{ "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:8a430a7f-28fc-4a6f-9a3c-5bb2412cfbed", "version": 1, "metadata": { "timestamp": "2026-10-13T09:47:45.680339+00:00", "component": { "type": "application", "name": "sbomify Release v0.25.1", "bom-ref": "release-EFzqiQE6pzzU" } }, "components": [ { "bom-ref": "pkg:pypi/pip@26.1.2", "type": "library", "name": "pip", "version": "26.1.2", "purl": "pkg:pypi/pip@26.1.2", "scope": "excluded", "description": "Present only as an unextracted wheel at /usr/share/python-wheels/pip-26.1.2-py3-none-any.whl, inherited from the Chainguard base image. Not installed, not importable, not executable by the runtime user." }, { "bom-ref": "pkg:golang/github.com/sigstore/cosign@v3.1.3", "type": "application", "name": "cosign", "version": "v3.1.3", "purl": "pkg:golang/github.com/sigstore/cosign@v3.1.3", "description": "The identity as published in this tag's SBOM. The module path is missing its Go major version suffix, which is what causes the six false advisory matches. Retained here verbatim so this VEX matches the finding as a scanner reports it." }, { "bom-ref": "pkg:golang/github.com/sigstore/cosign/v3@v3.1.3", "type": "application", "name": "cosign", "version": "v3.1.3", "purl": "pkg:golang/github.com/sigstore/cosign/v3@v3.1.3", "description": "The correct Go module path for cosign v3.1.3, confirmed against go.mod at that tag. Emitted by sbomify PR #1519 onward. Included so this VEX keeps matching once the SBOM is regenerated." } ], "vulnerabilities": [ { "bom-ref": "vuln-cve-2026-13346", "id": "CVE-2026-13346", "source": { "name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-13346" }, "references": [ { "id": "GHSA-qwm4-qh6w-59xr", "source": { "name": "GitHub Advisory Database", "url": "https://github.com/advisories/GHSA-qwm4-qh6w-59xr" } }, { "id": "PYSEC-2026-3721", "source": { "name": "PyPI Advisory Database", "url": "https://osv.dev/vulnerability/PYSEC-2026-3721" } } ], "ratings": [ { "source": { "name": "GitHub Advisory Database", "url": "https://github.com/advisories/GHSA-qwm4-qh6w-59xr" }, "severity": "high", "score": 7.5 } ], "description": "pip would incorrectly handle doubly-encoded package URLs from indexes, allowing files to be installed to arbitrary locations on disk. Fixed in pip 26.2.0.", "affects": [ { "ref": "sbomify-container@v26.8.0", "versions": [ { "version": "v26.8.0", "status": "unaffected" } ] }, { "ref": "pkg:pypi/pip@26.1.2" } ], "analysis": { "state": "not_affected", "justification": "code_not_reachable", "response": [ "update" ], "detail": "pip 26.1.2 is present in the image but is not installed and cannot execute.\n\nVerified by inspecting ghcr.io/sbomify/sbomify:v26.8.0 (index digest sha256:953fdc9693b5c504bd0db3734066c1feb7f8d4c9bc2cafe15dc4f3725160b014, linux/amd64 manifest sha256:84c652b88f5cb45aed29ab84a33b4262a5d4909b8e1bc4510d64fa4c4f8f980f).\n\n1. Form on disk. pip exists only as an unextracted wheel archive at /usr/share/python-wheels/pip-26.1.2-py3-none-any.whl, 1814110 bytes, owned root:root, mode 0644. It is inherited from the pinned base image cgr.dev/chainguard/python@sha256:33334c2bf93fd99e6b3c42b518cc44bb5277a954826cdb4f9275ef95818d7eb7, which ships the same file. Nothing in the build extracts or installs it.\n\n2. Not importable. Inside the running image, importlib.util.find_spec(\"pip\") returns None. setuptools resolves from the virtualenv, pip and wheel do not. The stdlib ensurepip module reports _PIP_VERSION 26.1.2, which records the bundled wheel rather than an installation.\n\n3. Not installable by the runtime user. The container runs as UID 65532 (nonroot). The virtualenv site-packages directory is not writable by that user, and the production image is distroless with no shell.\n\n4. Never invoked. No application source calls pip. Python dependencies are installed with uv, at build time, in a separate stage that does not contribute to the runtime filesystem.\n\nCVE-2026-13346 requires pip to resolve and install a package from an index. Reaching that state from this image requires arbitrary code execution first, then installing pip from the wheel into a writable location, then pointing it at a hostile index. The first step already exceeds what this vulnerability grants.\n\nScope and remediation. This describes the image at the stated digest. The fix is not in the sbomify repository: the wheel comes from the base image, and a distroless stage cannot remove it because it has no shell and permits no RUN instruction. It clears when Chainguard publishes a base carrying pip 26.2.0 or later and CHAINGUARD_PYTHON_IMAGE in the Dockerfile is bumped to that digest.", "firstIssued": "2026-09-07T16:05:00Z", "lastUpdated": "2026-09-07T16:05:00Z" } }, { "bom-ref": "vuln-cve-2023-46737", "id": "CVE-2023-46737", "source": { "name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-46737" }, "references": [ { "id": "GHSA-vfp6-jrw2-99g9", "source": { "name": "GitHub Advisory Database", "url": "https://github.com/advisories/GHSA-vfp6-jrw2-99g9" } }, { "id": "GO-2023-2181", "source": { "name": "OSV", "url": "https://osv.dev/vulnerability/GO-2023-2181" } }, { "id": "BIT-cosign-2023-46737", "source": { "name": "OSV", "url": "https://osv.dev/vulnerability/BIT-cosign-2023-46737" } } ], "ratings": [ { "source": { "name": "GitHub Advisory Database", "url": "https://github.com/advisories/GHSA-vfp6-jrw2-99g9" }, "severity": "medium" } ], "description": "Denial of service attack from remote registry in github.com/sigstore/cosign.", "affects": [ { "ref": "sbomify-container@v26.8.0", "versions": [ { "version": "v26.8.0", "status": "unaffected" } ] }, { "ref": "pkg:golang/github.com/sigstore/cosign@v3.1.3" }, { "ref": "pkg:golang/github.com/sigstore/cosign/v3@v3.1.3" } ], "analysis": { "state": "not_affected", "justification": "code_not_present", "response": [ "will_not_fix" ], "detail": "The image ships cosign v3.1.3, which does not contain this vulnerability. The finding is an artifact of a malformed package URL in this tag's SBOM, not of the binary in the image.\n\nVerified in ghcr.io/sbomify/sbomify:v26.8.0 (index digest sha256:953fdc9693b5c504bd0db3734066c1feb7f8d4c9bc2cafe15dc4f3725160b014, linux/amd64 manifest sha256:84c652b88f5cb45aed29ab84a33b4262a5d4909b8e1bc4510d64fa4c4f8f980f): running `cosign version` inside the image reports GitVersion v3.1.3, GitCommit 11926fa5bbbbde47e88fc006b625a17769b743b2, built 2026-08-05, go1.26.4.\n\nRoot cause of the false match. This tag's SBOM identifies the binary as pkg:golang/github.com/sigstore/cosign@v3.1.3. A Go module path carries its major version as a suffix from v2 onward, so cosign v3.1.3 is the module github.com/sigstore/cosign/v3, confirmed by reading go.mod at tag v3.1.3. The path without the suffix names the abandoned v1 module. Advisory records carry a separate entry for that path with \"introduced 0\" and no fixed version, so it matches every version of cosign that has ever existed. That stale v1 entry, not the shipped binary, is what the scanner matched.\n\nStatus against the correct module path github.com/sigstore/cosign/v3: the advisory has no github.com/sigstore/cosign/v3 entry at all. It was fixed in the v2 module line at 2.2.1, well before the v3 module branched, so the vulnerable code has never been present in any v3 release.\n\nFixed for future releases by sbomify PR #1519, which derives the major version suffix from the pinned version so the emitted PURL names the correct module. This statement covers tag v26.8.0, whose SBOM was published before that change and cannot be regenerated retroactively.\n\nIndependently of version, this code path is not exercised: sbomify never has cosign contact a container registry. The only invocation is `cosign verify-blob-attestation` against a local bundle file.", "firstIssued": "2026-09-07T16:05:00Z", "lastUpdated": "2026-09-07T16:05:00Z" } }, { "bom-ref": "vuln-cve-2024-29902", "id": "CVE-2024-29902", "source": { "name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-29902" }, "references": [ { "id": "GHSA-88jx-383q-w4qc", "source": { "name": "GitHub Advisory Database", "url": "https://github.com/advisories/GHSA-88jx-383q-w4qc" } }, { "id": "GO-2024-2718", "source": { "name": "OSV", "url": "https://osv.dev/vulnerability/GO-2024-2718" } }, { "id": "BIT-cosign-2024-29902", "source": { "name": "OSV", "url": "https://osv.dev/vulnerability/BIT-cosign-2024-29902" } } ], "ratings": [ { "source": { "name": "GitHub Advisory Database", "url": "https://github.com/advisories/GHSA-88jx-383q-w4qc" }, "severity": "medium" } ], "description": "Cosign malicious attachments can cause system-wide denial of service.", "affects": [ { "ref": "sbomify-container@v26.8.0", "versions": [ { "version": "v26.8.0", "status": "unaffected" } ] }, { "ref": "pkg:golang/github.com/sigstore/cosign@v3.1.3" }, { "ref": "pkg:golang/github.com/sigstore/cosign/v3@v3.1.3" } ], "analysis": { "state": "not_affected", "justification": "code_not_present", "response": [ "will_not_fix" ], "detail": "The image ships cosign v3.1.3, which does not contain this vulnerability. The finding is an artifact of a malformed package URL in this tag's SBOM, not of the binary in the image.\n\nVerified in ghcr.io/sbomify/sbomify:v26.8.0 (index digest sha256:953fdc9693b5c504bd0db3734066c1feb7f8d4c9bc2cafe15dc4f3725160b014, linux/amd64 manifest sha256:84c652b88f5cb45aed29ab84a33b4262a5d4909b8e1bc4510d64fa4c4f8f980f): running `cosign version` inside the image reports GitVersion v3.1.3, GitCommit 11926fa5bbbbde47e88fc006b625a17769b743b2, built 2026-08-05, go1.26.4.\n\nRoot cause of the false match. This tag's SBOM identifies the binary as pkg:golang/github.com/sigstore/cosign@v3.1.3. A Go module path carries its major version as a suffix from v2 onward, so cosign v3.1.3 is the module github.com/sigstore/cosign/v3, confirmed by reading go.mod at tag v3.1.3. The path without the suffix names the abandoned v1 module. Advisory records carry a separate entry for that path with \"introduced 0\" and no fixed version, so it matches every version of cosign that has ever existed. That stale v1 entry, not the shipped binary, is what the scanner matched.\n\nStatus against the correct module path github.com/sigstore/cosign/v3: the advisory has no github.com/sigstore/cosign/v3 entry at all. It was fixed in the v2 module line at 2.2.4, well before the v3 module branched, so the vulnerable code has never been present in any v3 release.\n\nFixed for future releases by sbomify PR #1519, which derives the major version suffix from the pinned version so the emitted PURL names the correct module. This statement covers tag v26.8.0, whose SBOM was published before that change and cannot be regenerated retroactively.\n\nIndependently of version, the registry attachment path is not exercised: sbomify only runs `cosign verify-blob-attestation` against a local bundle file.", "firstIssued": "2026-09-07T16:05:00Z", "lastUpdated": "2026-09-07T16:05:00Z" } }, { "bom-ref": "vuln-cve-2024-29903", "id": "CVE-2024-29903", "source": { "name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-29903" }, "references": [ { "id": "GHSA-95pr-fxf5-86gv", "source": { "name": "GitHub Advisory Database", "url": "https://github.com/advisories/GHSA-95pr-fxf5-86gv" } }, { "id": "GO-2024-2719", "source": { "name": "OSV", "url": "https://osv.dev/vulnerability/GO-2024-2719" } }, { "id": "BIT-cosign-2024-29903", "source": { "name": "OSV", "url": "https://osv.dev/vulnerability/BIT-cosign-2024-29903" } } ], "ratings": [ { "source": { "name": "GitHub Advisory Database", "url": "https://github.com/advisories/GHSA-95pr-fxf5-86gv" }, "severity": "medium" } ], "description": "Cosign malicious artifacts can cause machine-wide denial of service.", "affects": [ { "ref": "sbomify-container@v26.8.0", "versions": [ { "version": "v26.8.0", "status": "unaffected" } ] }, { "ref": "pkg:golang/github.com/sigstore/cosign@v3.1.3" }, { "ref": "pkg:golang/github.com/sigstore/cosign/v3@v3.1.3" } ], "analysis": { "state": "not_affected", "justification": "code_not_present", "response": [ "will_not_fix" ], "detail": "The image ships cosign v3.1.3, which does not contain this vulnerability. The finding is an artifact of a malformed package URL in this tag's SBOM, not of the binary in the image.\n\nVerified in ghcr.io/sbomify/sbomify:v26.8.0 (index digest sha256:953fdc9693b5c504bd0db3734066c1feb7f8d4c9bc2cafe15dc4f3725160b014, linux/amd64 manifest sha256:84c652b88f5cb45aed29ab84a33b4262a5d4909b8e1bc4510d64fa4c4f8f980f): running `cosign version` inside the image reports GitVersion v3.1.3, GitCommit 11926fa5bbbbde47e88fc006b625a17769b743b2, built 2026-08-05, go1.26.4.\n\nRoot cause of the false match. This tag's SBOM identifies the binary as pkg:golang/github.com/sigstore/cosign@v3.1.3. A Go module path carries its major version as a suffix from v2 onward, so cosign v3.1.3 is the module github.com/sigstore/cosign/v3, confirmed by reading go.mod at tag v3.1.3. The path without the suffix names the abandoned v1 module. Advisory records carry a separate entry for that path with \"introduced 0\" and no fixed version, so it matches every version of cosign that has ever existed. That stale v1 entry, not the shipped binary, is what the scanner matched.\n\nStatus against the correct module path github.com/sigstore/cosign/v3: the advisory has no github.com/sigstore/cosign/v3 entry at all. It was fixed in the v2 module line at 2.2.4, well before the v3 module branched, so the vulnerable code has never been present in any v3 release.\n\nFixed for future releases by sbomify PR #1519, which derives the major version suffix from the pinned version so the emitted PURL names the correct module. This statement covers tag v26.8.0, whose SBOM was published before that change and cannot be regenerated retroactively.\n\nThe cosign subprocess is additionally bounded by an explicit timeout in sbomify/apps/plugins/builtins/verification.py.", "firstIssued": "2026-09-07T16:05:00Z", "lastUpdated": "2026-09-07T16:05:00Z" } }, { "bom-ref": "vuln-cve-2026-22703", "id": "CVE-2026-22703", "source": { "name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-22703" }, "references": [ { "id": "GHSA-whqx-f9j3-ch6m", "source": { "name": "GitHub Advisory Database", "url": "https://github.com/advisories/GHSA-whqx-f9j3-ch6m" } }, { "id": "GO-2026-4309", "source": { "name": "OSV", "url": "https://osv.dev/vulnerability/GO-2026-4309" } }, { "id": "BIT-cosign-2026-22703", "source": { "name": "OSV", "url": "https://osv.dev/vulnerability/BIT-cosign-2026-22703" } } ], "ratings": [ { "source": { "name": "GitHub Advisory Database", "url": "https://github.com/advisories/GHSA-whqx-f9j3-ch6m" }, "severity": "medium" } ], "description": "Cosign verification accepts any valid Rekor entry under certain conditions.", "affects": [ { "ref": "sbomify-container@v26.8.0", "versions": [ { "version": "v26.8.0", "status": "unaffected" } ] }, { "ref": "pkg:golang/github.com/sigstore/cosign@v3.1.3" }, { "ref": "pkg:golang/github.com/sigstore/cosign/v3@v3.1.3" } ], "analysis": { "state": "not_affected", "justification": "code_not_present", "response": [ "will_not_fix" ], "detail": "The image ships cosign v3.1.3, which does not contain this vulnerability. The finding is an artifact of a malformed package URL in this tag's SBOM, not of the binary in the image.\n\nVerified in ghcr.io/sbomify/sbomify:v26.8.0 (index digest sha256:953fdc9693b5c504bd0db3734066c1feb7f8d4c9bc2cafe15dc4f3725160b014, linux/amd64 manifest sha256:84c652b88f5cb45aed29ab84a33b4262a5d4909b8e1bc4510d64fa4c4f8f980f): running `cosign version` inside the image reports GitVersion v3.1.3, GitCommit 11926fa5bbbbde47e88fc006b625a17769b743b2, built 2026-08-05, go1.26.4.\n\nRoot cause of the false match. This tag's SBOM identifies the binary as pkg:golang/github.com/sigstore/cosign@v3.1.3. A Go module path carries its major version as a suffix from v2 onward, so cosign v3.1.3 is the module github.com/sigstore/cosign/v3, confirmed by reading go.mod at tag v3.1.3. The path without the suffix names the abandoned v1 module. Advisory records carry a separate entry for that path with \"introduced 0\" and no fixed version, so it matches every version of cosign that has ever existed. That stale v1 entry, not the shipped binary, is what the scanner matched.\n\nStatus against the correct module path github.com/sigstore/cosign/v3: the advisory's v3 entry is fixed at 3.0.4. The shipped 3.1.3 is later than the fix, so the vulnerable code is not present in this image.\n\nFixed for future releases by sbomify PR #1519, which derives the major version suffix from the pinned version so the emitted PURL names the correct module. This statement covers tag v26.8.0, whose SBOM was published before that change and cannot be regenerated retroactively.", "firstIssued": "2026-09-07T16:05:00Z", "lastUpdated": "2026-09-07T16:05:00Z" } }, { "bom-ref": "vuln-cve-2026-24122", "id": "CVE-2026-24122", "source": { "name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-24122" }, "references": [ { "id": "GHSA-wfqv-66vq-46rm", "source": { "name": "GitHub Advisory Database", "url": "https://github.com/advisories/GHSA-wfqv-66vq-46rm" } }, { "id": "GO-2026-4529", "source": { "name": "OSV", "url": "https://osv.dev/vulnerability/GO-2026-4529" } }, { "id": "BIT-cosign-2026-24122", "source": { "name": "OSV", "url": "https://osv.dev/vulnerability/BIT-cosign-2026-24122" } } ], "ratings": [ { "source": { "name": "GitHub Advisory Database", "url": "https://github.com/advisories/GHSA-wfqv-66vq-46rm" }, "severity": "medium" } ], "description": "Cosign considered signatures valid with expired intermediate certificates when transparency log verification is skipped.", "affects": [ { "ref": "sbomify-container@v26.8.0", "versions": [ { "version": "v26.8.0", "status": "unaffected" } ] }, { "ref": "pkg:golang/github.com/sigstore/cosign@v3.1.3" }, { "ref": "pkg:golang/github.com/sigstore/cosign/v3@v3.1.3" } ], "analysis": { "state": "not_affected", "justification": "code_not_present", "response": [ "will_not_fix" ], "detail": "The image ships cosign v3.1.3, which does not contain this vulnerability. The finding is an artifact of a malformed package URL in this tag's SBOM, not of the binary in the image.\n\nVerified in ghcr.io/sbomify/sbomify:v26.8.0 (index digest sha256:953fdc9693b5c504bd0db3734066c1feb7f8d4c9bc2cafe15dc4f3725160b014, linux/amd64 manifest sha256:84c652b88f5cb45aed29ab84a33b4262a5d4909b8e1bc4510d64fa4c4f8f980f): running `cosign version` inside the image reports GitVersion v3.1.3, GitCommit 11926fa5bbbbde47e88fc006b625a17769b743b2, built 2026-08-05, go1.26.4.\n\nRoot cause of the false match. This tag's SBOM identifies the binary as pkg:golang/github.com/sigstore/cosign@v3.1.3. A Go module path carries its major version as a suffix from v2 onward, so cosign v3.1.3 is the module github.com/sigstore/cosign/v3, confirmed by reading go.mod at tag v3.1.3. The path without the suffix names the abandoned v1 module. Advisory records carry a separate entry for that path with \"introduced 0\" and no fixed version, so it matches every version of cosign that has ever existed. That stale v1 entry, not the shipped binary, is what the scanner matched.\n\nStatus against the correct module path github.com/sigstore/cosign/v3: the advisory's v3 entry is fixed at 3.0.5. The shipped 3.1.3 is later than the fix, so the vulnerable code is not present in this image.\n\nFixed for future releases by sbomify PR #1519, which derives the major version suffix from the pinned version so the emitted PURL names the correct module. This statement covers tag v26.8.0, whose SBOM was published before that change and cannot be regenerated retroactively.\n\nA second, independent reason this does not apply: the precondition is never met. sbomify's cosign invocation passes no flag that skips transparency log verification, and no COSIGN_* environment variable is set anywhere in the image or the application.", "firstIssued": "2026-09-07T16:05:00Z", "lastUpdated": "2026-09-07T16:05:00Z" } }, { "bom-ref": "vuln-cve-2026-39395", "id": "CVE-2026-39395", "source": { "name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39395" }, "references": [ { "id": "GHSA-w6c6-c85g-mmv6", "source": { "name": "GitHub Advisory Database", "url": "https://github.com/advisories/GHSA-w6c6-c85g-mmv6" } }, { "id": "GO-2026-5694", "source": { "name": "OSV", "url": "https://osv.dev/vulnerability/GO-2026-5694" } }, { "id": "BIT-cosign-2026-39395", "source": { "name": "OSV", "url": "https://osv.dev/vulnerability/BIT-cosign-2026-39395" } } ], "ratings": [ { "source": { "name": "GitHub Advisory Database", "url": "https://github.com/advisories/GHSA-w6c6-c85g-mmv6" }, "severity": "medium" } ], "description": "Cosign's verify-blob-attestation reports a false positive when payload parsing fails.", "affects": [ { "ref": "sbomify-container@v26.8.0", "versions": [ { "version": "v26.8.0", "status": "unaffected" } ] }, { "ref": "pkg:golang/github.com/sigstore/cosign@v3.1.3" }, { "ref": "pkg:golang/github.com/sigstore/cosign/v3@v3.1.3" } ], "analysis": { "state": "not_affected", "justification": "code_not_present", "response": [ "will_not_fix" ], "detail": "The image ships cosign v3.1.3, which does not contain this vulnerability. The finding is an artifact of a malformed package URL in this tag's SBOM, not of the binary in the image.\n\nVerified in ghcr.io/sbomify/sbomify:v26.8.0 (index digest sha256:953fdc9693b5c504bd0db3734066c1feb7f8d4c9bc2cafe15dc4f3725160b014, linux/amd64 manifest sha256:84c652b88f5cb45aed29ab84a33b4262a5d4909b8e1bc4510d64fa4c4f8f980f): running `cosign version` inside the image reports GitVersion v3.1.3, GitCommit 11926fa5bbbbde47e88fc006b625a17769b743b2, built 2026-08-05, go1.26.4.\n\nRoot cause of the false match. This tag's SBOM identifies the binary as pkg:golang/github.com/sigstore/cosign@v3.1.3. A Go module path carries its major version as a suffix from v2 onward, so cosign v3.1.3 is the module github.com/sigstore/cosign/v3, confirmed by reading go.mod at tag v3.1.3. The path without the suffix names the abandoned v1 module. Advisory records carry a separate entry for that path with \"introduced 0\" and no fixed version, so it matches every version of cosign that has ever existed. That stale v1 entry, not the shipped binary, is what the scanner matched.\n\nStatus against the correct module path github.com/sigstore/cosign/v3: the advisory's v3 entry is introduced at 3.0.0 and fixed at 3.0.6. The shipped 3.1.3 is later than the fix, so the vulnerable code is not present in this image.\n\nFixed for future releases by sbomify PR #1519, which derives the major version suffix from the pinned version so the emitted PURL names the correct module. This statement covers tag v26.8.0, whose SBOM was published before that change and cannot be regenerated retroactively.\n\nThis is the one advisory whose subcommand sbomify actually runs: sbomify/apps/plugins/builtins/verification.py invokes `cosign verify-blob-attestation` on uploaded SBOMs and treats exit code 0 as verified. The shipped 3.1.3 is past the 3.0.6 fix, so the false positive behaviour is not present. Recorded here because a regression in this specific area would matter: the result feeds the verification:attestation category that compliance profiles consume.", "firstIssued": "2026-09-07T16:05:00Z", "lastUpdated": "2026-09-07T16:05:00Z" } } ] }