{
  "kind": "sbom_heatmap",
  "analysis_version": 1,
  "generated_at": "2026-10-11T15:43:02.125298+00:00",
  "sboms": [
    {
      "artifact_path": "apache-ant-1.10.18-bin.tar.bz2",
      "sbom_url": "https://downloads.apache.org/ant/binaries/apache-ant-1.10.18-bin.tar.bz2.cdx.json",
      "sha256": "b6ebc90a2ce95c8bc080ddcd1d60630bf34c9a49679336b79b247cb7cd6180e5",
      "retrieved_at": "2026-10-11T15:43:02.204042+00:00",
      "components": 1744,
      "files": 1725,
      "packages": 18,
      "error": null
    },
    {
      "artifact_path": "apache-ant-1.10.18-bin.tar.gz",
      "sbom_url": "https://downloads.apache.org/ant/binaries/apache-ant-1.10.18-bin.tar.gz.cdx.json",
      "sha256": "7398817931bb2769f45fbf06fcc30e3981a73554e3a08c298182f8ede8fb167f",
      "retrieved_at": "2026-10-11T15:43:02.292887+00:00",
      "components": 1744,
      "files": 1725,
      "packages": 18,
      "error": null
    },
    {
      "artifact_path": "apache-ant-1.10.18-bin.tar.xz",
      "sbom_url": "https://downloads.apache.org/ant/binaries/apache-ant-1.10.18-bin.tar.xz.cdx.json",
      "sha256": "bd3d1acba129e3ea918d90f46e91d9b133f5eada3f345f99fb58cc017274c36e",
      "retrieved_at": "2026-10-11T15:43:02.371510+00:00",
      "components": 1744,
      "files": 1725,
      "packages": 18,
      "error": null
    },
    {
      "artifact_path": "apache-ant-1.10.18-bin.zip",
      "sbom_url": "https://downloads.apache.org/ant/binaries/apache-ant-1.10.18-bin.zip.cdx.json",
      "sha256": "03f20fbe6b2ed8df0df5d072c19646279e212d6a90061bd36cf8fb741cb1772a",
      "retrieved_at": "2026-10-11T15:43:02.444063+00:00",
      "components": 1744,
      "files": 1725,
      "packages": 18,
      "error": null
    },
    {
      "artifact_path": "apache-ant-1.10.18-src.tar.bz2",
      "sbom_url": "https://downloads.apache.org/ant/source/apache-ant-1.10.18-src.tar.bz2.cdx.json",
      "sha256": "4f2415b3b7cba95fab2a4066b2aac35eb66d38064f9ed5a664357330cedaba7d",
      "retrieved_at": "2026-10-11T15:43:02.547819+00:00",
      "components": 2446,
      "files": 2446,
      "packages": 0,
      "error": null
    },
    {
      "artifact_path": "apache-ant-1.10.18-src.tar.gz",
      "sbom_url": "https://downloads.apache.org/ant/source/apache-ant-1.10.18-src.tar.gz.cdx.json",
      "sha256": "ce07beab55556f651ccb1d52ec2bf0e37f19fa630c1c375d4eb276ffd1e738b0",
      "retrieved_at": "2026-10-11T15:43:02.653290+00:00",
      "components": 2446,
      "files": 2446,
      "packages": 0,
      "error": null
    },
    {
      "artifact_path": "apache-ant-1.10.18-src.tar.xz",
      "sbom_url": "https://downloads.apache.org/ant/source/apache-ant-1.10.18-src.tar.xz.cdx.json",
      "sha256": "729c713f4947e1f785a123f5b502a1ac0b1a76f107e8d9acb7b186c5a6e500bc",
      "retrieved_at": "2026-10-11T15:43:02.749539+00:00",
      "components": 2446,
      "files": 2446,
      "packages": 0,
      "error": null
    },
    {
      "artifact_path": "apache-ant-1.10.18-src.zip",
      "sbom_url": "https://downloads.apache.org/ant/source/apache-ant-1.10.18-src.zip.cdx.json",
      "sha256": "9d484387f29a6a1ac6b9cb2a95f0e1e52fbd1ade8d51aa9c02bb366de27b4695",
      "retrieved_at": "2026-10-11T15:43:02.860293+00:00",
      "components": 2446,
      "files": 2446,
      "packages": 0,
      "error": null
    }
  ],
  "rows": [
    {
      "key": "pkg:maven/log4j/log4j",
      "purl": "pkg:maven/log4j/log4j@1.2.14",
      "source_purls": [
        "pkg:maven/log4j/log4j@1.2.14?type=jar"
      ],
      "name": "log4j",
      "ecosystem": "maven",
      "version": "1.2.14",
      "artifacts": [
        "apache-ant-1.10.18-bin.tar.bz2",
        "apache-ant-1.10.18-bin.tar.gz",
        "apache-ant-1.10.18-bin.tar.xz",
        "apache-ant-1.10.18-bin.zip"
      ],
      "advisory_status": "found",
      "advisories": [
        "GHSA-2qrg-x229-3v8q",
        "GHSA-65fg-84f6-3jq3",
        "GHSA-f7vh-qwp3-x37m",
        "GHSA-fp5r-v3w9-4333",
        "GHSA-vp98-w2p3-mv35",
        "GHSA-w9p3-5cr8-m3jj"
      ],
      "published_at": "2006-12-01T06:27:21Z",
      "repository_url": "http://svn.apache.org/viewvc/logging/log4j/tags/v1_2_17_rc3",
      "source_repo": null,
      "repository_source": null,
      "latest_release_at": "2012-05-26T09:43:39.000Z",
      "latest_release_version": "1.2.17",
      "rankings_average": 0.028845864925231116,
      "archived": null,
      "dds": null,
      "active_maintainers": null,
      "governance_files": null,
      "maintained": null,
      "scorecard_date": null,
      "criticality": 0.9938381556025709,
      "health": null,
      "health_inputs": 1,
      "risk": null
    },
    {
      "key": "pkg:maven/org.tukaani/xz",
      "purl": "pkg:maven/org.tukaani/xz@1.9",
      "source_purls": [
        "pkg:maven/org.tukaani/xz@1.9?type=jar"
      ],
      "name": "xz",
      "ecosystem": "maven",
      "version": "1.9",
      "artifacts": [
        "apache-ant-1.10.18-bin.tar.bz2",
        "apache-ant-1.10.18-bin.tar.gz",
        "apache-ant-1.10.18-bin.tar.xz",
        "apache-ant-1.10.18-bin.zip"
      ],
      "advisory_status": "none",
      "advisories": [],
      "published_at": "2021-03-12T17:53:44Z",
      "repository_url": "https://github.com/tukaani-project/xz-java",
      "source_repo": "github.com/tukaani-project/xz-java",
      "repository_source": "ecosyste.ms",
      "latest_release_at": "2026-03-01T14:04:50.000Z",
      "latest_release_version": "1.12",
      "rankings_average": 0.45109668456626856,
      "archived": false,
      "dds": 0.016233766233766267,
      "active_maintainers": 0,
      "governance_files": 0,
      "maintained": null,
      "scorecard_date": null,
      "criticality": 0.9193261360389389,
      "health": 0.20290131920806423,
      "health_inputs": 4,
      "risk": 0.7327936502541859
    },
    {
      "key": "pkg:maven/com.sun.mail/javax.mail",
      "purl": "pkg:maven/com.sun.mail/javax.mail@1.6.2",
      "source_purls": [
        "pkg:maven/com.sun.mail/javax.mail@1.6.2?type=jar"
      ],
      "name": "javax.mail",
      "ecosystem": "maven",
      "version": "1.6.2",
      "artifacts": [
        "apache-ant-1.10.18-bin.tar.bz2",
        "apache-ant-1.10.18-bin.tar.gz",
        "apache-ant-1.10.18-bin.tar.xz",
        "apache-ant-1.10.18-bin.zip"
      ],
      "advisory_status": "none",
      "advisories": [],
      "published_at": "2018-08-29T22:30:52Z",
      "repository_url": "https://github.com/javaee/javamail",
      "source_repo": "github.com/javaee/javamail",
      "repository_source": "deps.dev",
      "latest_release_at": "2018-08-29T22:30:52.000Z",
      "latest_release_version": "1.6.2",
      "rankings_average": 5.554526983974322,
      "archived": true,
      "dds": null,
      "active_maintainers": 0,
      "governance_files": 1,
      "maintained": 0,
      "scorecard_date": "2026-08-24T00:00:00Z",
      "criticality": 0.5926095653085024,
      "health": 0.05,
      "health_inputs": 3,
      "risk": 0.5629790870430772
    },
    {
      "key": "pkg:maven/junit/junit",
      "purl": "pkg:maven/junit/junit@4.13.2",
      "source_purls": [
        "pkg:maven/junit/junit@4.13.2?type=jar"
      ],
      "name": "junit",
      "ecosystem": "maven",
      "version": "4.13.2",
      "artifacts": [
        "apache-ant-1.10.18-bin.tar.bz2",
        "apache-ant-1.10.18-bin.tar.gz",
        "apache-ant-1.10.18-bin.tar.xz",
        "apache-ant-1.10.18-bin.zip"
      ],
      "advisory_status": "none",
      "advisories": [],
      "published_at": "2021-02-13T16:31:52Z",
      "repository_url": "https://github.com/junit-team/junit4",
      "source_repo": "github.com/junit-team/junit4",
      "repository_source": "deps.dev",
      "latest_release_at": "2021-02-13T16:31:54.000Z",
      "latest_release_version": "4.13.2",
      "rankings_average": 1.1279111228631067,
      "archived": false,
      "dds": 0.89120151371807,
      "active_maintainers": 1,
      "governance_files": 2,
      "maintained": 0,
      "scorecard_date": "2026-08-24T00:00:00Z",
      "criticality": 0.8363767961682208,
      "health": 0.4728003784295175,
      "health_inputs": 4,
      "risk": 0.4409375304302186
    },
    {
      "key": "pkg:maven/commons-net/commons-net",
      "purl": "pkg:maven/commons-net/commons-net@3.13.0",
      "source_purls": [
        "pkg:maven/commons-net/commons-net@3.13.0?type=jar"
      ],
      "name": "commons-net",
      "ecosystem": "maven",
      "version": "3.13.0",
      "artifacts": [
        "apache-ant-1.10.18-bin.tar.bz2",
        "apache-ant-1.10.18-bin.tar.gz",
        "apache-ant-1.10.18-bin.tar.xz",
        "apache-ant-1.10.18-bin.zip"
      ],
      "advisory_status": "none",
      "advisories": [],
      "published_at": "2026-03-15T16:25:20Z",
      "repository_url": "https://gitbox.apache.org/repos/asf/commons-net",
      "source_repo": "github.com/apache/commons-net",
      "repository_source": "gitbox_mirror",
      "latest_release_at": "2026-03-15T16:25:13.000Z",
      "latest_release_version": "3.13.0",
      "rankings_average": 0.049157115759664444,
      "archived": false,
      "dds": 0.5900978698906161,
      "active_maintainers": 1,
      "governance_files": 3,
      "maintained": 10,
      "scorecard_date": "2026-08-24T00:00:00Z",
      "criticality": 0.9896022011288896,
      "health": 0.6829192831190634,
      "health_inputs": 4,
      "risk": 0.3137837753609012
    },
    {
      "key": "pkg:maven/com.sun.mail/jakarta.mail",
      "purl": "pkg:maven/com.sun.mail/jakarta.mail@2.0.2",
      "source_purls": [
        "pkg:maven/com.sun.mail/jakarta.mail@2.0.2?type=jar"
      ],
      "name": "jakarta.mail",
      "ecosystem": "maven",
      "version": "2.0.2",
      "artifacts": [
        "apache-ant-1.10.18-bin.tar.bz2",
        "apache-ant-1.10.18-bin.tar.gz",
        "apache-ant-1.10.18-bin.tar.xz",
        "apache-ant-1.10.18-bin.zip"
      ],
      "advisory_status": "none",
      "advisories": [],
      "published_at": "2025-07-29T09:18:19Z",
      "repository_url": "https://github.com/eclipse-ee4j/mail",
      "source_repo": "github.com/eclipse-ee4j/mail",
      "repository_source": "deps.dev",
      "latest_release_at": "2025-07-29T09:18:19.000Z",
      "latest_release_version": "2.0.2",
      "rankings_average": 8.452582366426734,
      "archived": false,
      "dds": 0.6632653061224489,
      "active_maintainers": 2,
      "governance_files": 2,
      "maintained": 6,
      "scorecard_date": "2026-08-24T00:00:00Z",
      "criticality": 0.5132764220854635,
      "health": 0.6488603526032012,
      "health_inputs": 4,
      "risk": 0.18023170186818013
    },
    {
      "key": "pkg:maven/org.junit.platform/junit-platform-launcher",
      "purl": "pkg:maven/org.junit.platform/junit-platform-launcher@1.10.5",
      "source_purls": [
        "pkg:maven/org.junit.platform/junit-platform-launcher@1.10.5?type=jar"
      ],
      "name": "junit-platform-launcher",
      "ecosystem": "maven",
      "version": "1.10.5",
      "artifacts": [
        "apache-ant-1.10.18-bin.tar.bz2",
        "apache-ant-1.10.18-bin.tar.gz",
        "apache-ant-1.10.18-bin.tar.xz",
        "apache-ant-1.10.18-bin.zip"
      ],
      "advisory_status": "none",
      "advisories": [],
      "published_at": "2024-10-04T12:34:46Z",
      "repository_url": "https://github.com/junit-team/junit-framework",
      "source_repo": "github.com/junit-team/junit5",
      "repository_source": "deps.dev",
      "latest_release_at": "2026-08-08T02:31:39.000Z",
      "latest_release_version": "6.1.3",
      "rankings_average": 2.1376532820389516,
      "archived": false,
      "dds": 0.6591469862530843,
      "active_maintainers": 4,
      "governance_files": 2,
      "maintained": 10,
      "scorecard_date": "2026-08-24T00:00:00Z",
      "criticality": 0.7522328715089963,
      "health": 0.8167160677483242,
      "health_inputs": 4,
      "risk": 0.13787219865913844
    },
    {
      "key": "pkg:maven/org.apache.bcel/bcel",
      "purl": "pkg:maven/org.apache.bcel/bcel@6.12.0",
      "source_purls": [
        "pkg:maven/org.apache.bcel/bcel@6.12.0?type=jar"
      ],
      "name": "bcel",
      "ecosystem": "maven",
      "version": "6.12.0",
      "artifacts": [
        "apache-ant-1.10.18-bin.tar.bz2",
        "apache-ant-1.10.18-bin.tar.gz",
        "apache-ant-1.10.18-bin.tar.xz",
        "apache-ant-1.10.18-bin.zip"
      ],
      "advisory_status": "none",
      "advisories": [],
      "published_at": "2026-01-18T22:29:01Z",
      "repository_url": "https://gitbox.apache.org/repos/asf/commons-bcel.git",
      "source_repo": "github.com/apache/commons-bcel",
      "repository_source": "gitbox_mirror",
      "latest_release_at": "2026-09-11T01:59:51.000Z",
      "latest_release_version": "6.13.0",
      "rankings_average": 0.43045871069434427,
      "archived": false,
      "dds": 0.7678263864967275,
      "active_maintainers": 2,
      "governance_files": 3,
      "maintained": 10,
      "scorecard_date": "2026-08-24T00:00:00Z",
      "criticality": 0.9224299412687228,
      "health": 0.8516434330299351,
      "health_inputs": 4,
      "risk": 0.13684853935702634
    },
    {
      "key": "pkg:maven/antlr/antlr",
      "purl": "pkg:maven/antlr/antlr@2.7.7",
      "source_purls": [
        "pkg:maven/antlr/antlr@2.7.7?type=jar"
      ],
      "name": "antlr",
      "ecosystem": "maven",
      "version": "2.7.7",
      "artifacts": [
        "apache-ant-1.10.18-bin.tar.bz2",
        "apache-ant-1.10.18-bin.tar.gz",
        "apache-ant-1.10.18-bin.tar.xz",
        "apache-ant-1.10.18-bin.zip"
      ],
      "advisory_status": "none",
      "advisories": [],
      "published_at": "2007-01-13T06:28:39Z",
      "repository_url": "",
      "source_repo": null,
      "repository_source": null,
      "latest_release_at": "2006-01-31T01:35:34.000Z",
      "latest_release_version": "2.7.6",
      "rankings_average": 0.09243675028719511,
      "archived": null,
      "dds": null,
      "active_maintainers": null,
      "governance_files": null,
      "maintained": null,
      "scorecard_date": null,
      "criticality": 0.9808432409261966,
      "health": null,
      "health_inputs": 1,
      "risk": null
    },
    {
      "key": "pkg:maven/bsf/bsf",
      "purl": "pkg:maven/bsf/bsf@2.4.0",
      "source_purls": [
        "pkg:maven/bsf/bsf@2.4.0?type=jar"
      ],
      "name": "bsf",
      "ecosystem": "maven",
      "version": "2.4.0",
      "artifacts": [
        "apache-ant-1.10.18-bin.tar.bz2",
        "apache-ant-1.10.18-bin.tar.gz",
        "apache-ant-1.10.18-bin.tar.xz",
        "apache-ant-1.10.18-bin.zip"
      ],
      "advisory_status": "none",
      "advisories": [],
      "published_at": "2006-10-07T12:02:31Z",
      "repository_url": "",
      "source_repo": null,
      "repository_source": null,
      "latest_release_at": "2005-11-08T21:51:27.000Z",
      "latest_release_version": "2.3.0",
      "rankings_average": 0.6651572226229596,
      "archived": null,
      "dds": null,
      "active_maintainers": null,
      "governance_files": null,
      "maintained": null,
      "scorecard_date": null,
      "criticality": 0.889511109164892,
      "health": null,
      "health_inputs": 1,
      "risk": null
    },
    {
      "key": "pkg:maven/com.jcraft/jsch",
      "purl": "pkg:maven/com.jcraft/jsch@0.1.55",
      "source_purls": [
        "pkg:maven/com.jcraft/jsch@0.1.55?type=jar"
      ],
      "name": "jsch",
      "ecosystem": "maven",
      "version": "0.1.55",
      "artifacts": [
        "apache-ant-1.10.18-bin.tar.bz2",
        "apache-ant-1.10.18-bin.tar.gz",
        "apache-ant-1.10.18-bin.tar.xz",
        "apache-ant-1.10.18-bin.zip"
      ],
      "advisory_status": "none",
      "advisories": [],
      "published_at": "2018-11-26T01:15:40Z",
      "repository_url": "http://git.jcraft.com/jsch.git",
      "source_repo": null,
      "repository_source": null,
      "latest_release_at": "2018-11-26T01:15:42.000Z",
      "latest_release_version": "0.1.55",
      "rankings_average": 0.06812535064518714,
      "archived": null,
      "dds": null,
      "active_maintainers": null,
      "governance_files": null,
      "maintained": null,
      "scorecard_date": null,
      "criticality": 0.9857197438445631,
      "health": null,
      "health_inputs": 1,
      "risk": null
    },
    {
      "key": "pkg:maven/commons-logging/commons-logging-api",
      "purl": "pkg:maven/commons-logging/commons-logging-api@1.1",
      "source_purls": [
        "pkg:maven/commons-logging/commons-logging-api@1.1?type=jar"
      ],
      "name": "commons-logging-api",
      "ecosystem": "maven",
      "version": "1.1",
      "artifacts": [
        "apache-ant-1.10.18-bin.tar.bz2",
        "apache-ant-1.10.18-bin.tar.gz",
        "apache-ant-1.10.18-bin.tar.xz",
        "apache-ant-1.10.18-bin.zip"
      ],
      "advisory_status": "none",
      "advisories": [],
      "published_at": "2006-05-13T12:31:49Z",
      "repository_url": "http://svn.apache.org/repos/asf/jakarta/commons/proper/logging/trunk/",
      "source_repo": null,
      "repository_source": null,
      "latest_release_at": "2007-06-03T21:26:01.000Z",
      "latest_release_version": "1.1",
      "rankings_average": 0.41870374823007667,
      "archived": null,
      "dds": null,
      "active_maintainers": null,
      "governance_files": null,
      "maintained": null,
      "scorecard_date": null,
      "criticality": 0.9242178833524628,
      "health": null,
      "health_inputs": 1,
      "risk": null
    },
    {
      "key": "pkg:maven/jakarta-regexp/jakarta-regexp",
      "purl": "pkg:maven/jakarta-regexp/jakarta-regexp@1.4",
      "source_purls": [
        "pkg:maven/jakarta-regexp/jakarta-regexp@1.4?type=jar"
      ],
      "name": "jakarta-regexp",
      "ecosystem": "maven",
      "version": "1.4",
      "artifacts": [
        "apache-ant-1.10.18-bin.tar.bz2",
        "apache-ant-1.10.18-bin.tar.gz",
        "apache-ant-1.10.18-bin.tar.xz",
        "apache-ant-1.10.18-bin.zip"
      ],
      "advisory_status": "none",
      "advisories": [],
      "published_at": "2005-11-22T18:15:26Z",
      "repository_url": "",
      "source_repo": null,
      "repository_source": null,
      "latest_release_at": "2005-11-08T22:23:55.000Z",
      "latest_release_version": "1.4",
      "rankings_average": 0.7083700675910342,
      "archived": null,
      "dds": null,
      "active_maintainers": null,
      "governance_files": null,
      "maintained": null,
      "scorecard_date": null,
      "criticality": 0.8839597498806304,
      "health": null,
      "health_inputs": 1,
      "risk": null
    },
    {
      "key": "pkg:maven/javax.media/jai-core",
      "purl": "pkg:maven/javax.media/jai-core@1.1.3",
      "source_purls": [
        "pkg:maven/javax.media/jai-core@1.1.3?type=jar"
      ],
      "name": "jai-core",
      "ecosystem": "maven",
      "version": "1.1.3",
      "artifacts": [
        "apache-ant-1.10.18-bin.tar.bz2",
        "apache-ant-1.10.18-bin.tar.gz",
        "apache-ant-1.10.18-bin.tar.xz",
        "apache-ant-1.10.18-bin.zip"
      ],
      "advisory_status": "not_found",
      "advisories": [],
      "published_at": null,
      "repository_url": null,
      "source_repo": null,
      "repository_source": null,
      "latest_release_at": null,
      "latest_release_version": null,
      "rankings_average": null,
      "archived": null,
      "dds": null,
      "active_maintainers": null,
      "governance_files": null,
      "maintained": null,
      "scorecard_date": null,
      "criticality": null,
      "health": null,
      "health_inputs": 0,
      "risk": null
    },
    {
      "key": "pkg:maven/jdepend/jdepend",
      "purl": "pkg:maven/jdepend/jdepend@2.9.1",
      "source_purls": [
        "pkg:maven/jdepend/jdepend@2.9.1?type=jar"
      ],
      "name": "jdepend",
      "ecosystem": "maven",
      "version": "2.9.1",
      "artifacts": [
        "apache-ant-1.10.18-bin.tar.bz2",
        "apache-ant-1.10.18-bin.tar.gz",
        "apache-ant-1.10.18-bin.tar.xz",
        "apache-ant-1.10.18-bin.zip"
      ],
      "advisory_status": "none",
      "advisories": [],
      "published_at": "2005-09-27T04:01:53Z",
      "repository_url": "",
      "source_repo": null,
      "repository_source": null,
      "latest_release_at": "2005-11-08T21:52:19.000Z",
      "latest_release_version": "2.9.1",
      "rankings_average": 1.2454491151845215,
      "archived": null,
      "dds": null,
      "active_maintainers": null,
      "governance_files": null,
      "maintained": null,
      "scorecard_date": null,
      "criticality": 0.8247271009409303,
      "health": null,
      "health_inputs": 1,
      "risk": null
    },
    {
      "key": "pkg:maven/oro/oro",
      "purl": "pkg:maven/oro/oro@2.0.8",
      "source_purls": [
        "pkg:maven/oro/oro@2.0.8?type=jar"
      ],
      "name": "oro",
      "ecosystem": "maven",
      "version": "2.0.8",
      "artifacts": [
        "apache-ant-1.10.18-bin.tar.bz2",
        "apache-ant-1.10.18-bin.tar.gz",
        "apache-ant-1.10.18-bin.tar.xz",
        "apache-ant-1.10.18-bin.zip"
      ],
      "advisory_status": "none",
      "advisories": [],
      "published_at": "2005-11-22T18:23:18Z",
      "repository_url": "",
      "source_repo": null,
      "repository_source": null,
      "latest_release_at": "2005-11-08T22:29:01.000Z",
      "latest_release_version": "2.0.8",
      "rankings_average": 0.2966124335443883,
      "archived": null,
      "dds": null,
      "active_maintainers": null,
      "governance_files": null,
      "maintained": null,
      "scorecard_date": null,
      "criticality": 0.9437165200541059,
      "health": null,
      "health_inputs": 1,
      "risk": null
    },
    {
      "key": "pkg:maven/xalan/xalan",
      "purl": "pkg:maven/xalan/xalan@2.7.3",
      "source_purls": [
        "pkg:maven/xalan/xalan@2.7.3?type=jar"
      ],
      "name": "xalan",
      "ecosystem": "maven",
      "version": "2.7.3",
      "artifacts": [
        "apache-ant-1.10.18-bin.tar.bz2",
        "apache-ant-1.10.18-bin.tar.gz",
        "apache-ant-1.10.18-bin.tar.xz",
        "apache-ant-1.10.18-bin.zip"
      ],
      "advisory_status": "none",
      "advisories": [],
      "published_at": "2023-05-05T00:40:51Z",
      "repository_url": "",
      "source_repo": null,
      "repository_source": null,
      "latest_release_at": "2023-05-04T12:31:31.000Z",
      "latest_release_version": "2.7.3",
      "rankings_average": 0.270898453153803,
      "archived": null,
      "dds": null,
      "active_maintainers": null,
      "governance_files": null,
      "maintained": null,
      "scorecard_date": null,
      "criticality": 0.9480568074216573,
      "health": null,
      "health_inputs": 1,
      "risk": null
    },
    {
      "key": "pkg:maven/xml-resolver/xml-resolver",
      "purl": "pkg:maven/xml-resolver/xml-resolver@1.2",
      "source_purls": [
        "pkg:maven/xml-resolver/xml-resolver@1.2?type=jar"
      ],
      "name": "xml-resolver",
      "ecosystem": "maven",
      "version": "1.2",
      "artifacts": [
        "apache-ant-1.10.18-bin.tar.bz2",
        "apache-ant-1.10.18-bin.tar.gz",
        "apache-ant-1.10.18-bin.tar.xz",
        "apache-ant-1.10.18-bin.zip"
      ],
      "advisory_status": "none",
      "advisories": [],
      "published_at": "2016-01-02T02:41:33Z",
      "repository_url": "http://svn.apache.org/viewvc/xml/commons/tags/xml-commons-resolver-1_2/",
      "source_repo": null,
      "repository_source": null,
      "latest_release_at": "2006-12-22T13:37:52.000Z",
      "latest_release_version": "1.2",
      "rankings_average": 0.48161951323769064,
      "archived": null,
      "dds": null,
      "active_maintainers": null,
      "governance_files": null,
      "maintained": null,
      "scorecard_date": null,
      "criticality": 0.9148157120122327,
      "health": null,
      "health_inputs": 1,
      "risk": null
    }
  ],
  "sources": {
    "Alpha-Omega heuristic": "https://github.com/alpha-omega-security/heatmap/tree/4ed37981",
    "ecosyste.ms packages": "https://packages.ecosyste.ms/api/v1",
    "ecosyste.ms repositories": "https://repos.ecosyste.ms/api/v1",
    "ecosyste.ms issues": "https://issues.ecosyste.ms/api/v1",
    "deps.dev and OpenSSF Scorecard": "https://api.deps.dev/v3alpha",
    "ecosyste.ms data licence": "https://creativecommons.org/licenses/by-sa/4.0/",
    "deps.dev terms": "https://docs.deps.dev/api/v3alpha/#terms"
  },
  "attribution": "Alpha-Omega maintenance heuristic, with missing inputs left unknown. Includes ecosyste.ms data under CC BY-SA 4.0 and deps.dev and OpenSSF Scorecard observations. ATR selected, normalised and combined records and calculated maintenance indicators. gitbox_mirror identifies an inferred Apache GitHub mirror, not verified repository identity."
}