{
  "kind": "sbom_heatmap",
  "analysis_version": 1,
  "generated_at": "2026-10-18T16:48:01.307833+00:00",
  "sboms": [
    {
      "artifact_path": "apache-ant-cyclonedx-0.2-bin-withdeps.tar.bz2",
      "sbom_url": "https://downloads.apache.org/ant/antlibs/cyclonedx/binaries/apache-ant-cyclonedx-0.2-bin-withdeps.tar.bz2.cdx.json",
      "sha256": "12569931fe292f71373358ed58e914eb2a965a401866d160b4728f12ea7a8ba2",
      "retrieved_at": "2026-10-18T16:48:01.339787+00:00",
      "components": 94,
      "files": 90,
      "packages": 4,
      "error": null
    },
    {
      "artifact_path": "apache-ant-cyclonedx-0.2-bin-withdeps.tar.gz",
      "sbom_url": "https://downloads.apache.org/ant/antlibs/cyclonedx/binaries/apache-ant-cyclonedx-0.2-bin-withdeps.tar.gz.cdx.json",
      "sha256": "e2907a0e586993db35ba36cf21277362f4fd4ecf19e89794e39bbb95b8a52737",
      "retrieved_at": "2026-10-18T16:48:01.370807+00:00",
      "components": 94,
      "files": 90,
      "packages": 4,
      "error": null
    },
    {
      "artifact_path": "apache-ant-cyclonedx-0.2-bin-withdeps.zip",
      "sbom_url": "https://downloads.apache.org/ant/antlibs/cyclonedx/binaries/apache-ant-cyclonedx-0.2-bin-withdeps.zip.cdx.json",
      "sha256": "06e59eb2045ed51c2ff2989553fe2cc62d7542a2e3a41e30cb3254203148d82c",
      "retrieved_at": "2026-10-18T16:48:01.401404+00:00",
      "components": 94,
      "files": 90,
      "packages": 4,
      "error": null
    },
    {
      "artifact_path": "apache-ant-cyclonedx-0.2-bin.tar.bz2",
      "sbom_url": "https://downloads.apache.org/ant/antlibs/cyclonedx/binaries/apache-ant-cyclonedx-0.2-bin.tar.bz2.cdx.json",
      "sha256": "7c05645c2fdd07627e97418b3a936dd6fec3830d7e827fac63de7aeffada3955",
      "retrieved_at": "2026-10-18T16:48:01.431121+00:00",
      "components": 86,
      "files": 82,
      "packages": 4,
      "error": null
    },
    {
      "artifact_path": "apache-ant-cyclonedx-0.2-bin.tar.gz",
      "sbom_url": "https://downloads.apache.org/ant/antlibs/cyclonedx/binaries/apache-ant-cyclonedx-0.2-bin.tar.gz.cdx.json",
      "sha256": "052026843623715dfa1622cebe770ed9a7cd568ab4f76d95ddcb618baeb9e7d6",
      "retrieved_at": "2026-10-18T16:48:01.459317+00:00",
      "components": 86,
      "files": 82,
      "packages": 4,
      "error": null
    },
    {
      "artifact_path": "apache-ant-cyclonedx-0.2-bin.zip",
      "sbom_url": "https://downloads.apache.org/ant/antlibs/cyclonedx/binaries/apache-ant-cyclonedx-0.2-bin.zip.cdx.json",
      "sha256": "293c37d91b830e96870938bd8c738d7b5d5d94594b7d464e6ee7c90c8c61f5d9",
      "retrieved_at": "2026-10-18T16:48:01.485630+00:00",
      "components": 86,
      "files": 82,
      "packages": 4,
      "error": null
    },
    {
      "artifact_path": "apache-ant-cyclonedx-0.2-src.tar.bz2",
      "sbom_url": "https://downloads.apache.org/ant/antlibs/cyclonedx/source/apache-ant-cyclonedx-0.2-src.tar.bz2.cdx.json",
      "sha256": "84d425a89fb997979f34b2d44bb91b09a2d5fea1c09541fb477a9d1f0bfa8bbf",
      "retrieved_at": "2026-10-18T16:48:01.513123+00:00",
      "components": 79,
      "files": 79,
      "packages": 0,
      "error": null
    },
    {
      "artifact_path": "apache-ant-cyclonedx-0.2-src.tar.gz",
      "sbom_url": "https://downloads.apache.org/ant/antlibs/cyclonedx/source/apache-ant-cyclonedx-0.2-src.tar.gz.cdx.json",
      "sha256": "f392d9d8d88b72893f7e601ecf949a96d7b86328f7339270cb9f9681d1ef6da0",
      "retrieved_at": "2026-10-18T16:48:01.541466+00:00",
      "components": 79,
      "files": 79,
      "packages": 0,
      "error": null
    },
    {
      "artifact_path": "apache-ant-cyclonedx-0.2-src.zip",
      "sbom_url": "https://downloads.apache.org/ant/antlibs/cyclonedx/source/apache-ant-cyclonedx-0.2-src.zip.cdx.json",
      "sha256": "fda2b47e171cbfcf7bc0f1b0fb741e78fc4e17c7a9cea7833fd6a762c846a710",
      "retrieved_at": "2026-10-18T16:48:01.569038+00:00",
      "components": 79,
      "files": 79,
      "packages": 0,
      "error": null
    }
  ],
  "rows": [
    {
      "key": "pkg:maven/org.apache.ant/ant",
      "purl": "pkg:maven/org.apache.ant/ant@1.10.18",
      "source_purls": [
        "pkg:maven/org.apache.ant/ant@1.10.18?type=jar"
      ],
      "name": "ant",
      "ecosystem": "maven",
      "version": "1.10.18",
      "artifacts": [
        "apache-ant-cyclonedx-0.2-bin-withdeps.tar.bz2",
        "apache-ant-cyclonedx-0.2-bin-withdeps.tar.gz",
        "apache-ant-cyclonedx-0.2-bin-withdeps.zip",
        "apache-ant-cyclonedx-0.2-bin.tar.bz2",
        "apache-ant-cyclonedx-0.2-bin.tar.gz",
        "apache-ant-cyclonedx-0.2-bin.zip"
      ],
      "advisory_status": "none",
      "advisories": [],
      "published_at": "2026-09-03T17:07:22Z",
      "repository_url": "https://gitbox.apache.org/repos/asf/ant.git",
      "source_repo": "github.com/apache/ant",
      "repository_source": "gitbox_mirror",
      "latest_release_at": "2026-09-07T01:57:09.000Z",
      "latest_release_version": "1.10.18",
      "rankings_average": 0.3819027009697844,
      "archived": false,
      "dds": 0.6688188120157673,
      "active_maintainers": 2,
      "governance_files": 2,
      "maintained": 10,
      "scorecard_date": "2026-08-24T00:00:00Z",
      "criticality": 0.9299127038658057,
      "health": 0.7410360589467981,
      "health_inputs": 4,
      "risk": 0.24081385862852808
    },
    {
      "key": "pkg:maven/org.cyclonedx/cyclonedx-core-java",
      "purl": "pkg:maven/org.cyclonedx/cyclonedx-core-java@13.2.0",
      "source_purls": [
        "pkg:maven/org.cyclonedx/cyclonedx-core-java@13.2.0?type=jar"
      ],
      "name": "cyclonedx-core-java",
      "ecosystem": "maven",
      "version": "13.2.0",
      "artifacts": [
        "apache-ant-cyclonedx-0.2-bin-withdeps.tar.bz2",
        "apache-ant-cyclonedx-0.2-bin-withdeps.tar.gz",
        "apache-ant-cyclonedx-0.2-bin-withdeps.zip",
        "apache-ant-cyclonedx-0.2-bin.tar.bz2",
        "apache-ant-cyclonedx-0.2-bin.tar.gz",
        "apache-ant-cyclonedx-0.2-bin.zip"
      ],
      "advisory_status": "none",
      "advisories": [],
      "published_at": "2026-08-24T22:48:44Z",
      "repository_url": "https://github.com/CycloneDX/cyclonedx-core-java",
      "source_repo": "github.com/cyclonedx/cyclonedx-core-java",
      "repository_source": "deps.dev",
      "latest_release_at": "2026-08-26T02:10:51.000Z",
      "latest_release_version": "13.2.0",
      "rankings_average": 12.839720835570228,
      "archived": false,
      "dds": 0.5057324840764331,
      "active_maintainers": 1,
      "governance_files": 0,
      "maintained": 10,
      "scorecard_date": "2026-08-24T00:00:00Z",
      "criticality": 0.43066648648556527,
      "health": 0.4475269230553182,
      "health_inputs": 4,
      "risk": 0.23793163892563543
    },
    {
      "key": "pkg:maven/org.apache.ant/ant-launcher",
      "purl": "pkg:maven/org.apache.ant/ant-launcher@1.10.18",
      "source_purls": [
        "pkg:maven/org.apache.ant/ant-launcher@1.10.18?type=jar"
      ],
      "name": "ant-launcher",
      "ecosystem": "maven",
      "version": "1.10.18",
      "artifacts": [
        "apache-ant-cyclonedx-0.2-bin-withdeps.tar.bz2",
        "apache-ant-cyclonedx-0.2-bin-withdeps.tar.gz",
        "apache-ant-cyclonedx-0.2-bin-withdeps.zip",
        "apache-ant-cyclonedx-0.2-bin.tar.bz2",
        "apache-ant-cyclonedx-0.2-bin.tar.gz",
        "apache-ant-cyclonedx-0.2-bin.zip"
      ],
      "advisory_status": "none",
      "advisories": [],
      "published_at": "2026-09-07T01:57:09Z",
      "repository_url": "https://gitbox.apache.org/repos/asf/ant.git",
      "source_repo": "github.com/apache/ant",
      "repository_source": "gitbox_mirror",
      "latest_release_at": "2026-09-07T01:57:09.000Z",
      "latest_release_version": "1.10.18",
      "rankings_average": 0.5355854772781918,
      "archived": false,
      "dds": 0.6688188120157673,
      "active_maintainers": 2,
      "governance_files": 2,
      "maintained": 10,
      "scorecard_date": "2026-08-24T00:00:00Z",
      "criticality": 0.9070638079385452,
      "health": 0.7410360589467981,
      "health_inputs": 4,
      "risk": 0.23489681849049024
    },
    {
      "key": "pkg:maven/org.apache.ivy/ivy",
      "purl": "pkg:maven/org.apache.ivy/ivy@2.6.0",
      "source_purls": [
        "pkg:maven/org.apache.ivy/ivy@2.6.0?type=jar"
      ],
      "name": "ivy",
      "ecosystem": "maven",
      "version": "2.6.0",
      "artifacts": [
        "apache-ant-cyclonedx-0.2-bin-withdeps.tar.bz2",
        "apache-ant-cyclonedx-0.2-bin-withdeps.tar.gz",
        "apache-ant-cyclonedx-0.2-bin-withdeps.zip",
        "apache-ant-cyclonedx-0.2-bin.tar.bz2",
        "apache-ant-cyclonedx-0.2-bin.tar.gz",
        "apache-ant-cyclonedx-0.2-bin.zip"
      ],
      "advisory_status": "none",
      "advisories": [],
      "published_at": "2026-07-12T06:16:08Z",
      "repository_url": "https://gitbox.apache.org/repos/asf/ant-ivy.git",
      "source_repo": "github.com/apache/ant-ivy",
      "repository_source": "gitbox_mirror",
      "latest_release_at": "2026-07-12T06:16:08.000Z",
      "latest_release_version": "2.6.0",
      "rankings_average": 0.16684031952125244,
      "archived": false,
      "dds": null,
      "active_maintainers": 3,
      "governance_files": 0,
      "maintained": null,
      "scorecard_date": null,
      "criticality": 0.9665665255128736,
      "health": null,
      "health_inputs": 3,
      "risk": null
    }
  ],
  "sources": {
    "Alpha-Omega heuristic": "https://github.com/alpha-omega-security/heatmap/tree/4ed37981",
    "ecosyste.ms packages": "https://packages.ecosyste.ms/api/v1",
    "ecosyste.ms repositories": "https://repos.ecosyste.ms/api/v1",
    "ecosyste.ms issues": "https://issues.ecosyste.ms/api/v1",
    "deps.dev and OpenSSF Scorecard": "https://api.deps.dev/v3alpha",
    "ecosyste.ms data licence": "https://creativecommons.org/licenses/by-sa/4.0/",
    "deps.dev terms": "https://docs.deps.dev/api/v3alpha/#terms"
  },
  "attribution": "Alpha-Omega maintenance heuristic, with missing inputs left unknown. Includes ecosyste.ms data under CC BY-SA 4.0 and deps.dev and OpenSSF Scorecard observations. ATR selected, normalised and combined records and calculated maintenance indicators. gitbox_mirror identifies an inferred Apache GitHub mirror, not verified repository identity."
}