Nice. I like the (shortest) output of this one better. And as opposed to trivy, it was able to detect the packages (and 1 vuln) in ghcr.io/linuxserver/swag.