft/file"
+	"github.com/anchore/syft/syft/pkg"
+	"github.com/anchore/syft/syft/pkg/cataloger/internal/pkgtest"
+)
+
+func Test_PEPackageCataloger(t *testing.T) {
+	cases := []struct {
+		name     string
+		fixture  string
+		expected []pkg.Package
+		wantErr  require.ErrorAssertionFunc
+	}{
+		{
+			name:    "non-.NET package",
+			fixture: "image-jruby",
+			expected: []pkg.Package{
+				{
+					Name:    "JRuby",
+					Version: "9.3.15.0",
+					Type:    pkg.BinaryPkg,
+					Locations: file.NewLocationSet(
+						file.NewLocation("/jruby_windows_9_3_15_0.exe"),
+					),
+					FoundBy: "pe-binary-package-cataloger",
+					Metadata: pkg.PEBinary{
+						VersionResources: pkg.KeyValues{
+							{Key: "CompanyName", Value: "JRuby Dev Team"},
+							{Key: "FileDescription", Value: "JRuby"},
+							{Key: "FileVersion", Value: "9.3.15.0"},
+							{Key: "InternalName", Value: "jruby"},
+							{Key: "LegalCopyright", Value: "JRuby Dev Team"},
+							{Key: "OriginalFilename", Value: "jruby_windows-x32_9_3_15_0.exe"},
+							{Key: "ProductName", Value: "JRuby"},
+							{Key: "ProductVersion", Value: "9.3.15.0"},
+						},
+					},
+				},
+			},
+		},
+		{
+			name:     "ignore .NET packages",
+			fixture:  "image-dotnet-app",
+			expected: nil, // expect nothing!
+		},
+	}
+
+	for _, v := range cases {
+		t.Run(v.name, func(t *testing.T) {
+			pkgtest.NewCatalogTester().
+				WithImageResolver(t, v.fixture).
+				IgnoreLocationLayer(). // this fixture can be rebuilt, thus the layer ID will change
+				Expects(v.expected, nil).
+				TestCataloger(t, NewPEPackageCataloger())
+		})
+	}
+
+}
@@ -0,0 +1,10 @@
+FROM alpine:latest AS builder
+
+RUN apk add --no-cache wget unzip
+RUN mkdir -p /app
+RUN wget -O /app/minver.nupkg https://www.nuget.org/api/v2/package/minver-cli/4.3.0
+RUN unzip /app/minver.nupkg -d /app/minver
+
+from busybox:latest
+
+COPY --from=builder /app/minver /minver
@@ -0,0 +1,7 @@
+FROM --platform=linux/amd64 alpine:latest AS builder
+
+RUN wget -O jruby_windows_9_3_15_0.exe https://s3.amazonaws.com/jruby.org/downloads/9.3.15.0/jruby_windows_9_3_15_0.exe
+
+FROM scratch
+
+COPY --from=builder /jruby_windows_9_3_15_0.exe /jruby_windows_9_3_15_0.exe
@@ -473,7 +473,7 @@ func readPEFile(resolver file.Resolver, loc file.Location) (*logicalPE, error) {
 	}
 	defer internal.CloseAndLogError(reader, loc.RealPath)

-	ldpe, err := getLogicalDotnetPE(file.NewLocationReadCloser(loc, reader))
+	ldpe, err := readLogicalPE(file.NewLocationReadCloser(loc, reader))
 	if err != nil {
 		return nil, unknown.New(loc, fmt.Errorf("unable to parse PE file: %w", err))
 	}
@@ -482,7 +482,7 @@ func readPEFile(resolver file.Resolver, loc file.Location) (*logicalPE, error) {
 		return nil, nil
 	}

-	if !ldpe.CLR.hasEvidenceOfCLR() {
+	if !ldpe.CLR.HasEvidenceOfCLR() {
 		// this is not a .NET binary
 		return nil, nil
 	}
@@ -252,8 +252,8 @@ func getLogicalDepsJSON(deps depsJSON, lm *libmanJSON) logicalDepsJSON {
 		if !bundlingDetected && knownBundlers.Has(name) {
 			bundlingDetected = true
 		}
-		p.AnyChildClaimsDLLs = searchForDLLClaims(packageMap, p.dependencyNameVersions()...)
-		p.AnyChildHasDLLs = searchForDLLEvidence(packageMap, p.dependencyNameVersions()...)
+		p.AnyChildClaimsDLLs = searchForDLLClaims(packageMap, strset.New(), p.dependencyNameVersions()...)
+		p.AnyChildHasDLLs = searchForDLLEvidence(packageMap, strset.New(), p.dependencyNameVersions()...)
 		packages[p.NameVersion] = *p
 	}

@@ -286,31 +286,35 @@ func mergeSets(s1, s2 *strset.Set) *strset.Set {
 type visitorFunc func(p *logicalDepsJSONPackage) bool

 // searchForDLLEvidence recursively searches for executables found for any of the given nameVersions and children recursively.
-func searchForDLLEvidence(packageMap map[string]*logicalDepsJSONPackage, nameVersions ...string) bool {
+func searchForDLLEvidence(packageMap map[string]*logicalDepsJSONPackage, visited *strset.Set, nameVersions ...string) bool {
 	return traverseDependencies(packageMap, func(p *logicalDepsJSONPackage) bool {
 		return p.FoundDLLs(true)
-	}, nameVersions...)
+	}, visited, nameVersions...)
 }

 // searchForDLLClaims recursively searches for DLL claims in the deps.json for any of the given nameVersions and children recursively.
-func searchForDLLClaims(packageMap map[string]*logicalDepsJSONPackage, nameVersions ...string) bool {
+func searchForDLLClaims(packageMap map[string]*logicalDepsJSONPackage, visited *strset.Set, nameVersions ...string) bool {
 	return traverseDependencies(packageMap, func(p *logicalDepsJSONPackage) bool {
 		return p.ClaimsDLLs(true)
-	}, nameVersions...)
+	}, visited, nameVersions...)
 }

-func traverseDependencies(packageMap map[string]*logicalDepsJSONPackage, visitor visitorFunc, nameVersions ...string) bool {
+func traverseDependencies(packageMap map[string]*logicalDepsJSONPackage, visitor visitorFunc, visited *strset.Set, nameVersions ...string) bool {
 	if len(nameVersions) == 0 {
 		return false
 	}

 	for _, nameVersion := range nameVersions {
+		if visited.Has(nameVersion) {
+			continue
+		}
+		visited.Add(nameVersion)
 		if p, ok := packageMap[nameVersion]; ok {
 			if visitor(p) {
 				return true
 			}

-			if traverseDependencies(packageMap, visitor, p.dependencyNameVersions()...) {
+			if traverseDependencies(packageMap, visitor, visited, p.dependencyNameVersions()...) {
 				return true
 			}
 		}
@@ -149,6 +149,11 @@ func TestGetLogicalDepsJSON_MergeTargets(t *testing.T) {
 						"lib/netcoreapp3.1/Microsoft.CodeAnalysis.CSharp.dll": {},
 					},
 				},
+				"Microsoft.CodeAnalysis.Common/4.0.0": {
+					Dependencies: map[string]string{
+						"Microsoft.CodeAnalysis.CSharp": "4.0.0",
+					},
+				},
 			},
 		},
 		Libraries: map[string]depsLibrary{
@@ -150,7 +150,7 @@ func newDotnetDepsEntry(lp logicalDepsJSONPackage) pkg.DotnetDepsEntry {
 	}
 }

-// newDotnetPortableExecutableEntry creates a portable executable entry from a logicalPE.
+// newDotnetPortableExecutableEntry creates a portable executable entry from a File.
 func newDotnetPortableExecutableEntry(pe logicalPE) pkg.DotnetPortableExecutableEntry {
 	return newDotnetPortableExecutableEntryFromMap(pe.VersionResources)
 }
@@ -1,740 +1,30 @@
 package dotnet

 import (
-	"bytes"
-	"debug/pe"
-	"encoding/binary"
-	"errors"
-	"fmt"
-	"io"
-	"unicode/utf16"
-
-	"github.com/scylladb/go-set/strset"
-	"github.com/scylladb/go-set/u32set"
-
-	"github.com/anchore/syft/internal/log"
 	"github.com/anchore/syft/syft/file"
-	"github.com/anchore/syft/syft/internal/unionreader"
+	"github.com/anchore/syft/syft/pkg/cataloger/internal/pe"
 )

-const peMaxAllowedDirectoryEntries = 0x1000
-
-var imageDirectoryEntryIndexes = []int{
-	pe.IMAGE_DIRECTORY_ENTRY_RESOURCE,       // where version resources are stored
-	pe.IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR, // where info about the CLR is stored
-}
-
-// logicalPE does not directly represent a binary shape to be parsed, instead it represents the
-// information of interest extracted from a PE file.
+// logicalPE represents a PE file within the context of a .NET project (considering the deps.json file).
 type logicalPE struct {
-	// Location is where the PE file was found
-	Location file.Location
+	pe.File

 	// TargetPath is the path is the deps.json target entry. This is not present in the PE file
 	// but instead is used in downstream processing to track associations between the PE file and the deps.json file.
 	TargetPath string
-
-	// CLR is the information about the CLR (common language runtime) version found in the PE file which helps
-	// understand if this executable is even a .NET application.
-	CLR *clrEvidence
-
-	// VersionResources is a map of version resource keys to their values found in the VERSIONINFO resource directory.
-	VersionResources map[string]string
 }

-// clrEvidence is basic info about the CLR (common language runtime) version from the COM descriptor.
-// This is not a complete representation of the CLR version, but rather a subset of the information that is
-// useful to us.
-type clrEvidence struct {
-	// HasClrResourceNames is true if there are CLR resource names found in the PE file (e.g. "CLRDEBUGINFO").
-	HasClrResourceNames bool
-
-	// MajorVersion is the minimum supported major version of the CLR.
-	MajorVersion uint16
-
-	// MinorVersion is the minimum supported minor version of the CLR.
-	MinorVersion uint16
-}
-
-// hasEvidenceOfCLR returns true if the PE file has evidence of a CLR (common language runtime) version.
-func (c *clrEvidence) hasEvidenceOfCLR() bool {
-	return c != nil && (c.MajorVersion != 0 && c.MinorVersion != 0 || c.HasClrResourceNames)
-}
-
-type peDosHeader struct {
-	Magic                 [2]byte // "MZ"
-	Unused                [58]byte
-	AddressOfNewEXEHeader uint32 // offset to PE header
-}
-
-// peImageCore20 represents the .NET Core 2.0 header structure.
-// Source: https://github.com/dotnet/msbuild/blob/9fa9d800dabce3bfcf8365f651f3a713e01f8a85/src/Tasks/NativeMethods.cs#L761-L775
-type peImageCore20 struct {
-	Cb                  uint32
-	MajorRuntimeVersion uint16
-	MinorRuntimeVersion uint16
-}
-
-// peImageResourceDirectory represents the resource directory structure.
-type peImageResourceDirectory struct {
-	Characteristics      uint32
-	TimeDateStamp        uint32
-	MajorVersion         uint16
-	MinorVersion         uint16
-	NumberOfNamedEntries uint16
-	NumberOfIDEntries    uint16
-}
-
-// peImageResourceDirectoryEntry represents an entry in the resource directory entries.
-type peImageResourceDirectoryEntry struct {
-	Name         uint32
-	OffsetToData uint32
-}
-
-// peImageResourceDataEntry is the unit of raw data in the Resource Data area.
-type peImageResourceDataEntry struct {
-	OffsetToData uint32
-	Size         uint32
-	CodePage     uint32
-	Reserved     uint32
-}
-
-// peVsFixedFileInfo represents the fixed file information structure.
-type peVsFixedFileInfo struct {
-	Signature        uint32
-	StructVersion    uint32
-	FileVersionMS    uint32
-	FileVersionLS    uint32
-	ProductVersionMS uint32
-	ProductVersionLS uint32
-	FileFlagsMask    uint32
-	FileFlags        uint32
-	FileOS           uint32
-	FileType         uint32
-	FileSubtype      uint32
-	FileDateMS       uint32
-	FileDateLS       uint32
-}
-
-type peVsVersionInfo peLenValLenType
-
-type peStringFileInfo peLenValLenType
-
-type peStringTable peLenValLenType
-
-type peString peLenValLenType
-
-type peLenValLenType struct {
-	Length      uint16
-	ValueLength uint16
-	Type        uint16
-}
-
-type extractedSection struct {
-	RVA     uint32
-	BaseRVA uint32
-	Size    uint32
-	Reader  *bytes.Reader
-}
-
-func (s extractedSection) exists() bool {
-	return s.RVA != 0 && s.Size != 0
-}
-
-func directoryName(i int) string {
-	switch i {
-	case pe.IMAGE_DIRECTORY_ENTRY_RESOURCE:
-		return "Resource"
-	case pe.IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR:
-		return "COM Descriptor"
-	}
-	return fmt.Sprintf("Unknown (%d)", i)
-}
-
-func getLogicalDotnetPE(f file.LocationReadCloser) (*logicalPE, error) {
-	r, err := unionreader.GetUnionReader(f)
+func readLogicalPE(reader file.LocationReadCloser) (*logicalPE, error) {
+	peFile, err := pe.Read(reader)
 	if err != nil {
 		return nil, err
 	}

-	sections, _, err := parsePEFile(r)
-	if err != nil {
-		return nil, fmt.Errorf("unable to parse PE sections: %w", err)
-	}
-
-	dirs := u32set.New()                        // keep track of the RVAs we have already parsed (prevent infinite recursion edge cases)
-	versionResources := make(map[string]string) // map of version resource keys to their values
-	resourceNames := strset.New()               // set of resource names found in the PE file
-	err = parseResourceDirectory(sections[pe.IMAGE_DIRECTORY_ENTRY_RESOURCE], dirs, versionResources, resourceNames)
-	if err != nil {
-		return nil, err
-	}
-
-	c, err := parseCLR(sections[pe.IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR], resourceNames)
-	if err != nil {
-		return nil, fmt.Errorf("unable to parse PE CLR directory: %w", err)
+	if peFile == nil {
+		return nil, nil
 	}

 	return &logicalPE{
-		Location:         f.Location,
-		CLR:              c,
-		VersionResources: versionResources,
+		File: *peFile,
 	}, nil
 }
-
-// parsePEFile creates readers for targeted sections of the binary used by downstream processing.
-func parsePEFile(file unionreader.UnionReader) (map[int]*extractedSection, []pe.SectionHeader32, error) {
-	fileHeader, magic, err := parsePEHeader(file)
-	if err != nil {
-		return nil, nil, fmt.Errorf("error parsing PE header: %w", err)
-	}
-
-	soi, headers, err := parseSectionHeaders(file, magic, fileHeader.NumberOfSections)
-	if err != nil {
-		return nil, nil, fmt.Errorf("error parsing section headers: %w", err)
-	}
-
-	for i, sec := range soi {
-		if !sec.exists() {
-			continue
-		}
-		data, err := readDataFromRVA(file, sec.RVA, sec.Size, headers)
-		if err != nil {
-			return nil, nil, fmt.Errorf("error reading %q section data: %w", directoryName(i), err)
-		}
-		sec.Reader = data
-	}
-
-	return soi, headers, nil
-}
-
-// parsePEHeader reads the beginning of a PE formatted file, returning the file header and "magic" indicator
-// for downstream logic to determine 32/64 bit parsing.
-func parsePEHeader(file unionreader.UnionReader) (*pe.FileHeader, uint16, error) {
-	var dosHeader peDosHeader
-	if err := binary.Read(file, binary.LittleEndian, &dosHeader); err != nil {
-		return nil, 0, fmt.Errorf("error reading DOS header: %w", err)
-	}
-	if string(dosHeader.Magic[:]) != "MZ" {
-		return nil, 0, fmt.Errorf("invalid DOS header magic")
-	}
-
-	peOffset := int64(dosHeader.AddressOfNewEXEHeader)
-	if _, err := file.Seek(peOffset, io.SeekStart); err != nil {
-		return nil, 0, fmt.Errorf("error seeking to PE header: %w", err)
-	}
-
-	var signature [4]byte
-	if err := binary.Read(file, binary.LittleEndian, &signature); err != nil {
-		return nil, 0, fmt.Errorf("error reading PE signature: %w", err)
-	}
-	if !bytes.Equal(signature[:], []byte("PE\x00\x00")) {
-		return nil, 0, fmt.Errorf("invalid PE signature")
-	}
-
-	var fileHeader pe.FileHeader
-	if err := binary.Read(file, binary.LittleEndian, &fileHeader); err != nil {
-		return nil, 0, fmt.Errorf("error reading file header: %w", err)
-	}
-
-	var magic uint16
-	if err := binary.Read(file, binary.LittleEndian, &magic); err != nil {
-		return nil, 0, fmt.Errorf("error reading optional header magic: %w", err)
-	}
-
-	// seek back to before reading magic (since that value is in the header)
-	if _, err := file.Seek(-2, io.SeekCurrent); err != nil {
-		return nil, 0, fmt.Errorf("error seeking back to before reading magic: %w", err)
-	}
-
-	return &fileHeader, magic, nil
-}
-
-// parseSectionHeaders reads the section headers from the PE file and extracts the virtual addresses + section size
-// information for the sections of interest. Additionally, all section headers are returned to aid in downstream processing.
-func parseSectionHeaders(file unionreader.UnionReader, magic uint16, numberOfSections uint16) (map[int]*extractedSection, []pe.SectionHeader32, error) {
-	soi := make(map[int]*extractedSection)
-	switch magic {
-	case 0x10B: // PE32
-		var optHeader pe.OptionalHeader32
-		if err := binary.Read(file, binary.LittleEndian, &optHeader); err != nil {
-			return nil, nil, fmt.Errorf("error reading optional header (PE32): %w", err)
-		}
-
-		for _, i := range imageDirectoryEntryIndexes {
-			sectionHeader := optHeader.DataDirectory[i]
-			if sectionHeader.Size == 0 {
-				continue
-			}
-			soi[i] = &extractedSection{
-				RVA:  sectionHeader.VirtualAddress,
-				Size: sectionHeader.Size,
-			}
-		}
-	case 0x20B: // PE32+ (64 bit)
-		var optHeader pe.OptionalHeader64
-		if err := binary.Read(file, binary.LittleEndian, &optHeader); err != nil {
-			return nil, nil, fmt.Errorf("error reading optional header (PE32+): %w", err)
-		}
-
-		for _, i := range imageDirectoryEntryIndexes {
-			sectionHeader := optHeader.DataDirectory[i]
-			if sectionHeader.Size == 0 {
-				continue
-			}
-			soi[i] = &extractedSection{
-				RVA:  sectionHeader.VirtualAddress,
-				Size: sectionHeader.Size,
-			}
-		}
-	default:
-		return nil, nil, fmt.Errorf("unknown optional header magic: 0x%x", magic)
-	}
-
-	// read section headers
-	headers := make([]pe.SectionHeader32, numberOfSections)
-	for i := 0; i < int(numberOfSections); i++ {
-		if err := binary.Read(file, binary.LittleEndian, &headers[i]); err != nil {
-			return nil, nil, fmt.Errorf("error reading section header: %w", err)
-		}
-	}
-
-	return soi, headers, nil
-}
-
-// parseCLR extracts the CLR (common language runtime) version information from the COM descriptor and makes
-// present/not-present determination based on the presence of CLR resource names.
-func parseCLR(sec *extractedSection, resourceNames *strset.Set) (*clrEvidence, error) {
-	hasCLRDebugResourceNames := resourceNames.HasAny("CLRDEBUGINFO")
-	if sec == nil || sec.Reader == nil {
-		return &clrEvidence{
-			HasClrResourceNames: hasCLRDebugResourceNames,
-		}, nil
-	}
-
-	reader := sec.Reader
-	var c peImageCore20
-	if err := binary.Read(reader, binary.LittleEndian, &c); err != nil {
-		return nil, fmt.Errorf("error reading CLR header: %w", err)
-	}
-
-	return &clrEvidence{
-		HasClrResourceNames: hasCLRDebugResourceNames,
-		MajorVersion:        c.MajorRuntimeVersion,
-		MinorVersion:        c.MinorRuntimeVersion,
-	}, nil
-}
-
-// rvaToFileOffset is a helper function to convert RVA to file offset using section headers
-func rvaToFileOffset(rva uint32, sections []pe.SectionHeader32) (uint32, error) {
-	for _, section := range sections {
-		if rva >= section.VirtualAddress && rva < section.VirtualAddress+section.VirtualSize {
-			return section.PointerToRawData + (rva - section.VirtualAddress), nil
-		}
-	}
-	return 0, fmt.Errorf("RVA 0x%x not found in any section", rva)
-}
-
-// readDataFromRVA will read data from a specific RVA in the PE file
-func readDataFromRVA(file io.ReadSeeker, rva, size uint32, sections []pe.SectionHeader32) (*bytes.Reader, error) {
-	if size == 0 {
-		return nil, fmt.Errorf("zero size specified")
-	}
-
-	offset, err := rvaToFileOffset(rva, sections)
-	if err != nil {
-		return nil, err
-	}
-
-	if _, err := file.Seek(int64(offset), io.SeekStart); err != nil {
-		return nil, fmt.Errorf("error seeking to data: %w", err)
-	}
-
-	data := make([]byte, size)
-	if _, err := io.ReadFull(file, data); err != nil {
-		return nil, fmt.Errorf("error reading data: %w", err)
-	}
-
-	return bytes.NewReader(data), nil
-}
-
-// parseResourceDirectory recursively parses a PE resource directory. This takes a relative virtual address (offset of
-// a piece of data or code relative to the base address), the size of the resource directory, the set of RVAs already
-// parsed, and the map to populate discovered version resource values.
-//
-// .rsrc Section
-// +------------------------------+
-// | Resource Directory Table     |
-// +------------------------------+
-// | Resource Directory Entries   |
-// |  +------------------------+  |
-// |  | Subdirectory or Data   |  |
-// |  +------------------------+  |
-// +------------------------------+
-// | Resource Data Entries        |
-// |  +------------------------+  |
-// |  | Resource Data          |  |
-// |  +------------------------+  |
-// +------------------------------+
-// | Actual Resource Data         |
-// +------------------------------+
-//
-// sources:
-// - https://learn.microsoft.com/en-us/windows/win32/debug/pe-format#the-rsrc-section
-// - https://learn.microsoft.com/en-us/previous-versions/ms809762(v=msdn.10)#pe-file-resources
-func parseResourceDirectory(sec *extractedSection, dirs *u32set.Set, fields map[string]string, names *strset.Set) error {
-	if sec == nil || sec.Size <= 0 {
-		return nil
-	}
-
-	if sec.Reader == nil {
-		return errors.New("resource section not found")
-	}
-
-	baseRVA := sec.BaseRVA
-	if baseRVA == 0 {
-		baseRVA = sec.RVA
-	}
-
-	offset := int64(sec.RVA - baseRVA)
-	if _, err := sec.Reader.Seek(offset, io.SeekStart); err != nil {
-		return fmt.Errorf("error seeking to directory offset: %w", err)
-	}
-
-	var directoryHeader peImageResourceDirectory
-	if err := readIntoStruct(sec.Reader, &directoryHeader); err != nil {
-		return fmt.Errorf("error reading directory header: %w", err)
-	}
-
-	numEntries := int(directoryHeader.NumberOfNamedEntries + directoryHeader.NumberOfIDEntries)
-	switch {
-	case numEntries > peMaxAllowedDirectoryEntries:
-		return fmt.Errorf("too many entries in resource directory: %d", numEntries)
-	case numEntries == 0:
-		return fmt.Errorf("no entries in resource directory")
-	case numEntries < 0:
-		return fmt.Errorf("invalid number of entries in resource directory: %d", numEntries)
-	}
-
-	for i := 0; i < numEntries; i++ {
-		var entry peImageResourceDirectoryEntry
-
-		entryOffset := offset + int64(binary.Size(directoryHeader)) + int64(i*binary.Size(entry))
-		if _, err := sec.Reader.Seek(entryOffset, io.SeekStart); err != nil {
-			log.Tracef("error seeking to PE entry offset: %v", err)
-			continue
-		}
-
-		if err := readIntoStruct(sec.Reader, &entry); err != nil {
-			continue
-		}
-
-		if err := processResourceEntry(entry, baseRVA, sec, dirs, fields, names); err != nil {
-			log.Tracef("error processing resource entry: %v", err)
-			continue
-		}
-	}
-
-	return nil
-}
-
-func processResourceEntry(entry peImageResourceDirectoryEntry, baseRVA uint32, sec *extractedSection, dirs *u32set.Set, fields map[string]string, names *strset.Set) error {
-	// if the high bit is set, this is a directory entry, otherwise it is a data entry
-	isDirectory := entry.OffsetToData&0x80000000 != 0
-
-	// note: the offset is relative to the beginning of the resource section, not an RVA
-	entryOffsetToData := entry.OffsetToData & 0x7FFFFFFF
-
-	nameIsString := entry.Name&0x80000000 != 0
-	nameOffset := entry.Name & 0x7FFFFFFF
-
-	// read the string name of the resource directory
-	if nameIsString {
-		currentPos, err := sec.Reader.Seek(0, io.SeekCurrent)
-		if err != nil {
-			return fmt.Errorf("error getting current reader position: %w", err)
-		}
-
-		if _, err := sec.Reader.Seek(int64(nameOffset), io.SeekStart); err != nil {
-			return fmt.Errorf("error restoring reader position: %w", err)
-		}
-
-		name, err := readUTF16WithLength(sec.Reader)
-		if err == nil {
-			names.Add(name)
-		}
-
-		if _, err := sec.Reader.Seek(currentPos, io.SeekStart); err != nil {
-			return fmt.Errorf("error restoring reader position: %w", err)
-		}
-	}
-
-	if isDirectory {
-		subRVA := baseRVA + entryOffsetToData
-		if dirs.Has(subRVA) {
-			// some malware uses recursive PE references to evade analysis
-			return fmt.Errorf("recursive PE reference detected; skipping directory at baseRVA=0x%x subRVA=0x%x", baseRVA, subRVA)
-		}
-
-		dirs.Add(subRVA)
-		err := parseResourceDirectory(
-			&extractedSection{
-				RVA:     subRVA,
-				BaseRVA: baseRVA,
-				Size:    sec.Size - (sec.RVA - baseRVA),
-				Reader:  sec.Reader,
-			},
-			dirs, fields, names)
-		if err != nil {
-			return err
-		}
-		return nil
-	}
-	return parseResourceDataEntry(sec.Reader, baseRVA, baseRVA+entryOffsetToData, sec.Size, fields)
-}
-
-func parseResourceDataEntry(reader *bytes.Reader, baseRVA, rva, remainingSize uint32, fields map[string]string) error {
-	var dataEntry peImageResourceDataEntry
-	offset := int64(rva - baseRVA)
-
-	if _, err := reader.Seek(offset, io.SeekStart); err != nil {
-		return fmt.Errorf("error seeking to data entry offset: %w", err)
-	}
-
-	if err := readIntoStruct(reader, &dataEntry); err != nil {
-		return fmt.Errorf("error reading resource data entry: %w", err)
-	}
-
-	if remainingSize < dataEntry.Size {
-		return fmt.Errorf("resource data entry size exceeds remaining size")
-	}
-
-	data := make([]byte, dataEntry.Size)
-	if _, err := reader.Seek(int64(dataEntry.OffsetToData-baseRVA), io.SeekStart); err != nil {
-		return fmt.Errorf("error seeking to resource data: %w", err)
-	}
-
-	if _, err := reader.Read(data); err != nil {
-		return fmt.Errorf("error reading resource data: %w", err)
-	}
-
-	return parseVersionResourceSection(bytes.NewReader(data), fields)
-}
-
-// parseVersionResourceSection parses a PE version resource section from within a resource directory.
-//
-//	"The main structure in a version resource is the VS_FIXEDFILEINFO structure. Additional structures include the
-//	VarFileInfo structure to store language information data, and StringFileInfo for user-defined string information.
-//	All strings in a version resource are in Unicode format. Each block of information is aligned on a DWORD boundary."
-//
-//	"VS_VERSIONINFO" (utf16)
-//	+---------------------------------------------------+
-//	| wLength (2 bytes)                                 |
-//	| wValueLength (2 bytes)                            |
-//	| wType (2 bytes)                                   |
-//	| szKey ("VS_VERSION_INFO") (utf16)                 |
-//	| Padding (to DWORD)                                |
-//	+---------------------------------------------------+
-//	| VS_FIXEDFILEINFO (52 bytes)                       |
-//	+---------------------------------------------------+
-//	| "StringFileInfo" (utf16)                          |
-//	+---------------------------------------------------+
-//	| wLength (2 bytes)                                 |
-//	| wValueLength (2 bytes)                            |
-//	| wType (2 bytes)                                   |
-//	| szKey ("StringFileInfo") (utf16)                  |
-//	| Padding (to DWORD)                                |
-//	| StringTable                                       |
-//	|   +--------------------------------------------+  |
-//	|   | wLength (2 bytes)                          |  |
-//	|   | wValueLength (2 bytes)                     |  |
-//	|   | wType (2 bytes)                            |  |
-//	|   | szKey ("040904b0")                         |  |
-//	|   | Padding (to DWORD)                         |  |
-//	|   | String                                     |  |
-//	|   | +--------------------------------------+   |  |
-//	|   | | wLength (2 bytes)                    |   |  |
-//	|   | | wValueLength (2 bytes)               |   |  |
-//	|   | | wType (2 bytes)                      |   |  |
-//	|   | | szKey ("FileVersion")                |   |  |
-//	|   | | Padding (to DWORD)                   |   |  |
-//	|   | | szValue ("15.00.0913.015")           |   |  |
-//	|   | | Padding (to DWORD)                   |   |  |
-//	|   +--------------------------------------------+  |
-//	+---------------------------------------------------+
-//	| VarFileInfo  (utf16)                              |
-//	+---------------------------------------------------+
-//	| (skip!)                                           |
-//	+---------------------------------------------------+
-//
-// sources:
-//   - https://learn.microsoft.com/en-us/windows/win32/menurc/resource-file-formats
-//   - https://learn.microsoft.com/en-us/windows/win32/menurc/vs-versioninfo
-//   - https://learn.microsoft.com/en-us/windows/win32/api/verrsrc/ns-verrsrc-vs_fixedfileinfo
-//   - https://learn.microsoft.com/en-us/windows/win32/menurc/varfileinfo
-//   - https://learn.microsoft.com/en-us/windows/win32/menurc/stringfileinfo
-//   - https://learn.microsoft.com/en-us/windows/win32/menurc/stringtable
-func parseVersionResourceSection(reader *bytes.Reader, fields map[string]string) error {
-	offset := 0
-
-	var info peVsVersionInfo
-	if szKey, err := readIntoStructAndSzKey(reader, &info, &offset); err != nil {
-		return fmt.Errorf("error reading PE version info: %v", err)
-	} else if szKey != "VS_VERSION_INFO" {
-		// this is a resource section, but not the version resources
-		return nil
-	}
-
-	if err := alignAndSeek(reader, &offset); err != nil {
-		return fmt.Errorf("error aligning past PE version info: %w", err)
-	}
-
-	var fixedFileInfo peVsFixedFileInfo
-	if err := readIntoStruct(reader, &fixedFileInfo, &offset); err != nil {
-		return fmt.Errorf("error reading PE FixedFileInfo: %v", err)
-	}
-
-	for reader.Len() > 0 {
-		if err := alignAndSeek(reader, &offset); err != nil {
-			return fmt.Errorf("error seeking to PE StringFileInfo: %w", err)
-		}
-
-		var sfiHeader peStringFileInfo
-		if szKey, err := readIntoStructAndSzKey(reader, &sfiHeader, &offset); err != nil {
-			return fmt.Errorf("error reading PE string file info header: %v", err)
-		} else if szKey != "StringFileInfo" {
-			// we only care about extracting strings from any string tables, skip this
-			offset += int(sfiHeader.ValueLength)
-			continue
-		}
-
-		var stOffset int
-
-		// note: the szKey for the prStringTable is the language
-		var stHeader peStringTable
-		if _, err := readIntoStructAndSzKey(reader, &stHeader, &offset, &stOffset); err != nil {
-			return fmt.Errorf("error reading PE string table header: %v", err)
-		}
-
-		for stOffset < int(stHeader.Length) {
-			var stringHeader peString
-			if err := readIntoStruct(reader, &stringHeader, &offset, &stOffset); err != nil {
-				break
-			}
-
-			key := readUTF16(reader, &offset, &stOffset)
-
-			if err := alignAndSeek(reader, &offset, &stOffset); err != nil {
-				return fmt.Errorf("error aligning to next PE string table value: %w", err)
-			}
-
-			var value string
-			if stringHeader.ValueLength > 0 {
-				value = readUTF16(reader, &offset, &stOffset)
-			}
-
-			fields[key] = value
-
-			if err := alignAndSeek(reader, &offset, &stOffset); err != nil {
-				return fmt.Errorf("error aligning to next PE string table key: %w", err)
-			}
-		}
-	}
-
-	if fields["FileVersion"] == "" {
-		// we can derive the file version from the fixed file info if it is not already specified as a string entry... neat!
-		fields["FileVersion"] = fmt.Sprintf("%d.%d.%d.%d",
-			fixedFileInfo.FileVersionMS>>16, fixedFileInfo.FileVersionMS&0xFFFF,
-			fixedFileInfo.FileVersionLS>>16, fixedFileInfo.FileVersionLS&0xFFFF)
-	}
-
-	return nil
-}
-
-// readIntoStructAndSzKey reads a struct from the reader and updates the offsets if provided, returning the szKey value.
-// This is only useful in the context of the resource directory parsing in narrow cases (this is invalid to use outside of that context).
-func readIntoStructAndSzKey[T any](reader *bytes.Reader, data *T, offsets ...*int) (string, error) {
-	if err := readIntoStruct(reader, data, offsets...); err != nil {
-		return "", err
-	}
-	return readUTF16(reader, offsets...), nil
-}
-
-// readIntoStruct reads a struct from the reader and updates the offsets if provided.
-func readIntoStruct[T any](reader io.Reader, data *T, offsets ...*int) error {
-	if err := binary.Read(reader, binary.LittleEndian, data); err != nil {
-		if errors.Is(err, io.EOF) {
-			return nil
-		}
-		return err
-	}
-
-	for i := range offsets {
-		*offsets[i] += binary.Size(*data)
-	}
-	return nil
-}
-
-// alignAndSeek aligns the reader to the next DWORD boundary and seeks to the new offset (updating any provided trackOffsets).
-func alignAndSeek(reader io.Seeker, offset *int, trackOffsets ...*int) error {
-	ogOffset := *offset
-	*offset = alignToDWORD(*offset)
-	diff := *offset - ogOffset
-	for i := range trackOffsets {
-		*trackOffsets[i] += diff
-	}
-	_, err := reader.Seek(int64(*offset), io.SeekStart)
-	return err
-}
-
-// alignToDWORD aligns the offset to the next DWORD boundary (4 byte boundary)
-func alignToDWORD(offset int) int {
-	return (offset + 3) & ^3
-}
-
-// readUTF16 is a helper function to read a null-terminated UTF16 string
-func readUTF16(reader *bytes.Reader, offsets ...*int) string {
-	startPos, err := reader.Seek(0, io.SeekCurrent)
-	if err != nil {
-		return ""
-	}
-
-	var result []rune
-	for {
-		var char uint16
-		err := binary.Read(reader, binary.LittleEndian, &char)
-		if err != nil || char == 0 {
-			break
-		}
-		result = append(result, rune(char))
-	}
-
-	// calculate how many bytes we've actually read (including null terminator)
-	endPos, _ := reader.Seek(0, io.SeekCurrent)
-	bytesRead := int(endPos - startPos)
-
-	for i := range offsets {
-		*offsets[i] += bytesRead
-	}
-
-	return string(result)
-}
-
-// readUTF16WithLength reads a length-prefixed UTF-16 string from reader.
-// The first 2 bytes represent the number of UTF-16 code units.
-func readUTF16WithLength(reader *bytes.Reader) (string, error) {
-	var length uint16
-	if err := binary.Read(reader, binary.LittleEndian, &length); err != nil {
-		return "", err
-	}
-	if length == 0 {
-		return "", nil
-	}
-
-	// read length UTF-16 code units.
-	codes := make([]uint16, length)
-	if err := binary.Read(reader, binary.LittleEndian, &codes); err != nil {
-		return "", err
-	}
-	return string(utf16.Decode(codes)), nil
-}
@@ -486,7 +486,6 @@ var defaultCandidateAdditions = buildCandidateLookup(
 			candidateKey{PkgName: "dnsmasq", Vendor: "dnsmasq"},
 			candidateAddition{AdditionalVendors: []string{"thekelleys"}},
 		},
-		//
 		// Binary packages
 		{
 			pkg.BinaryPkg,
@@ -630,7 +629,38 @@ var defaultCandidateRemovals = buildCandidateRemovalLookup(
 			candidateKey{PkgName: "grpc"},
 			candidateRemovals{ProductsToRemove: []string{"grpc"}},
 		},
-		// PHP Packages
+		// Rust packages
+		{
+			pkg.RustPkg,
+			candidateKey{PkgName: "hyper"},
+			// Avoid matching CVE-2024-23741
+			candidateRemovals{VendorsToRemove: []string{"vercel"}},
+		},
+		{
+			pkg.RustPkg,
+			candidateKey{PkgName: "opentelemetry"},
+			// Avoid matching CVE-2023-45142
+			candidateRemovals{ProductsToRemove: []string{"opentelemetry"}},
+		},
+		{
+			pkg.RustPkg,
+			candidateKey{PkgName: "prometheus"},
+			// Avoid matching CVE-2019-3826
+			candidateRemovals{VendorsToRemove: []string{"prometheus"}},
+		},
+		{
+			pkg.RustPkg,
+			candidateKey{PkgName: "phf"},
+			// Avoid matching CVE-2000-1186
+			candidateRemovals{VendorsToRemove: []string{"phf"}},
+		},
+		{
+			pkg.RustPkg,
+			candidateKey{PkgName: "redis"},
+			// Avoid matching CVE-2022-24735
+			candidateRemovals{VendorsToRemove: []string{"redis"}},
+		},
+		// PHP packages
 		{
 			pkg.PhpPearPkg,
 			candidateKey{PkgName: "redis"},
@@ -3848,6 +3848,9 @@
      "localhost-now": [
        "cpe:2.3:a:localhost-now_project:localhost-now:*:*:*:*:*:node.js:*:*"
      ],
+      "lockfile-lint-api": [
+        "cpe:2.3:a:lirantal:lockfile-lint-api:*:*:*:*:*:node.js:*:*"
+      ],
      "locutus": [
        "cpe:2.3:a:locutus:locutus:*:*:*:*:*:node.js:*:*"
      ],
@@ -7072,6 +7075,9 @@
      "versionize": [
        "cpe:2.3:a:versionize_project:versionize:*:*:*:*:*:rust:*:*"
      ],
+      "wasmi": [
+        "cpe:2.3:a:wasmi-labs:wasmi:*:*:*:*:*:rust:*:*"
+      ],
      "wasmtime": [
        "cpe:2.3:a:bytecodealliance:wasmtime:*:*:*:*:*:rust:*:*"
      ],
@@ -7546,6 +7552,7 @@
      "advanced-custom-fields": [
        "cpe:2.3:a:advancedcustomfields:advanced_custom_fields:*:*:*:*:*:wordpress:*:*",
        "cpe:2.3:a:advancedcustomfields:advanced_custom_fields:*:*:*:*:-:wordpress:*:*",
+        "cpe:2.3:a:advancedcustomfields:advanced_custom_fields:*:*:*:*:free:wordpress:*:*",
        "cpe:2.3:a:advancedcustomfields:advanced_custom_fields:*:*:*:*:pro:wordpress:*:*"
      ],
      "advanced-database-cleaner": [
@@ -7675,6 +7682,9 @@
      "ajax-bootmodal-login": [
        "cpe:2.3:a:ajax_bootmodal_login_project:ajax_bootmodal_login:*:*:*:*:*:wordpress:*:*"
      ],
+      "ajax-filter-posts": [
+        "cpe:2.3:a:addonmaster:post_grid_master:*:*:*:*:*:wordpress:*:*"
+      ],
      "ajax-load-more": [
        "cpe:2.3:a:connekthq:ajax_load_more:*:*:*:*:*:wordpress:*:*"
      ],
@@ -7880,6 +7890,9 @@
      "animate-it": [
        "cpe:2.3:a:eleopard:animate_it\\!:*:*:*:*:*:wordpress:*:*"
      ],
+      "animated-al-list": [
+        "cpe:2.3:a:alexdtn:animated_al_list:*:*:*:*:*:wordpress:*:*"
+      ],
      "animated-counters": [
        "cpe:2.3:a:eralion:animated_counters:*:*:*:*:*:wordpress:*:*"
      ],
@@ -8025,6 +8038,9 @@
      "arprice-responsive-pricing-table": [
        "cpe:2.3:a:reputeinfosystems:arprice_lite:*:*:*:*:*:wordpress:*:*"
      ],
+      "artibot": [
+        "cpe:2.3:a:artibot:artibot:*:*:*:*:*:wordpress:*:*"
+      ],
      "article-directory": [
        "cpe:2.3:a:article_directory_project:article_directory:*:*:*:*:*:wordpress:*:*"
      ],
@@ -8211,6 +8227,9 @@
      "awesome-weather": [
        "cpe:2.3:a:awesome_weather_widget_project:awesome_weather_widget:*:*:*:*:*:wordpress:*:*"
      ],
+      "awin-advertiser-tracking": [
+        "cpe:2.3:a:awin:awin_-_advertiser_tracking_for_woocommerce:*:*:*:*:*:wordpress:*:*"
+      ],
      "awin-data-feed": [
        "cpe:2.3:a:awin:awin_data_feed:*:*:*:*:*:wordpress:*:*"
      ],
@@ -8369,6 +8388,9 @@
        "cpe:2.3:a:web-x:be-popia-compliant:*:*:*:*:*:wordpress:*:*",
        "cpe:2.3:a:web-x:be_popia_compliant:*:*:*:*:*:wordpress:*:*"
      ],
+      "beaf-before-and-after-gallery": [
+        "cpe:2.3:a:themefic:ultimate_before_after_image_slider_\\\u0026_gallery:*:*:*:*:*:wordpress:*:*"
+      ],
      "beam-me-up-scotty": [
        "cpe:2.3:a:outtheboxthemes:beam_me_up_scotty:*:*:*:*:*:wordpress:*:*"
      ],
@@ -8811,6 +8833,9 @@
      "button-block": [
        "cpe:2.3:a:bplugins:button_block:*:*:*:*:*:wordpress:*:*"
      ],
+      "button-contact-vr": [
+        "cpe:2.3:a:buttonizer:call_\\/_chat_\\/_contact_button:*:*:*:*:*:wordpress:*:*"
+      ],
      "button-generation": [
        "cpe:2.3:a:wow-company:button_generator:*:*:*:*:*:wordpress:*:*"
      ],
@@ -8943,6 +8968,9 @@
      "canto": [
        "cpe:2.3:a:canto:canto:*:*:*:*:*:wordpress:*:*"
      ],
+      "canvasflow": [
+        "cpe:2.3:a:canvasflow:canvasflow:*:*:*:*:*:wordpress:*:*"
+      ],
      "canvasio3d-light": [
        "cpe:2.3:a:virtuellwerk:canvasio3d_light:*:*:*:*:*:wordpress:*:*"
      ],
@@ -9234,6 +9262,9 @@
      "clickdesk-live-support-chat-plugin": [
        "cpe:2.3:a:clickdesk:clickdesk:*:*:*:*:*:wordpress:*:*"
      ],
+      "clickwhale": [
+        "cpe:2.3:a:flowdee:clickwhale:*:*:*:*:*:wordpress:*:*"
+      ],
      "clictracker": [
        "cpe:2.3:a:wp_clictracker_project:wp_clictracker:*:*:*:*:*:wordpress:*:*"
      ],
@@ -9350,6 +9381,9 @@
      "colorful-categories": [
        "cpe:2.3:a:gesundheit-bewegt:colorful_categories:*:*:*:*:*:wordpress:*:*"
      ],
+      "colorlib-coming-soon-maintenance": [
+        "cpe:2.3:a:colorlib:coming_soon_\\\u0026_maintenance_mode:*:*:*:*:*:wordpress:*:*"
+      ],
      "column-matic": [
        "cpe:2.3:a:column-matic_project:column-matic:*:*:*:*:*:wordpress:*:*"
      ],
@@ -9721,6 +9755,9 @@
      "core-web-vitals-pagespeed-booster": [
        "cpe:2.3:a:magazine3:core_web_vitals_\\\u0026_pagespeed_booster:*:*:*:*:*:wordpress:*:*"
      ],
+      "coreactivity": [
+        "cpe:2.3:a:dev4press:coreactivity:*:*:*:*:*:wordpress:*:*"
+      ],
      "corner-ad": [
        "cpe:2.3:a:dwbooster:corner_ad:*:*:*:*:*:wordpress:*:*"
      ],
@@ -10083,6 +10120,9 @@
        "cpe:2.3:a:fastlinemedia:customizer_export\\/import:*:*:*:*:*:wordpress:*:*",
        "cpe:2.3:a:wpbeaverbuilder:customizer_export\\/import:*:*:*:*:*:wordpress:*:*"
      ],
+      "cww-companion": [
+        "cpe:2.3:a:codeworkweb:cww_companion:*:*:*:*:*:wordpress:*:*"
+      ],
      "cybersoldier": [
        "cpe:2.3:a:webbigt:cybersoldier:*:*:*:*:*:wordpress:*:*"
      ],
@@ -10179,7 +10219,8 @@
        "cpe:2.3:a:webtoffee:decorator:*:*:*:*:*:wordpress:*:*"
      ],
      "defender-security": [
-        "cpe:2.3:a:wmpudev:defender_security:*:*:*:*:*:wordpress:*:*",
+        "cpe:2.3:a:wpmudev:defender:*:*:*:*:*:wordpress:*:*",
+        "cpe:2.3:a:wpmudev:defender:*:*:*:*:free:wordpress:*:*",
        "cpe:2.3:a:wpmudev:defender_security:*:*:*:*:*:wordpress:*:*"
      ],
      "definitive-addons-for-elementor": [
@@ -10307,9 +10348,15 @@
      "dmsguestbook": [
        "cpe:2.3:a:dmsguestbook_project:dmsguestbook:*:*:*:*:*:wordpress:*:*"
      ],
+      "dn-footer-contacts": [
+        "cpe:2.3:a:digireturn:footer_contacts_bar:*:*:*:*:*:wordpress:*:*"
+      ],
      "dn-popup": [
        "cpe:2.3:a:digireturn:dn_popup:*:*:*:*:*:wordpress:*:*"
      ],
+      "dn-shipping-by-weight": [
+        "cpe:2.3:a:digireturn:shipping_by_weight_for_woocommerce:*:*:*:*:*:wordpress:*:*"
+      ],
      "document-emberdder": [
        "cpe:2.3:a:bplugins:document_embedder:*:*:*:*:*:wordpress:*:*"
      ],
@@ -10327,7 +10374,7 @@
        "cpe:2.3:a:wedevs:dokan:*:*:*:*:*:wordpress:*:*"
      ],
      "dokan-pro": [
-        "cpe:2.3:a:dokan:dokan_pro_plugin:*:*:*:*:*:wordpress:*:*"
+        "cpe:2.3:a:dokan:dokan:*:*:*:*:pro:wordpress:*:*"
      ],
      "dologin": [
        "cpe:2.3:a:wpdo:dologin_security:*:*:*:*:*:wordpress:*:*"
@@ -10744,6 +10791,9 @@
      "eg-attachments": [
        "cpe:2.3:a:egeorjon:eg-attachments:*:*:*:*:*:wordpress:*:*"
      ],
+      "ekc-tournament-manager": [
+        "cpe:2.3:a:lukashuser:ekc_tournament_manager:*:*:*:*:*:wordpress:*:*"
+      ],
      "elastic-email-sender": [
        "cpe:2.3:a:elasticemail:elastic_email_sender:*:*:*:*:*:wordpress:*:*"
      ],
@@ -10978,7 +11028,8 @@
        "cpe:2.3:a:estatik:estatik:*:*:*:*:*:wordpress:*:*"
      ],
      "estatik-mortgage-calculator": [
-        "cpe:2.3:a:estatik:estatik_mortgage_calculator:*:*:*:*:*:wordpress:*:*"
+        "cpe:2.3:a:estatik:estatik_mortgage_calculator:*:*:*:*:*:wordpress:*:*",
+        "cpe:2.3:a:estatik:mortgage_calculator:*:*:*:*:*:wordpress:*:*"
      ],
      "etsy-shop": [
        "cpe:2.3:a:etsy_shop_project:etsy_shop:*:*:*:*:*:wordpress:*:*"
@@ -11235,6 +11286,9 @@
      "fast-search-powered-by-solr": [
        "cpe:2.3:a:fast-search-powered-by-solr_project:fast-search-powered-by-solr:*:*:*:*:*:wordpress:*:*"
      ],
+      "fast-tube": [
+        "cpe:2.3:a:caspie:fast_tube:*:*:*:*:*:wordpress:*:*"
+      ],
      "fast-velocity-minify": [
        "cpe:2.3:a:fastvelocity:minify:*:*:*:*:*:wordpress:*:*"
      ],
@@ -11281,6 +11335,9 @@
      "featured-image-from-url": [
        "cpe:2.3:a:fifu:featured_image_from_url:*:*:*:*:*:wordpress:*:*"
      ],
+      "featured-image-plus": [
+        "cpe:2.3:a:krasenslavov:featured_image_plus:*:*:*:*:*:wordpress:*:*"
+      ],
      "feed-changer": [
        "cpe:2.3:a:wp-master:feed_changer_\\\u0026_remover:*:*:*:*:*:wordpress:*:*"
      ],
@@ -11302,6 +11359,9 @@
      "feedzy-rss-feeds": [
        "cpe:2.3:a:themeisle:rss_aggregator_by_feedzy:*:*:*:*:*:wordpress:*:*"
      ],
+      "fetch-jft": [
+        "cpe:2.3:a:pjaudiomv:fetch_jft:*:*:*:*:*:wordpress:*:*"
+      ],
      "fg-drupal-to-wp": [
        "cpe:2.3:a:fredericgilles:fg_drupal:*:*:*:*:*:wordpress:*:*"
      ],
@@ -11368,6 +11428,7 @@
        "cpe:2.3:a:find_my_blocks_project:find_my_blocks:*:*:*:*:*:wordpress:*:*"
      ],
      "first-graders-toolbox": [
+        "cpe:2.3:a:atakanau:1_click_disable_all:*:*:*:*:*:wordpress:*:*",
        "cpe:2.3:a:atakanau:one_click_disable_all:*:*:*:*:*:wordpress:*:*"
      ],
      "fish-and-ships": [
@@ -11426,6 +11487,9 @@
      "floating-button": [
        "cpe:2.3:a:wow-company:floating_button:*:*:*:*:*:wordpress:*:*"
      ],
+      "floating-contact": [
+        "cpe:2.3:a:just-a-web-developer:floating_contact_button:*:*:*:*:*:wordpress:*:*"
+      ],
      "floating-div": [
        "cpe:2.3:a:floating_div_project:floating_div:*:*:*:*:*:wordpress:*:*"
      ],
@@ -11475,6 +11539,9 @@
      "fluid-responsive-slideshow": [
        "cpe:2.3:a:tonjoostudio:fluid-responsive-slideshow:*:*:*:*:*:wordpress:*:*"
      ],
+      "flynax-bridge": [
+        "cpe:2.3:a:flynax:flynax_bridge:*:*:*:*:*:wordpress:*:*"
+      ],
      "folders": [
        "cpe:2.3:a:premio:folders:*:*:*:*:*:wordpress:*:*"
      ],
@@ -11849,6 +11916,9 @@
        "cpe:2.3:a:ghost:ghost:*:*:*:*:*:node.js:*:*",
        "cpe:2.3:a:ghost:ghost:*:*:*:*:*:wordpress:*:*"
      ],
+      "gianism": [
+        "cpe:2.3:a:takahashifumiki:gianism:*:*:*:*:*:wordpress:*:*"
+      ],
      "gift-certificate-creator": [
        "cpe:2.3:a:bobcares:gift-certificate-creator:*:*:*:*:*:wordpress:*:*"
      ],
@@ -12071,7 +12141,8 @@
        "cpe:2.3:a:groundhogg:groundhogg:*:*:*:*:*:wordpress:*:*"
      ],
      "gs-logo-slider": [
-        "cpe:2.3:a:gsplugins:gs_logo_slider:*:*:*:*:*:wordpress:*:*"
+        "cpe:2.3:a:gsplugins:gs_logo_slider:*:*:*:*:*:wordpress:*:*",
+        "cpe:2.3:a:gsplugins:logo_slider:*:*:*:*:*:wordpress:*:*"
      ],
      "gs-portfolio": [
        "cpe:2.3:a:gsplugins:gs_filterable_portfolio:*:*:*:*:*:wordpress:*:*"
@@ -12425,6 +12496,9 @@
      "ideapush": [
        "cpe:2.3:a:northernbeacheswebsites:ideapush:*:*:*:*:*:wordpress:*:*"
      ],
+      "idonate": [
+        "cpe:2.3:a:themeatelier:idonate:*:*:*:*:*:wordpress:*:*"
+      ],
      "idx-broker-platinum": [
        "cpe:2.3:a:idxbroker:idx_broker:*:*:*:*:platinum:wordpress:*:*",
        "cpe:2.3:a:idxbroker:impress_for_idx_broker:*:*:*:*:platinum:wordpress:*:*"
@@ -12680,6 +12754,9 @@
      "instant-images": [
        "cpe:2.3:a:connekthq:instant_images_-_one_click_unsplash_uploads:*:*:*:*:*:wordpress:*:*"
      ],
+      "instantio": [
+        "cpe:2.3:a:themefic:instantio:*:*:*:*:*:wordpress:*:*"
+      ],
      "instawp-connect": [
        "cpe:2.3:a:instawp:instawp_connect:*:*:*:*:*:wordpress:*:*"
      ],
@@ -12815,6 +12892,9 @@
      "jetpack": [
        "cpe:2.3:a:automattic:jetpack:*:*:*:*:*:wordpress:*:*"
      ],
+      "jetpack-boost": [
+        "cpe:2.3:a:automattic:jetpack_boost:*:*:*:*:*:wordpress:*:*"
+      ],
      "jetwidgets-for-elementor": [
        "cpe:2.3:a:crocoblock:jetwidgets_for_elementor:*:*:*:*:*:wordpress:*:*"
      ],
@@ -12920,6 +13000,9 @@
      "just-tables": [
        "cpe:2.3:a:hasthemes:justtables:*:*:*:*:*:wordpress:*:*"
      ],
+      "justrows-free": [
+        "cpe:2.3:a:canaveralstudio:justrows_free:*:*:*:*:*:wordpress:*:*"
+      ],
      "jvm-rich-text-icons": [
        "cpe:2.3:a:jorisvm:jvm_gutenberg_rich_text_icons:*:*:*:*:*:wordpress:*:*"
      ],
@@ -12953,6 +13036,9 @@
      "kb-support": [
        "cpe:2.3:a:logon:kb_support:*:*:*:*:*:wordpress:*:*"
      ],
+      "kbucket": [
+        "cpe:2.3:a:optimalaccess:kbucket:*:*:*:*:*:wordpress:*:*"
+      ],
      "keep-backup-daily": [
        "cpe:2.3:a:androidbubbles:keep_backup_daily:*:*:*:*:*:wordpress:*:*"
      ],
@@ -12992,6 +13078,9 @@
      "kk-star-ratings": [
        "cpe:2.3:a:kamalkhan:kk_star_ratings:*:*:*:*:*:wordpress:*:*"
      ],
+      "kkprogressbar": [
+        "cpe:2.3:a:krzysztof-furtak:kkprogressbar2:*:*:*:*:free:wordpress:*:*"
+      ],
      "klarna-checkout-for-woocommerce": [
        "cpe:2.3:a:klarna:klarna_checkout_for_woocommerce:*:*:*:*:*:wordpress:*:*"
      ],
@@ -13155,6 +13244,9 @@
      "legal-pages": [
        "cpe:2.3:a:wpwax:legal_pages:*:*:*:*:*:wordpress:*:*"
      ],
+      "legull": [
+        "cpe:2.3:a:alwayscurious:legull:*:*:*:*:*:wordpress:*:*"
+      ],
      "leira-cron-jobs": [
        "cpe:2.3:a:leira:cron_jobs:*:*:*:*:*:wordpress:*:*"
      ],
@@ -13373,6 +13465,9 @@
      "logwpmail": [
        "cpe:2.3:a:premierethemes:log_wp_mail:*:*:*:*:*:wordpress:*:*"
      ],
+      "lokalyze-call-now": [
+        "cpe:2.3:a:lokalyze:call_me_now:*:*:*:*:*:wordpress:*:*"
+      ],
      "ltl-freight-quotes-unishippers-edition": [
        "cpe:2.3:a:eniture:ltl_freight_quotes:*:*:*:*:unishippers:wordpress:*:*"
      ],
@@ -13467,7 +13562,7 @@
        "cpe:2.3:a:mailoptin:mailoptin:*:*:*:*:*:wordpress:*:*"
      ],
      "mailpoet": [
-        "cpe:2.3:a:mailpoet:mailpoet:*:*:*:*:*:wordpress:*:*"
+        "cpe:2.3:a:automattic:mailpoet:*:*:*:*:free:wordpress:*:*"
      ],
      "mailtree-log-mail": [
        "cpe:2.3:a:oacstudio:mailtree_log_mail:*:*:*:*:*:wordpress:*:*"
@@ -13475,6 +13570,9 @@
      "maintenance": [
        "cpe:2.3:a:webfactoryltd:maintenance:*:*:*:*:*:wordpress:*:*"
      ],
+      "maintenance-notice": [
+        "cpe:2.3:a:codevibrant:maintenance_notice:*:*:*:*:*:wordpress:*:*"
+      ],
      "maintenance-page": [
        "cpe:2.3:a:themegrill:maintenance_page:*:*:*:*:*:wordpress:*:*"
      ],
@@ -13643,6 +13741,9 @@
      "media-library-plus": [
        "cpe:2.3:a:maxfoundry:media_library_folders:*:*:*:*:*:wordpress:*:*"
      ],
+      "media-library-tools": [
+        "cpe:2.3:a:wptinysolutions:media_library_tools:*:*:*:*:*:wordpress:*:*"
+      ],
      "media-list": [
        "cpe:2.3:a:drelton:medialist:*:*:*:*:*:wordpress:*:*"
      ],
@@ -14204,6 +14305,9 @@
      "newsletter-optin-box": [
        "cpe:2.3:a:noptin:noptin:*:*:*:*:*:wordpress:*:*"
      ],
+      "newsletter-popup": [
+        "cpe:2.3:a:mndpsingh287:newsletter_popup:*:*:*:*:*:wordpress:*:*"
+      ],
      "newsletters-lite": [
        "cpe:2.3:a:tribulant:newsletters:*:*:*:*:*:wordpress:*:*"
      ],
@@ -14468,6 +14572,9 @@
      "openpgp-form-encryption": [
        "cpe:2.3:a:arnesonium:openpgp_form_encryption:*:*:*:*:*:wordpress:*:*"
      ],
+      "opensheetmusicdisplay": [
+        "cpe:2.3:a:opensheetmusicdisplay:opensheetmusicdisplay:*:*:*:*:*:wordpress:*:*"
+      ],
      "ops-robots-txt": [
        "cpe:2.3:a:ops-robots-txt_project:ops-robots-txt:*:*:*:*:*:wordpress:*:*"
      ],
@@ -14603,6 +14710,9 @@
      "pagepost-content-shortcode": [
        "cpe:2.3:a:page\\/post_content_shortcode_project:page\\/post_content_shortcode:*:*:*:*:*:wordpress:*:*"
      ],
+      "pagerank-tools": [
+        "cpe:2.3:a:mahype:pagerank_tools:*:*:*:*:*:wordpress:*:*"
+      ],
      "pagination": [
        "cpe:2.3:a:bestwebsoft:pagination:*:*:*:*:*:wordpress:*:*"
      ],
@@ -15057,6 +15167,9 @@
      "post-highlights": [
        "cpe:2.3:a:post_highlights_projects:post_highlights:*:*:*:*:*:wordpress:*:*"
      ],
+      "post-in-page-for-elementor": [
+        "cpe:2.3:a:migaweb:post_in_page_for_elementor:*:*:*:*:*:wordpress:*:*"
+      ],
      "post-index": [
        "cpe:2.3:a:post_index_project:post_index:*:*:*:*:*:wordpress:*:*"
      ],
@@ -15077,8 +15190,7 @@
        "cpe:2.3:a:i13websolution:post_sliders_\\\u0026_post_grids:*:*:*:*:*:wordpress:*:*"
      ],
      "post-smtp": [
-        "cpe:2.3:a:wpexperts:post_smtp:*:*:*:*:*:wordpress:*:*",
-        "cpe:2.3:a:wpexperts:post_smtp_mailer:*:*:*:*:*:wordpress:*:*"
+        "cpe:2.3:a:wpexperts:post_smtp:*:*:*:*:*:wordpress:*:*"
      ],
      "post-snippets": [
        "cpe:2.3:a:postsnippets:post_snippets:*:*:*:*:*:wordpress:*:*"
@@ -15427,6 +15539,9 @@
        "cpe:2.3:a:quick_chat_project:quick_chat:*:*:*:*:*:wordpress:*:*",
        "cpe:2.3:a:techytalk:quick_chat:*:*:*:*:*:wordpress:*:*"
      ],
+      "quick-code": [
+        "cpe:2.3:a:gwycon:quick_code:*:*:*:*:*:wordpress:*:*"
+      ],
      "quick-contact-form": [
        "cpe:2.3:a:fullworksplugins:quick_contact_form:*:*:*:*:*:wordpress:*:*"
      ],
@@ -15458,6 +15573,9 @@
      "quickswish": [
        "cpe:2.3:a:hasthemes:quickswish:*:*:*:*:*:wordpress:*:*"
      ],
+      "quillforms": [
+        "cpe:2.3:a:mdmag:quill_forms:*:*:*:*:*:wordpress:*:*"
+      ],
      "quiz-expert": [
        "cpe:2.3:a:wepupil:quiz_expert_-_easy_quiz_maker\\,_exam_and_test_manager:*:*:*:*:*:wordpress:*:*"
      ],
@@ -16131,6 +16249,9 @@
      "sendpress": [
        "cpe:2.3:a:pressified:sendpress:*:*:*:*:*:wordpress:*:*"
      ],
+      "sendpulse-email-marketing-newsletter": [
+        "cpe:2.3:a:sendpulse:sendpulse_email_marketing_newsletter:*:*:*:*:*:wordpress:*:*"
+      ],
      "sendpulse-web-push": [
        "cpe:2.3:a:sendpulse:free_web_push:*:*:*:*:*:wordpress:*:*"
      ],
@@ -16205,6 +16326,9 @@
        "cpe:2.3:a:legalweb:wp_dsgvo_tools:*:*:*:*:*:wordpress:*:*",
        "cpe:2.3:a:shapepress:wp_dsgvo_tools:*:*:*:*:*:wordpress:*:*"
      ],
+      "share-buttons": [
+        "cpe:2.3:a:artlosk:social_share_buttons:*:*:*:*:*:wordpress:*:*"
+      ],
      "share-on-diaspora": [
        "cpe:2.3:a:share_on_diaspora_project:share_on_diaspora:*:*:*:*:*:wordpress:*:*"
      ],
@@ -16285,7 +16409,8 @@
      ],
      "shortcodes-ultimate": [
        "cpe:2.3:a:getshortcodes:shortcodes_ultimate:*:*:*:*:*:wordpress:*:*",
-        "cpe:2.3:a:getshortcodes:shortcodes_ultimate:*:*:*:*:-:wordpress:*:*"
+        "cpe:2.3:a:getshortcodes:shortcodes_ultimate:*:*:*:*:-:wordpress:*:*",
+        "cpe:2.3:a:getshortcodes:shortcodes_ultimate:*:*:*:*:pro:wordpress:*:*"
      ],
      "shortcut-macros": [
        "cpe:2.3:a:shortcut_macros_project:shortcut_macros:*:*:*:*:*:wordpress:*:*"
@@ -16436,6 +16561,9 @@
        "cpe:2.3:a:simplefilelist:simple-file-list:*:*:*:*:*:wordpress:*:*",
        "cpe:2.3:a:simplefilelist:simple_file_list:*:*:*:*:*:wordpress:*:*"
      ],
+      "simple-form": [
+        "cpe:2.3:a:devsabbirahmed:simple_form:*:*:*:*:*:wordpress:*:*"
+      ],
      "simple-history": [
        "cpe:2.3:a:simple_history_project:simple_history:*:*:*:*:*:wordpress:*:*"
      ],
@@ -16464,6 +16592,9 @@
      "simple-ldap-login": [
        "cpe:2.3:a:objectiv:simple_ldap_login:*:*:*:*:*:wordpress:*:*"
      ],
+      "simple-lightbox": [
+        "cpe:2.3:a:archetyped:simple_lightbox:*:*:*:*:*:wordpress:*:*"
+      ],
      "simple-link-directory": [
        "cpe:2.3:a:quantumcloud:simple_link_directory:*:*:*:*:*:wordpress:*:*"
      ],
@@ -16846,7 +16977,8 @@
        "cpe:2.3:a:wpmudev:smartcrawl:*:*:*:*:*:wordpress:*:*"
      ],
      "smartsearchwp": [
-        "cpe:2.3:a:smartsearchwp:smartsearchwp:*:*:*:*:*:wordpress:*:*"
+        "cpe:2.3:a:smartsearchwp:smartsearchwp:*:*:*:*:*:wordpress:*:*",
+        "cpe:2.3:a:webdigit:chatbot_with_chatgpt:*:*:*:*:*:wordpress:*:*"
      ],
      "smartsoftbutton-widget-de-botones-de-chat": [
        "cpe:2.3:a:smartsoft:button_widget_smartsoft:*:*:*:*:*:wordpress:*:*"
@@ -16920,6 +17052,9 @@
      "social-media-feather": [
        "cpe:2.3:a:sharethis:social_media_feather:*:*:*:*:*:wordpress:*:*"
      ],
+      "social-media-widget": [
+        "cpe:2.3:a:bmwebproperties:social_media_widget:*:*:*:*:*:wordpress:*:*"
+      ],
      "social-networks-auto-poster-facebook-twitter-g": [
        "cpe:2.3:a:nextscripts:social_networks_auto_poster:*:*:*:*:*:wordpress:*:*"
      ],
@@ -17023,6 +17158,9 @@
      "spice-starter-sites": [
        "cpe:2.3:a:spicethemes:spice_starter_sites:*:*:*:*:*:wordpress:*:*"
      ],
+      "spider-contacts": [
+        "cpe:2.3:a:10web:spidercontacts:*:*:*:*:*:wordpress:*:*"
+      ],
      "spider-event-calendar": [
        "cpe:2.3:a:web-dorado:spider_calendar:*:*:*:*:*:wordpress:*:*",
        "cpe:2.3:a:web-dorado:spider_event_calendar:*:*:*:*:*:*:*:*"
@@ -17264,6 +17402,9 @@
      "support-chat": [
        "cpe:2.3:a:ninjateam:click_to_chat:*:*:*:*:*:wordpress:*:*"
      ],
+      "support-svg": [
+        "cpe:2.3:a:sayedulsayem:support_svg:*:*:*:*:*:wordpress:*:*"
+      ],
      "supportcandy": [
        "cpe:2.3:a:supportcandy:supportcandy:*:*:*:*:*:wordpress:*:*"
      ],
@@ -17691,6 +17832,9 @@
      "tourfic": [
        "cpe:2.3:a:themefic:tourfic:*:*:*:*:*:wordpress:*:*"
      ],
+      "tournamatch": [
+        "cpe:2.3:a:tournamatch:tournamatch:*:*:*:*:*:wordpress:*:*"
+      ],
      "tp-education": [
        "cpe:2.3:a:themepalace:tp_education:*:*:*:*:*:wordpress:*:*"
      ],
@@ -17706,6 +17850,9 @@
      "tracking-code-manager": [
        "cpe:2.3:a:data443:tracking_code_manager:*:*:*:*:*:wordpress:*:*"
      ],
+      "tradedoubler-affiliate-tracker": [
+        "cpe:2.3:a:tradedoubler:grow:*:*:*:*:*:wordpress:*:*"
+      ],
      "tradetracker-store": [
        "cpe:2.3:a:wpaffiliatefeed:tradetracker-store:*:*:*:*:*:wordpress:*:*"
      ],
@@ -18563,6 +18710,9 @@
      "widget-twitter": [
        "cpe:2.3:a:web-dorado:wd_widgettwitter:*:*:*:*:*:wordpress:*:*"
      ],
+      "widget4call": [
+        "cpe:2.3:a:apidaze:widget4call:*:*:*:*:*:wordpress:*:*"
+      ],
      "widgetkit-for-elementor": [
        "cpe:2.3:a:themesgrove:all-in-one_addons_for_elementor:*:*:*:*:*:wordpress:*:*"
      ],
@@ -18812,6 +18962,9 @@
      "woocommerce-amazon-affiliates-light-version": [
        "cpe:2.3:a:wzone_project:wzone:*:*:*:*:lite:wordpress:*:*"
      ],
+      "woocommerce-and-wp-emember-integration": [
+        "cpe:2.3:a:tipsandtricks-hq:wp_emember:*:*:*:*:*:wordpress:*:*"
+      ],
      "woocommerce-catalog-enquiry": [
        "cpe:2.3:a:multivendorx:product_catalog_mode_for_woocommerce:*:*:*:*:*:wordpress:*:*",
        "cpe:2.3:a:wc-marketplace:wc_catalog_enquiry:*:*:*:*:*:wordpress:*:*"
@@ -19095,6 +19248,9 @@
      "wp-ban": [
        "cpe:2.3:a:wp-ban_project:wp-ban:*:*:*:*:*:wordpress:*:*"
      ],
+      "wp-base-booking-of-appointments-services-and-events": [
+        "cpe:2.3:a:wp-base:wp_base_booking_of_appointments\\,_services_and_events:*:*:*:*:*:wordpress:*:*"
+      ],
      "wp-best-quiz": [
        "cpe:2.3:a:subina:wp_best_quiz:*:*:*:*:*:wordpress:*:*"
      ],
@@ -19228,6 +19384,9 @@
      "wp-commentnavi": [
        "cpe:2.3:a:wp-commentnavi_project:wp-commentnavi:*:*:*:*:*:wordpress:*:*"
      ],
+      "wp-compress-image-optimizer": [
+        "cpe:2.3:a:wpcompress:wp_compress:*:*:*:*:*:wordpress:*:*"
+      ],
      "wp-concours": [
        "cpe:2.3:a:olyos:wp-concours:*:*:*:*:*:wordpress:*:*"
      ],
@@ -19400,6 +19559,9 @@
      "wp-education": [
        "cpe:2.3:a:hasthemes:wp_education:*:*:*:*:*:wordpress:*:*"
      ],
+      "wp-eggdrop": [
+        "cpe:2.3:a:backie:wp-eggdrop:*:*:*:*:*:wordpress:*:*"
+      ],
      "wp-email": [
        "cpe:2.3:a:wp-email_project:wp-email:*:*:*:*:*:wordpress:*:*"
      ],
@@ -19627,6 +19789,9 @@
      "wp-imageflow2": [
        "cpe:2.3:a:spiffyplugins:wp_flow_plus:*:*:*:*:*:wordpress:*:*"
      ],
+      "wp-imagezoom": [
+        "cpe:2.3:a:aueda:wp-imagezoom:*:*:*:*:*:wordpress:*:*"
+      ],
      "wp-import-export-lite": [
        "cpe:2.3:a:vjinfotech:wp_import_export_lite:*:*:*:*:*:wordpress:*:*"
      ],
@@ -20231,7 +20396,7 @@
        "cpe:2.3:a:wp-t-wap_project:wp-t-wap:*:*:*:*:*:wordpress:*:*"
      ],
      "wp-table-builder": [
-        "cpe:2.3:a:wptablebuilder:wp_table_builder:*:*:*:*:*:wordpress:*:*"
+        "cpe:2.3:a:dotcamp:wp_table_builder:*:*:*:*:*:wordpress:*:*"
      ],
      "wp-table-reloaded": [
        "cpe:2.3:a:wp-table_reloaded_project:wp-table_reloaded:*:*:*:*:*:wordpress:*:*"
@@ -20493,7 +20658,8 @@
        "cpe:2.3:a:wpforms:wpforms:*:*:*:*:pro:wordpress:*:*"
      ],
      "wpforms-lite": [
-        "cpe:2.3:a:wpforms:contact_form:*:*:*:*:*:wordpress:*:*"
+        "cpe:2.3:a:wpforms:contact_form:*:*:*:*:*:wordpress:*:*",
+        "cpe:2.3:a:wpforms:wpforms:*:*:*:*:lite:wordpress:*:*"
      ],
      "wpforo": [
        "cpe:2.3:a:gvectors:wpforo:*:*:*:*:*:wordpress:*:*",
@@ -20552,6 +20718,9 @@
      "wpmarketplace": [
        "cpe:2.3:a:wpmarketplace_project:wpmarketplace:*:*:*:*:*:wordpress:*:*"
      ],
+      "wpmovielibrary": [
+        "cpe:2.3:a:caercam:wpmovielibrary:*:*:*:*:*:wordpress:*:*"
+      ],
      "wpo365-login": [
        "cpe:2.3:a:wpo365:wordpress_\\+_azure_ad_\\/_microsoft_office_365:*:*:*:*:*:wordpress:*:*"
      ],
@@ -20836,6 +21005,9 @@
      "z-companion": [
        "cpe:2.3:a:wpzita:z_companion:*:*:*:*:*:wordpress:*:*"
      ],
+      "z-downloads": [
+        "cpe:2.3:a:urbanbase:z-downloads:*:*:*:*:*:wordpress:*:*"
+      ],
      "z-url-preview": [
        "cpe:2.3:a:z-url_preview_project:z-url_preview:*:*:*:*:*:wordpress:*:*"
      ],
@@ -0,0 +1,736 @@
+package pe
+
+import (
+	"bytes"
+	"debug/pe"
+	"encoding/binary"
+	"errors"
+	"fmt"
+	"io"
+	"unicode/utf16"
+
+	"github.com/scylladb/go-set/strset"
+	"github.com/scylladb/go-set/u32set"
+
+	"github.com/anchore/syft/internal/log"
+	"github.com/anchore/syft/syft/file"
+	"github.com/anchore/syft/syft/internal/unionreader"
+)
+
+const peMaxAllowedDirectoryEntries = 0x1000
+
+var imageDirectoryEntryIndexes = []int{
+	pe.IMAGE_DIRECTORY_ENTRY_RESOURCE,       // where version resources are stored
+	pe.IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR, // where info about the CLR is stored
+}
+
+// File does not directly represent a binary shape to be parsed, instead it represents the
+// information of interest extracted from a PE file.
+type File struct {
+	// Location is where the PE file was found
+	Location file.Location
+
+	// CLR is the information about the CLR (common language runtime) version found in the PE file which helps
+	// understand if this executable is even a .NET application.
+	CLR *CLREvidence
+
+	// VersionResources is a map of version resource keys to their values found in the VERSIONINFO resource directory.
+	VersionResources map[string]string
+}
+
+// CLREvidence is basic info about the CLR (common language runtime) version from the COM descriptor.
+// This is not a complete representation of the CLR version, but rather a subset of the information that is
+// useful to us.
+type CLREvidence struct {
+	// HasClrResourceNames is true if there are CLR resource names found in the PE file (e.g. "CLRDEBUGINFO").
+	HasClrResourceNames bool
+
+	// MajorVersion is the minimum supported major version of the CLR.
+	MajorVersion uint16
+
+	// MinorVersion is the minimum supported minor version of the CLR.
+	MinorVersion uint16
+}
+
+// HasEvidenceOfCLR returns true if the PE file has evidence of a CLR (common language runtime) version.
+func (c *CLREvidence) HasEvidenceOfCLR() bool {
+	return c != nil && (c.MajorVersion != 0 && c.MinorVersion != 0 || c.HasClrResourceNames)
+}
+
+type peDosHeader struct {
+	Magic                 [2]byte // "MZ"
+	Unused                [58]byte
+	AddressOfNewEXEHeader uint32 // offset to PE header
+}
+
+// peImageCore20 represents the .NET Core 2.0 header structure.
+// Source: https://github.com/dotnet/msbuild/blob/9fa9d800dabce3bfcf8365f651f3a713e01f8a85/src/Tasks/NativeMethods.cs#L761-L775
+type peImageCore20 struct {
+	Cb                  uint32
+	MajorRuntimeVersion uint16
+	MinorRuntimeVersion uint16
+}
+
+// peImageResourceDirectory represents the resource directory structure.
+type peImageResourceDirectory struct {
+	Characteristics      uint32
+	TimeDateStamp        uint32
+	MajorVersion         uint16
+	MinorVersion         uint16
+	NumberOfNamedEntries uint16
+	NumberOfIDEntries    uint16
+}
+
+// peImageResourceDirectoryEntry represents an entry in the resource directory entries.
+type peImageResourceDirectoryEntry struct {
+	Name         uint32
+	OffsetToData uint32
+}
+
+// peImageResourceDataEntry is the unit of raw data in the Resource Data area.
+type peImageResourceDataEntry struct {
+	OffsetToData uint32
+	Size         uint32
+	CodePage     uint32
+	Reserved     uint32
+}
+
+// peVsFixedFileInfo represents the fixed file information structure.
+type peVsFixedFileInfo struct {
+	Signature        uint32
+	StructVersion    uint32
+	FileVersionMS    uint32
+	FileVersionLS    uint32
+	ProductVersionMS uint32
+	ProductVersionLS uint32
+	FileFlagsMask    uint32
+	FileFlags        uint32
+	FileOS           uint32
+	FileType         uint32
+	FileSubtype      uint32
+	FileDateMS       uint32
+	FileDateLS       uint32
+}
+
+type peVsVersionInfo peLenValLenType
+
+type peStringFileInfo peLenValLenType
+
+type peStringTable peLenValLenType
+
+type peString peLenValLenType
+
+type peLenValLenType struct {
+	Length      uint16
+	ValueLength uint16
+	Type        uint16
+}
+
+type extractedSection struct {
+	RVA     uint32
+	BaseRVA uint32
+	Size    uint32
+	Reader  *bytes.Reader
+}
+
+func (s extractedSection) exists() bool {
+	return s.RVA != 0 && s.Size != 0
+}
+
+func directoryName(i int) string {
+	switch i {
+	case pe.IMAGE_DIRECTORY_ENTRY_RESOURCE:
+		return "Resource"
+	case pe.IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR:
+		return "COM Descriptor"
+	}
+	return fmt.Sprintf("Unknown (%d)", i)
+}
+
+func Read(f file.LocationReadCloser) (*File, error) {
+	r, err := unionreader.GetUnionReader(f)
+	if err != nil {
+		return nil, err
+	}
+
+	sections, _, err := parsePEFile(r)
+	if err != nil {
+		return nil, fmt.Errorf("unable to parse PE sections: %w", err)
+	}
+
+	dirs := u32set.New()                        // keep track of the RVAs we have already parsed (prevent infinite recursion edge cases)
+	versionResources := make(map[string]string) // map of version resource keys to their values
+	resourceNames := strset.New()               // set of resource names found in the PE file
+	err = parseResourceDirectory(sections[pe.IMAGE_DIRECTORY_ENTRY_RESOURCE], dirs, versionResources, resourceNames)
+	if err != nil {
+		return nil, err
+	}
+
+	c, err := parseCLR(sections[pe.IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR], resourceNames)
+	if err != nil {
+		return nil, fmt.Errorf("unable to parse PE CLR directory: %w", err)
+	}
+
+	return &File{
+		Location:         f.Location,
+		CLR:              c,
+		VersionResources: versionResources,
+	}, nil
+}
+
+// parsePEFile creates readers for targeted sections of the binary used by downstream processing.
+func parsePEFile(file unionreader.UnionReader) (map[int]*extractedSection, []pe.SectionHeader32, error) {
+	fileHeader, magic, err := parsePEHeader(file)
+	if err != nil {
+		return nil, nil, fmt.Errorf("error parsing PE header: %w", err)
+	}
+
+	soi, headers, err := parseSectionHeaders(file, magic, fileHeader.NumberOfSections)
+	if err != nil {
+		return nil, nil, fmt.Errorf("error parsing section headers: %w", err)
+	}
+
+	for i, sec := range soi {
+		if !sec.exists() {
+			continue
+		}
+		data, err := readDataFromRVA(file, sec.RVA, sec.Size, headers)
+		if err != nil {
+			return nil, nil, fmt.Errorf("error reading %q section data: %w", directoryName(i), err)
+		}
+		sec.Reader = data
+	}
+
+	return soi, headers, nil
+}
+
+// parsePEHeader reads the beginning of a PE formatted file, returning the file header and "magic" indicator
+// for downstream logic to determine 32/64 bit parsing.
+func parsePEHeader(file unionreader.UnionReader) (*pe.FileHeader, uint16, error) {
+	var dosHeader peDosHeader
+	if err := binary.Read(file, binary.LittleEndian, &dosHeader); err != nil {
+		return nil, 0, fmt.Errorf("error reading DOS header: %w", err)
+	}
+	if string(dosHeader.Magic[:]) != "MZ" {
+		return nil, 0, fmt.Errorf("invalid DOS header magic")
+	}
+
+	peOffset := int64(dosHeader.AddressOfNewEXEHeader)
+	if _, err := file.Seek(peOffset, io.SeekStart); err != nil {
+		return nil, 0, fmt.Errorf("error seeking to PE header: %w", err)
+	}
+
+	var signature [4]byte
+	if err := binary.Read(file, binary.LittleEndian, &signature); err != nil {
+		return nil, 0, fmt.Errorf("error reading PE signature: %w", err)
+	}
+	if !bytes.Equal(signature[:], []byte("PE\x00\x00")) {
+		return nil, 0, fmt.Errorf("invalid PE signature")
+	}
+
+	var fileHeader pe.FileHeader
+	if err := binary.Read(file, binary.LittleEndian, &fileHeader); err != nil {
+		return nil, 0, fmt.Errorf("error reading file header: %w", err)
+	}
+
+	var magic uint16
+	if err := binary.Read(file, binary.LittleEndian, &magic); err != nil {
+		return nil, 0, fmt.Errorf("error reading optional header magic: %w", err)
+	}
+
+	// seek back to before reading magic (since that value is in the header)
+	if _, err := file.Seek(-2, io.SeekCurrent); err != nil {
+		return nil, 0, fmt.Errorf("error seeking back to before reading magic: %w", err)
+	}
+
+	return &fileHeader, magic, nil
+}
+
+// parseSectionHeaders reads the section headers from the PE file and extracts the virtual addresses + section size
+// information for the sections of interest. Additionally, all section headers are returned to aid in downstream processing.
+func parseSectionHeaders(file unionreader.UnionReader, magic uint16, numberOfSections uint16) (map[int]*extractedSection, []pe.SectionHeader32, error) {
+	soi := make(map[int]*extractedSection)
+	switch magic {
+	case 0x10B: // PE32
+		var optHeader pe.OptionalHeader32
+		if err := binary.Read(file, binary.LittleEndian, &optHeader); err != nil {
+			return nil, nil, fmt.Errorf("error reading optional header (PE32): %w", err)
+		}
+
+		for _, i := range imageDirectoryEntryIndexes {
+			sectionHeader := optHeader.DataDirectory[i]
+			if sectionHeader.Size == 0 {
+				continue
+			}
+			soi[i] = &extractedSection{
+				RVA:  sectionHeader.VirtualAddress,
+				Size: sectionHeader.Size,
+			}
+		}
+	case 0x20B: // PE32+ (64 bit)
+		var optHeader pe.OptionalHeader64
+		if err := binary.Read(file, binary.LittleEndian, &optHeader); err != nil {
+			return nil, nil, fmt.Errorf("error reading optional header (PE32+): %w", err)
+		}
+
+		for _, i := range imageDirectoryEntryIndexes {
+			sectionHeader := optHeader.DataDirectory[i]
+			if sectionHeader.Size == 0 {
+				continue
+			}
+			soi[i] = &extractedSection{
+				RVA:  sectionHeader.VirtualAddress,
+				Size: sectionHeader.Size,
+			}
+		}
+	default:
+		return nil, nil, fmt.Errorf("unknown optional header magic: 0x%x", magic)
+	}
+
+	// read section headers
+	headers := make([]pe.SectionHeader32, numberOfSections)
+	for i := 0; i < int(numberOfSections); i++ {
+		if err := binary.Read(file, binary.LittleEndian, &headers[i]); err != nil {
+			return nil, nil, fmt.Errorf("error reading section header: %w", err)
+		}
+	}
+
+	return soi, headers, nil
+}
+
+// parseCLR extracts the CLR (common language runtime) version information from the COM descriptor and makes
+// present/not-present determination based on the presence of CLR resource names.
+func parseCLR(sec *extractedSection, resourceNames *strset.Set) (*CLREvidence, error) {
+	hasCLRDebugResourceNames := resourceNames.HasAny("CLRDEBUGINFO")
+	if sec == nil || sec.Reader == nil {
+		return &CLREvidence{
+			HasClrResourceNames: hasCLRDebugResourceNames,
+		}, nil
+	}
+
+	reader := sec.Reader
+	var c peImageCore20
+	if err := binary.Read(reader, binary.LittleEndian, &c); err != nil {
+		return nil, fmt.Errorf("error reading CLR header: %w", err)
+	}
+
+	return &CLREvidence{
+		HasClrResourceNames: hasCLRDebugResourceNames,
+		MajorVersion:        c.MajorRuntimeVersion,
+		MinorVersion:        c.MinorRuntimeVersion,
+	}, nil
+}
+
+// rvaToFileOffset is a helper function to convert RVA to file offset using section headers
+func rvaToFileOffset(rva uint32, sections []pe.SectionHeader32) (uint32, error) {
+	for _, section := range sections {
+		if rva >= section.VirtualAddress && rva < section.VirtualAddress+section.VirtualSize {
+			return section.PointerToRawData + (rva - section.VirtualAddress), nil
+		}
+	}
+	return 0, fmt.Errorf("RVA 0x%x not found in any section", rva)
+}
+
+// readDataFromRVA will read data from a specific RVA in the PE file
+func readDataFromRVA(file io.ReadSeeker, rva, size uint32, sections []pe.SectionHeader32) (*bytes.Reader, error) {
+	if size == 0 {
+		return nil, fmt.Errorf("zero size specified")
+	}
+
+	offset, err := rvaToFileOffset(rva, sections)
+	if err != nil {
+		return nil, err
+	}
+
+	if _, err := file.Seek(int64(offset), io.SeekStart); err != nil {
+		return nil, fmt.Errorf("error seeking to data: %w", err)
+	}
+
+	data := make([]byte, size)
+	if _, err := io.ReadFull(file, data); err != nil {
+		return nil, fmt.Errorf("error reading data: %w", err)
+	}
+
+	return bytes.NewReader(data), nil
+}
+
+// parseResourceDirectory recursively parses a PE resource directory. This takes a relative virtual address (offset of
+// a piece of data or code relative to the base address), the size of the resource directory, the set of RVAs already
+// parsed, and the map to populate discovered version resource values.
+//
+// .rsrc Section
+// +------------------------------+
+// | Resource Directory Table     |
+// +------------------------------+
+// | Resource Directory Entries   |
+// |  +------------------------+  |
+// |  | Subdirectory or Data   |  |
+// |  +------------------------+  |
+// +------------------------------+
+// | Resource Data Entries        |
+// |  +------------------------+  |
+// |  | Resource Data          |  |
+// |  +------------------------+  |
+// +------------------------------+
+// | Actual Resource Data         |
+// +------------------------------+
+//
+// sources:
+// - https://learn.microsoft.com/en-us/windows/win32/debug/pe-format#the-rsrc-section
+// - https://learn.microsoft.com/en-us/previous-versions/ms809762(v=msdn.10)#pe-file-resources
+func parseResourceDirectory(sec *extractedSection, dirs *u32set.Set, fields map[string]string, names *strset.Set) error {
+	if sec == nil || sec.Size <= 0 {
+		return nil
+	}
+
+	if sec.Reader == nil {
+		return errors.New("resource section not found")
+	}
+
+	baseRVA := sec.BaseRVA
+	if baseRVA == 0 {
+		baseRVA = sec.RVA
+	}
+
+	offset := int64(sec.RVA - baseRVA)
+	if _, err := sec.Reader.Seek(offset, io.SeekStart); err != nil {
+		return fmt.Errorf("error seeking to directory offset: %w", err)
+	}
+
+	var directoryHeader peImageResourceDirectory
+	if err := readIntoStruct(sec.Reader, &directoryHeader); err != nil {
+		return fmt.Errorf("error reading directory header: %w", err)
+	}
+
+	numEntries := int(directoryHeader.NumberOfNamedEntries + directoryHeader.NumberOfIDEntries)
+	switch {
+	case numEntries > peMaxAllowedDirectoryEntries:
+		return fmt.Errorf("too many entries in resource directory: %d", numEntries)
+	case numEntries == 0:
+		return fmt.Errorf("no entries in resource directory")
+	case numEntries < 0:
+		return fmt.Errorf("invalid number of entries in resource directory: %d", numEntries)
+	}
+
+	for i := 0; i < numEntries; i++ {
+		var entry peImageResourceDirectoryEntry
+
+		entryOffset := offset + int64(binary.Size(directoryHeader)) + int64(i*binary.Size(entry))
+		if _, err := sec.Reader.Seek(entryOffset, io.SeekStart); err != nil {
+			log.Tracef("error seeking to PE entry offset: %v", err)
+			continue
+		}
+
+		if err := readIntoStruct(sec.Reader, &entry); err != nil {
+			continue
+		}
+
+		if err := processResourceEntry(entry, baseRVA, sec, dirs, fields, names); err != nil {
+			log.Tracef("error processing resource entry: %v", err)
+			continue
+		}
+	}
+
+	return nil
+}
+
+func processResourceEntry(entry peImageResourceDirectoryEntry, baseRVA uint32, sec *extractedSection, dirs *u32set.Set, fields map[string]string, names *strset.Set) error {
+	// if the high bit is set, this is a directory entry, otherwise it is a data entry
+	isDirectory := entry.OffsetToData&0x80000000 != 0
+
+	// note: the offset is relative to the beginning of the resource section, not an RVA
+	entryOffsetToData := entry.OffsetToData & 0x7FFFFFFF
+
+	nameIsString := entry.Name&0x80000000 != 0
+	nameOffset := entry.Name & 0x7FFFFFFF
+
+	// read the string name of the resource directory
+	if nameIsString {
+		currentPos, err := sec.Reader.Seek(0, io.SeekCurrent)
+		if err != nil {
+			return fmt.Errorf("error getting current reader position: %w", err)
+		}
+
+		if _, err := sec.Reader.Seek(int64(nameOffset), io.SeekStart); err != nil {
+			return fmt.Errorf("error restoring reader position: %w", err)
+		}
+
+		name, err := readUTF16WithLength(sec.Reader)
+		if err == nil {
+			names.Add(name)
+		}
+
+		if _, err := sec.Reader.Seek(currentPos, io.SeekStart); err != nil {
+			return fmt.Errorf("error restoring reader position: %w", err)
+		}
+	}
+
+	if isDirectory {
+		subRVA := baseRVA + entryOffsetToData
+		if dirs.Has(subRVA) {
+			// some malware uses recursive PE references to evade analysis
+			return fmt.Errorf("recursive PE reference detected; skipping directory at baseRVA=0x%x subRVA=0x%x", baseRVA, subRVA)
+		}
+
+		dirs.Add(subRVA)
+		err := parseResourceDirectory(
+			&extractedSection{
+				RVA:     subRVA,
+				BaseRVA: baseRVA,
+				Size:    sec.Size - (sec.RVA - baseRVA),
+				Reader:  sec.Reader,
+			},
+			dirs, fields, names)
+		if err != nil {
+			return err
+		}
+		return nil
+	}
+	return parseResourceDataEntry(sec.Reader, baseRVA, baseRVA+entryOffsetToData, sec.Size, fields)
+}
+
+func parseResourceDataEntry(reader *bytes.Reader, baseRVA, rva, remainingSize uint32, fields map[string]string) error {
+	var dataEntry peImageResourceDataEntry
+	offset := int64(rva - baseRVA)
+
+	if _, err := reader.Seek(offset, io.SeekStart); err != nil {
+		return fmt.Errorf("error seeking to data entry offset: %w", err)
+	}
+
+	if err := readIntoStruct(reader, &dataEntry); err != nil {
+		return fmt.Errorf("error reading resource data entry: %w", err)
+	}
+
+	if remainingSize < dataEntry.Size {
+		return fmt.Errorf("resource data entry size exceeds remaining size")
+	}
+
+	data := make([]byte, dataEntry.Size)
+	if _, err := reader.Seek(int64(dataEntry.OffsetToData-baseRVA), io.SeekStart); err != nil {
+		return fmt.Errorf("error seeking to resource data: %w", err)
+	}
+
+	if _, err := reader.Read(data); err != nil {
+		return fmt.Errorf("error reading resource data: %w", err)
+	}
+
+	return parseVersionResourceSection(bytes.NewReader(data), fields)
+}
+
+// parseVersionResourceSection parses a PE version resource section from within a resource directory.
+//
+//	"The main structure in a version resource is the VS_FIXEDFILEINFO structure. Additional structures include the
+//	VarFileInfo structure to store language information data, and StringFileInfo for user-defined string information.
+//	All strings in a version resource are in Unicode format. Each block of information is aligned on a DWORD boundary."
+//
+//	"VS_VERSIONINFO" (utf16)
+//	+---------------------------------------------------+
+//	| wLength (2 bytes)                                 |
+//	| wValueLength (2 bytes)                            |
+//	| wType (2 bytes)                                   |
+//	| szKey ("VS_VERSION_INFO") (utf16)                 |
+//	| Padding (to DWORD)                                |
+//	+---------------------------------------------------+
+//	| VS_FIXEDFILEINFO (52 bytes)                       |
+//	+---------------------------------------------------+
+//	| "StringFileInfo" (utf16)                          |
+//	+---------------------------------------------------+
+//	| wLength (2 bytes)                                 |
+//	| wValueLength (2 bytes)                            |
+//	| wType (2 bytes)                                   |
+//	| szKey ("StringFileInfo") (utf16)                  |
+//	| Padding (to DWORD)                                |
+//	| StringTable                                       |
+//	|   +--------------------------------------------+  |
+//	|   | wLength (2 bytes)                          |  |
+//	|   | wValueLength (2 bytes)                     |  |
+//	|   | wType (2 bytes)                            |  |
+//	|   | szKey ("040904b0")                         |  |
+//	|   | Padding (to DWORD)                         |  |
+//	|   | String                                     |  |
+//	|   | +--------------------------------------+   |  |
+//	|   | | wLength (2 bytes)                    |   |  |
+//	|   | | wValueLength (2 bytes)               |   |  |
+//	|   | | wType (2 bytes)                      |   |  |
+//	|   | | szKey ("FileVersion")                |   |  |
+//	|   | | Padding (to DWORD)                   |   |  |
+//	|   | | szValue ("15.00.0913.015")           |   |  |
+//	|   | | Padding (to DWORD)                   |   |  |
+//	|   +--------------------------------------------+  |
+//	+---------------------------------------------------+
+//	| VarFileInfo  (utf16)                              |
+//	+---------------------------------------------------+
+//	| (skip!)                                           |
+//	+---------------------------------------------------+
+//
+// sources:
+//   - https://learn.microsoft.com/en-us/windows/win32/menurc/resource-file-formats
+//   - https://learn.microsoft.com/en-us/windows/win32/menurc/vs-versioninfo
+//   - https://learn.microsoft.com/en-us/windows/win32/api/verrsrc/ns-verrsrc-vs_fixedfileinfo
+//   - https://learn.microsoft.com/en-us/windows/win32/menurc/varfileinfo
+//   - https://learn.microsoft.com/en-us/windows/win32/menurc/stringfileinfo
+//   - https://learn.microsoft.com/en-us/windows/win32/menurc/stringtable
+func parseVersionResourceSection(reader *bytes.Reader, fields map[string]string) error {
+	offset := 0
+
+	var info peVsVersionInfo
+	if szKey, err := readIntoStructAndSzKey(reader, &info, &offset); err != nil {
+		return fmt.Errorf("error reading PE version info: %v", err)
+	} else if szKey != "VS_VERSION_INFO" {
+		// this is a resource section, but not the version resources
+		return nil
+	}
+
+	if err := alignAndSeek(reader, &offset); err != nil {
+		return fmt.Errorf("error aligning past PE version info: %w", err)
+	}
+
+	var fixedFileInfo peVsFixedFileInfo
+	if err := readIntoStruct(reader, &fixedFileInfo, &offset); err != nil {
+		return fmt.Errorf("error reading PE FixedFileInfo: %v", err)
+	}
+
+	for reader.Len() > 0 {
+		if err := alignAndSeek(reader, &offset); err != nil {
+			return fmt.Errorf("error seeking to PE StringFileInfo: %w", err)
+		}
+
+		var sfiHeader peStringFileInfo
+		if szKey, err := readIntoStructAndSzKey(reader, &sfiHeader, &offset); err != nil {
+			return fmt.Errorf("error reading PE string file info header: %v", err)
+		} else if szKey != "StringFileInfo" {
+			// we only care about extracting strings from any string tables, skip this
+			offset += int(sfiHeader.ValueLength)
+			continue
+		}
+
+		var stOffset int
+
+		// note: the szKey for the prStringTable is the language
+		var stHeader peStringTable
+		if _, err := readIntoStructAndSzKey(reader, &stHeader, &offset, &stOffset); err != nil {
+			return fmt.Errorf("error reading PE string table header: %v", err)
+		}
+
+		for stOffset < int(stHeader.Length) {
+			var stringHeader peString
+			if err := readIntoStruct(reader, &stringHeader, &offset, &stOffset); err != nil {
+				break
+			}
+
+			key := readUTF16(reader, &offset, &stOffset)
+
+			if err := alignAndSeek(reader, &offset, &stOffset); err != nil {
+				return fmt.Errorf("error aligning to next PE string table value: %w", err)
+			}
+
+			var value string
+			if stringHeader.ValueLength > 0 {
+				value = readUTF16(reader, &offset, &stOffset)
+			}
+
+			fields[key] = value
+
+			if err := alignAndSeek(reader, &offset, &stOffset); err != nil {
+				return fmt.Errorf("error aligning to next PE string table key: %w", err)
+			}
+		}
+	}
+
+	if fields["FileVersion"] == "" {
+		// we can derive the file version from the fixed file info if it is not already specified as a string entry... neat!
+		fields["FileVersion"] = fmt.Sprintf("%d.%d.%d.%d",
+			fixedFileInfo.FileVersionMS>>16, fixedFileInfo.FileVersionMS&0xFFFF,
+			fixedFileInfo.FileVersionLS>>16, fixedFileInfo.FileVersionLS&0xFFFF)
+	}
+
+	return nil
+}
+
+// readIntoStructAndSzKey reads a struct from the reader and updates the offsets if provided, returning the szKey value.
+// This is only useful in the context of the resource directory parsing in narrow cases (this is invalid to use outside of that context).
+func readIntoStructAndSzKey[T any](reader *bytes.Reader, data *T, offsets ...*int) (string, error) {
+	if err := readIntoStruct(reader, data, offsets...); err != nil {
+		return "", err
+	}
+	return readUTF16(reader, offsets...), nil
+}
+
+// readIntoStruct reads a struct from the reader and updates the offsets if provided.
+func readIntoStruct[T any](reader io.Reader, data *T, offsets ...*int) error {
+	if err := binary.Read(reader, binary.LittleEndian, data); err != nil {
+		if errors.Is(err, io.EOF) {
+			return nil
+		}
+		return err
+	}
+
+	for i := range offsets {
+		*offsets[i] += binary.Size(*data)
+	}
+	return nil
+}
+
+// alignAndSeek aligns the reader to the next DWORD boundary and seeks to the new offset (updating any provided trackOffsets).
+func alignAndSeek(reader io.Seeker, offset *int, trackOffsets ...*int) error {
+	ogOffset := *offset
+	*offset = alignToDWORD(*offset)
+	diff := *offset - ogOffset
+	for i := range trackOffsets {
+		*trackOffsets[i] += diff
+	}
+	_, err := reader.Seek(int64(*offset), io.SeekStart)
+	return err
+}
+
+// alignToDWORD aligns the offset to the next DWORD boundary (4 byte boundary)
+func alignToDWORD(offset int) int {
+	return (offset + 3) & ^3
+}
+
+// readUTF16 is a helper function to read a null-terminated UTF16 string
+func readUTF16(reader *bytes.Reader, offsets ...*int) string {
+	startPos, err := reader.Seek(0, io.SeekCurrent)
+	if err != nil {
+		return ""
+	}
+
+	var result []rune
+	for {
+		var char uint16
+		err := binary.Read(reader, binary.LittleEndian, &char)
+		if err != nil || char == 0 {
+			break
+		}
+		result = append(result, rune(char))
+	}
+
+	// calculate how many bytes we've actually read (including null terminator)
+	endPos, _ := reader.Seek(0, io.SeekCurrent)
+	bytesRead := int(endPos - startPos)
+
+	for i := range offsets {
+		*offsets[i] += bytesRead
+	}
+
+	return string(result)
+}
+
+// readUTF16WithLength reads a length-prefixed UTF-16 string from reader.
+// The first 2 bytes represent the number of UTF-16 code units.
+func readUTF16WithLength(reader *bytes.Reader) (string, error) {
+	var length uint16
+	if err := binary.Read(reader, binary.LittleEndian, &length); err != nil {
+		return "", err
+	}
+	if length == 0 {
+		return "", nil
+	}
+
+	// read length UTF-16 code units.
+	codes := make([]uint16, length)
+	if err := binary.Read(reader, binary.LittleEndian, &codes); err != nil {
+		return "", err
+	}
+	return string(utf16.Decode(codes)), nil
+}
@@ -1,4 +1,4 @@
-package dotnet
+package pe

 import (
 	"testing"
@@ -13,7 +13,7 @@ import (
 	"github.com/anchore/syft/syft/source/stereoscopesource"
 )

-func Test_getLogicalDotnetPE(t *testing.T) {
+func Test_Read_DotNetDetection(t *testing.T) {
 	tests := []struct {
 		name    string
 		fixture string
@@ -126,7 +126,7 @@ func Test_getLogicalDotnetPE(t *testing.T) {

 			reader := fixtureFile(t, tt.fixture, tt.path)

-			got, err := getLogicalDotnetPE(reader)
+			got, err := Read(reader)
 			tt.wantErr(t, err)
 			if err != nil {
 				return
@@ -136,7 +136,7 @@ func Test_getLogicalDotnetPE(t *testing.T) {
 				t.Errorf("unexpected version resources (-want +got): %s", d)
 			}

-			assert.Equal(t, tt.wantCLR, got.CLR.hasEvidenceOfCLR())
+			assert.Equal(t, tt.wantCLR, got.CLR.HasEvidenceOfCLR())
 		})
 	}
 }
@@ -0,0 +1 @@
+../../../dotnet/test-fixtures/image-net8-app
@@ -0,0 +1 @@
+../../../dotnet/test-fixtures/image-net8-app-single-file
@@ -16,7 +16,6 @@ import (
 	"github.com/anchore/syft/internal"
 	"github.com/anchore/syft/internal/log"
 	"github.com/anchore/syft/internal/mimetype"
-	"github.com/anchore/syft/internal/unknown"
 	"github.com/anchore/syft/syft/artifact"
 	"github.com/anchore/syft/syft/file"
 	"github.com/anchore/syft/syft/format/cyclonedxjson"
@@ -509,7 +508,7 @@ func (ni nativeImagePE) fetchPkgs() (pkgs []pkg.Package, relationships []artifac
 }

 // fetchPkgs provides the packages available in a UnionReader.
-func fetchPkgs(reader unionreader.UnionReader, filename string) ([]pkg.Package, []artifact.Relationship, error) {
+func fetchPkgs(reader unionreader.UnionReader, filename string) ([]pkg.Package, []artifact.Relationship) {
 	var pkgs []pkg.Package
 	var relationships []artifact.Relationship
 	imageFormats := []func(string, io.ReaderAt) (nativeImage, error){newElf, newMachO, newPE}
@@ -519,9 +518,8 @@ func fetchPkgs(reader unionreader.UnionReader, filename string) ([]pkg.Package,
 	readers, err := unionreader.GetReaders(reader)
 	if err != nil {
 		log.Debugf("failed to open the java native-image binary: %v", err)
-		return nil, nil, nil
+		return nil, nil
 	}
-	var unknowns error
 	for _, r := range readers {
 		for _, makeNativeImage := range imageFormats {
 			ni, err := makeNativeImage(filename, r)
@@ -534,14 +532,13 @@ func fetchPkgs(reader unionreader.UnionReader, filename string) ([]pkg.Package,
 			newPkgs, newRelationships, err := ni.fetchPkgs()
 			if err != nil {
 				log.Tracef("unable to extract SBOM from possible java native-image %s: %v", filename, err)
-				unknowns = unknown.Join(unknowns, fmt.Errorf("unable to extract SBOM from possible java native-image %s: %w", filename, err))
 				continue
 			}
 			pkgs = append(pkgs, newPkgs...)
 			relationships = append(relationships, newRelationships...)
 		}
 	}
-	return pkgs, relationships, unknowns
+	return pkgs, relationships
 }

 // Catalog attempts to find any native image executables reachable from a resolver.
@@ -552,18 +549,17 @@ func (c *nativeImageCataloger) Catalog(_ context.Context, resolver file.Resolver
 	if err != nil {
 		return pkgs, nil, fmt.Errorf("failed to find binaries by mime types: %w", err)
 	}
-	var errs error
+
 	for _, location := range fileMatches {
 		newPkgs, newRelationships, err := processLocation(location, resolver)
 		if err != nil {
-			errs = unknown.Append(errs, location, err)
-			continue
+			return nil, nil, err
 		}
 		pkgs = append(pkgs, newPkgs...)
 		relationships = append(relationships, newRelationships...)
 	}

-	return pkgs, relationships, errs
+	return pkgs, relationships, nil
 }

 func processLocation(location file.Location, resolver file.Resolver) ([]pkg.Package, []artifact.Relationship, error) {
@@ -578,6 +574,6 @@ func processLocation(location file.Location, resolver file.Resolver) ([]pkg.Pack
 	if err != nil {
 		return nil, nil, err
 	}
-	pkgs, relationships, err := fetchPkgs(reader, location.RealPath)
-	return pkgs, relationships, err
+	pkgs, relationships := fetchPkgs(reader, location.RealPath)
+	return pkgs, relationships, nil
 }
@@ -11,5 +11,5 @@ import (
 // NewOpamPackageManagerCataloger returns a new cataloger object for OCaml opam.
 func NewOpamPackageManagerCataloger() pkg.Cataloger {
 	return generic.NewCataloger("opam-cataloger").
-		WithParserByGlobs(parseOpamPackage, "*opam")
+		WithParserByGlobs(parseOpamPackage, "**/*opam")
 }
@@ -716,10 +716,15 @@ func Test_PackageCataloger_SitePackageRelationships(t *testing.T) {
 				"certifi @ 2020.12.5 (/usr/local/lib/python3.9/dist-packages) [dependency-of] requests @ 2.25.0 (/usr/local/lib/python3.9/dist-packages)",
 				"certifi @ 2020.12.5 (/usr/local/lib/python3.9/dist-packages) [dependency-of] urllib3 @ 1.26.18 (/usr/local/lib/python3.9/dist-packages)", // available when extra == "secure", but another dependency is primarily installing it
 				"chardet @ 3.0.4 (/usr/local/lib/python3.9/dist-packages) [dependency-of] requests @ 2.25.0 (/usr/local/lib/python3.9/dist-packages)",
+				"distlib @ 0.3.9 (/usr/local/lib/python3.9/dist-packages) [dependency-of] virtualenv @ 20.31.2 (/usr/local/lib/python3.9/dist-packages)",
+				"filelock @ 3.18.0 (/usr/local/lib/python3.9/dist-packages) [dependency-of] virtualenv @ 20.31.2 (/usr/local/lib/python3.9/dist-packages)",
 				"idna @ 2.10 (/usr/local/lib/python3.9/dist-packages) [dependency-of] requests @ 2.25.0 (/usr/local/lib/python3.9/dist-packages)",
+				"idna @ 2.10 (/usr/local/lib/python3.9/dist-packages) [dependency-of] urllib3 @ 1.26.18 (/usr/local/lib/python3.9/dist-packages)", // available when extra == "secure", but another dependency is primarily installing it
+				"platformdirs @ 4.3.8 (/usr/local/lib/python3.9/dist-packages) [dependency-of] virtualenv @ 20.31.2 (/usr/local/lib/python3.9/dist-packages)",
 				"six @ 1.16.0 (/usr/local/lib/python3.9/dist-packages) [dependency-of] blessed @ 1.20.0 (/usr/local/lib/python3.9/dist-packages)",
 				"soupsieve @ 2.2.1 (/usr/local/lib/python3.9/dist-packages) [dependency-of] beautifulsoup4 @ 4.9.3 (/usr/local/lib/python3.9/dist-packages)",
 				"urllib3 @ 1.26.18 (/usr/local/lib/python3.9/dist-packages) [dependency-of] requests @ 2.25.0 (/usr/local/lib/python3.9/dist-packages)",
+				"virtualenv @ 20.31.2 (/usr/local/lib/python3.9/dist-packages) [dependency-of] filelock @ 3.18.0 (/usr/local/lib/python3.9/dist-packages)", // available when extra == "testing", but we are installing it
 				"wcwidth @ 0.2.13 (/usr/local/lib/python3.9/dist-packages) [dependency-of] blessed @ 1.20.0 (/usr/local/lib/python3.9/dist-packages)",

 				// purely python 3.8 dist-packages
@@ -736,9 +741,14 @@ func Test_PackageCataloger_SitePackageRelationships(t *testing.T) {
 				"certifi @ 2020.12.5 (/usr/local/lib/python3.8/dist-packages) [dependency-of] requests @ 2.25.0 (/usr/local/lib/python3.8/dist-packages)",
 				"certifi @ 2020.12.5 (/usr/local/lib/python3.8/dist-packages) [dependency-of] urllib3 @ 1.26.18 (/usr/local/lib/python3.8/dist-packages)", // available when extra == "secure", but another dependency is primarily installing it
 				"chardet @ 3.0.4 (/usr/local/lib/python3.8/dist-packages) [dependency-of] requests @ 2.25.0 (/usr/local/lib/python3.8/dist-packages)",
+				"distlib @ 0.3.9 (/usr/local/lib/python3.8/dist-packages) [dependency-of] virtualenv @ 20.31.2 (/usr/local/lib/python3.8/dist-packages)",
+				"filelock @ 3.16.1 (/usr/local/lib/python3.8/dist-packages) [dependency-of] virtualenv @ 20.31.2 (/usr/local/lib/python3.8/dist-packages)",
 				"idna @ 2.10 (/usr/local/lib/python3.8/dist-packages) [dependency-of] requests @ 2.25.0 (/usr/local/lib/python3.8/dist-packages)",
+				"idna @ 2.10 (/usr/local/lib/python3.8/dist-packages) [dependency-of] urllib3 @ 1.26.18 (/usr/local/lib/python3.8/dist-packages)", // available when extra == "secure", but another dependency is primarily installing it
+				"platformdirs @ 4.3.6 (/usr/local/lib/python3.8/dist-packages) [dependency-of] virtualenv @ 20.31.2 (/usr/local/lib/python3.8/dist-packages)",
 				"soupsieve @ 2.2 (/usr/local/lib/python3.8/dist-packages) [dependency-of] beautifulsoup4 @ 4.9.2 (/usr/local/lib/python3.8/dist-packages)",
 				"urllib3 @ 1.26.18 (/usr/local/lib/python3.8/dist-packages) [dependency-of] requests @ 2.25.0 (/usr/local/lib/python3.8/dist-packages)",
+				"virtualenv @ 20.31.2 (/usr/local/lib/python3.8/dist-packages) [dependency-of] filelock @ 3.16.1 (/usr/local/lib/python3.8/dist-packages)", // available when extra == "testing", but we are installing it
 				"xmod @ 1.8.1 (/usr/local/lib/python3.8/dist-packages) [dependency-of] runs @ 1.2.2 (/usr/local/lib/python3.8/dist-packages)",

 				// project 1 virtual env
@@ -759,6 +769,7 @@ func Test_PackageCataloger_SitePackageRelationships(t *testing.T) {
 				"blessed @ 1.20.0 (/usr/local/lib/python3.9/dist-packages) [dependency-of] inquirer @ 3.0.0 (/app/project1/venv/lib/python3.9/site-packages)",      // note: depends on global site package!
 				"python-editor @ 1.0.4 (/usr/local/lib/python3.9/dist-packages) [dependency-of] inquirer @ 3.0.0 (/app/project1/venv/lib/python3.9/site-packages)", // note: depends on global site package!
 				"readchar @ 4.2.1 (/app/project1/venv/lib/python3.9/site-packages) [dependency-of] inquirer @ 3.0.0 (/app/project1/venv/lib/python3.9/site-packages)",
+				"setuptools @ 44.0.0 (/app/project1/venv/lib/python3.9/site-packages) [dependency-of] virtualenv @ 20.31.2 (/usr/local/lib/python3.9/dist-packages)", // available when extra == "test", but we are installing it
 				"soupsieve @ 2.3 (/app/project1/venv/lib/python3.9/site-packages) [dependency-of] beautifulsoup4 @ 4.10.0 (/app/project1/venv/lib/python3.9/site-packages)",

 				// project 2 virtual env
@@ -115,14 +115,16 @@ func wheelEggDependencySpecifier(p pkg.Package) dependency.Specification {
 	}
 }

-// extractPackageName removes any extras or version constraints from a given Requires-Dist field value (and
+// extractPackageName removes any extras, version constraints or environment markers from a given Requires-Dist field value (and
 // semantically similar fields), leaving only the package name.
 func extractPackageName(s string) string {
 	// examples:
-	// html5lib ; extra == 'html5lib'   -->  html5lib
-	// soupsieve (>1.2)					-->  soupsieve
+	// requests [security,tests]		--> requests
+	// requests >= 2.8.1			--> requests
+	// requests (>= 2.8.1)			--> requests
+	// requests ; python_version < "2.7"	--> requests

-	return strings.TrimSpace(internal.SplitAny(s, "(;")[0])
+	return strings.TrimSpace(internal.SplitAny(s, "[(<!=>~;")[0])
 }
 func extractPackageNames(ss []string) []string {
 	var names []string
@@ -10,9 +10,9 @@ import (
 	"strconv"
 	"time"

-	rpmdb "github.com/anchore/go-rpmdb/pkg"
 	"github.com/sassoftware/go-rpmutils"

+	rpmdb "github.com/anchore/go-rpmdb/pkg"
 	"github.com/anchore/syft/internal/log"
 	"github.com/anchore/syft/syft/artifact"
 	"github.com/anchore/syft/syft/file"
@@ -9,7 +9,6 @@ import (
 	"strings"

 	rpmdb "github.com/anchore/go-rpmdb/pkg"
-
 	"github.com/anchore/syft/internal/log"
 	"github.com/anchore/syft/internal/unknown"
 	"github.com/anchore/syft/syft/artifact"
@@ -59,7 +59,7 @@ func TestTerraformCataloger(t *testing.T) {
 		Metadata: pkg.TerraformLockProviderEntry{
 			URL:         "registry.terraform.io/hashicorp/google",
 			Version:     "6.8.0",
-			Constraints: "6.8.0",
+			Constraints: "",
 			Hashes: []string{
 				"h1:GlCaVPk6eKMg2ZbRY7C5tUeHGNIABT+qFtMl8+XWZHM=",
 				"zh:1b78f4451f1617092eb6891c9c13eda79671060601c40947feea6794c732157a",
@@ -26,7 +26,6 @@ provider "registry.terraform.io/hashicorp/aws" {

 provider "registry.terraform.io/hashicorp/google" {
  version     = "6.8.0"
-  constraints = "6.8.0"
  hashes = [
    "h1:GlCaVPk6eKMg2ZbRY7C5tUeHGNIABT+qFtMl8+XWZHM=",
    "zh:1b78f4451f1617092eb6891c9c13eda79671060601c40947feea6794c732157a",
@@ -3,7 +3,7 @@ package pkg
 // TerraformLockProviderEntry represents a single provider entry in a Terraform dependency lock file (.terraform.lock.hcl).
 type TerraformLockProviderEntry struct {
 	URL         string   `hcl:",label" json:"url"`
-	Constraints string   `hcl:"constraints" json:"constraints"`
+	Constraints string   `hcl:"constraints,optional" json:"constraints"`
 	Version     string   `hcl:"version" json:"version"`
 	Hashes      []string `hcl:"hashes" json:"hashes"`
 }
@@ -22,7 +22,6 @@ func Test_Unknowns(t *testing.T) {
 				assertInOutput(`no package identified in executable file`),
 				assertInOutput(`unable to read files from java archive`),
 				assertInOutput(`no package identified in archive`),
-				assertInOutput(`cycle during symlink resolution`),
 				assertSuccessfulReturnCode,
 			},
 		},
Author	SHA1	Message	Date
Alex Goodman	18f9b5ab58	remove benchmark utils (#3982 ) Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>	2025-06-09 18:24:49 +00:00
Keith Zantow	9090c69708	fix: exclude packages with SPDX GENERATED_FROM source package indication (#3981 ) Signed-off-by: Keith Zantow <kzantow@gmail.com>	2025-06-09 14:12:23 -04:00
dependabot[bot]	1396a14550	chore(deps): bump modernc.org/sqlite from 1.37.1 to 1.38.0 (#3979 ) Bumps [modernc.org/sqlite](https://gitlab.com/cznic/sqlite) from 1.37.1 to 1.38.0. - [Commits](https://gitlab.com/cznic/sqlite/compare/v1.37.1...v1.38.0) --- updated-dependencies: - dependency-name: modernc.org/sqlite dependency-version: 1.38.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2025-06-09 10:31:10 -04:00
dependabot[bot]	592bc0af7d	chore(deps): bump github.com/go-git/go-git/v5 from 5.16.1 to 5.16.2 (#3978 ) Bumps [github.com/go-git/go-git/v5](https://github.com/go-git/go-git) from 5.16.1 to 5.16.2. - [Release notes](https://github.com/go-git/go-git/releases) - [Commits](https://github.com/go-git/go-git/compare/v5.16.1...v5.16.2) --- updated-dependencies: - dependency-name: github.com/go-git/go-git/v5 dependency-version: 5.16.2 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2025-06-09 10:26:47 -04:00
anchore-actions-token-generator[bot]andspiffcs	b6b8a8f52e	chore(deps): update tools to latest versions (#3977 ) Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: spiffcs <32073428+spiffcs@users.noreply.github.com>	2025-06-09 08:56:36 -04:00
anchore-actions-token-generator[bot]andwagoodman	a196cc9215	chore(deps): update CPE dictionary index (#3976 ) Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: wagoodman <590471+wagoodman@users.noreply.github.com>	2025-06-09 08:56:18 -04:00
dependabot[bot]	12c8003317	chore(deps): bump golang.org/x/net from 0.40.0 to 0.41.0 (#3970 ) Bumps [golang.org/x/net](https://github.com/golang/net) from 0.40.0 to 0.41.0. - [Commits](https://github.com/golang/net/compare/v0.40.0...v0.41.0) --- updated-dependencies: - dependency-name: golang.org/x/net dependency-version: 0.41.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2025-06-06 10:23:02 -04:00
dependabot[bot]	0a25c0ec5c	chore(deps): bump github.com/sergi/go-diff (#3971 ) Bumps [github.com/sergi/go-diff](https://github.com/sergi/go-diff) from 1.3.2-0.20230802210424-5b0b94c5c0d3 to 1.4.0. - [Commits](https://github.com/sergi/go-diff/commits/v1.4.0) --- updated-dependencies: - dependency-name: github.com/sergi/go-diff dependency-version: 1.4.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2025-06-06 10:22:54 -04:00
Christoph Blessing	5ae11bd1f7	Fix Python package dependency detection (#3965 ) Previously a dependency relationship between two Python packages was not detected if there were no parentheses around the version specifier in the wheel metadata of the parent package. This commit allows detection of such relationships. Signed-off-by: Christoph Blessing <chris24.blessing@gmail.com>	2025-06-06 09:46:16 -04:00
John Vandenberg	bc1cbde4f7	fix: Remove three Rust crate false positive CPE matches (#3967 ) Signed-off-by: John Vandenberg <jayvdb@gmail.com>	2025-06-06 04:29:06 -04:00
Michael BrileyandAlex Goodman	868a6a7584	Harden Container Runtime with Non-Root User (#3941 ) * Update Dockerfile Signed-off-by: Michael Briley <michael.briley937@gmail.com> * Update Dockerfile Signed-off-by: Michael Briley <michael.briley937@gmail.com> * Update validations.yaml Signed-off-by: Michael Briley <michael.briley937@gmail.com> * Update validations.yaml Signed-off-by: Michael Briley <michael.briley937@gmail.com> * Update Dockerfile Signed-off-by: Michael Briley <michael.briley937@gmail.com> * Update validations.yaml Signed-off-by: Michael Briley <michael.briley937@gmail.com> * Update Dockerfile Signed-off-by: Michael Briley <michael.briley937@gmail.com> * Update .goreleaser.yaml Signed-off-by: Michael Briley <michael.briley937@gmail.com> * Update .goreleaser.yaml Signed-off-by: Michael Briley <michael.briley937@gmail.com> * use distroless/static-debian12:nonroot directly Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * keep manual manifest curation Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * remove qemu usage Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * add smoke test for snapshot Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * split up manifests section with comments Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * correct ci step name Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * fix arch condition Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * keep path prefix Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> --------- Signed-off-by: Michael Briley <michael.briley937@gmail.com> Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com>	2025-06-05 12:36:23 -04:00
John Vandenberg	bd894b9c4d	fix: Remove two Rust crate false positive CPE matches (#3962 ) Rust crates opentelemetry and redis are being given CPEs that match CVEs such as CVE-2023-45142 and CVE-2022-24735 respectively. The vendor overrides added here prevent that. Signed-off-by: John Vandenberg <jayvdb@gmail.com>	2025-06-05 10:28:54 -04:00
dependabot[bot]	c36c69779a	chore(deps): bump golang.org/x/mod from 0.24.0 to 0.25.0 (#3963 ) Bumps [golang.org/x/mod](https://github.com/golang/mod) from 0.24.0 to 0.25.0. - [Commits](https://github.com/golang/mod/compare/v0.24.0...v0.25.0) --- updated-dependencies: - dependency-name: golang.org/x/mod dependency-version: 0.25.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2025-06-05 13:46:58 +00:00
dependabot[bot]	cd23ccc6e6	chore(deps): bump github.com/gkampitakis/go-snaps from 0.5.12 to 0.5.13 (#3964 ) Bumps [github.com/gkampitakis/go-snaps](https://github.com/gkampitakis/go-snaps) from 0.5.12 to 0.5.13. - [Release notes](https://github.com/gkampitakis/go-snaps/releases) - [Commits](https://github.com/gkampitakis/go-snaps/compare/v0.5.12...v0.5.13) --- updated-dependencies: - dependency-name: github.com/gkampitakis/go-snaps dependency-version: 0.5.13 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2025-06-05 13:45:40 +00:00
Keith Zantow	71d84603c1	fix: bump stereoscope to fix symlink performance issue (#3953 ) Signed-off-by: Keith Zantow <kzantow@gmail.com>	2025-06-04 15:50:03 +00:00
dependabot[bot]	f2118b568d	chore(deps): bump github.com/go-git/go-git/v5 from 5.16.0 to 5.16.1 (#3960 ) Bumps [github.com/go-git/go-git/v5](https://github.com/go-git/go-git) from 5.16.0 to 5.16.1. - [Release notes](https://github.com/go-git/go-git/releases) - [Commits](https://github.com/go-git/go-git/compare/v5.16.0...v5.16.1) --- updated-dependencies: - dependency-name: github.com/go-git/go-git/v5 dependency-version: 5.16.1 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2025-06-04 14:02:45 +00:00
dependabot[bot]	bb50f1650d	chore(deps): bump github/codeql-action from 3.28.18 to 3.28.19 (#3952 ) Bumps [github/codeql-action](https://github.com/github/codeql-action) from 3.28.18 to 3.28.19. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/ff0a06e83cb2de871e5a09832bc6a81e7276941f...fca7ace96b7d713c7035871441bd52efbe39e27e) --- updated-dependencies: - dependency-name: github/codeql-action dependency-version: 3.28.19 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2025-06-03 10:20:24 -04:00
Christopher Angelo Phillips	a0be514184	feat: add syft schema version to version command (#3949 ) --------- Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com>	2025-06-02 15:50:21 +00:00
dependabot[bot]	8cc808f8f6	chore(deps): bump github.com/gkampitakis/go-snaps from 0.5.11 to 0.5.12 (#3943 ) Bumps [github.com/gkampitakis/go-snaps](https://github.com/gkampitakis/go-snaps) from 0.5.11 to 0.5.12. - [Release notes](https://github.com/gkampitakis/go-snaps/releases) - [Commits](https://github.com/gkampitakis/go-snaps/compare/v0.5.11...v0.5.12) --- updated-dependencies: - dependency-name: github.com/gkampitakis/go-snaps dependency-version: 0.5.12 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2025-06-02 10:46:30 -04:00
anchore-actions-token-generator[bot]andspiffcs	967e2f85bf	chore(deps): update tools to latest versions (#3945 ) Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: spiffcs <32073428+spiffcs@users.noreply.github.com>	2025-06-02 10:46:20 -04:00
anchore-actions-token-generator[bot]andwagoodman	339fea9851	chore(deps): update CPE dictionary index (#3947 ) Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: wagoodman <590471+wagoodman@users.noreply.github.com>	2025-06-02 10:43:31 -04:00
Keith Zantow	576e729c84	fix: revert incorrect graalvm unknown behavior (#3944 ) Signed-off-by: Keith Zantow <kzantow@gmail.com>	2025-05-30 11:36:57 -04:00
dependabot[bot]	b3e8926025	chore(deps): bump github.com/google/go-containerregistry (#3933 ) Bumps [github.com/google/go-containerregistry](https://github.com/google/go-containerregistry) from 0.20.4 to 0.20.5. - [Release notes](https://github.com/google/go-containerregistry/releases) - [Changelog](https://github.com/google/go-containerregistry/blob/main/.goreleaser.yml) - [Commits](https://github.com/google/go-containerregistry/compare/v0.20.4...v0.20.5) --- updated-dependencies: - dependency-name: github.com/google/go-containerregistry dependency-version: 0.20.5 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2025-05-28 12:45:51 -04:00
anchore-actions-token-generator[bot]andwagoodman	002ec4510a	chore(deps): update CPE dictionary index (#3935 ) Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: wagoodman <590471+wagoodman@users.noreply.github.com>	2025-05-28 12:45:42 -04:00
Thomas Gosteli	684e1e963d	fix(terraform): parse provider lock entries without constraints (#3934 ) In a .terraform.lock.hcl file in a provider block the `constraints` attribute is actually not required (=optional). Signed-off-by: Thomas Gosteli <thomas.gosteli@protonmail.ch>	2025-05-27 14:55:19 -04:00
Dan LuhringandKeith Zantow	bbf3bb5856	fix(relationship): favor real paths over symlinks for ownership by file (#3923 ) Signed-off-by: Dan Luhring <dluhring@chainguard.dev> Signed-off-by: Keith Zantow <kzantow@gmail.com> Co-authored-by: Keith Zantow <kzantow@gmail.com>	2025-05-23 14:33:19 -04:00
dependabot[bot]	31c1be6d4d	chore(deps): bump modernc.org/sqlite from 1.37.0 to 1.37.1 (#3926 ) Bumps [modernc.org/sqlite](https://gitlab.com/cznic/sqlite) from 1.37.0 to 1.37.1. - [Commits](https://gitlab.com/cznic/sqlite/compare/v1.37.0...v1.37.1) --- updated-dependencies: - dependency-name: modernc.org/sqlite dependency-version: 1.37.1 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2025-05-22 10:47:26 -04:00
Keith Zantow	7bfb4c86a6	fix(dotnet-deps-cataloger): avoid repeated dependency resolution (#3930 ) Signed-off-by: Keith Zantow <kzantow@gmail.com>	2025-05-21 21:28:40 -04:00
anchore-actions-token-generator[bot]andspiffcs	18ed8b60f8	chore(deps): update tools to latest versions (#3921 ) Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: spiffcs <32073428+spiffcs@users.noreply.github.com>	2025-05-21 10:56:17 -04:00
dependabot[bot]	b5e9f75ef1	chore(deps): bump github.com/google/go-containerregistry (#3925 ) Bumps [github.com/google/go-containerregistry](https://github.com/google/go-containerregistry) from 0.20.3 to 0.20.4. - [Release notes](https://github.com/google/go-containerregistry/releases) - [Changelog](https://github.com/google/go-containerregistry/blob/main/.goreleaser.yml) - [Commits](https://github.com/google/go-containerregistry/compare/v0.20.3...v0.20.4) --- updated-dependencies: - dependency-name: github.com/google/go-containerregistry dependency-version: 0.20.4 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2025-05-21 10:55:48 -04:00
Alex Goodman	ac883f52ed	add cdx group as purl namespace (#3922 ) Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>	2025-05-20 15:56:08 -04:00
Alex Goodman	e23ca43a83	add PE binary cataloger (#3911 ) Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>	2025-05-19 14:17:09 -04:00
				`@@ -0,0 +1 @@`
				`../../../dotnet/test-fixtures/image-net8-app`