{
  "kind": "sbom_heatmap",
  "analysis_version": 1,
  "generated_at": "2026-09-10T17:19:34.916761+00:00",
  "sboms": [
    {
      "artifact_path": "apache-ivy-2.6.0-bin-with-deps.tar.gz",
      "sbom_url": "https://downloads.apache.org/ant/ivy/2.6.0/apache-ivy-2.6.0-bin-with-deps.tar.gz.cdx.json",
      "sha256": "17f67d42b6f3f9982a825520503b87eadda821becd20f2a6b967afb83b3accc6",
      "retrieved_at": "2026-09-10T17:19:35.022515+00:00",
      "components": 375,
      "files": 363,
      "packages": 12,
      "error": null
    },
    {
      "artifact_path": "apache-ivy-2.6.0-bin-with-deps.zip",
      "sbom_url": "https://downloads.apache.org/ant/ivy/2.6.0/apache-ivy-2.6.0-bin-with-deps.zip.cdx.json",
      "sha256": "e5f5304b7914c8e1896f73b5fa29518c622a088f11c2f0fc40b5d43ce72f443a",
      "retrieved_at": "2026-09-10T17:19:35.265018+00:00",
      "components": 375,
      "files": 363,
      "packages": 12,
      "error": null
    },
    {
      "artifact_path": "apache-ivy-2.6.0-bin.tar.gz",
      "sbom_url": "https://downloads.apache.org/ant/ivy/2.6.0/apache-ivy-2.6.0-bin.tar.gz.cdx.json",
      "sha256": "b25f2d412f943430eaace6950ee57b39d8ce6582a2a8cd0df0c6b698b5222d5e",
      "retrieved_at": "2026-09-10T17:19:35.496462+00:00",
      "components": 357,
      "files": 345,
      "packages": 12,
      "error": null
    },
    {
      "artifact_path": "apache-ivy-2.6.0-bin.zip",
      "sbom_url": "https://downloads.apache.org/ant/ivy/2.6.0/apache-ivy-2.6.0-bin.zip.cdx.json",
      "sha256": "10b3cd0dc6950f53dddd17cc1682f8b8acb270decf020f58e2c40eedfdf8aac6",
      "retrieved_at": "2026-09-10T17:19:35.611588+00:00",
      "components": 357,
      "files": 345,
      "packages": 12,
      "error": null
    },
    {
      "artifact_path": "apache-ivy-2.6.0-src.tar.gz",
      "sbom_url": "https://downloads.apache.org/ant/ivy/2.6.0/apache-ivy-2.6.0-src.tar.gz.cdx.json",
      "sha256": "60a289fe349128caf129581445da22d3a5038e26f3aaf267453a50084707da93",
      "retrieved_at": "2026-09-10T17:19:35.946432+00:00",
      "components": 2473,
      "files": 2473,
      "packages": 0,
      "error": null
    },
    {
      "artifact_path": "apache-ivy-2.6.0-src.zip",
      "sbom_url": "https://downloads.apache.org/ant/ivy/2.6.0/apache-ivy-2.6.0-src.zip.cdx.json",
      "sha256": "004c8b98105636524e877593add46496c8b92bdff8132615ddee7bd60cb81909",
      "retrieved_at": "2026-09-10T17:19:36.229163+00:00",
      "components": 2473,
      "files": 2473,
      "packages": 0,
      "error": null
    }
  ],
  "rows": [
    {
      "key": "pkg:maven/org.bouncycastle/bcprov-jdk15on",
      "purl": "pkg:maven/org.bouncycastle/bcprov-jdk15on@1.70",
      "source_purls": [
        "pkg:maven/org.bouncycastle/bcprov-jdk15on@1.70?type=jar"
      ],
      "name": "bcprov-jdk15on",
      "ecosystem": "maven",
      "version": "1.70",
      "artifacts": [
        "apache-ivy-2.6.0-bin-with-deps.tar.gz",
        "apache-ivy-2.6.0-bin-with-deps.zip",
        "apache-ivy-2.6.0-bin.tar.gz",
        "apache-ivy-2.6.0-bin.zip"
      ],
      "advisory_status": "found",
      "advisories": [
        "GHSA-4h8f-2wvx-gg5w",
        "GHSA-8xfc-gm6g-vgpv",
        "GHSA-hr8g-6v94-x4m9",
        "GHSA-v435-xc8x-wvr9",
        "GHSA-wjxj-5m7g-mg7q"
      ],
      "published_at": "2021-12-01T03:36:38Z",
      "repository_url": "https://github.com/bcgit/bc-java",
      "source_repo": "github.com/bcgit/bc-java",
      "repository_source": "deps.dev",
      "latest_release_at": "2021-12-01T03:36:38.000Z",
      "rankings_average": 2.821379511968506,
      "archived": false,
      "dds": 0.5124223602484472,
      "active_maintainers": 0,
      "governance_files": 2,
      "maintained": 10,
      "scorecard_date": "2026-08-24T00:00:00Z",
      "criticality": 0.7095175561889111,
      "health": 0.2947722567287785,
      "health_inputs": 4,
      "risk": 0.5003714649624179
    },
    {
      "key": "pkg:maven/org.bouncycastle/bcpg-jdk15on",
      "purl": "pkg:maven/org.bouncycastle/bcpg-jdk15on@1.70",
      "source_purls": [
        "pkg:maven/org.bouncycastle/bcpg-jdk15on@1.70?type=jar"
      ],
      "name": "bcpg-jdk15on",
      "ecosystem": "maven",
      "version": "1.70",
      "artifacts": [
        "apache-ivy-2.6.0-bin-with-deps.tar.gz",
        "apache-ivy-2.6.0-bin-with-deps.zip",
        "apache-ivy-2.6.0-bin.tar.gz",
        "apache-ivy-2.6.0-bin.zip"
      ],
      "advisory_status": "found",
      "advisories": [
        "GHSA-cj8j-37rh-8475"
      ],
      "published_at": "2021-12-01T03:39:41Z",
      "repository_url": "https://github.com/bcgit/bc-java",
      "source_repo": "github.com/bcgit/bc-java",
      "repository_source": "deps.dev",
      "latest_release_at": "2021-12-01T03:39:41.000Z",
      "rankings_average": 3.365478960500126,
      "archived": false,
      "dds": 0.5124223602484472,
      "active_maintainers": 0,
      "governance_files": 2,
      "maintained": 10,
      "scorecard_date": "2026-08-24T00:00:00Z",
      "criticality": 0.6806740137369045,
      "health": 0.2947722567287785,
      "health_inputs": 4,
      "risk": 0.48003019861104157
    },
    {
      "key": "pkg:maven/org.apache.commons/commons-vfs2",
      "purl": "pkg:maven/org.apache.commons/commons-vfs2@2.2",
      "source_purls": [
        "pkg:maven/org.apache.commons/commons-vfs2@2.2?type=jar"
      ],
      "name": "commons-vfs2",
      "ecosystem": "maven",
      "version": "2.2",
      "artifacts": [
        "apache-ivy-2.6.0-bin-with-deps.tar.gz",
        "apache-ivy-2.6.0-bin-with-deps.zip",
        "apache-ivy-2.6.0-bin.tar.gz",
        "apache-ivy-2.6.0-bin.zip"
      ],
      "advisory_status": "found",
      "advisories": [
        "GHSA-3936-3gx6-49c4",
        "GHSA-9q4x-fr4m-jp86"
      ],
      "published_at": "2017-10-02T22:41:12Z",
      "repository_url": "https://gitbox.apache.org/repos/asf?p=commons-vfs.git",
      "source_repo": "github.com/apache/commons-vfs",
      "repository_source": "gitbox_mirror",
      "latest_release_at": "2025-02-02T21:06:21.000Z",
      "rankings_average": 0.3762041548819182,
      "archived": false,
      "dds": 0.6954191033138402,
      "active_maintainers": 0,
      "governance_files": 3,
      "maintained": null,
      "scorecard_date": null,
      "criticality": 0.9308080697537884,
      "health": 0.5403290858319455,
      "health_inputs": 4,
      "risk": 0.42786539633872617
    },
    {
      "key": "pkg:maven/org.apache.ant/ant",
      "purl": "pkg:maven/org.apache.ant/ant@1.9.16",
      "source_purls": [
        "pkg:maven/org.apache.ant/ant@1.9.16?type=jar"
      ],
      "name": "ant",
      "ecosystem": "maven",
      "version": "1.9.16",
      "artifacts": [
        "apache-ivy-2.6.0-bin-with-deps.tar.gz",
        "apache-ivy-2.6.0-bin-with-deps.zip",
        "apache-ivy-2.6.0-bin.tar.gz",
        "apache-ivy-2.6.0-bin.zip"
      ],
      "advisory_status": "found",
      "advisories": [
        "GHSA-f62v-xpxf-3v68"
      ],
      "published_at": "2021-07-10T18:00:37Z",
      "repository_url": "https://gitbox.apache.org/repos/asf/ant.git",
      "source_repo": "github.com/apache/ant",
      "repository_source": "gitbox_mirror",
      "latest_release_at": "2026-09-07T01:57:09.000Z",
      "rankings_average": 0.3819027009697844,
      "archived": false,
      "dds": 0.6688188120157673,
      "active_maintainers": 2,
      "governance_files": 2,
      "maintained": 10,
      "scorecard_date": "2026-08-24T00:00:00Z",
      "criticality": 0.9299127038658057,
      "health": 0.749706854204789,
      "health_inputs": 4,
      "risk": 0.23275077596550298
    },
    {
      "key": "pkg:maven/org.apache.httpcomponents/httpclient",
      "purl": "pkg:maven/org.apache.httpcomponents/httpclient@4.5.13",
      "source_purls": [
        "pkg:maven/org.apache.httpcomponents/httpclient@4.5.13?type=jar"
      ],
      "name": "httpclient",
      "ecosystem": "maven",
      "version": "4.5.13",
      "artifacts": [
        "apache-ivy-2.6.0-bin-with-deps.tar.gz",
        "apache-ivy-2.6.0-bin-with-deps.zip",
        "apache-ivy-2.6.0-bin.tar.gz",
        "apache-ivy-2.6.0-bin.zip"
      ],
      "advisory_status": "none",
      "advisories": [],
      "published_at": "2020-10-03T14:47:40Z",
      "repository_url": "https://github.com/apache/httpcomponents-client",
      "source_repo": "github.com/apache/httpcomponents-client",
      "repository_source": "ecosyste.ms",
      "latest_release_at": "2022-11-30T18:40:54.000Z",
      "rankings_average": 3.242606395768214,
      "archived": false,
      "dds": 0.3961652714015663,
      "active_maintainers": 2,
      "governance_files": 2,
      "maintained": 10,
      "scorecard_date": "2026-08-24T00:00:00Z",
      "criticality": 0.6868602258396523,
      "health": 0.43237465118372487,
      "health_inputs": 4,
      "risk": 0.3898792752802582
    },
    {
      "key": "pkg:maven/org.apache.commons/commons-compress",
      "purl": "pkg:maven/org.apache.commons/commons-compress@1.27.1",
      "source_purls": [
        "pkg:maven/org.apache.commons/commons-compress@1.27.1?type=jar"
      ],
      "name": "commons-compress",
      "ecosystem": "maven",
      "version": "1.27.1",
      "artifacts": [
        "apache-ivy-2.6.0-bin-with-deps.tar.gz",
        "apache-ivy-2.6.0-bin-with-deps.zip",
        "apache-ivy-2.6.0-bin.tar.gz",
        "apache-ivy-2.6.0-bin.zip"
      ],
      "advisory_status": "none",
      "advisories": [],
      "published_at": "2024-08-17T00:35:06Z",
      "repository_url": "https://gitbox.apache.org/repos/asf?p=commons-compress.git",
      "source_repo": "github.com/apache/commons-compress",
      "repository_source": "gitbox_mirror",
      "latest_release_at": "2025-07-26T20:45:40.000Z",
      "rankings_average": 0.021973765061045657,
      "archived": false,
      "dds": 0.6621724268894797,
      "active_maintainers": 3,
      "governance_files": 3,
      "maintained": 10,
      "scorecard_date": "2026-08-24T00:00:00Z",
      "criticality": 0.9952903025656559,
      "health": 0.821740164802128,
      "health_inputs": 4,
      "risk": 0.177420285309394
    },
    {
      "key": "pkg:maven/com.jcraft/jsch",
      "purl": "pkg:maven/com.jcraft/jsch@0.1.55",
      "source_purls": [
        "pkg:maven/com.jcraft/jsch@0.1.55?type=jar"
      ],
      "name": "jsch",
      "ecosystem": "maven",
      "version": "0.1.55",
      "artifacts": [
        "apache-ivy-2.6.0-bin-with-deps.tar.gz",
        "apache-ivy-2.6.0-bin-with-deps.zip",
        "apache-ivy-2.6.0-bin.tar.gz",
        "apache-ivy-2.6.0-bin.zip"
      ],
      "advisory_status": "none",
      "advisories": [],
      "published_at": "2018-11-26T01:15:40Z",
      "repository_url": "http://git.jcraft.com/jsch.git",
      "source_repo": null,
      "repository_source": null,
      "latest_release_at": "2018-11-26T01:15:42.000Z",
      "rankings_average": 0.06812535064518714,
      "archived": null,
      "dds": null,
      "active_maintainers": null,
      "governance_files": null,
      "maintained": null,
      "scorecard_date": null,
      "criticality": 0.9857197438445631,
      "health": null,
      "health_inputs": 1,
      "risk": null
    },
    {
      "key": "pkg:maven/com.jcraft/jsch.agentproxy",
      "purl": "pkg:maven/com.jcraft/jsch.agentproxy@0.0.9",
      "source_purls": [
        "pkg:maven/com.jcraft/jsch.agentproxy@0.0.9?type=jar"
      ],
      "name": "jsch.agentproxy",
      "ecosystem": "maven",
      "version": "0.0.9",
      "artifacts": [
        "apache-ivy-2.6.0-bin-with-deps.tar.gz",
        "apache-ivy-2.6.0-bin-with-deps.zip",
        "apache-ivy-2.6.0-bin.tar.gz",
        "apache-ivy-2.6.0-bin.zip"
      ],
      "advisory_status": "none",
      "advisories": [],
      "published_at": "2014-11-20T13:33:41Z",
      "repository_url": "https://github.com/ymnk/jsch-agent-proxy",
      "source_repo": "github.com/ymnk/jsch-agent-proxy",
      "repository_source": "deps.dev",
      "latest_release_at": "2014-11-20T13:33:41.000Z",
      "rankings_average": 19.989828709867954,
      "archived": false,
      "dds": null,
      "active_maintainers": 0,
      "governance_files": 0,
      "maintained": 0,
      "scorecard_date": "2026-08-24T00:00:00Z",
      "criticality": 0.3404206971124236,
      "health": null,
      "health_inputs": 3,
      "risk": null
    },
    {
      "key": "pkg:maven/com.jcraft/jsch.agentproxy.connector-factory",
      "purl": "pkg:maven/com.jcraft/jsch.agentproxy.connector-factory@0.0.9",
      "source_purls": [
        "pkg:maven/com.jcraft/jsch.agentproxy.connector-factory@0.0.9?type=jar"
      ],
      "name": "jsch.agentproxy.connector-factory",
      "ecosystem": "maven",
      "version": "0.0.9",
      "artifacts": [
        "apache-ivy-2.6.0-bin-with-deps.tar.gz",
        "apache-ivy-2.6.0-bin-with-deps.zip",
        "apache-ivy-2.6.0-bin.tar.gz",
        "apache-ivy-2.6.0-bin.zip"
      ],
      "advisory_status": "none",
      "advisories": [],
      "published_at": "2014-11-20T13:38:29Z",
      "repository_url": "https://github.com/ymnk/jsch-agent-proxy",
      "source_repo": "github.com/ymnk/jsch-agent-proxy",
      "repository_source": "deps.dev",
      "latest_release_at": "2014-11-20T13:38:34.000Z",
      "rankings_average": 11.53948883260419,
      "archived": false,
      "dds": null,
      "active_maintainers": 0,
      "governance_files": 0,
      "maintained": 0,
      "scorecard_date": "2026-08-24T00:00:00Z",
      "criticality": 0.45204404474477966,
      "health": null,
      "health_inputs": 3,
      "risk": null
    },
    {
      "key": "pkg:maven/com.jcraft/jsch.agentproxy.jsch",
      "purl": "pkg:maven/com.jcraft/jsch.agentproxy.jsch@0.0.9",
      "source_purls": [
        "pkg:maven/com.jcraft/jsch.agentproxy.jsch@0.0.9?type=jar"
      ],
      "name": "jsch.agentproxy.jsch",
      "ecosystem": "maven",
      "version": "0.0.9",
      "artifacts": [
        "apache-ivy-2.6.0-bin-with-deps.tar.gz",
        "apache-ivy-2.6.0-bin-with-deps.zip",
        "apache-ivy-2.6.0-bin.tar.gz",
        "apache-ivy-2.6.0-bin.zip"
      ],
      "advisory_status": "none",
      "advisories": [],
      "published_at": "2014-11-20T13:39:27Z",
      "repository_url": "https://github.com/ymnk/jsch-agent-proxy",
      "source_repo": "github.com/ymnk/jsch-agent-proxy",
      "repository_source": "deps.dev",
      "latest_release_at": "2014-11-20T13:39:39.000Z",
      "rankings_average": 11.527956031194627,
      "archived": false,
      "dds": null,
      "active_maintainers": 0,
      "governance_files": 0,
      "maintained": 0,
      "scorecard_date": "2026-08-24T00:00:00Z",
      "criticality": 0.45224342021523645,
      "health": null,
      "health_inputs": 3,
      "risk": null
    },
    {
      "key": "pkg:maven/org.apache.commons/commons-codec",
      "purl": "pkg:maven/org.apache.commons/commons-codec@1.18.0",
      "source_purls": [
        "pkg:maven/org.apache.commons/commons-codec@1.18.0?type=jar"
      ],
      "name": "commons-codec",
      "ecosystem": "maven",
      "version": "1.18.0",
      "artifacts": [
        "apache-ivy-2.6.0-bin-with-deps.tar.gz",
        "apache-ivy-2.6.0-bin-with-deps.zip",
        "apache-ivy-2.6.0-bin.tar.gz",
        "apache-ivy-2.6.0-bin.zip"
      ],
      "advisory_status": "not_found",
      "advisories": [],
      "published_at": null,
      "repository_url": null,
      "source_repo": null,
      "repository_source": null,
      "latest_release_at": null,
      "rankings_average": null,
      "archived": null,
      "dds": null,
      "active_maintainers": null,
      "governance_files": null,
      "maintained": null,
      "scorecard_date": null,
      "criticality": null,
      "health": null,
      "health_inputs": 0,
      "risk": null
    },
    {
      "key": "pkg:maven/oro/oro",
      "purl": "pkg:maven/oro/oro@2.0.8",
      "source_purls": [
        "pkg:maven/oro/oro@2.0.8?type=jar"
      ],
      "name": "oro",
      "ecosystem": "maven",
      "version": "2.0.8",
      "artifacts": [
        "apache-ivy-2.6.0-bin-with-deps.tar.gz",
        "apache-ivy-2.6.0-bin-with-deps.zip",
        "apache-ivy-2.6.0-bin.tar.gz",
        "apache-ivy-2.6.0-bin.zip"
      ],
      "advisory_status": "none",
      "advisories": [],
      "published_at": "2005-11-22T18:23:18Z",
      "repository_url": "",
      "source_repo": null,
      "repository_source": null,
      "latest_release_at": "2005-11-08T22:29:01.000Z",
      "rankings_average": 0.2966124335443883,
      "archived": null,
      "dds": null,
      "active_maintainers": null,
      "governance_files": null,
      "maintained": null,
      "scorecard_date": null,
      "criticality": 0.9437165200541059,
      "health": null,
      "health_inputs": 1,
      "risk": null
    }
  ],
  "sources": {
    "Alpha-Omega heuristic": "https://github.com/alpha-omega-security/heatmap/tree/4ed37981",
    "ecosyste.ms packages": "https://packages.ecosyste.ms/api/v1",
    "ecosyste.ms repositories": "https://repos.ecosyste.ms/api/v1",
    "ecosyste.ms issues": "https://issues.ecosyste.ms/api/v1",
    "deps.dev and OpenSSF Scorecard": "https://api.deps.dev/v3alpha",
    "ecosyste.ms data licence": "https://creativecommons.org/licenses/by-sa/4.0/",
    "deps.dev terms": "https://docs.deps.dev/api/v3alpha/#terms"
  },
  "attribution": "Alpha-Omega maintenance heuristic, with missing inputs left unknown. Includes ecosyste.ms data under CC BY-SA 4.0 and deps.dev and OpenSSF Scorecard observations. ATR selected, normalised and combined records and calculated maintenance indicators. gitbox_mirror identifies an inferred Apache GitHub mirror, not verified repository identity."
}