Dan Luhring

This CPE data says that version 8 is vulnerable, so I wouldn't think we'd want logic that suggests that version 8 is a fixed version here, regardless. You're definitely right...

cc: @wagoodman

This one should not have been squashed 😄

Adding two cents as I've just looked again at using Syft as a lib with "fresh eyes" 😄 . I like the idea of `sbom, err := syft.CreateSBOM(src, cfg)` that...

Looks related to the problem @plaisted points out: #1799

cc @kzantow

I ran into this, too... I'm curious, why don't Bubbles implement `tea.Model`? In my case, I'm working on an app that asks different kinds of questions, and uses different components...

Just adding an explicit note that this causes **false negatives**, too. The Go stdlib usually accounts for a large surface area in vuln-matching a Go binary, so situations where Grype...

Great idea! I just added [thoughts](https://github.com/anchore/syft/issues/510#issuecomment-939523521) to anchore/syft#510 for what our first iteration could look like, and I'm curious what choices folks think would make sense here in the `bom`...

@westonsteimel curious if you have any thoughts here 😃