{
  "kind": "sbom_heatmap",
  "analysis_version": 1,
  "generated_at": "2026-10-12T20:38:05.016182+00:00",
  "sboms": [
    {
      "artifact_path": "apache-tooling-community-over-code-0.9.0-bin.tar.gz",
      "sbom_url": "https://downloads.apache.org/tooling/tooling-community-over-code-0.9.0/apache-tooling-community-over-code-0.9.0-bin.tar.gz.cdx.json",
      "sha256": "0bc6afda2f3f6263b7ece450c70942d4e4484c294b3e172bd84580fd1735f030",
      "retrieved_at": "2026-10-12T20:38:05.033705+00:00",
      "components": 10,
      "files": 0,
      "packages": 9,
      "error": null
    }
  ],
  "rows": [
    {
      "key": "pkg:maven/com.fasterxml.jackson.core/jackson-databind",
      "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10",
      "source_purls": [
        "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10"
      ],
      "name": "jackson-databind",
      "ecosystem": "maven",
      "version": "2.9.10",
      "artifacts": [
        "apache-tooling-community-over-code-0.9.0-bin.tar.gz"
      ],
      "advisory_status": "found",
      "advisories": [
        "GHSA-27xj-rqx5-2255",
        "GHSA-288c-cq4h-88gq",
        "GHSA-4w82-r329-3q67",
        "GHSA-57j2-w4cx-62h2",
        "GHSA-58pp-9c76-5625",
        "GHSA-5949-rw7g-wx7w",
        "GHSA-5jmj-h7xm-6q6v",
        "GHSA-5p34-5m6p-p58g",
        "GHSA-5r5r-6hpj-8gg9",
        "GHSA-758m-v56v-grj4",
        "GHSA-89qr-369f-5m5x",
        "GHSA-8c4j-34r4-xr8g",
        "GHSA-8w26-6f25-cm9x",
        "GHSA-95cm-88f5-f2c7",
        "GHSA-9gph-22xh-8x98",
        "GHSA-9m6f-7xcq-8vf8",
        "GHSA-9vvp-fxw6-jcxr",
        "GHSA-c265-37vj-cwcc",
        "GHSA-c2q3-4qrh-fm48",
        "GHSA-cvm9-fjm9-3572",
        "GHSA-cxp5-3px4-pw24",
        "GHSA-f9xh-2qgp-cq57",
        "GHSA-fmmc-742q-jg75",
        "GHSA-fqwf-pjwf-7vqv",
        "GHSA-gjmw-vf9h-g25v",
        "GHSA-gww7-p5w4-wrfv",
        "GHSA-h3cw-g4mq-c5x2",
        "GHSA-h4rc-386g-6m85",
        "GHSA-hgj6-7826-r7m5",
        "GHSA-j823-4qch-3rgm",
        "GHSA-jjjh-jjxp-wpff",
        "GHSA-m6x4-97wx-4q27",
        "GHSA-mc6h-4qgp-37qh",
        "GHSA-mx7p-6679-8g3q",
        "GHSA-p43x-xfjf-5jhr",
        "GHSA-q93h-jc49-78gg",
        "GHSA-qjw2-hr98-qgfh",
        "GHSA-r3gr-cxrf-hg25",
        "GHSA-r695-7vr9-jgc2",
        "GHSA-rf6r-2c4q-2vwg",
        "GHSA-rgv9-q543-rqg4",
        "GHSA-rpr3-cw39-3pxh",
        "GHSA-v3xw-c963-f5hc",
        "GHSA-v585-23hc-c647",
        "GHSA-vfqx-33qm-g869",
        "GHSA-vvgp-rfg2-7rr6",
        "GHSA-wh8g-3j2c-rqj5",
        "GHSA-wjgm-6hv5-3cvf",
        "GHSA-wv8q-qhhj-9h54"
      ],
      "published_at": "2019-09-21T18:02:37Z",
      "repository_url": "https://github.com/FasterXML/jackson-databind",
      "source_repo": "github.com/fasterxml/jackson-databind",
      "repository_source": "deps.dev",
      "latest_release_at": "2026-09-22T02:29:22.000Z",
      "latest_release_version": "2.22.3",
      "rankings_average": 2.031618177446502,
      "archived": false,
      "dds": 0.148047640584954,
      "active_maintainers": 3,
      "governance_files": 1,
      "maintained": 10,
      "scorecard_date": "2026-08-24T00:00:00Z",
      "criticality": 0.7596820007448203,
      "health": 0.6156064184960028,
      "health_inputs": 4,
      "risk": 0.2920168850704237
    },
    {
      "key": "pkg:maven/org.mozilla/rhino",
      "purl": "pkg:maven/org.mozilla/rhino@1.7.14",
      "source_purls": [
        "pkg:maven/org.mozilla/rhino@1.7.14"
      ],
      "name": "rhino",
      "ecosystem": "maven",
      "version": "1.7.14",
      "artifacts": [
        "apache-tooling-community-over-code-0.9.0-bin.tar.gz"
      ],
      "advisory_status": "found",
      "advisories": [
        "GHSA-3w8q-xq97-5j7x"
      ],
      "published_at": "2022-01-06T22:05:30Z",
      "repository_url": "https://github.com/mozilla/rhino",
      "source_repo": "github.com/mozilla/rhino",
      "repository_source": "ecosyste.ms",
      "latest_release_at": "2026-02-15T20:54:49.000Z",
      "latest_release_version": "1.9.1",
      "rankings_average": 2.5324035503716997,
      "archived": false,
      "dds": 0.748464862406186,
      "active_maintainers": 2,
      "governance_files": 2,
      "maintained": 10,
      "scorecard_date": "2026-08-24T00:00:00Z",
      "criticality": 0.726555671277807,
      "health": 0.715885991899053,
      "health_inputs": 4,
      "risk": 0.20642464387521184
    },
    {
      "key": "pkg:maven/org.apache.logging.log4j/log4j-core",
      "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.14.1",
      "source_purls": [
        "pkg:maven/org.apache.logging.log4j/log4j-core@2.14.1"
      ],
      "name": "log4j-core",
      "ecosystem": "maven",
      "version": "2.14.1",
      "artifacts": [
        "apache-tooling-community-over-code-0.9.0-bin.tar.gz"
      ],
      "advisory_status": "found",
      "advisories": [
        "GHSA-3pxv-7cmr-fjr4",
        "GHSA-6hg6-v5c8-fphq",
        "GHSA-7rjr-3q55-vv33",
        "GHSA-8489-44mv-ggj8",
        "GHSA-jfh8-c2jp-5v3q",
        "GHSA-p6xc-xr62-6r2g",
        "GHSA-vc5p-v9hr-52mj"
      ],
      "published_at": "2021-03-07T05:12:31Z",
      "repository_url": "https://github.com/apache/logging-log4j2",
      "source_repo": "github.com/apache/logging-log4j2",
      "repository_source": "ecosyste.ms",
      "latest_release_at": "2026-06-29T07:44:53.000Z",
      "latest_release_version": "2.26.1",
      "rankings_average": 1.992546285164703,
      "archived": false,
      "dds": 0.6355577976362063,
      "active_maintainers": 4,
      "governance_files": 2,
      "maintained": 10,
      "scorecard_date": "2026-08-24T00:00:00Z",
      "criticality": 0.7624927406800472,
      "health": 0.8014609232374224,
      "health_inputs": 4,
      "risk": 0.15138460477278412
    },
    {
      "key": "pkg:maven/org.apache.commons/commons-lang3",
      "purl": "pkg:maven/org.apache.commons/commons-lang3@3.14.0",
      "source_purls": [
        "pkg:maven/org.apache.commons/commons-lang3@3.14.0"
      ],
      "name": "commons-lang3",
      "ecosystem": "maven",
      "version": "3.14.0",
      "artifacts": [
        "apache-tooling-community-over-code-0.9.0-bin.tar.gz"
      ],
      "advisory_status": "found",
      "advisories": [
        "GHSA-j288-q9x7-2f5v"
      ],
      "published_at": "2023-11-18T15:03:29Z",
      "repository_url": "https://gitbox.apache.org/repos/asf/commons-lang.git",
      "source_repo": "github.com/apache/commons-lang",
      "repository_source": "gitbox_mirror",
      "latest_release_at": "2026-09-30T02:08:31.000Z",
      "latest_release_version": "3.21.0",
      "rankings_average": 0.0017363928575483336,
      "archived": false,
      "dds": 0.7746743486973948,
      "active_maintainers": 2,
      "governance_files": 3,
      "maintained": 10,
      "scorecard_date": "2026-08-24T00:00:00Z",
      "criticality": 0.9996240862911424,
      "health": 0.8574196071298968,
      "health_inputs": 4,
      "risk": 0.14252679494580897
    },
    {
      "key": "pkg:maven/org.springframework/spring-core",
      "purl": "pkg:maven/org.springframework/spring-core@5.3.30",
      "source_purls": [
        "pkg:maven/org.springframework/spring-core@5.3.30"
      ],
      "name": "spring-core",
      "ecosystem": "maven",
      "version": "5.3.30",
      "artifacts": [
        "apache-tooling-community-over-code-0.9.0-bin.tar.gz"
      ],
      "advisory_status": "found",
      "advisories": [
        "GHSA-659m-px2c-25wj",
        "GHSA-jmp9-x22r-554x"
      ],
      "published_at": "2023-09-14T08:27:44Z",
      "repository_url": "https://github.com/spring-projects/spring-framework",
      "source_repo": "github.com/spring-projects/spring-framework",
      "repository_source": "deps.dev",
      "latest_release_at": "2026-08-21T02:19:10.000Z",
      "latest_release_version": "7.0.9",
      "rankings_average": 0.2421884624670056,
      "archived": false,
      "dds": 0.8931889626266154,
      "active_maintainers": 8,
      "governance_files": 2,
      "maintained": 10,
      "scorecard_date": "2026-08-24T00:00:00Z",
      "criticality": 0.9530077898670009,
      "health": 0.8779175290673009,
      "health_inputs": 4,
      "risk": 0.11634554580507393
    },
    {
      "key": "pkg:maven/org.eclipse.jetty/jetty-server",
      "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.43.v20210629",
      "source_purls": [
        "pkg:maven/org.eclipse.jetty/jetty-server@9.4.43.v20210629"
      ],
      "name": "jetty-server",
      "ecosystem": "maven",
      "version": "9.4.43.v20210629",
      "artifacts": [
        "apache-tooling-community-over-code-0.9.0-bin.tar.gz"
      ],
      "advisory_status": "found",
      "advisories": [
        "GHSA-7p3p-8qv8-m2vh",
        "GHSA-g8m5-722r-8whq",
        "GHSA-p26g-97m4-6q7c",
        "GHSA-q4rv-gq96-w7c5",
        "GHSA-qw69-rqj8-6qw8"
      ],
      "published_at": "2021-06-30T11:08:57Z",
      "repository_url": "https://github.com/jetty/jetty.project",
      "source_repo": "github.com/eclipse/jetty.project",
      "repository_source": "deps.dev",
      "latest_release_at": "2026-10-06T00:27:00.000Z",
      "latest_release_version": "12.1.14",
      "rankings_average": 1.8098777055518276,
      "archived": false,
      "dds": 0.785330550992319,
      "active_maintainers": 2,
      "governance_files": 3,
      "maintained": 10,
      "scorecard_date": "2026-08-24T00:00:00Z",
      "criticality": 0.7761399821580902,
      "health": 0.8614374253554121,
      "health_inputs": 4,
      "risk": 0.10754395421242947
    },
    {
      "key": "pkg:maven/mysql/mysql-connector-java",
      "purl": "pkg:maven/mysql/mysql-connector-java@8.0.33",
      "source_purls": [
        "pkg:maven/mysql/mysql-connector-java@8.0.33"
      ],
      "name": "mysql-connector-java",
      "ecosystem": "maven",
      "version": "8.0.33",
      "artifacts": [
        "apache-tooling-community-over-code-0.9.0-bin.tar.gz"
      ],
      "advisory_status": "found",
      "advisories": [
        "GHSA-m6vm-37g8-gqvh"
      ],
      "published_at": "2023-03-07T16:15:54Z",
      "repository_url": "",
      "source_repo": null,
      "repository_source": null,
      "latest_release_at": "2023-03-07T16:15:54.000Z",
      "latest_release_version": "8.0.33",
      "rankings_average": 4.651082701798996,
      "archived": false,
      "dds": null,
      "active_maintainers": null,
      "governance_files": 1,
      "maintained": null,
      "scorecard_date": null,
      "criticality": 0.6247449770559294,
      "health": null,
      "health_inputs": 2,
      "risk": null
    },
    {
      "key": "pkg:maven/org.slf4j/slf4j-api",
      "purl": "pkg:maven/org.slf4j/slf4j-api@2.0.13",
      "source_purls": [
        "pkg:maven/org.slf4j/slf4j-api@2.0.13"
      ],
      "name": "slf4j-api",
      "ecosystem": "maven",
      "version": "2.0.13",
      "artifacts": [
        "apache-tooling-community-over-code-0.9.0-bin.tar.gz"
      ],
      "advisory_status": "none",
      "advisories": [],
      "published_at": "2024-04-12T14:24:03Z",
      "repository_url": "https://github.com/qos-ch/slf4j",
      "source_repo": "github.com/qos-ch/slf4j",
      "repository_source": "deps.dev",
      "latest_release_at": "2026-09-23T02:52:54.000Z",
      "latest_release_version": "2.0.20",
      "rankings_average": 2.5688896723583943,
      "archived": false,
      "dds": 0.17976965448172255,
      "active_maintainers": 0,
      "governance_files": 1,
      "maintained": 6,
      "scorecard_date": "2026-08-24T00:00:00Z",
      "criticality": 0.7243290772955459,
      "health": 0.37376896365800144,
      "health_inputs": 4,
      "risk": 0.45359734872743324
    },
    {
      "key": "pkg:maven/jakarta.annotation/jakarta.annotation-api",
      "purl": "pkg:maven/jakarta.annotation/jakarta.annotation-api@2.1.1",
      "source_purls": [
        "pkg:maven/jakarta.annotation/jakarta.annotation-api@2.1.1"
      ],
      "name": "jakarta.annotation-api",
      "ecosystem": "maven",
      "version": "2.1.1",
      "artifacts": [
        "apache-tooling-community-over-code-0.9.0-bin.tar.gz"
      ],
      "advisory_status": "none",
      "advisories": [],
      "published_at": "2022-06-14T11:30:18Z",
      "repository_url": "https://github.com/jakartaee/common-annotations-api",
      "source_repo": "github.com/eclipse-ee4j/common-annotations-api",
      "repository_source": "deps.dev",
      "latest_release_at": "2024-02-15T14:43:36.000Z",
      "latest_release_version": "3.0.0",
      "rankings_average": 11.99751684639492,
      "archived": false,
      "dds": null,
      "active_maintainers": 0,
      "governance_files": 3,
      "maintained": 0,
      "scorecard_date": "2026-08-24T00:00:00Z",
      "criticality": 0.44427056280729893,
      "health": null,
      "health_inputs": 3,
      "risk": null
    }
  ],
  "sources": {
    "Alpha-Omega heuristic": "https://github.com/alpha-omega-security/heatmap/tree/4ed37981",
    "ecosyste.ms packages": "https://packages.ecosyste.ms/api/v1",
    "ecosyste.ms repositories": "https://repos.ecosyste.ms/api/v1",
    "ecosyste.ms issues": "https://issues.ecosyste.ms/api/v1",
    "deps.dev and OpenSSF Scorecard": "https://api.deps.dev/v3alpha",
    "ecosyste.ms data licence": "https://creativecommons.org/licenses/by-sa/4.0/",
    "deps.dev terms": "https://docs.deps.dev/api/v3alpha/#terms"
  },
  "attribution": "Alpha-Omega maintenance heuristic, with missing inputs left unknown. Includes ecosyste.ms data under CC BY-SA 4.0 and deps.dev and OpenSSF Scorecard observations. ATR selected, normalised and combined records and calculated maintenance indicators. gitbox_mirror identifies an inferred Apache GitHub mirror, not verified repository identity."
}