**What happened**: **What you expected to happen**: **Steps to reproduce the issue**: **Anything else we need to know?**: **Environment**: - Output of `syft version`: - OS (e.g: `cat /etc/os-release` or similar): https://pkg.go.dev/vuln/GO-2025-4020