{
  "kind": "sbom_heatmap",
  "analysis_version": 1,
  "generated_at": "2026-10-12T20:33:04.951130+00:00",
  "sboms": [
    {
      "artifact_path": "atr-maven-plugin-1.0.0-beta-1-source-release.zip",
      "sbom_url": "https://downloads.apache.org/tooling/tooling-atr-maven-plugin-1.0.0-beta-1/atr-maven-plugin-1.0.0-beta-1-cyclonedx.json",
      "sha256": "79f29457094798fc17451e6ba8e3042125a4b68e03317f95e64f3052fce40206",
      "retrieved_at": "2026-10-12T20:33:04.978635+00:00",
      "components": 36,
      "files": 0,
      "packages": 36,
      "error": null
    }
  ],
  "rows": [
    {
      "key": "pkg:maven/com.fasterxml.jackson.core/jackson-core",
      "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.22.2",
      "source_purls": [
        "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.22.2?type=jar"
      ],
      "name": "jackson-core",
      "ecosystem": "maven",
      "version": "2.22.2",
      "artifacts": [
        "atr-maven-plugin-1.0.0-beta-1-source-release.zip"
      ],
      "advisory_status": "found",
      "advisories": [
        "GHSA-7hhh-6rmp-j9qf",
        "GHSA-p6pp-m3f8-5c89"
      ],
      "published_at": "2026-08-16T16:26:43Z",
      "repository_url": "https://github.com/FasterXML/jackson-core",
      "source_repo": "github.com/fasterxml/jackson-core",
      "repository_source": "deps.dev",
      "latest_release_at": "2026-09-22T02:29:25.000Z",
      "latest_release_version": "2.22.3",
      "rankings_average": 2.8085276909513506,
      "archived": false,
      "dds": 0.1548655812192351,
      "active_maintainers": 2,
      "governance_files": 1,
      "maintained": 10,
      "scorecard_date": "2026-08-24T00:00:00Z",
      "criticality": 0.7102475056169733,
      "health": 0.533978371165386,
      "health_inputs": 4,
      "risk": 0.3309906994433435
    },
    {
      "key": "pkg:maven/com.fasterxml.jackson.core/jackson-databind",
      "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.22.2",
      "source_purls": [
        "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.22.2?type=jar"
      ],
      "name": "jackson-databind",
      "ecosystem": "maven",
      "version": "2.22.2",
      "artifacts": [
        "atr-maven-plugin-1.0.0-beta-1-source-release.zip"
      ],
      "advisory_status": "found",
      "advisories": [
        "GHSA-cxp5-3px4-pw24",
        "GHSA-wv8q-qhhj-9h54"
      ],
      "published_at": "2026-08-16T16:35:01Z",
      "repository_url": "https://github.com/FasterXML/jackson-databind",
      "source_repo": "github.com/fasterxml/jackson-databind",
      "repository_source": "deps.dev",
      "latest_release_at": "2026-09-22T02:29:22.000Z",
      "latest_release_version": "2.22.3",
      "rankings_average": 2.031618177446502,
      "archived": false,
      "dds": 0.148047640584954,
      "active_maintainers": 3,
      "governance_files": 1,
      "maintained": 10,
      "scorecard_date": "2026-08-24T00:00:00Z",
      "criticality": 0.7596820007448203,
      "health": 0.6156072114127011,
      "health_inputs": 4,
      "risk": 0.2920162827058799
    },
    {
      "key": "pkg:maven/com.google.inject/guice",
      "purl": "pkg:maven/com.google.inject/guice@5.1.0",
      "source_purls": [
        "pkg:maven/com.google.inject/guice@5.1.0?classifier=classes&type=jar"
      ],
      "name": "guice",
      "ecosystem": "maven",
      "version": "5.1.0",
      "artifacts": [
        "atr-maven-plugin-1.0.0-beta-1-source-release.zip"
      ],
      "advisory_status": "none",
      "advisories": [],
      "published_at": "2022-01-24T22:06:16Z",
      "repository_url": "https://github.com/google/guice",
      "source_repo": "github.com/google/guice",
      "repository_source": "deps.dev",
      "latest_release_at": "2023-05-12T17:41:05.000Z",
      "latest_release_version": "7.0.0",
      "rankings_average": 1.2094430143928847,
      "archived": false,
      "dds": 0.7975550122249389,
      "active_maintainers": 0,
      "governance_files": 1,
      "maintained": 5,
      "scorecard_date": "2026-08-24T00:00:00Z",
      "criticality": 0.8282297393566349,
      "health": 0.28272208638956803,
      "health_inputs": 4,
      "risk": 0.5940708994358389
    },
    {
      "key": "pkg:maven/com.google.guava/guava",
      "purl": "pkg:maven/com.google.guava/guava@33.6.0-jre",
      "source_purls": [
        "pkg:maven/com.google.guava/guava@33.6.0-jre?type=jar"
      ],
      "name": "guava",
      "ecosystem": "maven",
      "version": "33.6.0-jre",
      "artifacts": [
        "atr-maven-plugin-1.0.0-beta-1-source-release.zip"
      ],
      "advisory_status": "none",
      "advisories": [],
      "published_at": "2026-04-14T18:13:38Z",
      "repository_url": "https://github.com/google/guava",
      "source_repo": "github.com/google/guava",
      "repository_source": "deps.dev",
      "latest_release_at": "2017-08-04T21:24:32.000Z",
      "latest_release_version": "23.0",
      "rankings_average": 0.2313456760439208,
      "archived": false,
      "dds": 0.6975382767937557,
      "active_maintainers": 2,
      "governance_files": 1,
      "maintained": 10,
      "scorecard_date": "2026-08-24T00:00:00Z",
      "criticality": 0.9549074360772664,
      "health": 0.4243845691984389,
      "health_inputs": 4,
      "risk": 0.5496594551932298
    },
    {
      "key": "pkg:maven/org.slf4j/slf4j-api",
      "purl": "pkg:maven/org.slf4j/slf4j-api@1.7.36",
      "source_purls": [
        "pkg:maven/org.slf4j/slf4j-api@1.7.36?type=jar"
      ],
      "name": "slf4j-api",
      "ecosystem": "maven",
      "version": "1.7.36",
      "artifacts": [
        "atr-maven-plugin-1.0.0-beta-1-source-release.zip"
      ],
      "advisory_status": "none",
      "advisories": [],
      "published_at": "2022-02-08T13:33:50Z",
      "repository_url": "https://github.com/qos-ch/slf4j",
      "source_repo": "github.com/qos-ch/slf4j",
      "repository_source": "deps.dev",
      "latest_release_at": "2026-09-23T02:52:54.000Z",
      "latest_release_version": "2.0.20",
      "rankings_average": 2.5688896723583943,
      "archived": false,
      "dds": 0.17976965448172255,
      "active_maintainers": 0,
      "governance_files": 1,
      "maintained": 6,
      "scorecard_date": "2026-08-24T00:00:00Z",
      "criticality": 0.7243290772955459,
      "health": 0.37376975657469985,
      "health_inputs": 4,
      "risk": 0.4535967743948128
    },
    {
      "key": "pkg:maven/com.google.guava/failureaccess",
      "purl": "pkg:maven/com.google.guava/failureaccess@1.0.3",
      "source_purls": [
        "pkg:maven/com.google.guava/failureaccess@1.0.3?type=jar"
      ],
      "name": "failureaccess",
      "ecosystem": "maven",
      "version": "1.0.3",
      "artifacts": [
        "atr-maven-plugin-1.0.0-beta-1-source-release.zip"
      ],
      "advisory_status": "none",
      "advisories": [],
      "published_at": "2025-03-19T16:15:51Z",
      "repository_url": "https://github.com/google/guava",
      "source_repo": "github.com/google/guava",
      "repository_source": "deps.dev",
      "latest_release_at": "2025-03-19T16:15:50.000Z",
      "latest_release_version": "1.0.3",
      "rankings_average": 0.3299671395367476,
      "archived": false,
      "dds": 0.6975382767937557,
      "active_maintainers": 2,
      "governance_files": 1,
      "maintained": 10,
      "scorecard_date": "2026-08-24T00:00:00Z",
      "criticality": 0.9382130469242052,
      "health": 0.5437501753017019,
      "health_inputs": 4,
      "risk": 0.42805953818882475
    },
    {
      "key": "pkg:maven/com.fasterxml.jackson.core/jackson-annotations",
      "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-annotations@2.22",
      "source_purls": [
        "pkg:maven/com.fasterxml.jackson.core/jackson-annotations@2.22?type=jar"
      ],
      "name": "jackson-annotations",
      "ecosystem": "maven",
      "version": "2.22",
      "artifacts": [
        "atr-maven-plugin-1.0.0-beta-1-source-release.zip"
      ],
      "advisory_status": "none",
      "advisories": [],
      "published_at": "2026-05-31T04:44:48Z",
      "repository_url": "https://github.com/FasterXML/jackson-annotations",
      "source_repo": "github.com/fasterxml/jackson-annotations",
      "repository_source": "deps.dev",
      "latest_release_at": "2026-05-31T04:44:48.000Z",
      "latest_release_version": "2.22",
      "rankings_average": 4.647643917199174,
      "archived": false,
      "dds": 0.10285006195786861,
      "active_maintainers": 1,
      "governance_files": 1,
      "maintained": 10,
      "scorecard_date": "2026-08-24T00:00:00Z",
      "criticality": 0.6248768702649806,
      "health": 0.4116352256431275,
      "health_inputs": 4,
      "risk": 0.36765553877428403
    },
    {
      "key": "pkg:maven/org.codehaus.plexus/plexus-component-annotations",
      "purl": "pkg:maven/org.codehaus.plexus/plexus-component-annotations@2.2.0",
      "source_purls": [
        "pkg:maven/org.codehaus.plexus/plexus-component-annotations@2.2.0?type=jar"
      ],
      "name": "plexus-component-annotations",
      "ecosystem": "maven",
      "version": "2.2.0",
      "artifacts": [
        "atr-maven-plugin-1.0.0-beta-1-source-release.zip"
      ],
      "advisory_status": "none",
      "advisories": [],
      "published_at": "2023-12-24T00:55:57Z",
      "repository_url": "https://github.com/codehaus-plexus/plexus-containers",
      "source_repo": "github.com/codehaus-plexus/plexus-containers",
      "repository_source": "ecosyste.ms",
      "latest_release_at": "2023-12-24T00:55:57.000Z",
      "latest_release_version": "2.2.0",
      "rankings_average": 16.566829180390233,
      "archived": true,
      "dds": null,
      "active_maintainers": 0,
      "governance_files": 0,
      "maintained": 0,
      "scorecard_date": "2026-08-24T00:00:00Z",
      "criticality": 0.3789951080077929,
      "health": 0.05,
      "health_inputs": 3,
      "risk": 0.3600453526074032
    },
    {
      "key": "pkg:maven/org.codehaus.plexus/plexus-cipher",
      "purl": "pkg:maven/org.codehaus.plexus/plexus-cipher@2.0",
      "source_purls": [
        "pkg:maven/org.codehaus.plexus/plexus-cipher@2.0?type=jar"
      ],
      "name": "plexus-cipher",
      "ecosystem": "maven",
      "version": "2.0",
      "artifacts": [
        "atr-maven-plugin-1.0.0-beta-1-source-release.zip"
      ],
      "advisory_status": "none",
      "advisories": [],
      "published_at": "2021-09-08T19:31:20Z",
      "repository_url": "https://github.com/codehaus-plexus/plexus-cipher",
      "source_repo": "github.com/codehaus-plexus/plexus-cipher",
      "repository_source": "deps.dev",
      "latest_release_at": "2024-09-28T18:28:40.000Z",
      "latest_release_version": "3.0.0",
      "rankings_average": 22.082137465601782,
      "archived": true,
      "dds": null,
      "active_maintainers": 0,
      "governance_files": 0,
      "maintained": 0,
      "scorecard_date": "2026-08-24T00:00:00Z",
      "criticality": 0.3198316193351586,
      "health": 0.05,
      "health_inputs": 3,
      "risk": 0.3038400383684006
    },
    {
      "key": "pkg:maven/org.codehaus.plexus/plexus-utils",
      "purl": "pkg:maven/org.codehaus.plexus/plexus-utils@4.1.0",
      "source_purls": [
        "pkg:maven/org.codehaus.plexus/plexus-utils@4.1.0?type=jar"
      ],
      "name": "plexus-utils",
      "ecosystem": "maven",
      "version": "4.1.0",
      "artifacts": [
        "atr-maven-plugin-1.0.0-beta-1-source-release.zip"
      ],
      "advisory_status": "none",
      "advisories": [],
      "published_at": "2026-08-19T13:41:11Z",
      "repository_url": "https://github.com/codehaus-plexus/plexus-utils",
      "source_repo": "github.com/codehaus-plexus/plexus-utils",
      "repository_source": "ecosyste.ms",
      "latest_release_at": "2026-08-20T02:17:24.000Z",
      "latest_release_version": "4.1.0",
      "rankings_average": 12.628858032415982,
      "archived": false,
      "dds": 0.9006024096385542,
      "active_maintainers": 2,
      "governance_files": 0,
      "maintained": 10,
      "scorecard_date": "2026-08-24T00:00:00Z",
      "criticality": 0.4339932295857192,
      "health": 0.6295430931315384,
      "health_inputs": 4,
      "risk": 0.1607757894341796
    },
    {
      "key": "pkg:maven/org.apache.maven.shared/maven-shared-utils",
      "purl": "pkg:maven/org.apache.maven.shared/maven-shared-utils@3.4.2",
      "source_purls": [
        "pkg:maven/org.apache.maven.shared/maven-shared-utils@3.4.2?type=jar"
      ],
      "name": "maven-shared-utils",
      "ecosystem": "maven",
      "version": "3.4.2",
      "artifacts": [
        "atr-maven-plugin-1.0.0-beta-1-source-release.zip"
      ],
      "advisory_status": "none",
      "advisories": [],
      "published_at": "2023-05-11T20:51:56Z",
      "repository_url": "https://gitbox.apache.org/repos/asf/maven-shared-utils.git",
      "source_repo": "github.com/apache/maven-shared-utils",
      "repository_source": "gitbox_mirror",
      "latest_release_at": "2026-09-27T02:37:06.000Z",
      "latest_release_version": "3.5.0",
      "rankings_average": 13.667370781567538,
      "archived": false,
      "dds": 0.8213627992633518,
      "active_maintainers": 2,
      "governance_files": 0,
      "maintained": 10,
      "scorecard_date": "2026-08-24T00:00:00Z",
      "criticality": 0.418081208901974,
      "health": 0.6184121130390061,
      "health_inputs": 4,
      "risk": 0.15953472508300212
    },
    {
      "key": "pkg:maven/org.apache.maven.plugin-tools/maven-plugin-annotations",
      "purl": "pkg:maven/org.apache.maven.plugin-tools/maven-plugin-annotations@3.15.2",
      "source_purls": [
        "pkg:maven/org.apache.maven.plugin-tools/maven-plugin-annotations@3.15.2?type=jar"
      ],
      "name": "maven-plugin-annotations",
      "ecosystem": "maven",
      "version": "3.15.2",
      "artifacts": [
        "atr-maven-plugin-1.0.0-beta-1-source-release.zip"
      ],
      "advisory_status": "none",
      "advisories": [],
      "published_at": "2025-10-20T19:22:05Z",
      "repository_url": "https://gitbox.apache.org/repos/asf/maven-plugin-tools.git",
      "source_repo": "github.com/apache/maven-plugin-tools",
      "repository_source": "gitbox_mirror",
      "latest_release_at": "2026-09-10T02:14:15.000Z",
      "latest_release_version": "3.16.0",
      "rankings_average": 11.419355484587893,
      "archived": false,
      "dds": 0.7055261165783497,
      "active_maintainers": 4,
      "governance_files": 0,
      "maintained": 10,
      "scorecard_date": "2026-08-24T00:00:00Z",
      "criticality": 0.4541299251849924,
      "health": 0.6689013743185421,
      "health_inputs": 4,
      "risk": 0.15036179410957426
    },
    {
      "key": "pkg:maven/org.apache.maven/maven-plugin-api",
      "purl": "pkg:maven/org.apache.maven/maven-plugin-api@3.9.16",
      "source_purls": [
        "pkg:maven/org.apache.maven/maven-plugin-api@3.9.16?type=jar"
      ],
      "name": "maven-plugin-api",
      "ecosystem": "maven",
      "version": "3.9.16",
      "artifacts": [
        "atr-maven-plugin-1.0.0-beta-1-source-release.zip"
      ],
      "advisory_status": "none",
      "advisories": [],
      "published_at": "2026-05-13T21:37:39Z",
      "repository_url": "https://gitbox.apache.org/repos/asf/maven.git",
      "source_repo": "github.com/apache/maven",
      "repository_source": "gitbox_mirror",
      "latest_release_at": "2026-10-02T02:17:55.000Z",
      "latest_release_version": "3.10.0",
      "rankings_average": 1.6541636611364912,
      "archived": false,
      "dds": 0.8029802658074909,
      "active_maintainers": 10,
      "governance_files": 2,
      "maintained": 10,
      "scorecard_date": "2026-08-24T00:00:00Z",
      "criticality": 0.7884931506586592,
      "health": 0.8649549906889087,
      "health_inputs": 4,
      "risk": 0.10648206487243037
    },
    {
      "key": "pkg:maven/org.apache.maven/maven-artifact",
      "purl": "pkg:maven/org.apache.maven/maven-artifact@3.9.16",
      "source_purls": [
        "pkg:maven/org.apache.maven/maven-artifact@3.9.16?type=jar"
      ],
      "name": "maven-artifact",
      "ecosystem": "maven",
      "version": "3.9.16",
      "artifacts": [
        "atr-maven-plugin-1.0.0-beta-1-source-release.zip"
      ],
      "advisory_status": "none",
      "advisories": [],
      "published_at": "2026-05-13T21:37:33Z",
      "repository_url": "https://gitbox.apache.org/repos/asf/maven.git",
      "source_repo": "github.com/apache/maven",
      "repository_source": "gitbox_mirror",
      "latest_release_at": "2026-10-02T02:17:43.000Z",
      "latest_release_version": "3.10.0",
      "rankings_average": 1.6578504448184659,
      "archived": false,
      "dds": 0.8029802658074909,
      "active_maintainers": 10,
      "governance_files": 2,
      "maintained": 10,
      "scorecard_date": "2026-08-24T00:00:00Z",
      "criticality": 0.7881923800075883,
      "health": 0.8649549589791168,
      "health_inputs": 4,
      "risk": 0.10644147229047234
    },
    {
      "key": "pkg:maven/org.apache.maven/maven-core",
      "purl": "pkg:maven/org.apache.maven/maven-core@3.9.16",
      "source_purls": [
        "pkg:maven/org.apache.maven/maven-core@3.9.16?type=jar"
      ],
      "name": "maven-core",
      "ecosystem": "maven",
      "version": "3.9.16",
      "artifacts": [
        "atr-maven-plugin-1.0.0-beta-1-source-release.zip"
      ],
      "advisory_status": "none",
      "advisories": [],
      "published_at": "2026-05-13T21:38:30Z",
      "repository_url": "https://gitbox.apache.org/repos/asf/maven.git",
      "source_repo": "github.com/apache/maven",
      "repository_source": "gitbox_mirror",
      "latest_release_at": "2026-10-02T02:17:42.000Z",
      "latest_release_version": "3.10.0",
      "rankings_average": 1.659974352809169,
      "archived": false,
      "dds": 0.8029802658074909,
      "active_maintainers": 10,
      "governance_files": 2,
      "maintained": 10,
      "scorecard_date": "2026-08-24T00:00:00Z",
      "criticality": 0.788019299306261,
      "health": 0.8649549563366341,
      "health_inputs": 4,
      "risk": 0.10641810068238902
    },
    {
      "key": "pkg:maven/org.apache.maven/maven-model",
      "purl": "pkg:maven/org.apache.maven/maven-model@3.9.16",
      "source_purls": [
        "pkg:maven/org.apache.maven/maven-model@3.9.16?type=jar"
      ],
      "name": "maven-model",
      "ecosystem": "maven",
      "version": "3.9.16",
      "artifacts": [
        "atr-maven-plugin-1.0.0-beta-1-source-release.zip"
      ],
      "advisory_status": "none",
      "advisories": [],
      "published_at": "2026-05-13T21:37:27Z",
      "repository_url": "https://gitbox.apache.org/repos/asf/maven.git",
      "source_repo": "github.com/apache/maven",
      "repository_source": "gitbox_mirror",
      "latest_release_at": "2026-10-02T02:17:42.000Z",
      "latest_release_version": "3.10.0",
      "rankings_average": 1.6668670353450348,
      "archived": false,
      "dds": 0.8029802658074909,
      "active_maintainers": 10,
      "governance_files": 2,
      "maintained": 10,
      "scorecard_date": "2026-08-24T00:00:00Z",
      "criticality": 0.7874585539285678,
      "health": 0.8649549563366341,
      "health_inputs": 4,
      "risk": 0.1063423747983744
    },
    {
      "key": "pkg:maven/org.apache.maven/maven-settings",
      "purl": "pkg:maven/org.apache.maven/maven-settings@3.9.16",
      "source_purls": [
        "pkg:maven/org.apache.maven/maven-settings@3.9.16?type=jar"
      ],
      "name": "maven-settings",
      "ecosystem": "maven",
      "version": "3.9.16",
      "artifacts": [
        "atr-maven-plugin-1.0.0-beta-1-source-release.zip"
      ],
      "advisory_status": "none",
      "advisories": [],
      "published_at": "2026-05-13T21:37:56Z",
      "repository_url": "https://gitbox.apache.org/repos/asf/maven.git",
      "source_repo": "github.com/apache/maven",
      "repository_source": "gitbox_mirror",
      "latest_release_at": "2026-10-02T02:17:54.000Z",
      "latest_release_version": "3.10.0",
      "rankings_average": 1.6955598300873607,
      "archived": false,
      "dds": 0.8029802658074909,
      "active_maintainers": 10,
      "governance_files": 2,
      "maintained": 10,
      "scorecard_date": "2026-08-24T00:00:00Z",
      "criticality": 0.7851397578177732,
      "health": 0.864954988046426,
      "health_inputs": 4,
      "risk": 0.10602920797972737
    },
    {
      "key": "pkg:maven/org.apache.maven/maven-settings-builder",
      "purl": "pkg:maven/org.apache.maven/maven-settings-builder@3.9.16",
      "source_purls": [
        "pkg:maven/org.apache.maven/maven-settings-builder@3.9.16?type=jar"
      ],
      "name": "maven-settings-builder",
      "ecosystem": "maven",
      "version": "3.9.16",
      "artifacts": [
        "atr-maven-plugin-1.0.0-beta-1-source-release.zip"
      ],
      "advisory_status": "none",
      "advisories": [],
      "published_at": "2026-05-13T21:38:02Z",
      "repository_url": "https://gitbox.apache.org/repos/asf/maven.git",
      "source_repo": "github.com/apache/maven",
      "repository_source": "gitbox_mirror",
      "latest_release_at": "2026-10-02T02:17:54.000Z",
      "latest_release_version": "3.10.0",
      "rankings_average": 1.7447303037589166,
      "archived": false,
      "dds": 0.8029802658074909,
      "active_maintainers": 10,
      "governance_files": 2,
      "maintained": 10,
      "scorecard_date": "2026-08-24T00:00:00Z",
      "criticality": 0.7812228702471772,
      "health": 0.864954988046426,
      "health_inputs": 4,
      "risk": 0.10550025185093542
    },
    {
      "key": "pkg:maven/org.apache.maven/maven-model-builder",
      "purl": "pkg:maven/org.apache.maven/maven-model-builder@3.9.16",
      "source_purls": [
        "pkg:maven/org.apache.maven/maven-model-builder@3.9.16?type=jar"
      ],
      "name": "maven-model-builder",
      "ecosystem": "maven",
      "version": "3.9.16",
      "artifacts": [
        "atr-maven-plugin-1.0.0-beta-1-source-release.zip"
      ],
      "advisory_status": "none",
      "advisories": [],
      "published_at": "2026-05-13T21:37:52Z",
      "repository_url": "https://gitbox.apache.org/repos/asf/maven.git",
      "source_repo": "github.com/apache/maven",
      "repository_source": "gitbox_mirror",
      "latest_release_at": "2026-10-02T02:17:43.000Z",
      "latest_release_version": "3.10.0",
      "rankings_average": 1.7509016590526572,
      "archived": false,
      "dds": 0.8029802658074909,
      "active_maintainers": 10,
      "governance_files": 2,
      "maintained": 10,
      "scorecard_date": "2026-08-24T00:00:00Z",
      "criticality": 0.7807362277398057,
      "health": 0.8649549589791168,
      "health_inputs": 4,
      "risk": 0.10543455590161167
    },
    {
      "key": "pkg:maven/org.apache.maven/maven-repository-metadata",
      "purl": "pkg:maven/org.apache.maven/maven-repository-metadata@3.9.16",
      "source_purls": [
        "pkg:maven/org.apache.maven/maven-repository-metadata@3.9.16?type=jar"
      ],
      "name": "maven-repository-metadata",
      "ecosystem": "maven",
      "version": "3.9.16",
      "artifacts": [
        "atr-maven-plugin-1.0.0-beta-1-source-release.zip"
      ],
      "advisory_status": "none",
      "advisories": [],
      "published_at": "2026-05-13T21:38:07Z",
      "repository_url": "https://gitbox.apache.org/repos/asf/maven.git",
      "source_repo": "github.com/apache/maven",
      "repository_source": "gitbox_mirror",
      "latest_release_at": "2026-10-02T02:17:58.000Z",
      "latest_release_version": "3.10.0",
      "rankings_average": 1.767572333092891,
      "archived": false,
      "dds": 0.8029802658074909,
      "active_maintainers": 10,
      "governance_files": 2,
      "maintained": 10,
      "scorecard_date": "2026-08-24T00:00:00Z",
      "criticality": 0.779427098780345,
      "health": 0.8649549986163567,
      "health_inputs": 4,
      "risk": 0.10525773363324076
    },
    {
      "key": "pkg:maven/org.apache.maven/maven-resolver-provider",
      "purl": "pkg:maven/org.apache.maven/maven-resolver-provider@3.9.16",
      "source_purls": [
        "pkg:maven/org.apache.maven/maven-resolver-provider@3.9.16?type=jar"
      ],
      "name": "maven-resolver-provider",
      "ecosystem": "maven",
      "version": "3.9.16",
      "artifacts": [
        "atr-maven-plugin-1.0.0-beta-1-source-release.zip"
      ],
      "advisory_status": "none",
      "advisories": [],
      "published_at": "2026-05-13T21:38:13Z",
      "repository_url": "https://gitbox.apache.org/repos/asf/maven.git",
      "source_repo": "github.com/apache/maven",
      "repository_source": "gitbox_mirror",
      "latest_release_at": "2026-10-02T02:17:55.000Z",
      "latest_release_version": "3.10.0",
      "rankings_average": 1.8317704576420613,
      "archived": false,
      "dds": 0.8029802658074909,
      "active_maintainers": 10,
      "governance_files": 2,
      "maintained": 10,
      "scorecard_date": "2026-08-24T00:00:00Z",
      "criticality": 0.774458301650933,
      "health": 0.8649549906889087,
      "health_inputs": 4,
      "risk": 0.10458672855750221
    },
    {
      "key": "pkg:maven/org.apache.maven/maven-builder-support",
      "purl": "pkg:maven/org.apache.maven/maven-builder-support@3.9.16",
      "source_purls": [
        "pkg:maven/org.apache.maven/maven-builder-support@3.9.16?type=jar"
      ],
      "name": "maven-builder-support",
      "ecosystem": "maven",
      "version": "3.9.16",
      "artifacts": [
        "atr-maven-plugin-1.0.0-beta-1-source-release.zip"
      ],
      "advisory_status": "none",
      "advisories": [],
      "published_at": "2026-05-13T21:37:44Z",
      "repository_url": "https://gitbox.apache.org/repos/asf/maven.git",
      "source_repo": "github.com/apache/maven",
      "repository_source": "gitbox_mirror",
      "latest_release_at": "2026-10-02T02:17:44.000Z",
      "latest_release_version": "3.10.0",
      "rankings_average": 2.0925631315858593,
      "archived": false,
      "dds": 0.8029802658074909,
      "active_maintainers": 10,
      "governance_files": 2,
      "maintained": 10,
      "scorecard_date": "2026-08-24T00:00:00Z",
      "criticality": 0.7553692833429461,
      "health": 0.8649549616215993,
      "health_inputs": 4,
      "risk": 0.10200887385891315
    },
    {
      "key": "pkg:maven/aopalliance/aopalliance",
      "purl": "pkg:maven/aopalliance/aopalliance@1.0",
      "source_purls": [
        "pkg:maven/aopalliance/aopalliance@1.0?type=jar"
      ],
      "name": "aopalliance",
      "ecosystem": "maven",
      "version": "1.0",
      "artifacts": [
        "atr-maven-plugin-1.0.0-beta-1-source-release.zip"
      ],
      "advisory_status": "none",
      "advisories": [],
      "published_at": "2005-08-01T09:23:54Z",
      "repository_url": "",
      "source_repo": null,
      "repository_source": null,
      "latest_release_at": "2007-02-26T22:43:40.000Z",
      "latest_release_version": "1.0",
      "rankings_average": 0.06238144853196548,
      "archived": null,
      "dds": null,
      "active_maintainers": null,
      "governance_files": null,
      "maintained": null,
      "scorecard_date": null,
      "criticality": 0.9868880915421223,
      "health": null,
      "health_inputs": 1,
      "risk": null
    },
    {
      "key": "pkg:maven/javax.inject/javax.inject",
      "purl": "pkg:maven/javax.inject/javax.inject@1",
      "source_purls": [
        "pkg:maven/javax.inject/javax.inject@1?type=jar"
      ],
      "name": "javax.inject",
      "ecosystem": "maven",
      "version": "1",
      "artifacts": [
        "atr-maven-plugin-1.0.0-beta-1-source-release.zip"
      ],
      "advisory_status": "none",
      "advisories": [],
      "published_at": "2009-10-13T23:35:00Z",
      "repository_url": "http://code.google.com/p/atinject/source/checkout",
      "source_repo": null,
      "repository_source": null,
      "latest_release_at": "2009-10-13T23:35:00.000Z",
      "latest_release_version": "1",
      "rankings_average": 0.15016668502037261,
      "archived": null,
      "dds": null,
      "active_maintainers": null,
      "governance_files": null,
      "maintained": null,
      "scorecard_date": null,
      "criticality": 0.9696851090112815,
      "health": null,
      "health_inputs": 1,
      "risk": null
    },
    {
      "key": "pkg:maven/org.apache.maven.resolver/maven-resolver-api",
      "purl": "pkg:maven/org.apache.maven.resolver/maven-resolver-api@1.9.27",
      "source_purls": [
        "pkg:maven/org.apache.maven.resolver/maven-resolver-api@1.9.27?type=jar"
      ],
      "name": "maven-resolver-api",
      "ecosystem": "maven",
      "version": "1.9.27",
      "artifacts": [
        "atr-maven-plugin-1.0.0-beta-1-source-release.zip"
      ],
      "advisory_status": "none",
      "advisories": [],
      "published_at": "2026-02-20T15:50:18Z",
      "repository_url": "https://gitbox.apache.org/repos/asf/maven-resolver.git",
      "source_repo": "github.com/apache/maven-resolver",
      "repository_source": "gitbox_mirror",
      "latest_release_at": "2026-10-02T02:17:55.000Z",
      "latest_release_version": "2.0.24",
      "rankings_average": 9.445728222605798,
      "archived": false,
      "dds": null,
      "active_maintainers": 4,
      "governance_files": 1,
      "maintained": 10,
      "scorecard_date": "2026-08-24T00:00:00Z",
      "criticality": 0.4916290693278542,
      "health": null,
      "health_inputs": 3,
      "risk": null
    },
    {
      "key": "pkg:maven/org.apache.maven.resolver/maven-resolver-impl",
      "purl": "pkg:maven/org.apache.maven.resolver/maven-resolver-impl@1.9.27",
      "source_purls": [
        "pkg:maven/org.apache.maven.resolver/maven-resolver-impl@1.9.27?type=jar"
      ],
      "name": "maven-resolver-impl",
      "ecosystem": "maven",
      "version": "1.9.27",
      "artifacts": [
        "atr-maven-plugin-1.0.0-beta-1-source-release.zip"
      ],
      "advisory_status": "none",
      "advisories": [],
      "published_at": "2026-02-20T15:51:23Z",
      "repository_url": "https://gitbox.apache.org/repos/asf/maven-resolver.git",
      "source_repo": "github.com/apache/maven-resolver",
      "repository_source": "gitbox_mirror",
      "latest_release_at": "2026-10-02T02:17:58.000Z",
      "latest_release_version": "2.0.24",
      "rankings_average": 9.57440417786357,
      "archived": false,
      "dds": null,
      "active_maintainers": 4,
      "governance_files": 1,
      "maintained": 10,
      "scorecard_date": "2026-08-24T00:00:00Z",
      "criticality": 0.48897620934925823,
      "health": null,
      "health_inputs": 3,
      "risk": null
    },
    {
      "key": "pkg:maven/org.apache.maven.resolver/maven-resolver-named-locks",
      "purl": "pkg:maven/org.apache.maven.resolver/maven-resolver-named-locks@1.9.27",
      "source_purls": [
        "pkg:maven/org.apache.maven.resolver/maven-resolver-named-locks@1.9.27?type=jar"
      ],
      "name": "maven-resolver-named-locks",
      "ecosystem": "maven",
      "version": "1.9.27",
      "artifacts": [
        "atr-maven-plugin-1.0.0-beta-1-source-release.zip"
      ],
      "advisory_status": "none",
      "advisories": [],
      "published_at": "2026-02-20T15:50:54Z",
      "repository_url": "https://gitbox.apache.org/repos/asf/maven-resolver.git",
      "source_repo": "github.com/apache/maven-resolver",
      "repository_source": "gitbox_mirror",
      "latest_release_at": "2026-10-02T02:17:56.000Z",
      "latest_release_version": "2.0.24",
      "rankings_average": 12.136549497991565,
      "archived": false,
      "dds": null,
      "active_maintainers": 4,
      "governance_files": 1,
      "maintained": 10,
      "scorecard_date": "2026-08-24T00:00:00Z",
      "criticality": 0.44196508544207014,
      "health": null,
      "health_inputs": 3,
      "risk": null
    },
    {
      "key": "pkg:maven/org.apache.maven.resolver/maven-resolver-spi",
      "purl": "pkg:maven/org.apache.maven.resolver/maven-resolver-spi@1.9.27",
      "source_purls": [
        "pkg:maven/org.apache.maven.resolver/maven-resolver-spi@1.9.27?type=jar"
      ],
      "name": "maven-resolver-spi",
      "ecosystem": "maven",
      "version": "1.9.27",
      "artifacts": [
        "atr-maven-plugin-1.0.0-beta-1-source-release.zip"
      ],
      "advisory_status": "none",
      "advisories": [],
      "published_at": "2026-02-20T15:50:24Z",
      "repository_url": "https://gitbox.apache.org/repos/asf/maven-resolver.git",
      "source_repo": "github.com/apache/maven-resolver",
      "repository_source": "gitbox_mirror",
      "latest_release_at": "2026-10-02T02:17:57.000Z",
      "latest_release_version": "2.0.24",
      "rankings_average": 9.654461206982862,
      "archived": false,
      "dds": null,
      "active_maintainers": 4,
      "governance_files": 1,
      "maintained": 10,
      "scorecard_date": "2026-08-24T00:00:00Z",
      "criticality": 0.4873419473045111,
      "health": null,
      "health_inputs": 3,
      "risk": null
    },
    {
      "key": "pkg:maven/org.apache.maven.resolver/maven-resolver-util",
      "purl": "pkg:maven/org.apache.maven.resolver/maven-resolver-util@1.9.27",
      "source_purls": [
        "pkg:maven/org.apache.maven.resolver/maven-resolver-util@1.9.27?type=jar"
      ],
      "name": "maven-resolver-util",
      "ecosystem": "maven",
      "version": "1.9.27",
      "artifacts": [
        "atr-maven-plugin-1.0.0-beta-1-source-release.zip"
      ],
      "advisory_status": "none",
      "advisories": [],
      "published_at": "2026-02-20T15:50:36Z",
      "repository_url": "https://gitbox.apache.org/repos/asf/maven-resolver.git",
      "source_repo": "github.com/apache/maven-resolver",
      "repository_source": "gitbox_mirror",
      "latest_release_at": "2026-10-02T02:17:55.000Z",
      "latest_release_version": "2.0.24",
      "rankings_average": 9.59999519417534,
      "archived": false,
      "dds": null,
      "active_maintainers": 4,
      "governance_files": 1,
      "maintained": 10,
      "scorecard_date": "2026-08-24T00:00:00Z",
      "criticality": 0.4884524598820056,
      "health": null,
      "health_inputs": 3,
      "risk": null
    },
    {
      "key": "pkg:maven/org.codehaus.plexus/plexus-classworlds",
      "purl": "pkg:maven/org.codehaus.plexus/plexus-classworlds@2.11.0",
      "source_purls": [
        "pkg:maven/org.codehaus.plexus/plexus-classworlds@2.11.0?type=jar"
      ],
      "name": "plexus-classworlds",
      "ecosystem": "maven",
      "version": "2.11.0",
      "artifacts": [
        "atr-maven-plugin-1.0.0-beta-1-source-release.zip"
      ],
      "advisory_status": "none",
      "advisories": [],
      "published_at": "2026-05-11T18:21:25Z",
      "repository_url": "https://github.com/codehaus-plexus/plexus-classworlds",
      "source_repo": "github.com/codehaus-plexus/plexus-classworlds",
      "repository_source": "ecosyste.ms",
      "latest_release_at": "2026-08-20T02:17:22.000Z",
      "latest_release_version": "2.12.1",
      "rankings_average": 12.611143840749602,
      "archived": false,
      "dds": null,
      "active_maintainers": 2,
      "governance_files": 0,
      "maintained": 10,
      "scorecard_date": "2026-08-24T00:00:00Z",
      "criticality": 0.43427504271131123,
      "health": null,
      "health_inputs": 3,
      "risk": null
    },
    {
      "key": "pkg:maven/org.codehaus.plexus/plexus-interpolation",
      "purl": "pkg:maven/org.codehaus.plexus/plexus-interpolation@1.29",
      "source_purls": [
        "pkg:maven/org.codehaus.plexus/plexus-interpolation@1.29?type=jar"
      ],
      "name": "plexus-interpolation",
      "ecosystem": "maven",
      "version": "1.29",
      "artifacts": [
        "atr-maven-plugin-1.0.0-beta-1-source-release.zip"
      ],
      "advisory_status": "none",
      "advisories": [],
      "published_at": "2025-11-07T17:46:40Z",
      "repository_url": "https://github.com/codehaus-plexus/plexus-interpolation",
      "source_repo": "github.com/codehaus-plexus/plexus-interpolation",
      "repository_source": "ecosyste.ms",
      "latest_release_at": "2026-08-20T02:17:24.000Z",
      "latest_release_version": "1.30.0",
      "rankings_average": 18.056522740241668,
      "archived": false,
      "dds": null,
      "active_maintainers": 1,
      "governance_files": 0,
      "maintained": 9,
      "scorecard_date": "2026-08-24T00:00:00Z",
      "criticality": 0.3613580765065909,
      "health": null,
      "health_inputs": 3,
      "risk": null
    },
    {
      "key": "pkg:maven/org.codehaus.plexus/plexus-sec-dispatcher",
      "purl": "pkg:maven/org.codehaus.plexus/plexus-sec-dispatcher@2.0",
      "source_purls": [
        "pkg:maven/org.codehaus.plexus/plexus-sec-dispatcher@2.0?type=jar"
      ],
      "name": "plexus-sec-dispatcher",
      "ecosystem": "maven",
      "version": "2.0",
      "artifacts": [
        "atr-maven-plugin-1.0.0-beta-1-source-release.zip"
      ],
      "advisory_status": "none",
      "advisories": [],
      "published_at": "2021-09-10T11:23:39Z",
      "repository_url": "https://github.com/codehaus-plexus/plexus-sec-dispatcher",
      "source_repo": "github.com/codehaus-plexus/plexus-sec-dispatcher",
      "repository_source": "deps.dev",
      "latest_release_at": "2026-08-20T02:17:20.000Z",
      "latest_release_version": "4.2.0",
      "rankings_average": 23.375976507451234,
      "archived": false,
      "dds": null,
      "active_maintainers": 1,
      "governance_files": 0,
      "maintained": null,
      "scorecard_date": null,
      "criticality": 0.3080141534177284,
      "health": null,
      "health_inputs": 3,
      "risk": null
    },
    {
      "key": "pkg:maven/org.eclipse.sisu/org.eclipse.sisu.inject",
      "purl": "pkg:maven/org.eclipse.sisu/org.eclipse.sisu.inject@1.0.0",
      "source_purls": [
        "pkg:maven/org.eclipse.sisu/org.eclipse.sisu.inject@1.0.0?type=jar"
      ],
      "name": "org.eclipse.sisu.inject",
      "ecosystem": "maven",
      "version": "1.0.0",
      "artifacts": [
        "atr-maven-plugin-1.0.0-beta-1-source-release.zip"
      ],
      "advisory_status": "none",
      "advisories": [],
      "published_at": "2026-02-07T19:50:53Z",
      "repository_url": "https://github.com/eclipse-sisu/sisu-project",
      "source_repo": "github.com/eclipse-sisu/sisu-project",
      "repository_source": "deps.dev",
      "latest_release_at": "2026-07-28T00:27:46.000Z",
      "latest_release_version": "1.1.0",
      "rankings_average": 17.570418305155332,
      "archived": false,
      "dds": null,
      "active_maintainers": 1,
      "governance_files": 2,
      "maintained": null,
      "scorecard_date": null,
      "criticality": 0.36695696454595805,
      "health": null,
      "health_inputs": 3,
      "risk": null
    },
    {
      "key": "pkg:maven/org.eclipse.sisu/org.eclipse.sisu.plexus",
      "purl": "pkg:maven/org.eclipse.sisu/org.eclipse.sisu.plexus@1.0.0",
      "source_purls": [
        "pkg:maven/org.eclipse.sisu/org.eclipse.sisu.plexus@1.0.0?type=jar"
      ],
      "name": "org.eclipse.sisu.plexus",
      "ecosystem": "maven",
      "version": "1.0.0",
      "artifacts": [
        "atr-maven-plugin-1.0.0-beta-1-source-release.zip"
      ],
      "advisory_status": "none",
      "advisories": [],
      "published_at": "2026-02-07T19:50:53Z",
      "repository_url": "https://github.com/eclipse-sisu/sisu-project",
      "source_repo": "github.com/eclipse-sisu/sisu-project",
      "repository_source": "deps.dev",
      "latest_release_at": "2026-07-28T00:27:33.000Z",
      "latest_release_version": "1.1.0",
      "rankings_average": 20.63692226343746,
      "archived": false,
      "dds": null,
      "active_maintainers": 1,
      "governance_files": 2,
      "maintained": null,
      "scorecard_date": null,
      "criticality": 0.33384161730571815,
      "health": null,
      "health_inputs": 3,
      "risk": null
    },
    {
      "key": "pkg:maven/org.jspecify/jspecify",
      "purl": "pkg:maven/org.jspecify/jspecify@1.0.0",
      "source_purls": [
        "pkg:maven/org.jspecify/jspecify@1.0.0?type=jar"
      ],
      "name": "jspecify",
      "ecosystem": "maven",
      "version": "1.0.0",
      "artifacts": [
        "atr-maven-plugin-1.0.0-beta-1-source-release.zip"
      ],
      "advisory_status": "none",
      "advisories": [],
      "published_at": "2024-07-16T21:00:10Z",
      "repository_url": "https://github.com/jspecify/jspecify",
      "source_repo": "github.com/jspecify/jspecify",
      "repository_source": "deps.dev",
      "latest_release_at": "2026-07-30T00:26:23.000Z",
      "latest_release_version": "1.0.1",
      "rankings_average": 14.978148496339609,
      "archived": false,
      "dds": null,
      "active_maintainers": 3,
      "governance_files": 1,
      "maintained": 10,
      "scorecard_date": "2026-08-24T00:00:00Z",
      "criticality": 0.3995341920748844,
      "health": null,
      "health_inputs": 3,
      "risk": null
    },
    {
      "key": "pkg:maven/org.ow2.asm/asm",
      "purl": "pkg:maven/org.ow2.asm/asm@9.9.1",
      "source_purls": [
        "pkg:maven/org.ow2.asm/asm@9.9.1?type=jar"
      ],
      "name": "asm",
      "ecosystem": "maven",
      "version": "9.9.1",
      "artifacts": [
        "atr-maven-plugin-1.0.0-beta-1-source-release.zip"
      ],
      "advisory_status": "none",
      "advisories": [],
      "published_at": "2025-12-06T15:16:52Z",
      "repository_url": "https://gitlab.ow2.org/asm/asm/",
      "source_repo": null,
      "repository_source": null,
      "latest_release_at": "2026-10-10T02:29:52.000Z",
      "latest_release_version": "9.11",
      "rankings_average": 0.6659586973364323,
      "archived": null,
      "dds": null,
      "active_maintainers": 0,
      "governance_files": null,
      "maintained": null,
      "scorecard_date": null,
      "criticality": 0.8894068421268606,
      "health": null,
      "health_inputs": 2,
      "risk": null
    }
  ],
  "sources": {
    "Alpha-Omega heuristic": "https://github.com/alpha-omega-security/heatmap/tree/4ed37981",
    "ecosyste.ms packages": "https://packages.ecosyste.ms/api/v1",
    "ecosyste.ms repositories": "https://repos.ecosyste.ms/api/v1",
    "ecosyste.ms issues": "https://issues.ecosyste.ms/api/v1",
    "deps.dev and OpenSSF Scorecard": "https://api.deps.dev/v3alpha",
    "ecosyste.ms data licence": "https://creativecommons.org/licenses/by-sa/4.0/",
    "deps.dev terms": "https://docs.deps.dev/api/v3alpha/#terms"
  },
  "attribution": "Alpha-Omega maintenance heuristic, with missing inputs left unknown. Includes ecosyste.ms data under CC BY-SA 4.0 and deps.dev and OpenSSF Scorecard observations. ATR selected, normalised and combined records and calculated maintenance indicators. gitbox_mirror identifies an inferred Apache GitHub mirror, not verified repository identity."
}