From bebdfc86a69c7dd6430abb95394c822f5189bdc7 Mon Sep 17 00:00:00 2001
From: Abrar Shivani <ashivani@nvidia.com>
Date: Mon, 24 Aug 2026 14:58:29 -0700
Subject: [PATCH 01/18] Add a bash test harness for the notices tooling

The notices generator had no tests. Guard main so the script can be
sourced, and add a minimal assertion harness for the URL derivation
added next.

Signed-off-by: Abrar Shivani <ashivani@nvidia.com>
---
 Makefile                                   |  6 +++
 tools/generate-third-party-notices.sh      |  6 ++-
 tools/generate-third-party-notices_test.sh | 35 +++++++++++++++++
 tools/test-helpers.sh                      | 45 ++++++++++++++++++++++
 4 files changed, 91 insertions(+), 1 deletion(-)
 create mode 100644 tools/generate-third-party-notices_test.sh
 create mode 100644 tools/test-helpers.sh

diff --git a/Makefile b/Makefile
index 4d5faf5cb..c6c3f4882 100644
--- a/Makefile
+++ b/Makefile
@@ -203,6 +203,12 @@ check-third-party-notices: third-party-notices
 	@git diff --exit-code -- THIRD_PARTY_NOTICES.md \
 		|| { echo "ERROR: THIRD_PARTY_NOTICES.md is stale. Run 'make third-party-notices' and commit the change."; exit 1; }
 
+.PHONY: test-tools
+test-tools:
+	@for t in tools/*_test.sh; do \
+		bash "$$t" || exit 1; \
+	done
+
 # Apply go fmt to the codebase
 fmt:
 	go list -f '{{.Dir}}' $(MODULE)/... \
diff --git a/tools/generate-third-party-notices.sh b/tools/generate-third-party-notices.sh
index cca33a7a3..5ae2745b7 100755
--- a/tools/generate-third-party-notices.sh
+++ b/tools/generate-third-party-notices.sh
@@ -365,4 +365,8 @@ main() {
     log "Wrote ${OUTPUT} (${count} Go packages)"
 }
 
-main "$@"
+# Sourced by the tests and by tools/verify-license-urls.sh, which reuse these
+# functions without the side effects of a full run.
+if [[ "${BASH_SOURCE[0]}" == "${0}" ]]; then
+    main "$@"
+fi
diff --git a/tools/generate-third-party-notices_test.sh b/tools/generate-third-party-notices_test.sh
new file mode 100644
index 000000000..d22578ec9
--- /dev/null
+++ b/tools/generate-third-party-notices_test.sh
@@ -0,0 +1,35 @@
+#!/usr/bin/env bash
+# Copyright (c) NVIDIA CORPORATION.  All rights reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+set -uo pipefail
+
+HERE="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+# shellcheck source=tools/test-helpers.sh
+source "${HERE}/test-helpers.sh"
+# shellcheck source=tools/generate-third-party-notices.sh
+source "${HERE}/generate-third-party-notices.sh"
+
+# If the guard is missing, sourcing runs the generator and exits before here.
+assert_eq "sourced" "sourced" "sourcing the generator does not execute main"
+
+fixture="$(mktemp)"
+trap 'rm -f "${fixture}"' EXIT
+printf 'plain text, no backticks\n' > "${fixture}"
+assert_eq '```' "$(fence_for "${fixture}")" "fence_for: minimum width is three"
+printf 'a ```` b\n' > "${fixture}"
+assert_eq '`````' "$(fence_for "${fixture}")" "fence_for: one wider than the longest run"
+
+finish
diff --git a/tools/test-helpers.sh b/tools/test-helpers.sh
new file mode 100644
index 000000000..2a37e1f6a
--- /dev/null
+++ b/tools/test-helpers.sh
@@ -0,0 +1,45 @@
+#!/usr/bin/env bash
+# Copyright (c) NVIDIA CORPORATION.  All rights reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+TESTS_RUN=0
+TESTS_FAILED=0
+
+assert_eq() {
+    local expected="$1" actual="$2" description="$3"
+    TESTS_RUN=$(( TESTS_RUN + 1 ))
+    if [[ "${expected}" != "${actual}" ]]; then
+        TESTS_FAILED=$(( TESTS_FAILED + 1 ))
+        printf 'FAIL: %s\n  expected: [%s]\n  actual:   [%s]\n' \
+            "${description}" "${expected}" "${actual}" >&2
+    fi
+}
+
+# Output is captured so an expected failure does not pollute the log.
+assert_fails() {
+    local description="$1"
+    shift
+    TESTS_RUN=$(( TESTS_RUN + 1 ))
+    if "$@" >/dev/null 2>&1; then
+        TESTS_FAILED=$(( TESTS_FAILED + 1 ))
+        printf 'FAIL: %s\n  expected non-zero exit, got 0\n' "${description}" >&2
+    fi
+}
+
+finish() {
+    printf '%s: %d assertions, %d failures\n' \
+        "$(basename "${0}")" "${TESTS_RUN}" "${TESTS_FAILED}" >&2
+    (( TESTS_FAILED == 0 ))
+}

From 74abe1e45c99bec2384ea8c297a62c1bb715c109 Mon Sep 17 00:00:00 2001
From: Abrar Shivani <ashivani@nvidia.com>
Date: Mon, 24 Aug 2026 15:04:21 -0700
Subject: [PATCH 02/18] Fix guard regression test to be environment-independent

The original tautology assertion would silently pass in CI environments
where go-licenses is installed, allowing a regressed guard to corrupt
the tracked THIRD_PARTY_NOTICES.md file.

Add a deterministic structural check for BASH_SOURCE[0] in the
generator, and redirect OUTPUT to a throwaway path to prevent file
corruption if the guard ever regresses.

Signed-off-by: Abrar Shivani <ashivani@nvidia.com>
---
 tools/generate-third-party-notices_test.sh | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/tools/generate-third-party-notices_test.sh b/tools/generate-third-party-notices_test.sh
index d22578ec9..b6ce4ffcd 100644
--- a/tools/generate-third-party-notices_test.sh
+++ b/tools/generate-third-party-notices_test.sh
@@ -19,12 +19,24 @@ set -uo pipefail
 HERE="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 # shellcheck source=tools/test-helpers.sh
 source "${HERE}/test-helpers.sh"
+
+# If the guard ever regresses, sourcing must not overwrite the committed
+# notices file. OUTPUT is honoured by compose_document.
+OUTPUT="$(mktemp)"
+export OUTPUT
+
 # shellcheck source=tools/generate-third-party-notices.sh
 source "${HERE}/generate-third-party-notices.sh"
 
 # If the guard is missing, sourcing runs the generator and exits before here.
 assert_eq "sourced" "sourced" "sourcing the generator does not execute main"
 
+# Environment-independent: proves the guard is present rather than relying on
+# main failing fast, which it only does on a host without go-licenses.
+assert_eq "1" \
+    "$(LC_ALL=C grep -c 'BASH_SOURCE\[0\]' "${HERE}/generate-third-party-notices.sh")" \
+    "the generator guards main against running on source"
+
 fixture="$(mktemp)"
 trap 'rm -f "${fixture}"' EXIT
 printf 'plain text, no backticks\n' > "${fixture}"

From 056eeb8e1c61f99725638c3314f38bd752f27ce0 Mon Sep 17 00:00:00 2001
From: Abrar Shivani <ashivani@nvidia.com>
Date: Mon, 24 Aug 2026 15:18:53 -0700
Subject: [PATCH 03/18] Add pure transforms for license URL construction

Proxy case-encoding is done in awk: the obvious sed form silently
corrupts every module path containing a capital, which the proxy then
rejects. Also covers version and ref normalisation, the gopkg.in
convention, GitHub submodule subdirectories, and the blob and raw URL
templates for GitHub and Gerrit.

Signed-off-by: Abrar Shivani <ashivani@nvidia.com>
---
 tools/license-url-lib.sh      | 156 ++++++++++++++++++++++++++++++++++
 tools/license-url-lib_test.sh |  86 +++++++++++++++++++
 2 files changed, 242 insertions(+)
 create mode 100644 tools/license-url-lib.sh
 create mode 100644 tools/license-url-lib_test.sh

diff --git a/tools/license-url-lib.sh b/tools/license-url-lib.sh
new file mode 100644
index 000000000..d30f50ab8
--- /dev/null
+++ b/tools/license-url-lib.sh
@@ -0,0 +1,156 @@
+#!/usr/bin/env bash
+# Copyright (c) NVIDIA CORPORATION.  All rights reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+# Pure string transforms shared by the resolvers and the notices generator.
+# No network and (except base64_decode, which reads stdin) no I/O, so every
+# rule here is testable offline.
+
+# The module proxy case-encodes an uppercase letter as '!' plus its lowercase
+# form: github.com/NVIDIA -> github.com/!n!v!i!d!i!a. This MUST NOT be done with
+# sed: 's/\([A-Z]\)/!\l\1/g' yields '!lN!lV...' on BSD sed, which the proxy
+# rejects as an invalid escaped module path.
+proxy_escape() {
+    printf '%s' "$1" | awk '{
+        n = split($0, chars, "")
+        out = ""
+        for (i = 1; i <= n; i++) {
+            c = chars[i]
+            out = out (c ~ /[A-Z]/ ? "!" tolower(c) : c)
+        }
+        print out
+    }'
+}
+
+strip_major_suffix() {
+    if [[ "$1" =~ ^(.*)/v[0-9]+$ ]]; then
+        printf '%s' "${BASH_REMATCH[1]}"
+    else
+        printf '%s' "$1"
+    fi
+}
+
+normalize_version() {
+    printf '%s' "${1%+incompatible}"
+}
+
+# A pseudo-version ends in <14-digit UTC timestamp>-<12-hex commit>. That
+# trailing hash is the only ref such a module has; there is no tag.
+# Pre-release versions have an optional 0. prefix before the timestamp.
+pseudo_version_hash() {
+    if [[ "$1" =~ -[0-9.]*[0-9]{14}-([0-9a-f]{12})$ ]]; then
+        printf '%s' "${BASH_REMATCH[1]}"
+    fi
+}
+
+normalize_repo_url() {
+    local url="${1%/}"
+    printf '%s' "${url%.git}"
+}
+
+github_repo_from_path() {
+    local module rest org repo
+    module="$(strip_major_suffix "$1")"
+    case "${module}" in github.com/*) ;; *) return 0 ;; esac
+    rest="${module#github.com/}"
+    org="${rest%%/*}"
+    rest="${rest#*/}"
+    repo="${rest%%/*}"
+    [[ -n "${org}" && -n "${repo}" && "${org}" != "${module}" ]] || return 0
+    printf 'https://github.com/%s/%s' "${org}" "${repo}"
+}
+
+# The module's directory inside a github repository, derived from the path
+# alone. GitHub serves no go-import meta, so when the proxy has no Origin this
+# is the only source of the submodule tag prefix; without it a module such as
+# github.com/Mellanox/maintenance-operator/api loses its 'api/' tag and no
+# candidate URL can match.
+github_subdir_from_path() {
+    local module rest
+    module="$(strip_major_suffix "$1")"
+    case "${module}" in github.com/*) ;; *) return 0 ;; esac
+    rest="${module#github.com/}"
+    [[ "${rest}" == */* ]] || return 0
+    rest="${rest#*/}"                 # drop org
+    [[ "${rest}" == */* ]] || return 0
+    printf '%s' "${rest#*/}"          # drop repo
+}
+
+# gopkg.in publishes a go-import pointing at itself, which serves no blobs.
+# Its documented convention maps onto GitHub.
+gopkg_in_repo() {
+    local rest user pkg
+    case "$1" in gopkg.in/*) ;; *) return 0 ;; esac
+    rest="${1#gopkg.in/}"
+    if [[ "${rest}" == */* ]]; then
+        user="${rest%%/*}"
+        pkg="${rest#*/}"
+        printf 'https://github.com/%s/%s' "${user}" "${pkg%.v*}"
+    else
+        pkg="${rest%.v*}"
+        printf 'https://github.com/go-%s/%s' "${pkg}" "${pkg}"
+    fi
+}
+
+derived_subdir() {
+    local module prefix
+    module="$(strip_major_suffix "$1")"
+    prefix="$(strip_major_suffix "$2")"
+    [[ "${module}" == "${prefix}" ]] && return 0
+    [[ "${module}" == "${prefix}/"* ]] || return 0
+    printf '%s' "${module#"${prefix}/"}"
+}
+
+# Gerrit serves blobs under /+/<ref>/, not /blob/<ref>/.
+blob_url() {
+    local repo="$1" ref="$2" path="$3"
+    case "${repo}" in
+        https://go.googlesource.com/*) printf '%s/+/%s/%s' "${repo}" "${ref}" "${path}" ;;
+        *)                             printf '%s/blob/%s/%s' "${repo}" "${ref}" "${path}" ;;
+    esac
+}
+
+raw_url_for() {
+    local blob="$1" rest owner repo
+    case "${blob}" in
+        https://github.com/*)
+            rest="${blob#https://github.com/}"
+            owner="${rest%%/*}"; rest="${rest#*/}"
+            repo="${rest%%/*}";  rest="${rest#*/}"
+            rest="${rest#blob/}"
+            printf 'https://raw.githubusercontent.com/%s/%s/%s' "${owner}" "${repo}" "${rest}"
+            ;;
+        https://go.googlesource.com/*)
+            printf '%s?format=TEXT' "${blob}"
+            ;;
+    esac
+}
+
+raw_is_base64() {
+    case "$1" in https://go.googlesource.com/*) return 0 ;; *) return 1 ;; esac
+}
+
+# GNU coreutils spells the decode flag -d; BSD documents -D. Probe once rather
+# than assuming, or every Gerrit-hosted module fails to hash on a strict BSD.
+base64_decode() {
+    if [[ -z "${BASE64_DECODE_FLAG:-}" ]]; then
+        if printf '' | base64 -d >/dev/null 2>&1; then
+            BASE64_DECODE_FLAG="-d"
+        else
+            BASE64_DECODE_FLAG="-D"
+        fi
+    fi
+    base64 "${BASE64_DECODE_FLAG}"
+}
diff --git a/tools/license-url-lib_test.sh b/tools/license-url-lib_test.sh
new file mode 100644
index 000000000..99a1f577d
--- /dev/null
+++ b/tools/license-url-lib_test.sh
@@ -0,0 +1,86 @@
+#!/usr/bin/env bash
+# Copyright (c) NVIDIA CORPORATION.  All rights reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+set -uo pipefail
+HERE="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+source "${HERE}/test-helpers.sh"
+source "${HERE}/license-url-lib.sh"
+
+# The bug that silently broke proxy resolution for all ten uppercase modules.
+assert_eq "github.com/!n!v!i!d!i!a/go-nvlib" \
+    "$(proxy_escape github.com/NVIDIA/go-nvlib)" "proxy_escape lowercases with a bang"
+assert_eq "github.com/!mellanox/maintenance-operator/api" \
+    "$(proxy_escape github.com/Mellanox/maintenance-operator/api)" "proxy_escape single capital"
+assert_eq "k8s.io/api" "$(proxy_escape k8s.io/api)" "proxy_escape leaves lowercase alone"
+
+assert_eq "github.com/Masterminds/semver" \
+    "$(strip_major_suffix github.com/Masterminds/semver/v3)" "strip /v3"
+assert_eq "go.yaml.in/yaml" \
+    "$(strip_major_suffix go.yaml.in/yaml/v3)" "strip /v3 from a vanity path"
+assert_eq "gopkg.in/inf.v0" \
+    "$(strip_major_suffix gopkg.in/inf.v0)" "gopkg.in .vN is not a /vN suffix"
+
+assert_eq "v2.0.1" "$(normalize_version 'v2.0.1+incompatible')" "strip +incompatible"
+assert_eq "faa5f7b0171c" \
+    "$(pseudo_version_hash v0.0.0-20250102033503-faa5f7b0171c)" "pseudo-version hash"
+assert_eq "d8f796af33cc" \
+    "$(pseudo_version_hash v1.1.2-0.20180830191138-d8f796af33cc)" "pre-release pseudo-version"
+assert_eq "" "$(pseudo_version_hash v1.19.1)" "a tagged version has no hash"
+
+assert_eq "https://github.com/klauspost/compress" \
+    "$(github_repo_from_path github.com/klauspost/compress)" "github root module"
+assert_eq "https://github.com/Mellanox/maintenance-operator" \
+    "$(github_repo_from_path github.com/Mellanox/maintenance-operator/api)" "github submodule"
+assert_eq "" "$(github_repo_from_path k8s.io/api)" "non-github yields empty"
+
+# Without this the github fallback loses the submodule tag prefix entirely.
+assert_eq "api" \
+    "$(github_subdir_from_path github.com/Mellanox/maintenance-operator/api)" "github subdir"
+assert_eq "pkg/apis/monitoring" \
+    "$(github_subdir_from_path github.com/prometheus-operator/prometheus-operator/pkg/apis/monitoring)" \
+    "multi-segment github subdir"
+assert_eq "" "$(github_subdir_from_path github.com/Masterminds/semver/v3)" "/vN is not a subdir"
+assert_eq "" "$(github_subdir_from_path github.com/klauspost/compress)" "root module has no subdir"
+
+assert_eq "https://github.com/go-inf/inf" "$(gopkg_in_repo gopkg.in/inf.v0)" "gopkg.in single segment"
+assert_eq "https://github.com/go-yaml/yaml" "$(gopkg_in_repo gopkg.in/yaml.v3)" "gopkg.in yaml"
+assert_eq "https://github.com/evanphx/json-patch" \
+    "$(gopkg_in_repo gopkg.in/evanphx/json-patch.v4)" "gopkg.in user/pkg"
+assert_eq "" "$(gopkg_in_repo github.com/foo/bar)" "non-gopkg.in yields empty"
+
+assert_eq "https://github.com/cyphar/libpathrs" \
+    "$(normalize_repo_url 'https://github.com/cyphar/libpathrs.git')" "strip .git"
+assert_eq "https://github.com/foo/bar" \
+    "$(normalize_repo_url 'https://github.com/foo/bar/')" "strip trailing slash"
+
+assert_eq "api" "$(derived_subdir sigs.k8s.io/kustomize/api sigs.k8s.io/kustomize)" "subdir from prefix"
+assert_eq "" "$(derived_subdir github.com/klauspost/compress github.com/klauspost/compress)" "root module"
+
+assert_eq "https://github.com/klauspost/compress/blob/v1.19.1/LICENSE" \
+    "$(blob_url https://github.com/klauspost/compress v1.19.1 LICENSE)" "github blob template"
+assert_eq "https://go.googlesource.com/crypto/+/refs/tags/v0.55.0/LICENSE" \
+    "$(blob_url https://go.googlesource.com/crypto refs/tags/v0.55.0 LICENSE)" "gerrit blob template"
+
+assert_eq "https://raw.githubusercontent.com/klauspost/compress/v1.19.1/zstd/internal/xxhash/LICENSE.txt" \
+    "$(raw_url_for https://github.com/klauspost/compress/blob/v1.19.1/zstd/internal/xxhash/LICENSE.txt)" \
+    "github raw URL"
+assert_eq "https://go.googlesource.com/crypto/+/refs/tags/v0.55.0/LICENSE?format=TEXT" \
+    "$(raw_url_for https://go.googlesource.com/crypto/+/refs/tags/v0.55.0/LICENSE)" "gerrit raw URL"
+assert_fails "github raw is not base64" raw_is_base64 https://github.com/a/b/blob/v1/LICENSE
+
+assert_eq "hello" "$(printf 'aGVsbG8=' | base64_decode)" "base64_decode works on this host"
+
+finish

From 9d9e001edf61893d87fc1b6bb58e24e59bfbd48f Mon Sep 17 00:00:00 2001
From: Abrar Shivani <ashivani@nvidia.com>
Date: Mon, 24 Aug 2026 15:25:02 -0700
Subject: [PATCH 04/18] Emit module, version and verified license location

annotate_modules keeps the version it already parsed instead of
discarding it, and each package's license files are looked up in the
verified URL map. A missing entry is fatal. Each file's URL is printed
under its own heading, which is the only unambiguous place for it when a
package carries several, and the Dependency header no longer disagrees
with the Module bullet.

Signed-off-by: Abrar Shivani <ashivani@nvidia.com>
---
 tools/generate-third-party-notices.sh      | 112 +++++++++++++++++----
 tools/generate-third-party-notices_test.sh |  75 ++++++++++++++
 2 files changed, 168 insertions(+), 19 deletions(-)

diff --git a/tools/generate-third-party-notices.sh b/tools/generate-third-party-notices.sh
index 5ae2745b7..6cb25fe35 100755
--- a/tools/generate-third-party-notices.sh
+++ b/tools/generate-third-party-notices.sh
@@ -180,10 +180,10 @@ collapse_index() {
     '
 }
 
-# Rows carry module names from modules.txt rather than a URL: in vendor mode
-# go-licenses reports a URL into this repo at HEAD, which stops describing
-# released content once main moves. Versions are intentionally omitted because
-# the notices identify dependencies and their licenses, not an exact build.
+# Rows carry the module path and version from modules.txt rather than a URL:
+# in vendor mode go-licenses reports a URL into this repo at HEAD, which stops
+# describing released content once main moves and names our copy, not
+# upstream. The verified upstream location comes from tools/license-urls.tsv.
 # Longest prefix wins: a license may sit below the module root.
 annotate_modules() {
     awk -v modfile="${MODULES_TXT}" '
@@ -203,9 +203,11 @@ annotate_modules() {
                     }
                     mods[++m] = f[2]
                     disp[f[2]] = f[r]
+                    ver[f[2]] = f[r + 1]
                 } else {
                     mods[++m] = f[2]
                     disp[f[2]] = f[2]
+                    ver[f[2]] = f[3]
                 }
             }
             close(modfile)
@@ -221,7 +223,7 @@ annotate_modules() {
                 mp = mods[i]
                 if (($1 == mp || index($1, mp "/") == 1) && length(mp) > length(best)) best = mp
             }
-            print $0, (best == "" ? "unknown" : disp[best])
+            print $0, (best == "" ? "unknown" : disp[best]), (best == "" ? "unknown" : ver[best])
         }
     '
 }
@@ -238,6 +240,11 @@ build_indexes() {
             "Run 'go mod vendor' and re-run, rather than committing a file with unattributed entries."
     fi
 
+    if cut -d, -f5 "${INDEX_FILE}" | LC_ALL=C grep -qx 'unknown'; then
+        die "could not resolve a version for some packages from ${MODULES_TXT}." \
+            "Run 'go mod vendor' and re-run, rather than committing a file with unattributed entries."
+    fi
+
     # go-licenses reports a license it cannot classify as "Unknown" and exits 0.
     # Anchored both sides: licenses are joined with " / ", and an identifier
     # merely starting with "Unknown" must not match.
@@ -262,40 +269,106 @@ license_files_for() {
     done < <(find "${dir}" -maxdepth 1 -type f -print0 2>/dev/null | LC_ALL=C sort -z)
 }
 
+LICENSE_URLS="${LICENSE_URLS:-tools/license-urls.tsv}"
+VENDOR_DIR="${VENDOR_DIR:-vendor}"
+
+# Separate from check_prerequisites: tools/verify-license-urls.sh reuses the
+# collection stages to discover which license files the document will link, and
+# it is the command that produces this map, so it must run without it.
+require_url_map() {
+    [[ -f "${LICENSE_URLS}" ]] \
+        || die "${LICENSE_URLS} not found." \
+               "Run 'make third-party-notices-urls' (needs network) and commit the result."
+}
+
+# The directory whose license files govern PACKAGE, relative to MODULE. Walks
+# up from the package to the module root and takes the first directory holding
+# a license file, which is how go-licenses attributes them.
+license_dir_within_module() {
+    local module="$2" dir="$1" relative
+    while :; do
+        if [[ -n "$(license_files_for "${VENDOR_DIR}/${dir}")" ]]; then
+            relative="${dir#"${module}"}"
+            printf '%s' "${relative#/}"
+            return 0
+        fi
+        [[ "${dir}" == "${module}" ]] && return 1
+        [[ "${dir}" != */* ]] && return 1
+        dir="${dir%/*}"
+    done
+}
+
+location_for() {
+    local url
+    url="$(LC_ALL=C awk -F'\t' -v m="$1" -v v="$2" -v p="$3" \
+        '$1 == m && $2 == v && $3 == p { print $4; found = 1; exit }
+         END { exit !found }' "${LICENSE_URLS}")" || return 1
+    printf '%s' "${url}"
+}
+
+# ' / '-joined [filename](url) links, one per license file, mirroring how the
+# License column joins identifiers.
+location_cell() {
+    local package="$1" module="$2" version="$3"
+    local relative name license_path url cell="" lf
+    relative="$(license_dir_within_module "${package}" "${module}")" \
+        || die "no license file found for ${package} under ${VENDOR_DIR}/${module}." \
+               "Run 'go mod vendor' and re-run."
+    while IFS= read -r lf; do
+        [[ -z "${lf}" ]] && continue
+        name="$(basename "${lf}")"
+        license_path="${relative:+${relative}/}${name}"
+        url="$(location_for "${module}" "${version}" "${license_path}")" \
+            || die "${LICENSE_URLS} has no verified URL for ${module}@${version} ${license_path}." \
+                   "Run 'make third-party-notices-urls' (needs network) and commit the result."
+        cell="${cell:+${cell} / }[${name}](${url})"
+    done < <(license_files_for "${LICENSES_DIR}/${package}")
+    printf '%s' "${cell}"
+}
+
 emit_index_table() {
-    local index="$1" pkg _ license module
-    printf '| Package | License | Dependency |\n'
-    printf '|---------|---------|------------|\n'
+    local index="$1" package _ license module version
+    printf '| Package | Module | Version | License | Location |\n'
+    printf '|---------|--------|---------|---------|----------|\n'
 
-    while IFS=, read -r pkg _ license module; do
-        [[ -z "${pkg}" ]] && continue
+    while IFS=, read -r package _ license module version; do
+        [[ -z "${package}" ]] && continue
         # shellcheck disable=SC2016  # backticks are literal markdown here.
-        printf '| `%s` | %s | `%s` |\n' "${pkg}" "${license:-Unknown}" "${module:-unknown}"
+        printf '| `%s` | `%s` | %s | %s | %s |\n' \
+            "${package}" "${module:-unknown}" "${version:-unknown}" "${license:-Unknown}" \
+            "$(location_cell "${package}" "${module}" "${version}")"
     done < "${index}"
 }
 
 emit_sections() {
     local index="$1" root="$2"
-    local pkg _ license module files lf fence
+    local package _ license module version files lf fence relative name url
 
-    while IFS=, read -r pkg _ license module; do
-        [[ -z "${pkg}" ]] && continue
+    while IFS=, read -r package _ license module version; do
+        [[ -z "${package}" ]] && continue
 
-        printf '### %s\n\n' "${pkg}"
-        printf '* License: %s\n' "${license:-Unknown}"
-        printf '* Module: %s\n\n' "${module:-unknown}"
+        printf '### %s\n\n' "${package}"
+        printf '* Module: %s\n' "${module:-unknown}"
+        printf '* Version: %s\n' "${version:-unknown}"
+        printf '* License: %s\n\n' "${license:-Unknown}"
 
         files=()
         while IFS= read -r lf; do
             [[ -n "${lf}" ]] && files+=("${lf}")
-        done < <(license_files_for "${root}/${pkg}")
+        done < <(license_files_for "${root}/${package}")
 
         if (( ${#files[@]} == 0 )); then
             printf 'License text unavailable. See upstream source for the full license.\n'
         else
+            relative="$(license_dir_within_module "${package}" "${module}")" || relative=""
             for lf in "${files[@]}"; do
+                name="$(basename "${lf}")"
+                url="$(location_for "${module}" "${version}" "${relative:+${relative}/}${name}")" \
+                    || die "${LICENSE_URLS} has no verified URL for ${module}@${version} ${relative:+${relative}/}${name}." \
+                           "Run 'make third-party-notices-urls' (needs network) and commit the result."
                 fence="$(fence_for "${lf}")"
-                printf '#### %s\n\n' "$(basename "${lf}")"
+                printf '#### %s\n\n' "${name}"
+                printf '<%s>\n\n' "${url}"
                 printf '%stext\n' "${fence}"
                 cat "${lf}"
                 echo
@@ -308,6 +381,7 @@ emit_sections() {
 }
 
 compose_document() {
+    require_url_map
     log "Composing ${OUTPUT}..."
     {
         cat <<'EOF'
diff --git a/tools/generate-third-party-notices_test.sh b/tools/generate-third-party-notices_test.sh
index b6ce4ffcd..6485ca0ac 100644
--- a/tools/generate-third-party-notices_test.sh
+++ b/tools/generate-third-party-notices_test.sh
@@ -44,4 +44,79 @@ assert_eq '```' "$(fence_for "${fixture}")" "fence_for: minimum width is three"
 printf 'a ```` b\n' > "${fixture}"
 assert_eq '`````' "$(fence_for "${fixture}")" "fence_for: one wider than the longest run"
 
+modules_fixture="$(mktemp)"
+cat > "${modules_fixture}" <<'MODULES'
+# github.com/klauspost/compress v1.19.1
+## explicit
+# k8s.io/api v0.36.4
+MODULES
+
+index_input="$(mktemp)"
+cat > "${index_input}" <<'ROWS'
+github.com/klauspost/compress,ignored,Apache-2.0
+github.com/klauspost/compress/zstd/internal/xxhash,ignored,MIT
+k8s.io/api,ignored,Apache-2.0
+ROWS
+
+assert_eq "github.com/klauspost/compress/zstd/internal/xxhash,ignored,MIT,github.com/klauspost/compress,v1.19.1" \
+    "$(MODULES_TXT="${modules_fixture}" annotate_modules < "${index_input}" | sed -n 2p)" \
+    "annotate_modules appends module and version"
+assert_eq "k8s.io/api,ignored,Apache-2.0,k8s.io/api,v0.36.4" \
+    "$(MODULES_TXT="${modules_fixture}" annotate_modules < "${index_input}" | sed -n 3p)" \
+    "annotate_modules resolves a root module"
+
+urls_fixture="$(mktemp)"
+printf 'github.com/klauspost/compress\tv1.19.1\tLICENSE\thttps://example.invalid/root\n' > "${urls_fixture}"
+printf 'github.com/klauspost/compress\tv1.19.1\tzstd/internal/xxhash/LICENSE.txt\thttps://example.invalid/xxhash\n' >> "${urls_fixture}"
+
+assert_eq "https://example.invalid/xxhash" \
+    "$(LICENSE_URLS="${urls_fixture}" location_for \
+        github.com/klauspost/compress v1.19.1 zstd/internal/xxhash/LICENSE.txt)" \
+    "location_for finds a nested license path"
+assert_fails "location_for fails closed on a miss" \
+    env LICENSE_URLS="${urls_fixture}" bash -c \
+    'source tools/generate-third-party-notices.sh; location_for github.com/nope v1.0.0 LICENSE'
+
+vendor_fixture="$(mktemp -d)"
+mkdir -p "${vendor_fixture}/github.com/klauspost/compress/zstd/internal/xxhash"
+touch "${vendor_fixture}/github.com/klauspost/compress/LICENSE"
+touch "${vendor_fixture}/github.com/klauspost/compress/zstd/internal/xxhash/LICENSE.txt"
+assert_eq "zstd/internal/xxhash" \
+    "$(VENDOR_DIR="${vendor_fixture}" license_dir_within_module \
+        github.com/klauspost/compress/zstd/internal/xxhash github.com/klauspost/compress)" \
+    "license_dir_within_module finds the nearest enclosing license"
+assert_eq "" \
+    "$(VENDOR_DIR="${vendor_fixture}" license_dir_within_module \
+        github.com/klauspost/compress github.com/klauspost/compress)" \
+    "license_dir_within_module is empty at the module root"
+assert_fails "license_dir_within_module fails when no license exists" \
+    env VENDOR_DIR="${vendor_fixture}" bash -c \
+    'source tools/generate-third-party-notices.sh; license_dir_within_module github.com/absent/mod github.com/absent/mod'
+
+render="$(mktemp -d)"
+mkdir -p "${render}/cache/github.com/klauspost/compress/zstd/internal/xxhash"
+printf 'MIT text\n' > "${render}/cache/github.com/klauspost/compress/zstd/internal/xxhash/LICENSE.txt"
+cat > "${render}/index.csv" <<'IDX'
+github.com/klauspost/compress/zstd/internal/xxhash,ignored,MIT,github.com/klauspost/compress,v1.19.1
+IDX
+
+assert_eq '| Package | Module | Version | License | Location |' \
+    "$(LICENSE_URLS="${urls_fixture}" VENDOR_DIR="${vendor_fixture}" LICENSES_DIR="${render}/cache" \
+       emit_index_table "${render}/index.csv" | sed -n 1p)" \
+    "index header has five columns"
+assert_eq '| `github.com/klauspost/compress/zstd/internal/xxhash` | `github.com/klauspost/compress` | v1.19.1 | MIT | [LICENSE.txt](https://example.invalid/xxhash) |' \
+    "$(LICENSE_URLS="${urls_fixture}" VENDOR_DIR="${vendor_fixture}" LICENSES_DIR="${render}/cache" \
+       emit_index_table "${render}/index.csv" | sed -n 3p)" \
+    "index row labels the link by filename"
+
+section="$(LICENSE_URLS="${urls_fixture}" VENDOR_DIR="${vendor_fixture}" LICENSES_DIR="${render}/cache" \
+    emit_sections "${render}/index.csv" "${render}/cache")"
+assert_eq "* Module: github.com/klauspost/compress" "$(printf '%s' "${section}" | sed -n 3p)" "section names the module"
+assert_eq "* Version: v1.19.1" "$(printf '%s' "${section}" | sed -n 4p)" "section names the version"
+assert_eq "<https://example.invalid/xxhash>" \
+    "$(printf '%s' "${section}" | LC_ALL=C grep -m1 '^<http')" "section prints the file URL"
+
+rm -rf "${vendor_fixture}" "${render}"
+rm -f "${modules_fixture}" "${index_input}" "${urls_fixture}"
+
 finish

From a6c3f1de41bb97db426d0256fa737c0fba495f11 Mon Sep 17 00:00:00 2001
From: Abrar Shivani <ashivani@nvidia.com>
Date: Mon, 24 Aug 2026 15:33:34 -0700
Subject: [PATCH 05/18] Fix emit_index_table swallowing location_cell's fatal
 error

location_cell was called nested inside printf's argument list, so its
die/exit only killed the command substitution, not the script; under
set -e a package with no verified URL rendered a blank Location cell
and the generator still exited 0. Hoist the call to its own statement
so the failure propagates, and add a regression test that a missing
map entry aborts emit_index_table.

Signed-off-by: Abrar Shivani <ashivani@nvidia.com>
---
 tools/generate-third-party-notices.sh      |  7 ++++---
 tools/generate-third-party-notices_test.sh | 10 ++++++++++
 2 files changed, 14 insertions(+), 3 deletions(-)

diff --git a/tools/generate-third-party-notices.sh b/tools/generate-third-party-notices.sh
index 6cb25fe35..b45ba7935 100755
--- a/tools/generate-third-party-notices.sh
+++ b/tools/generate-third-party-notices.sh
@@ -327,16 +327,17 @@ location_cell() {
 }
 
 emit_index_table() {
-    local index="$1" package _ license module version
+    local index="$1" package _ license module version location
     printf '| Package | Module | Version | License | Location |\n'
     printf '|---------|--------|---------|---------|----------|\n'
 
     while IFS=, read -r package _ license module version; do
         [[ -z "${package}" ]] && continue
+        location="$(location_cell "${package}" "${module}" "${version}")"
         # shellcheck disable=SC2016  # backticks are literal markdown here.
         printf '| `%s` | `%s` | %s | %s | %s |\n' \
-            "${package}" "${module:-unknown}" "${version:-unknown}" "${license:-Unknown}" \
-            "$(location_cell "${package}" "${module}" "${version}")"
+            "${package}" "${module:-unknown}" "${version:-unknown}" \
+            "${license:-Unknown}" "${location}"
     done < "${index}"
 }
 
diff --git a/tools/generate-third-party-notices_test.sh b/tools/generate-third-party-notices_test.sh
index 6485ca0ac..ea38ae015 100644
--- a/tools/generate-third-party-notices_test.sh
+++ b/tools/generate-third-party-notices_test.sh
@@ -109,6 +109,16 @@ assert_eq '| `github.com/klauspost/compress/zstd/internal/xxhash` | `github.com/
        emit_index_table "${render}/index.csv" | sed -n 3p)" \
     "index row labels the link by filename"
 
+# Regression: a package whose module/version pair has no entry in the URL map
+# must abort the whole table, not render with a blank Location cell.
+mismatch_index="${render}/mismatch-index.csv"
+cat > "${mismatch_index}" <<'IDX'
+github.com/klauspost/compress/zstd/internal/xxhash,ignored,MIT,github.com/klauspost/compress,v9.9.9
+IDX
+assert_fails "emit_index_table fails closed when the URL map has no entry for a row" \
+    env LICENSE_URLS="${urls_fixture}" VENDOR_DIR="${vendor_fixture}" LICENSES_DIR="${render}/cache" \
+    bash -c 'source tools/generate-third-party-notices.sh; emit_index_table "$1"' _ "${mismatch_index}"
+
 section="$(LICENSE_URLS="${urls_fixture}" VENDOR_DIR="${vendor_fixture}" LICENSES_DIR="${render}/cache" \
     emit_sections "${render}/index.csv" "${render}/cache")"
 assert_eq "* Module: github.com/klauspost/compress" "$(printf '%s' "${section}" | sed -n 3p)" "section names the module"

From 4f3e709f0b75fefac94b6b2f4deeb48438849892 Mon Sep 17 00:00:00 2001
From: Abrar Shivani <ashivani@nvidia.com>
Date: Mon, 24 Aug 2026 15:34:07 -0700
Subject: [PATCH 06/18] Resolve each vendored module to its upstream repository

Uses the module proxy Origin, then the go-import meta tag, then the
github.com path shape. Upstream publishes these mappings, so nothing is
hand-written: dario.cat/mergo resolves to imdario/mergo and go.yaml.in
to yaml/go-yaml.

The EXIT trap that removes the temp file referenced a variable local to
main(); once main returned normally rather than exiting, the process's
implicit exit fired that trap after the variable had gone out of scope,
and set -u turned the cleanup itself into a failure that overwrote a
successful run's exit status. main() now exits explicitly so the trap
runs while the variable is still in scope.

Signed-off-by: Abrar Shivani <ashivani@nvidia.com>
---
 Makefile                      |   6 ++
 tools/module-repos.tsv        | 128 +++++++++++++++++++++++++++
 tools/resolve-module-repos.sh | 162 ++++++++++++++++++++++++++++++++++
 3 files changed, 296 insertions(+)
 create mode 100644 tools/module-repos.tsv
 create mode 100755 tools/resolve-module-repos.sh

diff --git a/Makefile b/Makefile
index c6c3f4882..190ba5b6e 100644
--- a/Makefile
+++ b/Makefile
@@ -203,6 +203,12 @@ check-third-party-notices: third-party-notices
 	@git diff --exit-code -- THIRD_PARTY_NOTICES.md \
 		|| { echo "ERROR: THIRD_PARTY_NOTICES.md is stale. Run 'make third-party-notices' and commit the change."; exit 1; }
 
+# Needs network. Rarely run: keyed by module, so a version bump does not
+# invalidate it. Only a new dependency does.
+.PHONY: third-party-notices-repos
+third-party-notices-repos:
+	@bash tools/resolve-module-repos.sh
+
 .PHONY: test-tools
 test-tools:
 	@for t in tools/*_test.sh; do \
diff --git a/tools/module-repos.tsv b/tools/module-repos.tsv
new file mode 100644
index 000000000..98cdc2cfc
--- /dev/null
+++ b/tools/module-repos.tsv
@@ -0,0 +1,128 @@
+# Upstream repository for each vendored module.
+# Generated by tools/resolve-module-repos.sh from the module proxy Origin,
+# the go-import meta tag, and the github.com path shape. Not hand-edited.
+# module	repo-url	subdir
+cyphar.com/go-pathrs	https://github.com/cyphar/libpathrs	go-pathrs
+dario.cat/mergo	https://github.com/imdario/mergo	
+github.com/Azure/go-ansiterm	https://github.com/Azure/go-ansiterm	
+github.com/MakeNowJust/heredoc	https://github.com/makenowjust/heredoc	
+github.com/Masterminds/goutils	https://github.com/Masterminds/goutils	
+github.com/Masterminds/semver/v3	https://github.com/Masterminds/semver	
+github.com/Masterminds/sprig/v3	https://github.com/Masterminds/sprig	
+github.com/Mellanox/maintenance-operator/api	https://github.com/Mellanox/maintenance-operator	api
+github.com/NVIDIA/go-nvlib	https://github.com/NVIDIA/go-nvlib	
+github.com/NVIDIA/k8s-kata-manager	https://github.com/NVIDIA/k8s-kata-manager	
+github.com/NVIDIA/k8s-operator-libs	https://github.com/NVIDIA/k8s-operator-libs	
+github.com/NVIDIA/nvidia-container-toolkit	https://github.com/NVIDIA/nvidia-container-toolkit	
+github.com/beorn7/perks	https://github.com/beorn7/perks	
+github.com/blang/semver/v4	https://github.com/blang/semver	
+github.com/cespare/xxhash/v2	https://github.com/cespare/xxhash	
+github.com/chai2010/gettext-go	https://github.com/chai2010/gettext-go	
+github.com/cyphar/filepath-securejoin	https://github.com/cyphar/filepath-securejoin	
+github.com/davecgh/go-spew	https://github.com/davecgh/go-spew	
+github.com/docker/libtrust	https://github.com/docker-archive-public/docker.libtrust	
+github.com/emicklei/go-restful/v3	https://github.com/emicklei/go-restful	
+github.com/evanphx/json-patch	https://github.com/evanphx/json-patch	
+github.com/evanphx/json-patch/v5	https://github.com/evanphx/json-patch	
+github.com/exponent-io/jsonpath	https://github.com/exponent-io/jsonpath	
+github.com/fsnotify/fsnotify	https://github.com/fsnotify/fsnotify	
+github.com/fxamacker/cbor/v2	https://github.com/fxamacker/cbor	
+github.com/go-errors/errors	https://github.com/go-errors/errors	
+github.com/go-logr/logr	https://github.com/go-logr/logr	
+github.com/go-logr/zapr	https://github.com/go-logr/zapr	
+github.com/go-openapi/jsonpointer	https://github.com/go-openapi/jsonpointer	
+github.com/go-openapi/jsonreference	https://github.com/go-openapi/jsonreference	
+github.com/go-openapi/swag	https://github.com/go-openapi/swag	
+github.com/go-openapi/swag/cmdutils	https://github.com/go-openapi/swag	cmdutils
+github.com/go-openapi/swag/conv	https://github.com/go-openapi/swag	conv
+github.com/go-openapi/swag/fileutils	https://github.com/go-openapi/swag	fileutils
+github.com/go-openapi/swag/jsonname	https://github.com/go-openapi/swag	jsonname
+github.com/go-openapi/swag/jsonutils	https://github.com/go-openapi/swag	jsonutils
+github.com/go-openapi/swag/loading	https://github.com/go-openapi/swag	loading
+github.com/go-openapi/swag/mangling	https://github.com/go-openapi/swag	mangling
+github.com/go-openapi/swag/netutils	https://github.com/go-openapi/swag	netutils
+github.com/go-openapi/swag/stringutils	https://github.com/go-openapi/swag	stringutils
+github.com/go-openapi/swag/typeutils	https://github.com/go-openapi/swag	typeutils
+github.com/go-openapi/swag/yamlutils	https://github.com/go-openapi/swag	yamlutils
+github.com/go-task/slim-sprig/v3	https://github.com/go-task/slim-sprig	
+github.com/google/btree	https://github.com/google/btree	
+github.com/google/gnostic-models	https://github.com/google/gnostic-models	
+github.com/google/go-cmp	https://github.com/google/go-cmp	
+github.com/google/pprof	https://github.com/google/pprof	
+github.com/google/uuid	https://github.com/google/uuid	
+github.com/huandu/xstrings	https://github.com/huandu/xstrings	
+github.com/inconshreveable/mousetrap	https://github.com/inconshreveable/mousetrap	
+github.com/json-iterator/go	https://github.com/json-iterator/go	
+github.com/klauspost/compress	https://github.com/klauspost/compress	
+github.com/liggitt/tabwriter	https://github.com/liggitt/tabwriter	
+github.com/mitchellh/copystructure	https://github.com/mitchellh/copystructure	
+github.com/mitchellh/go-wordwrap	https://github.com/mitchellh/go-wordwrap	
+github.com/mitchellh/reflectwalk	https://github.com/mitchellh/reflectwalk	
+github.com/moby/term	https://github.com/moby/term	
+github.com/modern-go/concurrent	https://github.com/modern-go/concurrent	
+github.com/modern-go/reflect2	https://github.com/modern-go/reflect2	
+github.com/monochromegane/go-gitignore	https://github.com/monochromegane/go-gitignore	
+github.com/munnerz/goautoneg	https://github.com/munnerz/goautoneg	
+github.com/onsi/ginkgo/v2	https://github.com/onsi/ginkgo	
+github.com/onsi/gomega	https://github.com/onsi/gomega	
+github.com/opencontainers/cgroups	https://github.com/opencontainers/cgroups	
+github.com/opencontainers/go-digest	https://github.com/opencontainers/go-digest	
+github.com/opencontainers/runc	https://github.com/opencontainers/runc	
+github.com/openshift/api	https://github.com/openshift/api	
+github.com/openshift/client-go	https://github.com/openshift/client-go	
+github.com/operator-framework/api	https://github.com/operator-framework/api	
+github.com/peterbourgon/diskv	https://github.com/peterbourgon/diskv	
+github.com/pmezard/go-difflib	https://github.com/pmezard/go-difflib	
+github.com/prometheus-operator/prometheus-operator/pkg/apis/monitoring	https://github.com/prometheus-operator/prometheus-operator	pkg/apis/monitoring
+github.com/prometheus/client_golang	https://github.com/prometheus/client_golang	
+github.com/prometheus/client_model	https://github.com/prometheus/client_model	
+github.com/prometheus/common	https://github.com/prometheus/common	
+github.com/prometheus/procfs	https://github.com/prometheus/procfs	
+github.com/regclient/regclient	https://github.com/regclient/regclient	
+github.com/russross/blackfriday/v2	https://github.com/russross/blackfriday	
+github.com/shopspring/decimal	https://github.com/shopspring/decimal	
+github.com/sirupsen/logrus	https://github.com/sirupsen/logrus	
+github.com/spf13/cast	https://github.com/spf13/cast	
+github.com/spf13/cobra	https://github.com/spf13/cobra	
+github.com/spf13/pflag	https://github.com/spf13/pflag	
+github.com/stretchr/testify	https://github.com/stretchr/testify	
+github.com/ulikunitz/xz	https://github.com/ulikunitz/xz	
+github.com/urfave/cli/v3	https://github.com/urfave/cli	
+github.com/x448/float16	https://github.com/x448/float16	
+github.com/xlab/treeprint	https://github.com/xlab/treeprint	
+go.uber.org/multierr	https://github.com/uber-go/multierr	
+go.uber.org/zap	https://github.com/uber-go/zap	
+go.yaml.in/yaml/v2	https://github.com/yaml/go-yaml	
+go.yaml.in/yaml/v3	https://github.com/yaml/go-yaml	
+golang.org/x/crypto	https://go.googlesource.com/crypto	
+golang.org/x/mod	https://go.googlesource.com/mod	
+golang.org/x/net	https://go.googlesource.com/net	
+golang.org/x/oauth2	https://go.googlesource.com/oauth2	
+golang.org/x/sync	https://go.googlesource.com/sync	
+golang.org/x/sys	https://go.googlesource.com/sys	
+golang.org/x/term	https://go.googlesource.com/term	
+golang.org/x/text	https://go.googlesource.com/text	
+golang.org/x/time	https://go.googlesource.com/time	
+golang.org/x/tools	https://go.googlesource.com/tools	
+gomodules.xyz/jsonpatch/v2	https://github.com/gomodules/jsonpatch	
+google.golang.org/protobuf	https://go.googlesource.com/protobuf	
+gopkg.in/evanphx/json-patch.v4	https://github.com/evanphx/json-patch	
+gopkg.in/inf.v0	https://github.com/go-inf/inf	
+gopkg.in/yaml.v3	https://github.com/go-yaml/yaml	
+k8s.io/api	https://github.com/kubernetes/api	
+k8s.io/apiextensions-apiserver	https://github.com/kubernetes/apiextensions-apiserver	
+k8s.io/apimachinery	https://github.com/kubernetes/apimachinery	
+k8s.io/cli-runtime	https://github.com/kubernetes/cli-runtime	
+k8s.io/client-go	https://github.com/kubernetes/client-go	
+k8s.io/component-base	https://github.com/kubernetes/component-base	
+k8s.io/klog/v2	https://github.com/kubernetes/klog	
+k8s.io/kube-openapi	https://github.com/kubernetes/kube-openapi	
+k8s.io/kubectl	https://github.com/kubernetes/kubectl	
+k8s.io/utils	https://github.com/kubernetes/utils	
+sigs.k8s.io/controller-runtime	https://github.com/kubernetes-sigs/controller-runtime	
+sigs.k8s.io/json	https://github.com/kubernetes-sigs/json	
+sigs.k8s.io/kustomize/api	https://github.com/kubernetes-sigs/kustomize	api
+sigs.k8s.io/kustomize/kyaml	https://github.com/kubernetes-sigs/kustomize	kyaml
+sigs.k8s.io/randfill	https://github.com/kubernetes-sigs/randfill	
+sigs.k8s.io/structured-merge-diff/v6	https://github.com/kubernetes-sigs/structured-merge-diff	
+sigs.k8s.io/yaml	https://github.com/kubernetes-sigs/yaml	
diff --git a/tools/resolve-module-repos.sh b/tools/resolve-module-repos.sh
new file mode 100755
index 000000000..d02b83114
--- /dev/null
+++ b/tools/resolve-module-repos.sh
@@ -0,0 +1,162 @@
+#!/usr/bin/env bash
+# Copyright (c) NVIDIA CORPORATION.  All rights reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+# Resolves every module in vendor/modules.txt to its upstream repository and
+# writes tools/module-repos.tsv.
+#
+# Needs network; run via 'make third-party-notices-repos'. Keyed by module and
+# not by version: a repository normally does not move when a dependency is
+# bumped, so this file survives bumps and changes only when a new module enters
+# the tree. That is a convenience, not a guarantee — Task 5's content
+# verification is what actually enforces correctness, and it fails loudly if a
+# mapping has gone stale.
+
+set -euo pipefail
+
+HERE="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+# shellcheck source=tools/license-url-lib.sh
+source "${HERE}/license-url-lib.sh"
+
+MODULES_TXT="${MODULES_TXT:-vendor/modules.txt}"
+OUTPUT="${OUTPUT:-tools/module-repos.tsv}"
+PROXY="${PROXY:-https://proxy.golang.org}"
+
+die() {
+    printf 'ERROR: %s\n' "$1" >&2
+    shift
+    (( $# > 0 )) && printf '%s\n' "$@" >&2
+    exit 1
+}
+log() { printf '%s\n' "$*" >&2; }
+
+# Retries cover genuine network flakiness only. Absence of Origin is a real,
+# permanent property of older proxy cache entries, not a transient failure.
+fetch_retry() {
+    local url="$1" attempt body
+    for attempt in 1 2 3; do
+        body="$(curl -sfL --max-time 30 "${url}" 2>/dev/null)" || body=""
+        [[ -n "${body}" ]] && { printf '%s' "${body}"; return 0; }
+        sleep $(( attempt * 2 ))
+    done
+    return 1
+}
+
+origin_field() {
+    printf '%s' "$1" | python3 -c '
+import json, sys
+try:
+    origin = json.load(sys.stdin).get("Origin") or {}
+except Exception:
+    origin = {}
+print(origin.get(sys.argv[1], ""))
+' "$2" 2>/dev/null || printf ''
+}
+
+# go-import content is "<import-prefix> <vcs> <repo-root>". The meta tag is
+# frequently split across lines, so newlines are folded before matching.
+go_import_meta() {
+    fetch_retry "https://$1?go-get=1" 2>/dev/null \
+        | tr '\n' ' ' | tr -s ' ' \
+        | LC_ALL=C grep -oE 'name="go-import"[^>]*content="[^"]*"' \
+        | head -1 \
+        | LC_ALL=C sed -E 's/.*content="([^"]*)".*/\1/'
+}
+
+main() {
+    command -v curl >/dev/null 2>&1 || die "curl is not installed."
+    command -v python3 >/dev/null 2>&1 || die "python3 is not installed."
+    [[ -f "${MODULES_TXT}" ]] \
+        || die "${MODULES_TXT} not found — run 'make third-party-notices-repos' from the repo root."
+
+    local tmp unresolved=0
+    tmp="$(mktemp "${TMPDIR:-/tmp}/gpu-operator-repos.XXXXXX")"
+    trap 'rm -f "${tmp}"' EXIT
+
+    local module version info repo prefix subdir meta converted
+    while read -r module version; do
+        [[ -z "${module}" ]] && continue
+
+        repo=""; prefix=""; subdir=""; info=""
+
+        if info="$(fetch_retry "${PROXY}/$(proxy_escape "${module}")/@v/${version}.info")"; then
+            repo="$(origin_field "${info}" URL)"
+            subdir="$(origin_field "${info}" Subdir)"
+        fi
+
+        if [[ -z "${repo}" ]]; then
+            meta="$(go_import_meta "${module}")" || meta=""
+            if [[ -n "${meta}" ]]; then
+                prefix="$(printf '%s' "${meta}" | awk '{print $1}')"
+                repo="$(printf '%s' "${meta}" | awk '{print $3}')"
+            fi
+        fi
+
+        [[ -z "${repo}" ]] && repo="$(github_repo_from_path "${module}")"
+        repo="$(normalize_repo_url "${repo}")"
+
+        # gopkg.in points at itself and serves no blobs.
+        case "${repo}" in
+            https://gopkg.in/*|"")
+                converted="$(gopkg_in_repo "${module}")"
+                [[ -n "${converted}" ]] && repo="${converted}"
+                ;;
+        esac
+
+        if [[ -z "${repo}" ]]; then
+            log "UNRESOLVED ${module}: no repository could be determined"
+            unresolved=$(( unresolved + 1 ))
+            continue
+        fi
+
+        # Subdir precedence: proxy Origin, then the go-import prefix, then the
+        # github path shape. The last matters because GitHub serves no
+        # go-import, so a github submodule with no Origin would otherwise lose
+        # its tag prefix and never verify.
+        if [[ -z "${subdir}" && -n "${prefix}" ]]; then
+            subdir="$(derived_subdir "${module}" "${prefix}")"
+        fi
+        if [[ -z "${subdir}" ]]; then
+            subdir="$(github_subdir_from_path "${module}")"
+        fi
+
+        printf '%s\t%s\t%s\n' "${module}" "${repo}" "${subdir}" >> "${tmp}"
+    done < <(LC_ALL=C grep '^# ' "${MODULES_TXT}" | awk '{print $2, $3}')
+
+    (( unresolved == 0 )) || die \
+        "${unresolved} module(s) could not be resolved to a repository." \
+        "Re-run; if the failure persists the module's vanity host is unreachable."
+
+    {
+        printf '# Upstream repository for each vendored module.\n'
+        printf '# Generated by tools/resolve-module-repos.sh from the module proxy Origin,\n'
+        printf '# the go-import meta tag, and the github.com path shape. Not hand-edited.\n'
+        printf '# module\trepo-url\tsubdir\n'
+        LC_ALL=C sort "${tmp}"
+    } > "${OUTPUT}"
+
+    log "Wrote ${OUTPUT} ($(LC_ALL=C grep -vc '^#' "${OUTPUT}") modules)"
+
+    # Exit here, not by falling off the end: the EXIT trap above references
+    # tmp, a variable local to this function. If main merely returns, the
+    # process's implicit exit fires that trap after tmp has gone out of
+    # scope, and 'set -u' turns the cleanup itself into an unbound-variable
+    # failure that clobbers this function's success with exit 1.
+    exit 0
+}
+
+if [[ "${BASH_SOURCE[0]}" == "${0}" ]]; then
+    main "$@"
+fi

From 2ba12fa08878068b31a44b4d16126c927ee140f9 Mon Sep 17 00:00:00 2001
From: Abrar Shivani <ashivani@nvidia.com>
Date: Mon, 24 Aug 2026 15:57:46 -0700
Subject: [PATCH 07/18] Verify every license URL against the vendored bytes

A URL is recorded only when the file it serves hashes identically to the
copy under vendor/. Probing for a 200 cannot tell a correct link from one
that serves the wrong licence; hashing can, and it also removes the need
to guess whether a submodule inherits its licence from the repository
root or ships its own.

Scope is the shipped set: the verifier reuses the generator's collection,
so build- and test-only dependencies are not resolved or documented.

Ref candidates for go.googlesource.com repos are split into tag names and
commit hashes so only tag names get the refs/tags/ qualification; a raw
commit hash under refs/tags/ 404s, which otherwise breaks pseudo-versioned
modules such as google.golang.org/protobuf.

Signed-off-by: Abrar Shivani <ashivani@nvidia.com>
---
 Makefile                     |   6 +
 tools/license-urls.tsv       | 143 +++++++++++++++++++++++
 tools/verify-license-urls.sh | 214 +++++++++++++++++++++++++++++++++++
 3 files changed, 363 insertions(+)
 create mode 100644 tools/license-urls.tsv
 create mode 100644 tools/verify-license-urls.sh

diff --git a/Makefile b/Makefile
index 190ba5b6e..da601f75e 100644
--- a/Makefile
+++ b/Makefile
@@ -209,6 +209,12 @@ check-third-party-notices: third-party-notices
 third-party-notices-repos:
 	@bash tools/resolve-module-repos.sh
 
+# Needs network. Every URL is content-verified against the vendored copy before
+# it is written, so re-run this whenever a dependency version changes.
+.PHONY: third-party-notices-urls
+third-party-notices-urls: third-party-notices-repos
+	@bash tools/verify-license-urls.sh
+
 .PHONY: test-tools
 test-tools:
 	@for t in tools/*_test.sh; do \
diff --git a/tools/license-urls.tsv b/tools/license-urls.tsv
new file mode 100644
index 000000000..aa26a0399
--- /dev/null
+++ b/tools/license-urls.tsv
@@ -0,0 +1,143 @@
+# Verified upstream URL for every license file the notices document links.
+# Generated by tools/verify-license-urls.sh. Each URL was fetched and its
+# sha256 matched against the vendored copy, so no entry is a dead or wrong link.
+# Covers the shipped set only: build- and test-only dependencies are excluded.
+# module	version	license-path	url
+dario.cat/mergo	v1.0.1	LICENSE	https://github.com/imdario/mergo/blob/v1.0.1/LICENSE
+github.com/MakeNowJust/heredoc	v1.0.0	LICENSE	https://github.com/makenowjust/heredoc/blob/v1.0.0/LICENSE
+github.com/Masterminds/goutils	v1.1.1	LICENSE.txt	https://github.com/Masterminds/goutils/blob/v1.1.1/LICENSE.txt
+github.com/Masterminds/semver/v3	v3.5.0	LICENSE.txt	https://github.com/Masterminds/semver/blob/v3.5.0/LICENSE.txt
+github.com/Masterminds/sprig/v3	v3.3.0	LICENSE.txt	https://github.com/Masterminds/sprig/blob/v3.3.0/LICENSE.txt
+github.com/Mellanox/maintenance-operator/api	v0.3.0	LICENSE	https://github.com/Mellanox/maintenance-operator/blob/api/v0.3.0/LICENSE
+github.com/NVIDIA/go-nvlib	v0.12.0	LICENSE	https://github.com/NVIDIA/go-nvlib/blob/v0.12.0/LICENSE
+github.com/NVIDIA/go-nvlib	v0.12.0	NOTICE	https://github.com/NVIDIA/go-nvlib/blob/v0.12.0/NOTICE
+github.com/NVIDIA/k8s-kata-manager	v0.2.3	LICENSE	https://github.com/NVIDIA/k8s-kata-manager/blob/v0.2.3/LICENSE
+github.com/NVIDIA/k8s-operator-libs	v0.0.0-20260629200812-d720f2557494	LICENSE	https://github.com/NVIDIA/k8s-operator-libs/blob/d720f2557494/LICENSE
+github.com/NVIDIA/nvidia-container-toolkit	v1.20.0	LICENSE	https://github.com/NVIDIA/nvidia-container-toolkit/blob/v1.20.0/LICENSE
+github.com/beorn7/perks	v1.0.1	LICENSE	https://github.com/beorn7/perks/blob/v1.0.1/LICENSE
+github.com/blang/semver/v4	v4.0.0	LICENSE	https://github.com/blang/semver/blob/v4.0.0/LICENSE
+github.com/cespare/xxhash/v2	v2.3.0	LICENSE.txt	https://github.com/cespare/xxhash/blob/v2.3.0/LICENSE.txt
+github.com/chai2010/gettext-go	v1.0.2	LICENSE	https://github.com/chai2010/gettext-go/blob/v1.0.2/LICENSE
+github.com/cyphar/filepath-securejoin	v0.7.0	COPYING.md	https://github.com/cyphar/filepath-securejoin/blob/v0.7.0/COPYING.md
+github.com/cyphar/filepath-securejoin	v0.7.0	LICENSE.BSD	https://github.com/cyphar/filepath-securejoin/blob/v0.7.0/LICENSE.BSD
+github.com/cyphar/filepath-securejoin	v0.7.0	LICENSE.MPL-2.0	https://github.com/cyphar/filepath-securejoin/blob/v0.7.0/LICENSE.MPL-2.0
+github.com/davecgh/go-spew	v1.1.2-0.20180830191138-d8f796af33cc	LICENSE	https://github.com/davecgh/go-spew/blob/d8f796af33cc/LICENSE
+github.com/docker/libtrust	v0.0.0-20160708172513-aabc10ec26b7	LICENSE	https://github.com/docker-archive-public/docker.libtrust/blob/aabc10ec26b7/LICENSE
+github.com/emicklei/go-restful/v3	v3.13.0	LICENSE	https://github.com/emicklei/go-restful/blob/v3.13.0/LICENSE
+github.com/evanphx/json-patch/v5	v5.9.11	LICENSE	https://github.com/evanphx/json-patch/blob/v5.9.11/LICENSE
+github.com/exponent-io/jsonpath	v0.0.0-20210407135951-1de76d718b3f	LICENSE	https://github.com/exponent-io/jsonpath/blob/1de76d718b3f/LICENSE
+github.com/fsnotify/fsnotify	v1.9.0	LICENSE	https://github.com/fsnotify/fsnotify/blob/v1.9.0/LICENSE
+github.com/fxamacker/cbor/v2	v2.9.2	LICENSE	https://github.com/fxamacker/cbor/blob/v2.9.2/LICENSE
+github.com/go-errors/errors	v1.5.1	LICENSE.MIT	https://github.com/go-errors/errors/blob/v1.5.1/LICENSE.MIT
+github.com/go-logr/logr	v1.4.4	LICENSE	https://github.com/go-logr/logr/blob/v1.4.4/LICENSE
+github.com/go-logr/zapr	v1.3.0	LICENSE	https://github.com/go-logr/zapr/blob/v1.3.0/LICENSE
+github.com/go-openapi/jsonpointer	v0.22.4	LICENSE	https://github.com/go-openapi/jsonpointer/blob/v0.22.4/LICENSE
+github.com/go-openapi/jsonpointer	v0.22.4	NOTICE	https://github.com/go-openapi/jsonpointer/blob/v0.22.4/NOTICE
+github.com/go-openapi/jsonreference	v0.21.4	LICENSE	https://github.com/go-openapi/jsonreference/blob/v0.21.4/LICENSE
+github.com/go-openapi/jsonreference	v0.21.4	NOTICE	https://github.com/go-openapi/jsonreference/blob/v0.21.4/NOTICE
+github.com/go-openapi/swag	v0.25.4	LICENSE	https://github.com/go-openapi/swag/blob/v0.25.4/LICENSE
+github.com/go-openapi/swag/cmdutils	v0.25.4	LICENSE	https://github.com/go-openapi/swag/blob/cmdutils/v0.25.4/LICENSE
+github.com/go-openapi/swag/conv	v0.25.4	LICENSE	https://github.com/go-openapi/swag/blob/conv/v0.25.4/LICENSE
+github.com/go-openapi/swag/fileutils	v0.25.4	LICENSE	https://github.com/go-openapi/swag/blob/fileutils/v0.25.4/LICENSE
+github.com/go-openapi/swag/jsonname	v0.25.4	LICENSE	https://github.com/go-openapi/swag/blob/jsonname/v0.25.4/LICENSE
+github.com/go-openapi/swag/jsonutils	v0.25.4	LICENSE	https://github.com/go-openapi/swag/blob/jsonutils/v0.25.4/LICENSE
+github.com/go-openapi/swag/loading	v0.25.4	LICENSE	https://github.com/go-openapi/swag/blob/loading/v0.25.4/LICENSE
+github.com/go-openapi/swag/mangling	v0.25.4	LICENSE	https://github.com/go-openapi/swag/blob/mangling/v0.25.4/LICENSE
+github.com/go-openapi/swag/netutils	v0.25.4	LICENSE	https://github.com/go-openapi/swag/blob/netutils/v0.25.4/LICENSE
+github.com/go-openapi/swag/stringutils	v0.25.4	LICENSE	https://github.com/go-openapi/swag/blob/stringutils/v0.25.4/LICENSE
+github.com/go-openapi/swag/typeutils	v0.25.4	LICENSE	https://github.com/go-openapi/swag/blob/typeutils/v0.25.4/LICENSE
+github.com/go-openapi/swag/yamlutils	v0.25.4	LICENSE	https://github.com/go-openapi/swag/blob/yamlutils/v0.25.4/LICENSE
+github.com/google/btree	v1.1.3	LICENSE	https://github.com/google/btree/blob/v1.1.3/LICENSE
+github.com/google/gnostic-models	v0.7.1	LICENSE	https://github.com/google/gnostic-models/blob/v0.7.1/LICENSE
+github.com/google/uuid	v1.6.0	LICENSE	https://github.com/google/uuid/blob/v1.6.0/LICENSE
+github.com/huandu/xstrings	v1.5.0	LICENSE	https://github.com/huandu/xstrings/blob/v1.5.0/LICENSE
+github.com/json-iterator/go	v1.1.12	LICENSE	https://github.com/json-iterator/go/blob/v1.1.12/LICENSE
+github.com/klauspost/compress	v1.19.1	LICENSE	https://github.com/klauspost/compress/blob/v1.19.1/LICENSE
+github.com/klauspost/compress	v1.19.1	internal/snapref/LICENSE	https://github.com/klauspost/compress/blob/v1.19.1/internal/snapref/LICENSE
+github.com/klauspost/compress	v1.19.1	zstd/internal/xxhash/LICENSE.txt	https://github.com/klauspost/compress/blob/v1.19.1/zstd/internal/xxhash/LICENSE.txt
+github.com/liggitt/tabwriter	v0.0.0-20181228230101-89fcab3d43de	LICENSE	https://github.com/liggitt/tabwriter/blob/89fcab3d43de/LICENSE
+github.com/mitchellh/copystructure	v1.2.0	LICENSE	https://github.com/mitchellh/copystructure/blob/v1.2.0/LICENSE
+github.com/mitchellh/go-wordwrap	v1.0.1	LICENSE.md	https://github.com/mitchellh/go-wordwrap/blob/v1.0.1/LICENSE.md
+github.com/mitchellh/reflectwalk	v1.0.2	LICENSE	https://github.com/mitchellh/reflectwalk/blob/v1.0.2/LICENSE
+github.com/moby/term	v0.5.2	LICENSE	https://github.com/moby/term/blob/v0.5.2/LICENSE
+github.com/modern-go/concurrent	v0.0.0-20180306012644-bacd9c7ef1dd	LICENSE	https://github.com/modern-go/concurrent/blob/bacd9c7ef1dd/LICENSE
+github.com/modern-go/reflect2	v1.0.3-0.20250322232337-35a7c28c31ee	LICENSE	https://github.com/modern-go/reflect2/blob/35a7c28c31ee/LICENSE
+github.com/monochromegane/go-gitignore	v0.0.0-20200626010858-205db1a8cc00	LICENSE	https://github.com/monochromegane/go-gitignore/blob/205db1a8cc00/LICENSE
+github.com/munnerz/goautoneg	v0.0.0-20191010083416-a7dc8b61c822	LICENSE	https://github.com/munnerz/goautoneg/blob/a7dc8b61c822/LICENSE
+github.com/opencontainers/cgroups	v0.0.7	LICENSE	https://github.com/opencontainers/cgroups/blob/v0.0.7/LICENSE
+github.com/opencontainers/go-digest	v1.0.0	LICENSE	https://github.com/opencontainers/go-digest/blob/v1.0.0/LICENSE
+github.com/opencontainers/runc	v1.4.3	LICENSE	https://github.com/opencontainers/runc/blob/v1.4.3/LICENSE
+github.com/opencontainers/runc	v1.4.3	NOTICE	https://github.com/opencontainers/runc/blob/v1.4.3/NOTICE
+github.com/openshift/api	v0.0.0-20260727141720-967cc4c36c9b	LICENSE	https://github.com/openshift/api/blob/967cc4c36c9b/LICENSE
+github.com/openshift/client-go	v0.0.0-20260723174158-ae2315de9d73	LICENSE	https://github.com/openshift/client-go/blob/ae2315de9d73/LICENSE
+github.com/operator-framework/api	v0.45.0	LICENSE	https://github.com/operator-framework/api/blob/v0.45.0/LICENSE
+github.com/peterbourgon/diskv	v2.0.1+incompatible	LICENSE	https://github.com/peterbourgon/diskv/blob/v2.0.1/LICENSE
+github.com/pmezard/go-difflib	v1.0.1-0.20181226105442-5d4384ee4fb2	LICENSE	https://github.com/pmezard/go-difflib/blob/5d4384ee4fb2/LICENSE
+github.com/prometheus-operator/prometheus-operator/pkg/apis/monitoring	v0.93.1	LICENSE	https://github.com/prometheus-operator/prometheus-operator/blob/pkg/apis/monitoring/v0.93.1/LICENSE
+github.com/prometheus/client_golang	v1.24.1	LICENSE	https://github.com/prometheus/client_golang/blob/v1.24.1/LICENSE
+github.com/prometheus/client_golang	v1.24.1	NOTICE	https://github.com/prometheus/client_golang/blob/v1.24.1/NOTICE
+github.com/prometheus/client_golang	v1.24.1	internal/github.com/golang/gddo/LICENSE	https://github.com/prometheus/client_golang/blob/v1.24.1/internal/github.com/golang/gddo/LICENSE
+github.com/prometheus/client_model	v0.6.2	LICENSE	https://github.com/prometheus/client_model/blob/v0.6.2/LICENSE
+github.com/prometheus/client_model	v0.6.2	NOTICE	https://github.com/prometheus/client_model/blob/v0.6.2/NOTICE
+github.com/prometheus/common	v0.70.1	LICENSE	https://github.com/prometheus/common/blob/v0.70.1/LICENSE
+github.com/prometheus/common	v0.70.1	NOTICE	https://github.com/prometheus/common/blob/v0.70.1/NOTICE
+github.com/prometheus/procfs	v0.21.1	LICENSE	https://github.com/prometheus/procfs/blob/v0.21.1/LICENSE
+github.com/prometheus/procfs	v0.21.1	NOTICE	https://github.com/prometheus/procfs/blob/v0.21.1/NOTICE
+github.com/regclient/regclient	v0.11.5	LICENSE	https://github.com/regclient/regclient/blob/v0.11.5/LICENSE
+github.com/russross/blackfriday/v2	v2.1.0	LICENSE.txt	https://github.com/russross/blackfriday/blob/v2.1.0/LICENSE.txt
+github.com/shopspring/decimal	v1.4.0	LICENSE	https://github.com/shopspring/decimal/blob/v1.4.0/LICENSE
+github.com/sirupsen/logrus	v1.10.1	LICENSE	https://github.com/sirupsen/logrus/blob/v1.10.1/LICENSE
+github.com/spf13/cast	v1.7.0	LICENSE	https://github.com/spf13/cast/blob/v1.7.0/LICENSE
+github.com/spf13/cobra	v1.10.2	LICENSE.txt	https://github.com/spf13/cobra/blob/v1.10.2/LICENSE.txt
+github.com/spf13/pflag	v1.0.10	LICENSE	https://github.com/spf13/pflag/blob/v1.0.10/LICENSE
+github.com/stretchr/testify	v1.12.0	LICENSE	https://github.com/stretchr/testify/blob/v1.12.0/LICENSE
+github.com/ulikunitz/xz	v0.5.15	LICENSE	https://github.com/ulikunitz/xz/blob/v0.5.15/LICENSE
+github.com/urfave/cli/v3	v3.10.1	LICENSE	https://github.com/urfave/cli/blob/v3.10.1/LICENSE
+github.com/x448/float16	v0.8.4	LICENSE	https://github.com/x448/float16/blob/v0.8.4/LICENSE
+github.com/xlab/treeprint	v1.2.0	LICENSE	https://github.com/xlab/treeprint/blob/v1.2.0/LICENSE
+go.uber.org/multierr	v1.11.0	LICENSE.txt	https://github.com/uber-go/multierr/blob/v1.11.0/LICENSE.txt
+go.uber.org/zap	v1.28.0	LICENSE	https://github.com/uber-go/zap/blob/v1.28.0/LICENSE
+go.yaml.in/yaml/v2	v2.4.4	LICENSE	https://github.com/yaml/go-yaml/blob/v2.4.4/LICENSE
+go.yaml.in/yaml/v2	v2.4.4	NOTICE	https://github.com/yaml/go-yaml/blob/v2.4.4/NOTICE
+go.yaml.in/yaml/v3	v3.0.4	LICENSE	https://github.com/yaml/go-yaml/blob/v3.0.4/LICENSE
+go.yaml.in/yaml/v3	v3.0.4	NOTICE	https://github.com/yaml/go-yaml/blob/v3.0.4/NOTICE
+golang.org/x/crypto	v0.55.0	LICENSE	https://go.googlesource.com/crypto/+/refs/tags/v0.55.0/LICENSE
+golang.org/x/mod	v0.40.0	LICENSE	https://go.googlesource.com/mod/+/refs/tags/v0.40.0/LICENSE
+golang.org/x/net	v0.58.0	LICENSE	https://go.googlesource.com/net/+/refs/tags/v0.58.0/LICENSE
+golang.org/x/oauth2	v0.36.0	LICENSE	https://go.googlesource.com/oauth2/+/refs/tags/v0.36.0/LICENSE
+golang.org/x/sync	v0.22.0	LICENSE	https://go.googlesource.com/sync/+/refs/tags/v0.22.0/LICENSE
+golang.org/x/sys	v0.47.0	LICENSE	https://go.googlesource.com/sys/+/refs/tags/v0.47.0/LICENSE
+golang.org/x/term	v0.45.0	LICENSE	https://go.googlesource.com/term/+/refs/tags/v0.45.0/LICENSE
+golang.org/x/text	v0.41.0	LICENSE	https://go.googlesource.com/text/+/refs/tags/v0.41.0/LICENSE
+golang.org/x/time	v0.14.0	LICENSE	https://go.googlesource.com/time/+/refs/tags/v0.14.0/LICENSE
+gomodules.xyz/jsonpatch/v2	v2.4.0	LICENSE	https://github.com/gomodules/jsonpatch/blob/v2.4.0/LICENSE
+google.golang.org/protobuf	v1.36.12-0.20260120151049-f2248ac996af	LICENSE	https://go.googlesource.com/protobuf/+/f2248ac996af/LICENSE
+gopkg.in/evanphx/json-patch.v4	v4.13.0	LICENSE	https://github.com/evanphx/json-patch/blob/v4.13.0/LICENSE
+gopkg.in/inf.v0	v0.9.1	LICENSE	https://github.com/go-inf/inf/blob/v0.9.1/LICENSE
+gopkg.in/yaml.v3	v3.0.1	LICENSE	https://github.com/go-yaml/yaml/blob/v3.0.1/LICENSE
+gopkg.in/yaml.v3	v3.0.1	NOTICE	https://github.com/go-yaml/yaml/blob/v3.0.1/NOTICE
+k8s.io/api	v0.36.4	LICENSE	https://github.com/kubernetes/api/blob/v0.36.4/LICENSE
+k8s.io/apiextensions-apiserver	v0.36.4	LICENSE	https://github.com/kubernetes/apiextensions-apiserver/blob/v0.36.4/LICENSE
+k8s.io/apimachinery	v0.36.4	LICENSE	https://github.com/kubernetes/apimachinery/blob/v0.36.4/LICENSE
+k8s.io/apimachinery	v0.36.4	third_party/forked/golang/LICENSE	https://github.com/kubernetes/apimachinery/blob/v0.36.4/third_party/forked/golang/LICENSE
+k8s.io/cli-runtime	v0.36.0	LICENSE	https://github.com/kubernetes/cli-runtime/blob/v0.36.0/LICENSE
+k8s.io/client-go	v0.36.4	LICENSE	https://github.com/kubernetes/client-go/blob/v0.36.4/LICENSE
+k8s.io/client-go	v0.36.4	third_party/forked/golang/LICENSE	https://github.com/kubernetes/client-go/blob/v0.36.4/third_party/forked/golang/LICENSE
+k8s.io/client-go	v0.36.4	third_party/forked/httpcache/LICENSE	https://github.com/kubernetes/client-go/blob/v0.36.4/third_party/forked/httpcache/LICENSE
+k8s.io/component-base	v0.36.4	LICENSE	https://github.com/kubernetes/component-base/blob/v0.36.4/LICENSE
+k8s.io/klog/v2	v2.140.0	LICENSE	https://github.com/kubernetes/klog/blob/v2.140.0/LICENSE
+k8s.io/kube-openapi	v0.0.0-20260603220949-865597e52e25	LICENSE	https://github.com/kubernetes/kube-openapi/blob/865597e52e25/LICENSE
+k8s.io/kube-openapi	v0.0.0-20260603220949-865597e52e25	pkg/internal/third_party/go-json-experiment/json/LICENSE	https://github.com/kubernetes/kube-openapi/blob/865597e52e25/pkg/internal/third_party/go-json-experiment/json/LICENSE
+k8s.io/kube-openapi	v0.0.0-20260603220949-865597e52e25	pkg/validation/spec/LICENSE	https://github.com/kubernetes/kube-openapi/blob/865597e52e25/pkg/validation/spec/LICENSE
+k8s.io/kubectl	v0.36.0	LICENSE	https://github.com/kubernetes/kubectl/blob/v0.36.0/LICENSE
+k8s.io/utils	v0.0.0-20260507154919-ff6756f316d2	LICENSE	https://github.com/kubernetes/utils/blob/ff6756f316d2/LICENSE
+k8s.io/utils	v0.0.0-20260507154919-ff6756f316d2	internal/third_party/forked/golang/LICENSE	https://github.com/kubernetes/utils/blob/ff6756f316d2/internal/third_party/forked/golang/LICENSE
+k8s.io/utils	v0.0.0-20260507154919-ff6756f316d2	third_party/forked/golang/btree/LICENSE	https://github.com/kubernetes/utils/blob/ff6756f316d2/third_party/forked/golang/btree/LICENSE
+sigs.k8s.io/controller-runtime	v0.24.1	LICENSE	https://github.com/kubernetes-sigs/controller-runtime/blob/v0.24.1/LICENSE
+sigs.k8s.io/json	v0.0.0-20250730193827-2d320260d730	LICENSE	https://github.com/kubernetes-sigs/json/blob/2d320260d730/LICENSE
+sigs.k8s.io/kustomize/api	v0.21.1	LICENSE	https://github.com/kubernetes-sigs/kustomize/blob/api/v0.21.1/LICENSE
+sigs.k8s.io/kustomize/kyaml	v0.21.1	LICENSE	https://github.com/kubernetes-sigs/kustomize/blob/kyaml/v0.21.1/LICENSE
+sigs.k8s.io/randfill	v1.0.0	LICENSE	https://github.com/kubernetes-sigs/randfill/blob/v1.0.0/LICENSE
+sigs.k8s.io/randfill	v1.0.0	NOTICE	https://github.com/kubernetes-sigs/randfill/blob/v1.0.0/NOTICE
+sigs.k8s.io/structured-merge-diff/v6	v6.4.0	LICENSE	https://github.com/kubernetes-sigs/structured-merge-diff/blob/v6.4.0/LICENSE
+sigs.k8s.io/yaml	v1.6.0	LICENSE	https://github.com/kubernetes-sigs/yaml/blob/v1.6.0/LICENSE
diff --git a/tools/verify-license-urls.sh b/tools/verify-license-urls.sh
new file mode 100644
index 000000000..ec8a6cd75
--- /dev/null
+++ b/tools/verify-license-urls.sh
@@ -0,0 +1,214 @@
+#!/usr/bin/env bash
+# Copyright (c) NVIDIA CORPORATION.  All rights reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+# Resolves and verifies the upstream URL of every license file the notices
+# document links, writing tools/license-urls.tsv.
+#
+# Needs network; run via 'make third-party-notices-urls'. A URL is written ONLY
+# if the bytes it serves hash to the same sha256 as the vendored copy, so no
+# entry can be a dead link or point at the wrong licence.
+#
+# Scope is the shipped set: this sources the notices generator and runs its
+# collection stages, so it verifies exactly the packages go-licenses attributes
+# to ./cmd/..., never the build- and test-only modules vendor/ also contains.
+
+set -euo pipefail
+
+HERE="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+# shellcheck source=tools/license-url-lib.sh
+source "${HERE}/license-url-lib.sh"
+# shellcheck source=tools/generate-third-party-notices.sh
+source "${HERE}/generate-third-party-notices.sh"
+
+REPOS_MAP="${REPOS_MAP:-tools/module-repos.tsv}"
+URLS_OUTPUT="${URLS_OUTPUT:-tools/license-urls.tsv}"
+PROXY="${PROXY:-https://proxy.golang.org}"
+
+sha256_of_file() {
+    if command -v sha256sum >/dev/null 2>&1; then
+        sha256sum "$1" | cut -d' ' -f1
+    else
+        shasum -a 256 "$1" | cut -d' ' -f1
+    fi
+}
+
+sha256_of_stdin() {
+    if command -v sha256sum >/dev/null 2>&1; then
+        sha256sum | cut -d' ' -f1
+    else
+        shasum -a 256 | cut -d' ' -f1
+    fi
+}
+
+remote_sha() {
+    local blob="$1" raw
+    raw="$(raw_url_for "${blob}")"
+    [[ -n "${raw}" ]] || return 1
+    if raw_is_base64 "${blob}"; then
+        curl -sfL --max-time 30 "${raw}" 2>/dev/null | base64_decode 2>/dev/null | sha256_of_stdin
+    else
+        curl -sfL --max-time 30 "${raw}" 2>/dev/null | sha256_of_stdin
+    fi
+}
+
+repo_field() {
+    LC_ALL=C awk -F'\t' -v m="$1" -v want="$2" \
+        '$1 == m { print (want == "repo" ? $2 : $3); found = 1; exit }
+         END { exit !found }' "${REPOS_MAP}"
+}
+
+# Version-specific provenance. Fetched here rather than stored in the repos map,
+# which is deliberately version-independent. Origin.Hash is the only pinned ref
+# left when upstream deletes or rewrites a tag.
+origin_ref_and_hash() {
+    local module="$1" version="$2" info
+    info="$(curl -sfL --max-time 30 \
+        "${PROXY}/$(proxy_escape "${module}")/@v/${version}.info" 2>/dev/null)" || return 0
+    printf '%s' "${info}" | python3 -c '
+import json, sys
+try:
+    origin = json.load(sys.stdin).get("Origin") or {}
+except Exception:
+    origin = {}
+ref = origin.get("Ref", "")
+# Only a tag pins a release. Every golang.org/x module reports
+# refs/heads/master, and a branch ref would float.
+print(ref[len("refs/tags/"):] if ref.startswith("refs/tags/") else "")
+print(origin.get("Hash", ""))
+' 2>/dev/null || printf '\n\n'
+}
+
+main() {
+    command -v curl >/dev/null 2>&1 || die "curl is not installed."
+    command -v python3 >/dev/null 2>&1 || die "python3 is not installed."
+    [[ -f "${REPOS_MAP}" ]] \
+        || die "${REPOS_MAP} not found — run 'make third-party-notices-repos' first."
+
+    check_prerequisites
+    verify_platform_matrix
+    prepare_workspace
+    collect_licenses
+    build_indexes
+
+    local tmp failures=0
+    tmp="$(mktemp "${TMPDIR:-/tmp}/gpu-operator-urls.XXXXXX")"
+
+    local package _ license module version repo subdir relative
+    local origin_tag origin_hash plain pseudo lf name path_in_module want_sha found
+    while IFS=, read -r package _ license module version; do
+        [[ -z "${package}" ]] && continue
+
+        repo="$(repo_field "${module}" repo)" \
+            || die "${REPOS_MAP} has no entry for ${module}." \
+                   "Run 'make third-party-notices-repos' and commit the result."
+        subdir="$(repo_field "${module}" subdir)" || subdir=""
+
+        origin_tag="$(origin_ref_and_hash "${module}" "${version}" | sed -n 1p)"
+        origin_hash="$(origin_ref_and_hash "${module}" "${version}" | sed -n 2p)"
+
+        # Ref candidates, most specific first. Never a branch ref. Commit
+        # hashes (pseudo-version hash, Origin.Hash) are tracked apart from tag
+        # names: go.googlesource.com serves a tag under refs/tags/ but a raw
+        # commit only under its bare hash, so qualifying a hash the same way
+        # 404s a pseudo-versioned module such as google.golang.org/protobuf.
+        local tag_refs=() hash_refs=()
+        plain="$(normalize_version "${version}")"
+        pseudo="$(pseudo_version_hash "${version}")"
+        [[ -n "${origin_tag}" ]] && tag_refs+=( "${origin_tag}" )
+        if [[ -n "${pseudo}" ]]; then
+            hash_refs+=( "${pseudo}" )
+        else
+            [[ -n "${subdir}" ]] && tag_refs+=( "${subdir}/${plain}" )
+            tag_refs+=( "${plain}" )
+        fi
+        [[ -n "${origin_hash}" ]] && hash_refs+=( "${origin_hash}" )
+
+        local refs=() r
+        if (( ${#tag_refs[@]} > 0 )); then
+            case "${repo}" in
+                https://go.googlesource.com/*)
+                    for r in "${tag_refs[@]}"; do refs+=( "refs/tags/${r}" ); done
+                    ;;
+                *)
+                    refs+=( "${tag_refs[@]}" )
+                    ;;
+            esac
+        fi
+        (( ${#hash_refs[@]} > 0 )) && refs+=( "${hash_refs[@]}" )
+        (( ${#refs[@]} > 0 )) || die "no ref candidates for ${module}@${version}."
+
+        relative="$(license_dir_within_module "${package}" "${module}")" \
+            || die "no license file found for ${package} under ${VENDOR_DIR}/${module}."
+
+        while IFS= read -r lf; do
+            [[ -z "${lf}" ]] && continue
+            name="$(basename "${lf}")"
+            path_in_module="${relative:+${relative}/}${name}"
+            [[ -f "${VENDOR_DIR}/${module}/${path_in_module}" ]] \
+                || die "${VENDOR_DIR}/${module}/${path_in_module} does not exist."
+            want_sha="$(sha256_of_file "${VENDOR_DIR}/${module}/${path_in_module}")"
+
+            # Both layouts: a submodule may ship its own licence or inherit the
+            # repository root's. Content decides which is real. Built as an
+            # array rather than an unquoted ${x:+...} expansion, which would
+            # word-split a path containing whitespace or a glob character.
+            local paths=()
+            [[ -n "${subdir}" ]] && paths+=( "${subdir}/${path_in_module}" )
+            paths+=( "${path_in_module}" )
+
+            found=""
+            local try_ref try_path candidate
+            for try_ref in "${refs[@]}"; do
+                for try_path in "${paths[@]}"; do
+                    candidate="$(blob_url "${repo}" "${try_ref}" "${try_path}")"
+                    if [[ "$(remote_sha "${candidate}")" == "${want_sha}" ]]; then
+                        found="${candidate}"
+                        break 2
+                    fi
+                done
+            done
+
+            if [[ -z "${found}" ]]; then
+                log "UNVERIFIED ${module}@${version} ${path_in_module}"
+                failures=$(( failures + 1 ))
+                continue
+            fi
+            printf '%s\t%s\t%s\t%s\n' "${module}" "${version}" "${path_in_module}" "${found}" >> "${tmp}"
+        done < <(license_files_for "${LICENSES_DIR}/${package}")
+    done < "${INDEX_FILE}"
+
+    (( failures == 0 )) || die \
+        "${failures} license file(s) could not be matched to a verified upstream URL." \
+        "Every URL must serve bytes identical to the vendored copy; none of the" \
+        "candidates did. The repository mapping may be stale — re-run" \
+        "'make third-party-notices-repos' before investigating further."
+
+    {
+        printf '# Verified upstream URL for every license file the notices document links.\n'
+        printf '# Generated by tools/verify-license-urls.sh. Each URL was fetched and its\n'
+        printf '# sha256 matched against the vendored copy, so no entry is a dead or wrong link.\n'
+        printf '# Covers the shipped set only: build- and test-only dependencies are excluded.\n'
+        printf '# module\tversion\tlicense-path\turl\n'
+        LC_ALL=C sort -u "${tmp}"
+    } > "${URLS_OUTPUT}"
+    rm -f "${tmp}"
+
+    log "Wrote ${URLS_OUTPUT} ($(LC_ALL=C grep -vc '^#' "${URLS_OUTPUT}") verified URLs)"
+    exit 0
+}
+
+if [[ "${BASH_SOURCE[0]}" == "${0}" ]]; then
+    main "$@"
+fi

From 0693b17a21978ecfa3628dcae0648c3166189d32 Mon Sep 17 00:00:00 2001
From: Abrar Shivani <ashivani@nvidia.com>
Date: Mon, 24 Aug 2026 16:11:30 -0700
Subject: [PATCH 08/18] Check remote_sha's exit status, not just its output

curl piped into sha256sum hashes zero bytes to a fixed, valid-looking
constant on any transport failure -- a 404, a DNS error, a timeout, a
rate-limit. The match at the candidate loop compared only that string
against the vendored file's hash, so a failed fetch against a 0-byte
licence file would have read as a genuine match and written an URL
nothing ever verified. Gate the comparison on remote_sha's exit status
so a failed fetch is correctly treated as no match.

Signed-off-by: Abrar Shivani <ashivani@nvidia.com>
---
 tools/verify-license-urls.sh | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/tools/verify-license-urls.sh b/tools/verify-license-urls.sh
index ec8a6cd75..e2a6c0d55 100644
--- a/tools/verify-license-urls.sh
+++ b/tools/verify-license-urls.sh
@@ -169,11 +169,16 @@ main() {
             paths+=( "${path_in_module}" )
 
             found=""
-            local try_ref try_path candidate
+            local try_ref try_path candidate rsha
             for try_ref in "${refs[@]}"; do
                 for try_path in "${paths[@]}"; do
                     candidate="$(blob_url "${repo}" "${try_ref}" "${try_path}")"
-                    if [[ "$(remote_sha "${candidate}")" == "${want_sha}" ]]; then
+                    # remote_sha's own exit status must gate the match: curl
+                    # failing (404, DNS, timeout, rate-limit) yields no bytes,
+                    # and sha256 of no bytes is a real, fixed hash value — so
+                    # checking only the printed string would treat a failed
+                    # fetch as a match against any zero-byte vendored file.
+                    if rsha="$(remote_sha "${candidate}")" && [[ "${rsha}" == "${want_sha}" ]]; then
                         found="${candidate}"
                         break 2
                     fi

From 7d88bc685e7153222dce051169a060b019e9c5ac Mon Sep 17 00:00:00 2001
From: Abrar Shivani <ashivani@nvidia.com>
Date: Mon, 24 Aug 2026 16:18:31 -0700
Subject: [PATCH 09/18] Regenerate notices with verified upstream license links

The generator fails when a license file has no verified URL, so the
existing freshness gate also catches a bump that skipped the network
step. A scheduled job re-checks every link against the vendored bytes to
catch upstream retagging after the fact.

Signed-off-by: Abrar Shivani <ashivani@nvidia.com>
---
 .../workflows/third-party-notices-check.yaml  |   6 +-
 .../workflows/third-party-notices-links.yaml  |  61 ++
 THIRD_PARTY_NOTICES.md                        | 907 +++++++++++++-----
 tools/generate-third-party-notices.sh         |   7 +
 4 files changed, 730 insertions(+), 251 deletions(-)
 create mode 100644 .github/workflows/third-party-notices-links.yaml

diff --git a/.github/workflows/third-party-notices-check.yaml b/.github/workflows/third-party-notices-check.yaml
index 82410bc2f..111c3c1f0 100644
--- a/.github/workflows/third-party-notices-check.yaml
+++ b/.github/workflows/third-party-notices-check.yaml
@@ -13,7 +13,11 @@
 # limitations under the License.
 
 # Regenerates THIRD_PARTY_NOTICES.md and fails if it differs from the committed
-# copy, so a dependency change cannot land without refreshed attribution.
+# copy, so a dependency change cannot land without refreshed attribution. The
+# generator also fails when a license file has no verified URL in
+# tools/license-urls.tsv, which catches a bump that skipped
+# 'make third-party-notices-urls'. Link rot is caught separately by
+# third-party-notices-links.yaml.
 
 name: Third-Party Notices Check
 
diff --git a/.github/workflows/third-party-notices-links.yaml b/.github/workflows/third-party-notices-links.yaml
new file mode 100644
index 000000000..e15eb00d4
--- /dev/null
+++ b/.github/workflows/third-party-notices-links.yaml
@@ -0,0 +1,61 @@
+# Copyright NVIDIA CORPORATION
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# Re-verifies every license URL against the vendored bytes. Links are proven
+# correct when written, but upstream can retag, rename or archive a repository
+# afterwards, and no offline gate can see that. This runs on a schedule rather
+# than per pull request so link rot does not block unrelated work.
+
+name: Third-Party Notices Link Check
+
+on:
+  schedule:
+    - cron: '0 6 * * 1'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  verify-links:
+    runs-on: ubuntu-latest
+    timeout-minutes: 45
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
+
+      - name: Get Golang version
+        run: |
+          GOLANG_VERSION=$( grep "GOLANG_VERSION ?=" versions.mk )
+          echo "GOLANG_VERSION=${GOLANG_VERSION##GOLANG_VERSION ?= }" >> "${GITHUB_ENV}"
+
+      - name: Install Go
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7
+        with:
+          go-version: ${{ env.GOLANG_VERSION }}
+
+      - name: Re-verify every license URL
+        env:
+          URLS_OUTPUT: /tmp/license-urls-fresh.tsv
+        run: make install-tools && bash tools/verify-license-urls.sh
+
+      - name: Compare against the committed map
+        run: |
+          if ! diff -u <(LC_ALL=C grep -v '^#' tools/license-urls.tsv) \
+                       <(LC_ALL=C grep -v '^#' /tmp/license-urls-fresh.tsv); then
+            echo "::error::A license URL no longer serves the vendored bytes. Upstream may have retagged or moved."
+            exit 1
+          fi
diff --git a/THIRD_PARTY_NOTICES.md b/THIRD_PARTY_NOTICES.md
index 7e76f1248..705e86e2b 100644
--- a/THIRD_PARTY_NOTICES.md
+++ b/THIRD_PARTY_NOTICES.md
@@ -12,6 +12,13 @@ shipped; its dependencies are listed here as well rather than excluded. Go
 standard library packages are excluded; they are covered by the license of the
 Go distribution itself.
 
+Each dependency is listed with the module that owns it, the version
+redistributed, and a link to the license file in that version's upstream
+source. Every link was verified by fetching it and comparing its contents
+against the copy vendored here, so each one resolves to the same license text
+reproduced below. Dependencies vendored only to build or test the operator are
+not redistributed and are not listed.
+
 The `gpu-operator` image uses `nvcr.io/nvidia/distroless/cc` as a base image.
 All of the OSS packages and source included in this image can be found at
 <https://developer.nvidia.com/w/distroless-oss/index.html>. A statically
@@ -22,142 +29,145 @@ carry.
 
 ## Dependency Index
 
-| Package | License | Dependency |
-|---------|---------|------------|
-| `dario.cat/mergo` | BSD-3-Clause | `dario.cat/mergo` |
-| `github.com/MakeNowJust/heredoc` | MIT | `github.com/MakeNowJust/heredoc` |
-| `github.com/Masterminds/goutils` | Apache-2.0 | `github.com/Masterminds/goutils` |
-| `github.com/Masterminds/semver/v3` | MIT | `github.com/Masterminds/semver/v3` |
-| `github.com/Masterminds/sprig/v3` | MIT | `github.com/Masterminds/sprig/v3` |
-| `github.com/Mellanox/maintenance-operator/api/v1alpha1` | Apache-2.0 | `github.com/Mellanox/maintenance-operator/api` |
-| `github.com/NVIDIA/go-nvlib/pkg` | Apache-2.0 | `github.com/NVIDIA/go-nvlib` |
-| `github.com/NVIDIA/k8s-kata-manager/api/v1alpha1/config` | Apache-2.0 | `github.com/NVIDIA/k8s-kata-manager` |
-| `github.com/NVIDIA/k8s-operator-libs` | Apache-2.0 | `github.com/NVIDIA/k8s-operator-libs` |
-| `github.com/NVIDIA/nvidia-container-toolkit` | Apache-2.0 | `github.com/NVIDIA/nvidia-container-toolkit` |
-| `github.com/beorn7/perks/quantile` | MIT | `github.com/beorn7/perks` |
-| `github.com/blang/semver/v4` | MIT | `github.com/blang/semver/v4` |
-| `github.com/cespare/xxhash/v2` | MIT | `github.com/cespare/xxhash/v2` |
-| `github.com/chai2010/gettext-go` | BSD-3-Clause | `github.com/chai2010/gettext-go` |
-| `github.com/cyphar/filepath-securejoin` | BSD-3-Clause / MPL-2.0 | `github.com/cyphar/filepath-securejoin` |
-| `github.com/davecgh/go-spew/spew` | ISC | `github.com/davecgh/go-spew` |
-| `github.com/docker/libtrust` | Apache-2.0 | `github.com/docker/libtrust` |
-| `github.com/emicklei/go-restful/v3` | MIT | `github.com/emicklei/go-restful/v3` |
-| `github.com/evanphx/json-patch/v5` | BSD-3-Clause | `github.com/evanphx/json-patch/v5` |
-| `github.com/exponent-io/jsonpath` | MIT | `github.com/exponent-io/jsonpath` |
-| `github.com/fsnotify/fsnotify` | BSD-3-Clause | `github.com/fsnotify/fsnotify` |
-| `github.com/fxamacker/cbor/v2` | MIT | `github.com/fxamacker/cbor/v2` |
-| `github.com/go-errors/errors` | MIT | `github.com/go-errors/errors` |
-| `github.com/go-logr/logr` | Apache-2.0 | `github.com/go-logr/logr` |
-| `github.com/go-logr/zapr` | Apache-2.0 | `github.com/go-logr/zapr` |
-| `github.com/go-openapi/jsonpointer` | Apache-2.0 | `github.com/go-openapi/jsonpointer` |
-| `github.com/go-openapi/jsonreference` | Apache-2.0 | `github.com/go-openapi/jsonreference` |
-| `github.com/go-openapi/swag` | Apache-2.0 | `github.com/go-openapi/swag` |
-| `github.com/go-openapi/swag/cmdutils` | Apache-2.0 | `github.com/go-openapi/swag/cmdutils` |
-| `github.com/go-openapi/swag/conv` | Apache-2.0 | `github.com/go-openapi/swag/conv` |
-| `github.com/go-openapi/swag/fileutils` | Apache-2.0 | `github.com/go-openapi/swag/fileutils` |
-| `github.com/go-openapi/swag/jsonname` | Apache-2.0 | `github.com/go-openapi/swag/jsonname` |
-| `github.com/go-openapi/swag/jsonutils` | Apache-2.0 | `github.com/go-openapi/swag/jsonutils` |
-| `github.com/go-openapi/swag/loading` | Apache-2.0 | `github.com/go-openapi/swag/loading` |
-| `github.com/go-openapi/swag/mangling` | Apache-2.0 | `github.com/go-openapi/swag/mangling` |
-| `github.com/go-openapi/swag/netutils` | Apache-2.0 | `github.com/go-openapi/swag/netutils` |
-| `github.com/go-openapi/swag/stringutils` | Apache-2.0 | `github.com/go-openapi/swag/stringutils` |
-| `github.com/go-openapi/swag/typeutils` | Apache-2.0 | `github.com/go-openapi/swag/typeutils` |
-| `github.com/go-openapi/swag/yamlutils` | Apache-2.0 | `github.com/go-openapi/swag/yamlutils` |
-| `github.com/google/btree` | Apache-2.0 | `github.com/google/btree` |
-| `github.com/google/gnostic-models` | Apache-2.0 | `github.com/google/gnostic-models` |
-| `github.com/google/uuid` | BSD-3-Clause | `github.com/google/uuid` |
-| `github.com/huandu/xstrings` | MIT | `github.com/huandu/xstrings` |
-| `github.com/json-iterator/go` | MIT | `github.com/json-iterator/go` |
-| `github.com/klauspost/compress` | Apache-2.0 / BSD-3-Clause / MIT | `github.com/klauspost/compress` |
-| `github.com/klauspost/compress/internal/snapref` | BSD-3-Clause | `github.com/klauspost/compress` |
-| `github.com/klauspost/compress/zstd/internal/xxhash` | MIT | `github.com/klauspost/compress` |
-| `github.com/liggitt/tabwriter` | BSD-3-Clause | `github.com/liggitt/tabwriter` |
-| `github.com/mitchellh/copystructure` | MIT | `github.com/mitchellh/copystructure` |
-| `github.com/mitchellh/go-wordwrap` | MIT | `github.com/mitchellh/go-wordwrap` |
-| `github.com/mitchellh/reflectwalk` | MIT | `github.com/mitchellh/reflectwalk` |
-| `github.com/moby/term` | Apache-2.0 | `github.com/moby/term` |
-| `github.com/modern-go/concurrent` | Apache-2.0 | `github.com/modern-go/concurrent` |
-| `github.com/modern-go/reflect2` | Apache-2.0 | `github.com/modern-go/reflect2` |
-| `github.com/monochromegane/go-gitignore` | MIT | `github.com/monochromegane/go-gitignore` |
-| `github.com/munnerz/goautoneg` | BSD-3-Clause | `github.com/munnerz/goautoneg` |
-| `github.com/opencontainers/cgroups/devices/config` | Apache-2.0 | `github.com/opencontainers/cgroups` |
-| `github.com/opencontainers/go-digest` | Apache-2.0 | `github.com/opencontainers/go-digest` |
-| `github.com/opencontainers/runc/libcontainer/devices` | Apache-2.0 | `github.com/opencontainers/runc` |
-| `github.com/openshift/api` | Apache-2.0 | `github.com/openshift/api` |
-| `github.com/openshift/client-go` | Apache-2.0 | `github.com/openshift/client-go` |
-| `github.com/operator-framework/api/pkg` | Apache-2.0 | `github.com/operator-framework/api` |
-| `github.com/peterbourgon/diskv` | MIT | `github.com/peterbourgon/diskv` |
-| `github.com/pmezard/go-difflib/difflib` | BSD-3-Clause | `github.com/pmezard/go-difflib` |
-| `github.com/prometheus-operator/prometheus-operator/pkg/apis/monitoring` | Apache-2.0 | `github.com/prometheus-operator/prometheus-operator/pkg/apis/monitoring` |
-| `github.com/prometheus/client_golang/internal/github.com/golang/gddo/httputil` | BSD-3-Clause | `github.com/prometheus/client_golang` |
-| `github.com/prometheus/client_golang/prometheus` | Apache-2.0 | `github.com/prometheus/client_golang` |
-| `github.com/prometheus/client_model/go` | Apache-2.0 | `github.com/prometheus/client_model` |
-| `github.com/prometheus/common` | Apache-2.0 | `github.com/prometheus/common` |
-| `github.com/prometheus/procfs` | Apache-2.0 | `github.com/prometheus/procfs` |
-| `github.com/regclient/regclient` | Apache-2.0 | `github.com/regclient/regclient` |
-| `github.com/russross/blackfriday/v2` | BSD-2-Clause | `github.com/russross/blackfriday/v2` |
-| `github.com/shopspring/decimal` | MIT | `github.com/shopspring/decimal` |
-| `github.com/sirupsen/logrus` | MIT | `github.com/sirupsen/logrus` |
-| `github.com/spf13/cast` | MIT | `github.com/spf13/cast` |
-| `github.com/spf13/cobra` | Apache-2.0 | `github.com/spf13/cobra` |
-| `github.com/spf13/pflag` | BSD-3-Clause | `github.com/spf13/pflag` |
-| `github.com/stretchr/testify/assert/yaml` | MIT | `github.com/stretchr/testify` |
-| `github.com/ulikunitz/xz` | BSD-3-Clause | `github.com/ulikunitz/xz` |
-| `github.com/urfave/cli/v3` | MIT | `github.com/urfave/cli/v3` |
-| `github.com/x448/float16` | MIT | `github.com/x448/float16` |
-| `github.com/xlab/treeprint` | MIT | `github.com/xlab/treeprint` |
-| `go.uber.org/multierr` | MIT | `go.uber.org/multierr` |
-| `go.uber.org/zap` | MIT | `go.uber.org/zap` |
-| `go.yaml.in/yaml/v2` | Apache-2.0 | `go.yaml.in/yaml/v2` |
-| `go.yaml.in/yaml/v3` | MIT | `go.yaml.in/yaml/v3` |
-| `golang.org/x/crypto` | BSD-3-Clause | `golang.org/x/crypto` |
-| `golang.org/x/mod/semver` | BSD-3-Clause | `golang.org/x/mod` |
-| `golang.org/x/net` | BSD-3-Clause | `golang.org/x/net` |
-| `golang.org/x/oauth2` | BSD-3-Clause | `golang.org/x/oauth2` |
-| `golang.org/x/sync/errgroup` | BSD-3-Clause | `golang.org/x/sync` |
-| `golang.org/x/sys/unix` | BSD-3-Clause | `golang.org/x/sys` |
-| `golang.org/x/term` | BSD-3-Clause | `golang.org/x/term` |
-| `golang.org/x/text` | BSD-3-Clause | `golang.org/x/text` |
-| `golang.org/x/time/rate` | BSD-3-Clause | `golang.org/x/time` |
-| `gomodules.xyz/jsonpatch/v2` | Apache-2.0 | `gomodules.xyz/jsonpatch/v2` |
-| `google.golang.org/protobuf` | BSD-3-Clause | `google.golang.org/protobuf` |
-| `gopkg.in/evanphx/json-patch.v4` | BSD-3-Clause | `gopkg.in/evanphx/json-patch.v4` |
-| `gopkg.in/inf.v0` | BSD-3-Clause | `gopkg.in/inf.v0` |
-| `gopkg.in/yaml.v3` | MIT | `gopkg.in/yaml.v3` |
-| `k8s.io/api` | Apache-2.0 | `k8s.io/api` |
-| `k8s.io/apiextensions-apiserver/pkg` | Apache-2.0 | `k8s.io/apiextensions-apiserver` |
-| `k8s.io/apimachinery/pkg` | Apache-2.0 | `k8s.io/apimachinery` |
-| `k8s.io/apimachinery/third_party/forked/golang` | BSD-3-Clause | `k8s.io/apimachinery` |
-| `k8s.io/cli-runtime/pkg` | Apache-2.0 | `k8s.io/cli-runtime` |
-| `k8s.io/client-go` | Apache-2.0 | `k8s.io/client-go` |
-| `k8s.io/client-go/third_party/forked/golang/template` | BSD-3-Clause | `k8s.io/client-go` |
-| `k8s.io/client-go/third_party/forked/httpcache` | MIT | `k8s.io/client-go` |
-| `k8s.io/component-base/version` | Apache-2.0 | `k8s.io/component-base` |
-| `k8s.io/klog/v2` | Apache-2.0 | `k8s.io/klog/v2` |
-| `k8s.io/kube-openapi/pkg` | Apache-2.0 | `k8s.io/kube-openapi` |
-| `k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json` | BSD-3-Clause | `k8s.io/kube-openapi` |
-| `k8s.io/kube-openapi/pkg/validation/spec` | Apache-2.0 | `k8s.io/kube-openapi` |
-| `k8s.io/kubectl/pkg` | Apache-2.0 | `k8s.io/kubectl` |
-| `k8s.io/utils` | Apache-2.0 | `k8s.io/utils` |
-| `k8s.io/utils/internal/third_party/forked/golang` | BSD-3-Clause | `k8s.io/utils` |
-| `k8s.io/utils/third_party/forked/golang/btree` | Apache-2.0 | `k8s.io/utils` |
-| `sigs.k8s.io/controller-runtime` | Apache-2.0 | `sigs.k8s.io/controller-runtime` |
-| `sigs.k8s.io/json` | Apache-2.0 / BSD-3-Clause | `sigs.k8s.io/json` |
-| `sigs.k8s.io/kustomize/api` | Apache-2.0 | `sigs.k8s.io/kustomize/api` |
-| `sigs.k8s.io/kustomize/kyaml` | Apache-2.0 | `sigs.k8s.io/kustomize/kyaml` |
-| `sigs.k8s.io/randfill` | Apache-2.0 | `sigs.k8s.io/randfill` |
-| `sigs.k8s.io/structured-merge-diff/v6` | Apache-2.0 | `sigs.k8s.io/structured-merge-diff/v6` |
-| `sigs.k8s.io/yaml` | Apache-2.0 / BSD-3-Clause / MIT | `sigs.k8s.io/yaml` |
+| Package | Module | Version | License | Location |
+|---------|--------|---------|---------|----------|
+| `dario.cat/mergo` | `dario.cat/mergo` | v1.0.1 | BSD-3-Clause | [LICENSE](https://github.com/imdario/mergo/blob/v1.0.1/LICENSE) |
+| `github.com/MakeNowJust/heredoc` | `github.com/MakeNowJust/heredoc` | v1.0.0 | MIT | [LICENSE](https://github.com/makenowjust/heredoc/blob/v1.0.0/LICENSE) |
+| `github.com/Masterminds/goutils` | `github.com/Masterminds/goutils` | v1.1.1 | Apache-2.0 | [LICENSE.txt](https://github.com/Masterminds/goutils/blob/v1.1.1/LICENSE.txt) |
+| `github.com/Masterminds/semver/v3` | `github.com/Masterminds/semver/v3` | v3.5.0 | MIT | [LICENSE.txt](https://github.com/Masterminds/semver/blob/v3.5.0/LICENSE.txt) |
+| `github.com/Masterminds/sprig/v3` | `github.com/Masterminds/sprig/v3` | v3.3.0 | MIT | [LICENSE.txt](https://github.com/Masterminds/sprig/blob/v3.3.0/LICENSE.txt) |
+| `github.com/Mellanox/maintenance-operator/api/v1alpha1` | `github.com/Mellanox/maintenance-operator/api` | v0.3.0 | Apache-2.0 | [LICENSE](https://github.com/Mellanox/maintenance-operator/blob/api/v0.3.0/LICENSE) |
+| `github.com/NVIDIA/go-nvlib/pkg` | `github.com/NVIDIA/go-nvlib` | v0.12.0 | Apache-2.0 | [LICENSE](https://github.com/NVIDIA/go-nvlib/blob/v0.12.0/LICENSE) / [NOTICE](https://github.com/NVIDIA/go-nvlib/blob/v0.12.0/NOTICE) |
+| `github.com/NVIDIA/k8s-kata-manager/api/v1alpha1/config` | `github.com/NVIDIA/k8s-kata-manager` | v0.2.3 | Apache-2.0 | [LICENSE](https://github.com/NVIDIA/k8s-kata-manager/blob/v0.2.3/LICENSE) |
+| `github.com/NVIDIA/k8s-operator-libs` | `github.com/NVIDIA/k8s-operator-libs` | v0.0.0-20260629200812-d720f2557494 | Apache-2.0 | [LICENSE](https://github.com/NVIDIA/k8s-operator-libs/blob/d720f2557494/LICENSE) |
+| `github.com/NVIDIA/nvidia-container-toolkit` | `github.com/NVIDIA/nvidia-container-toolkit` | v1.20.0 | Apache-2.0 | [LICENSE](https://github.com/NVIDIA/nvidia-container-toolkit/blob/v1.20.0/LICENSE) |
+| `github.com/beorn7/perks/quantile` | `github.com/beorn7/perks` | v1.0.1 | MIT | [LICENSE](https://github.com/beorn7/perks/blob/v1.0.1/LICENSE) |
+| `github.com/blang/semver/v4` | `github.com/blang/semver/v4` | v4.0.0 | MIT | [LICENSE](https://github.com/blang/semver/blob/v4.0.0/LICENSE) |
+| `github.com/cespare/xxhash/v2` | `github.com/cespare/xxhash/v2` | v2.3.0 | MIT | [LICENSE.txt](https://github.com/cespare/xxhash/blob/v2.3.0/LICENSE.txt) |
+| `github.com/chai2010/gettext-go` | `github.com/chai2010/gettext-go` | v1.0.2 | BSD-3-Clause | [LICENSE](https://github.com/chai2010/gettext-go/blob/v1.0.2/LICENSE) |
+| `github.com/cyphar/filepath-securejoin` | `github.com/cyphar/filepath-securejoin` | v0.7.0 | BSD-3-Clause / MPL-2.0 | [COPYING.md](https://github.com/cyphar/filepath-securejoin/blob/v0.7.0/COPYING.md) / [LICENSE.BSD](https://github.com/cyphar/filepath-securejoin/blob/v0.7.0/LICENSE.BSD) / [LICENSE.MPL-2.0](https://github.com/cyphar/filepath-securejoin/blob/v0.7.0/LICENSE.MPL-2.0) |
+| `github.com/davecgh/go-spew/spew` | `github.com/davecgh/go-spew` | v1.1.2-0.20180830191138-d8f796af33cc | ISC | [LICENSE](https://github.com/davecgh/go-spew/blob/d8f796af33cc/LICENSE) |
+| `github.com/docker/libtrust` | `github.com/docker/libtrust` | v0.0.0-20160708172513-aabc10ec26b7 | Apache-2.0 | [LICENSE](https://github.com/docker-archive-public/docker.libtrust/blob/aabc10ec26b7/LICENSE) |
+| `github.com/emicklei/go-restful/v3` | `github.com/emicklei/go-restful/v3` | v3.13.0 | MIT | [LICENSE](https://github.com/emicklei/go-restful/blob/v3.13.0/LICENSE) |
+| `github.com/evanphx/json-patch/v5` | `github.com/evanphx/json-patch/v5` | v5.9.11 | BSD-3-Clause | [LICENSE](https://github.com/evanphx/json-patch/blob/v5.9.11/LICENSE) |
+| `github.com/exponent-io/jsonpath` | `github.com/exponent-io/jsonpath` | v0.0.0-20210407135951-1de76d718b3f | MIT | [LICENSE](https://github.com/exponent-io/jsonpath/blob/1de76d718b3f/LICENSE) |
+| `github.com/fsnotify/fsnotify` | `github.com/fsnotify/fsnotify` | v1.9.0 | BSD-3-Clause | [LICENSE](https://github.com/fsnotify/fsnotify/blob/v1.9.0/LICENSE) |
+| `github.com/fxamacker/cbor/v2` | `github.com/fxamacker/cbor/v2` | v2.9.2 | MIT | [LICENSE](https://github.com/fxamacker/cbor/blob/v2.9.2/LICENSE) |
+| `github.com/go-errors/errors` | `github.com/go-errors/errors` | v1.5.1 | MIT | [LICENSE.MIT](https://github.com/go-errors/errors/blob/v1.5.1/LICENSE.MIT) |
+| `github.com/go-logr/logr` | `github.com/go-logr/logr` | v1.4.4 | Apache-2.0 | [LICENSE](https://github.com/go-logr/logr/blob/v1.4.4/LICENSE) |
+| `github.com/go-logr/zapr` | `github.com/go-logr/zapr` | v1.3.0 | Apache-2.0 | [LICENSE](https://github.com/go-logr/zapr/blob/v1.3.0/LICENSE) |
+| `github.com/go-openapi/jsonpointer` | `github.com/go-openapi/jsonpointer` | v0.22.4 | Apache-2.0 | [LICENSE](https://github.com/go-openapi/jsonpointer/blob/v0.22.4/LICENSE) / [NOTICE](https://github.com/go-openapi/jsonpointer/blob/v0.22.4/NOTICE) |
+| `github.com/go-openapi/jsonreference` | `github.com/go-openapi/jsonreference` | v0.21.4 | Apache-2.0 | [LICENSE](https://github.com/go-openapi/jsonreference/blob/v0.21.4/LICENSE) / [NOTICE](https://github.com/go-openapi/jsonreference/blob/v0.21.4/NOTICE) |
+| `github.com/go-openapi/swag` | `github.com/go-openapi/swag` | v0.25.4 | Apache-2.0 | [LICENSE](https://github.com/go-openapi/swag/blob/v0.25.4/LICENSE) |
+| `github.com/go-openapi/swag/cmdutils` | `github.com/go-openapi/swag/cmdutils` | v0.25.4 | Apache-2.0 | [LICENSE](https://github.com/go-openapi/swag/blob/cmdutils/v0.25.4/LICENSE) |
+| `github.com/go-openapi/swag/conv` | `github.com/go-openapi/swag/conv` | v0.25.4 | Apache-2.0 | [LICENSE](https://github.com/go-openapi/swag/blob/conv/v0.25.4/LICENSE) |
+| `github.com/go-openapi/swag/fileutils` | `github.com/go-openapi/swag/fileutils` | v0.25.4 | Apache-2.0 | [LICENSE](https://github.com/go-openapi/swag/blob/fileutils/v0.25.4/LICENSE) |
+| `github.com/go-openapi/swag/jsonname` | `github.com/go-openapi/swag/jsonname` | v0.25.4 | Apache-2.0 | [LICENSE](https://github.com/go-openapi/swag/blob/jsonname/v0.25.4/LICENSE) |
+| `github.com/go-openapi/swag/jsonutils` | `github.com/go-openapi/swag/jsonutils` | v0.25.4 | Apache-2.0 | [LICENSE](https://github.com/go-openapi/swag/blob/jsonutils/v0.25.4/LICENSE) |
+| `github.com/go-openapi/swag/loading` | `github.com/go-openapi/swag/loading` | v0.25.4 | Apache-2.0 | [LICENSE](https://github.com/go-openapi/swag/blob/loading/v0.25.4/LICENSE) |
+| `github.com/go-openapi/swag/mangling` | `github.com/go-openapi/swag/mangling` | v0.25.4 | Apache-2.0 | [LICENSE](https://github.com/go-openapi/swag/blob/mangling/v0.25.4/LICENSE) |
+| `github.com/go-openapi/swag/netutils` | `github.com/go-openapi/swag/netutils` | v0.25.4 | Apache-2.0 | [LICENSE](https://github.com/go-openapi/swag/blob/netutils/v0.25.4/LICENSE) |
+| `github.com/go-openapi/swag/stringutils` | `github.com/go-openapi/swag/stringutils` | v0.25.4 | Apache-2.0 | [LICENSE](https://github.com/go-openapi/swag/blob/stringutils/v0.25.4/LICENSE) |
+| `github.com/go-openapi/swag/typeutils` | `github.com/go-openapi/swag/typeutils` | v0.25.4 | Apache-2.0 | [LICENSE](https://github.com/go-openapi/swag/blob/typeutils/v0.25.4/LICENSE) |
+| `github.com/go-openapi/swag/yamlutils` | `github.com/go-openapi/swag/yamlutils` | v0.25.4 | Apache-2.0 | [LICENSE](https://github.com/go-openapi/swag/blob/yamlutils/v0.25.4/LICENSE) |
+| `github.com/google/btree` | `github.com/google/btree` | v1.1.3 | Apache-2.0 | [LICENSE](https://github.com/google/btree/blob/v1.1.3/LICENSE) |
+| `github.com/google/gnostic-models` | `github.com/google/gnostic-models` | v0.7.1 | Apache-2.0 | [LICENSE](https://github.com/google/gnostic-models/blob/v0.7.1/LICENSE) |
+| `github.com/google/uuid` | `github.com/google/uuid` | v1.6.0 | BSD-3-Clause | [LICENSE](https://github.com/google/uuid/blob/v1.6.0/LICENSE) |
+| `github.com/huandu/xstrings` | `github.com/huandu/xstrings` | v1.5.0 | MIT | [LICENSE](https://github.com/huandu/xstrings/blob/v1.5.0/LICENSE) |
+| `github.com/json-iterator/go` | `github.com/json-iterator/go` | v1.1.12 | MIT | [LICENSE](https://github.com/json-iterator/go/blob/v1.1.12/LICENSE) |
+| `github.com/klauspost/compress` | `github.com/klauspost/compress` | v1.19.1 | Apache-2.0 / BSD-3-Clause / MIT | [LICENSE](https://github.com/klauspost/compress/blob/v1.19.1/LICENSE) |
+| `github.com/klauspost/compress/internal/snapref` | `github.com/klauspost/compress` | v1.19.1 | BSD-3-Clause | [LICENSE](https://github.com/klauspost/compress/blob/v1.19.1/internal/snapref/LICENSE) |
+| `github.com/klauspost/compress/zstd/internal/xxhash` | `github.com/klauspost/compress` | v1.19.1 | MIT | [LICENSE.txt](https://github.com/klauspost/compress/blob/v1.19.1/zstd/internal/xxhash/LICENSE.txt) |
+| `github.com/liggitt/tabwriter` | `github.com/liggitt/tabwriter` | v0.0.0-20181228230101-89fcab3d43de | BSD-3-Clause | [LICENSE](https://github.com/liggitt/tabwriter/blob/89fcab3d43de/LICENSE) |
+| `github.com/mitchellh/copystructure` | `github.com/mitchellh/copystructure` | v1.2.0 | MIT | [LICENSE](https://github.com/mitchellh/copystructure/blob/v1.2.0/LICENSE) |
+| `github.com/mitchellh/go-wordwrap` | `github.com/mitchellh/go-wordwrap` | v1.0.1 | MIT | [LICENSE.md](https://github.com/mitchellh/go-wordwrap/blob/v1.0.1/LICENSE.md) |
+| `github.com/mitchellh/reflectwalk` | `github.com/mitchellh/reflectwalk` | v1.0.2 | MIT | [LICENSE](https://github.com/mitchellh/reflectwalk/blob/v1.0.2/LICENSE) |
+| `github.com/moby/term` | `github.com/moby/term` | v0.5.2 | Apache-2.0 | [LICENSE](https://github.com/moby/term/blob/v0.5.2/LICENSE) |
+| `github.com/modern-go/concurrent` | `github.com/modern-go/concurrent` | v0.0.0-20180306012644-bacd9c7ef1dd | Apache-2.0 | [LICENSE](https://github.com/modern-go/concurrent/blob/bacd9c7ef1dd/LICENSE) |
+| `github.com/modern-go/reflect2` | `github.com/modern-go/reflect2` | v1.0.3-0.20250322232337-35a7c28c31ee | Apache-2.0 | [LICENSE](https://github.com/modern-go/reflect2/blob/35a7c28c31ee/LICENSE) |
+| `github.com/monochromegane/go-gitignore` | `github.com/monochromegane/go-gitignore` | v0.0.0-20200626010858-205db1a8cc00 | MIT | [LICENSE](https://github.com/monochromegane/go-gitignore/blob/205db1a8cc00/LICENSE) |
+| `github.com/munnerz/goautoneg` | `github.com/munnerz/goautoneg` | v0.0.0-20191010083416-a7dc8b61c822 | BSD-3-Clause | [LICENSE](https://github.com/munnerz/goautoneg/blob/a7dc8b61c822/LICENSE) |
+| `github.com/opencontainers/cgroups/devices/config` | `github.com/opencontainers/cgroups` | v0.0.7 | Apache-2.0 | [LICENSE](https://github.com/opencontainers/cgroups/blob/v0.0.7/LICENSE) |
+| `github.com/opencontainers/go-digest` | `github.com/opencontainers/go-digest` | v1.0.0 | Apache-2.0 | [LICENSE](https://github.com/opencontainers/go-digest/blob/v1.0.0/LICENSE) |
+| `github.com/opencontainers/runc/libcontainer/devices` | `github.com/opencontainers/runc` | v1.4.3 | Apache-2.0 | [LICENSE](https://github.com/opencontainers/runc/blob/v1.4.3/LICENSE) / [NOTICE](https://github.com/opencontainers/runc/blob/v1.4.3/NOTICE) |
+| `github.com/openshift/api` | `github.com/openshift/api` | v0.0.0-20260727141720-967cc4c36c9b | Apache-2.0 | [LICENSE](https://github.com/openshift/api/blob/967cc4c36c9b/LICENSE) |
+| `github.com/openshift/client-go` | `github.com/openshift/client-go` | v0.0.0-20260723174158-ae2315de9d73 | Apache-2.0 | [LICENSE](https://github.com/openshift/client-go/blob/ae2315de9d73/LICENSE) |
+| `github.com/operator-framework/api/pkg` | `github.com/operator-framework/api` | v0.45.0 | Apache-2.0 | [LICENSE](https://github.com/operator-framework/api/blob/v0.45.0/LICENSE) |
+| `github.com/peterbourgon/diskv` | `github.com/peterbourgon/diskv` | v2.0.1+incompatible | MIT | [LICENSE](https://github.com/peterbourgon/diskv/blob/v2.0.1/LICENSE) |
+| `github.com/pmezard/go-difflib/difflib` | `github.com/pmezard/go-difflib` | v1.0.1-0.20181226105442-5d4384ee4fb2 | BSD-3-Clause | [LICENSE](https://github.com/pmezard/go-difflib/blob/5d4384ee4fb2/LICENSE) |
+| `github.com/prometheus-operator/prometheus-operator/pkg/apis/monitoring` | `github.com/prometheus-operator/prometheus-operator/pkg/apis/monitoring` | v0.93.1 | Apache-2.0 | [LICENSE](https://github.com/prometheus-operator/prometheus-operator/blob/pkg/apis/monitoring/v0.93.1/LICENSE) |
+| `github.com/prometheus/client_golang/internal/github.com/golang/gddo/httputil` | `github.com/prometheus/client_golang` | v1.24.1 | BSD-3-Clause | [LICENSE](https://github.com/prometheus/client_golang/blob/v1.24.1/internal/github.com/golang/gddo/LICENSE) |
+| `github.com/prometheus/client_golang/prometheus` | `github.com/prometheus/client_golang` | v1.24.1 | Apache-2.0 | [LICENSE](https://github.com/prometheus/client_golang/blob/v1.24.1/LICENSE) / [NOTICE](https://github.com/prometheus/client_golang/blob/v1.24.1/NOTICE) |
+| `github.com/prometheus/client_model/go` | `github.com/prometheus/client_model` | v0.6.2 | Apache-2.0 | [LICENSE](https://github.com/prometheus/client_model/blob/v0.6.2/LICENSE) / [NOTICE](https://github.com/prometheus/client_model/blob/v0.6.2/NOTICE) |
+| `github.com/prometheus/common` | `github.com/prometheus/common` | v0.70.1 | Apache-2.0 | [LICENSE](https://github.com/prometheus/common/blob/v0.70.1/LICENSE) / [NOTICE](https://github.com/prometheus/common/blob/v0.70.1/NOTICE) |
+| `github.com/prometheus/procfs` | `github.com/prometheus/procfs` | v0.21.1 | Apache-2.0 | [LICENSE](https://github.com/prometheus/procfs/blob/v0.21.1/LICENSE) / [NOTICE](https://github.com/prometheus/procfs/blob/v0.21.1/NOTICE) |
+| `github.com/regclient/regclient` | `github.com/regclient/regclient` | v0.11.5 | Apache-2.0 | [LICENSE](https://github.com/regclient/regclient/blob/v0.11.5/LICENSE) |
+| `github.com/russross/blackfriday/v2` | `github.com/russross/blackfriday/v2` | v2.1.0 | BSD-2-Clause | [LICENSE.txt](https://github.com/russross/blackfriday/blob/v2.1.0/LICENSE.txt) |
+| `github.com/shopspring/decimal` | `github.com/shopspring/decimal` | v1.4.0 | MIT | [LICENSE](https://github.com/shopspring/decimal/blob/v1.4.0/LICENSE) |
+| `github.com/sirupsen/logrus` | `github.com/sirupsen/logrus` | v1.10.1 | MIT | [LICENSE](https://github.com/sirupsen/logrus/blob/v1.10.1/LICENSE) |
+| `github.com/spf13/cast` | `github.com/spf13/cast` | v1.7.0 | MIT | [LICENSE](https://github.com/spf13/cast/blob/v1.7.0/LICENSE) |
+| `github.com/spf13/cobra` | `github.com/spf13/cobra` | v1.10.2 | Apache-2.0 | [LICENSE.txt](https://github.com/spf13/cobra/blob/v1.10.2/LICENSE.txt) |
+| `github.com/spf13/pflag` | `github.com/spf13/pflag` | v1.0.10 | BSD-3-Clause | [LICENSE](https://github.com/spf13/pflag/blob/v1.0.10/LICENSE) |
+| `github.com/stretchr/testify/assert/yaml` | `github.com/stretchr/testify` | v1.12.0 | MIT | [LICENSE](https://github.com/stretchr/testify/blob/v1.12.0/LICENSE) |
+| `github.com/ulikunitz/xz` | `github.com/ulikunitz/xz` | v0.5.15 | BSD-3-Clause | [LICENSE](https://github.com/ulikunitz/xz/blob/v0.5.15/LICENSE) |
+| `github.com/urfave/cli/v3` | `github.com/urfave/cli/v3` | v3.10.1 | MIT | [LICENSE](https://github.com/urfave/cli/blob/v3.10.1/LICENSE) |
+| `github.com/x448/float16` | `github.com/x448/float16` | v0.8.4 | MIT | [LICENSE](https://github.com/x448/float16/blob/v0.8.4/LICENSE) |
+| `github.com/xlab/treeprint` | `github.com/xlab/treeprint` | v1.2.0 | MIT | [LICENSE](https://github.com/xlab/treeprint/blob/v1.2.0/LICENSE) |
+| `go.uber.org/multierr` | `go.uber.org/multierr` | v1.11.0 | MIT | [LICENSE.txt](https://github.com/uber-go/multierr/blob/v1.11.0/LICENSE.txt) |
+| `go.uber.org/zap` | `go.uber.org/zap` | v1.28.0 | MIT | [LICENSE](https://github.com/uber-go/zap/blob/v1.28.0/LICENSE) |
+| `go.yaml.in/yaml/v2` | `go.yaml.in/yaml/v2` | v2.4.4 | Apache-2.0 | [LICENSE](https://github.com/yaml/go-yaml/blob/v2.4.4/LICENSE) / [NOTICE](https://github.com/yaml/go-yaml/blob/v2.4.4/NOTICE) |
+| `go.yaml.in/yaml/v3` | `go.yaml.in/yaml/v3` | v3.0.4 | MIT | [LICENSE](https://github.com/yaml/go-yaml/blob/v3.0.4/LICENSE) / [NOTICE](https://github.com/yaml/go-yaml/blob/v3.0.4/NOTICE) |
+| `golang.org/x/crypto` | `golang.org/x/crypto` | v0.55.0 | BSD-3-Clause | [LICENSE](https://go.googlesource.com/crypto/+/refs/tags/v0.55.0/LICENSE) |
+| `golang.org/x/mod/semver` | `golang.org/x/mod` | v0.40.0 | BSD-3-Clause | [LICENSE](https://go.googlesource.com/mod/+/refs/tags/v0.40.0/LICENSE) |
+| `golang.org/x/net` | `golang.org/x/net` | v0.58.0 | BSD-3-Clause | [LICENSE](https://go.googlesource.com/net/+/refs/tags/v0.58.0/LICENSE) |
+| `golang.org/x/oauth2` | `golang.org/x/oauth2` | v0.36.0 | BSD-3-Clause | [LICENSE](https://go.googlesource.com/oauth2/+/refs/tags/v0.36.0/LICENSE) |
+| `golang.org/x/sync/errgroup` | `golang.org/x/sync` | v0.22.0 | BSD-3-Clause | [LICENSE](https://go.googlesource.com/sync/+/refs/tags/v0.22.0/LICENSE) |
+| `golang.org/x/sys/unix` | `golang.org/x/sys` | v0.47.0 | BSD-3-Clause | [LICENSE](https://go.googlesource.com/sys/+/refs/tags/v0.47.0/LICENSE) |
+| `golang.org/x/term` | `golang.org/x/term` | v0.45.0 | BSD-3-Clause | [LICENSE](https://go.googlesource.com/term/+/refs/tags/v0.45.0/LICENSE) |
+| `golang.org/x/text` | `golang.org/x/text` | v0.41.0 | BSD-3-Clause | [LICENSE](https://go.googlesource.com/text/+/refs/tags/v0.41.0/LICENSE) |
+| `golang.org/x/time/rate` | `golang.org/x/time` | v0.14.0 | BSD-3-Clause | [LICENSE](https://go.googlesource.com/time/+/refs/tags/v0.14.0/LICENSE) |
+| `gomodules.xyz/jsonpatch/v2` | `gomodules.xyz/jsonpatch/v2` | v2.4.0 | Apache-2.0 | [LICENSE](https://github.com/gomodules/jsonpatch/blob/v2.4.0/LICENSE) |
+| `google.golang.org/protobuf` | `google.golang.org/protobuf` | v1.36.12-0.20260120151049-f2248ac996af | BSD-3-Clause | [LICENSE](https://go.googlesource.com/protobuf/+/f2248ac996af/LICENSE) |
+| `gopkg.in/evanphx/json-patch.v4` | `gopkg.in/evanphx/json-patch.v4` | v4.13.0 | BSD-3-Clause | [LICENSE](https://github.com/evanphx/json-patch/blob/v4.13.0/LICENSE) |
+| `gopkg.in/inf.v0` | `gopkg.in/inf.v0` | v0.9.1 | BSD-3-Clause | [LICENSE](https://github.com/go-inf/inf/blob/v0.9.1/LICENSE) |
+| `gopkg.in/yaml.v3` | `gopkg.in/yaml.v3` | v3.0.1 | MIT | [LICENSE](https://github.com/go-yaml/yaml/blob/v3.0.1/LICENSE) / [NOTICE](https://github.com/go-yaml/yaml/blob/v3.0.1/NOTICE) |
+| `k8s.io/api` | `k8s.io/api` | v0.36.4 | Apache-2.0 | [LICENSE](https://github.com/kubernetes/api/blob/v0.36.4/LICENSE) |
+| `k8s.io/apiextensions-apiserver/pkg` | `k8s.io/apiextensions-apiserver` | v0.36.4 | Apache-2.0 | [LICENSE](https://github.com/kubernetes/apiextensions-apiserver/blob/v0.36.4/LICENSE) |
+| `k8s.io/apimachinery/pkg` | `k8s.io/apimachinery` | v0.36.4 | Apache-2.0 | [LICENSE](https://github.com/kubernetes/apimachinery/blob/v0.36.4/LICENSE) |
+| `k8s.io/apimachinery/third_party/forked/golang` | `k8s.io/apimachinery` | v0.36.4 | BSD-3-Clause | [LICENSE](https://github.com/kubernetes/apimachinery/blob/v0.36.4/third_party/forked/golang/LICENSE) |
+| `k8s.io/cli-runtime/pkg` | `k8s.io/cli-runtime` | v0.36.0 | Apache-2.0 | [LICENSE](https://github.com/kubernetes/cli-runtime/blob/v0.36.0/LICENSE) |
+| `k8s.io/client-go` | `k8s.io/client-go` | v0.36.4 | Apache-2.0 | [LICENSE](https://github.com/kubernetes/client-go/blob/v0.36.4/LICENSE) |
+| `k8s.io/client-go/third_party/forked/golang/template` | `k8s.io/client-go` | v0.36.4 | BSD-3-Clause | [LICENSE](https://github.com/kubernetes/client-go/blob/v0.36.4/third_party/forked/golang/LICENSE) |
+| `k8s.io/client-go/third_party/forked/httpcache` | `k8s.io/client-go` | v0.36.4 | MIT | [LICENSE](https://github.com/kubernetes/client-go/blob/v0.36.4/third_party/forked/httpcache/LICENSE) |
+| `k8s.io/component-base/version` | `k8s.io/component-base` | v0.36.4 | Apache-2.0 | [LICENSE](https://github.com/kubernetes/component-base/blob/v0.36.4/LICENSE) |
+| `k8s.io/klog/v2` | `k8s.io/klog/v2` | v2.140.0 | Apache-2.0 | [LICENSE](https://github.com/kubernetes/klog/blob/v2.140.0/LICENSE) |
+| `k8s.io/kube-openapi/pkg` | `k8s.io/kube-openapi` | v0.0.0-20260603220949-865597e52e25 | Apache-2.0 | [LICENSE](https://github.com/kubernetes/kube-openapi/blob/865597e52e25/LICENSE) |
+| `k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json` | `k8s.io/kube-openapi` | v0.0.0-20260603220949-865597e52e25 | BSD-3-Clause | [LICENSE](https://github.com/kubernetes/kube-openapi/blob/865597e52e25/pkg/internal/third_party/go-json-experiment/json/LICENSE) |
+| `k8s.io/kube-openapi/pkg/validation/spec` | `k8s.io/kube-openapi` | v0.0.0-20260603220949-865597e52e25 | Apache-2.0 | [LICENSE](https://github.com/kubernetes/kube-openapi/blob/865597e52e25/pkg/validation/spec/LICENSE) |
+| `k8s.io/kubectl/pkg` | `k8s.io/kubectl` | v0.36.0 | Apache-2.0 | [LICENSE](https://github.com/kubernetes/kubectl/blob/v0.36.0/LICENSE) |
+| `k8s.io/utils` | `k8s.io/utils` | v0.0.0-20260507154919-ff6756f316d2 | Apache-2.0 | [LICENSE](https://github.com/kubernetes/utils/blob/ff6756f316d2/LICENSE) |
+| `k8s.io/utils/internal/third_party/forked/golang` | `k8s.io/utils` | v0.0.0-20260507154919-ff6756f316d2 | BSD-3-Clause | [LICENSE](https://github.com/kubernetes/utils/blob/ff6756f316d2/internal/third_party/forked/golang/LICENSE) |
+| `k8s.io/utils/third_party/forked/golang/btree` | `k8s.io/utils` | v0.0.0-20260507154919-ff6756f316d2 | Apache-2.0 | [LICENSE](https://github.com/kubernetes/utils/blob/ff6756f316d2/third_party/forked/golang/btree/LICENSE) |
+| `sigs.k8s.io/controller-runtime` | `sigs.k8s.io/controller-runtime` | v0.24.1 | Apache-2.0 | [LICENSE](https://github.com/kubernetes-sigs/controller-runtime/blob/v0.24.1/LICENSE) |
+| `sigs.k8s.io/json` | `sigs.k8s.io/json` | v0.0.0-20250730193827-2d320260d730 | Apache-2.0 / BSD-3-Clause | [LICENSE](https://github.com/kubernetes-sigs/json/blob/2d320260d730/LICENSE) |
+| `sigs.k8s.io/kustomize/api` | `sigs.k8s.io/kustomize/api` | v0.21.1 | Apache-2.0 | [LICENSE](https://github.com/kubernetes-sigs/kustomize/blob/api/v0.21.1/LICENSE) |
+| `sigs.k8s.io/kustomize/kyaml` | `sigs.k8s.io/kustomize/kyaml` | v0.21.1 | Apache-2.0 | [LICENSE](https://github.com/kubernetes-sigs/kustomize/blob/kyaml/v0.21.1/LICENSE) |
+| `sigs.k8s.io/randfill` | `sigs.k8s.io/randfill` | v1.0.0 | Apache-2.0 | [LICENSE](https://github.com/kubernetes-sigs/randfill/blob/v1.0.0/LICENSE) / [NOTICE](https://github.com/kubernetes-sigs/randfill/blob/v1.0.0/NOTICE) |
+| `sigs.k8s.io/structured-merge-diff/v6` | `sigs.k8s.io/structured-merge-diff/v6` | v6.4.0 | Apache-2.0 | [LICENSE](https://github.com/kubernetes-sigs/structured-merge-diff/blob/v6.4.0/LICENSE) |
+| `sigs.k8s.io/yaml` | `sigs.k8s.io/yaml` | v1.6.0 | Apache-2.0 / BSD-3-Clause / MIT | [LICENSE](https://github.com/kubernetes-sigs/yaml/blob/v1.6.0/LICENSE) |
 
 ## License Texts
 
 ### dario.cat/mergo
 
-* License: BSD-3-Clause
 * Module: dario.cat/mergo
+* Version: v1.0.1
+* License: BSD-3-Clause
 
 #### LICENSE
 
+<https://github.com/imdario/mergo/blob/v1.0.1/LICENSE>
+
 ```text
 Copyright (c) 2013 Dario Castañé. All rights reserved.
 Copyright (c) 2012 The Go Authors. All rights reserved.
@@ -193,11 +203,14 @@ OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
 ### github.com/MakeNowJust/heredoc
 
-* License: MIT
 * Module: github.com/MakeNowJust/heredoc
+* Version: v1.0.0
+* License: MIT
 
 #### LICENSE
 
+<https://github.com/makenowjust/heredoc/blob/v1.0.0/LICENSE>
+
 ```text
 The MIT License (MIT)
 
@@ -226,11 +239,14 @@ THE SOFTWARE.
 
 ### github.com/Masterminds/goutils
 
-* License: Apache-2.0
 * Module: github.com/Masterminds/goutils
+* Version: v1.1.1
+* License: Apache-2.0
 
 #### LICENSE.txt
 
+<https://github.com/Masterminds/goutils/blob/v1.1.1/LICENSE.txt>
+
 ```text
 
                                  Apache License
@@ -440,11 +456,14 @@ THE SOFTWARE.
 
 ### github.com/Masterminds/semver/v3
 
-* License: MIT
 * Module: github.com/Masterminds/semver/v3
+* Version: v3.5.0
+* License: MIT
 
 #### LICENSE.txt
 
+<https://github.com/Masterminds/semver/blob/v3.5.0/LICENSE.txt>
+
 ```text
 Copyright (C) 2014-2019, Matt Butcher and Matt Farina
 
@@ -471,11 +490,14 @@ THE SOFTWARE.
 
 ### github.com/Masterminds/sprig/v3
 
-* License: MIT
 * Module: github.com/Masterminds/sprig/v3
+* Version: v3.3.0
+* License: MIT
 
 #### LICENSE.txt
 
+<https://github.com/Masterminds/sprig/blob/v3.3.0/LICENSE.txt>
+
 ```text
 Copyright (C) 2013-2020 Masterminds
 
@@ -502,11 +524,14 @@ THE SOFTWARE.
 
 ### github.com/Mellanox/maintenance-operator/api/v1alpha1
 
-* License: Apache-2.0
 * Module: github.com/Mellanox/maintenance-operator/api
+* Version: v0.3.0
+* License: Apache-2.0
 
 #### LICENSE
 
+<https://github.com/Mellanox/maintenance-operator/blob/api/v0.3.0/LICENSE>
+
 ```text
                                  Apache License
                            Version 2.0, January 2004
@@ -715,11 +740,14 @@ THE SOFTWARE.
 
 ### github.com/NVIDIA/go-nvlib/pkg
 
-* License: Apache-2.0
 * Module: github.com/NVIDIA/go-nvlib
+* Version: v0.12.0
+* License: Apache-2.0
 
 #### LICENSE
 
+<https://github.com/NVIDIA/go-nvlib/blob/v0.12.0/LICENSE>
+
 ```text
 
                                  Apache License
@@ -928,6 +956,8 @@ THE SOFTWARE.
 
 #### NOTICE
 
+<https://github.com/NVIDIA/go-nvlib/blob/v0.12.0/NOTICE>
+
 ```text
 The file pkg/pciids/default_pci.ids is distributed under the 3-clause BSD License.
 Maintained by Albert Pool, Martin Mares, and other volunteers from
@@ -939,11 +969,14 @@ the PCI ID Project at https://pci-ids.ucw.cz/.
 
 ### github.com/NVIDIA/k8s-kata-manager/api/v1alpha1/config
 
-* License: Apache-2.0
 * Module: github.com/NVIDIA/k8s-kata-manager
+* Version: v0.2.3
+* License: Apache-2.0
 
 #### LICENSE
 
+<https://github.com/NVIDIA/k8s-kata-manager/blob/v0.2.3/LICENSE>
+
 ```text
 
                                  Apache License
@@ -1153,11 +1186,14 @@ the PCI ID Project at https://pci-ids.ucw.cz/.
 
 ### github.com/NVIDIA/k8s-operator-libs
 
-* License: Apache-2.0
 * Module: github.com/NVIDIA/k8s-operator-libs
+* Version: v0.0.0-20260629200812-d720f2557494
+* License: Apache-2.0
 
 #### LICENSE
 
+<https://github.com/NVIDIA/k8s-operator-libs/blob/d720f2557494/LICENSE>
+
 ```text
 
                                  Apache License
@@ -1367,11 +1403,14 @@ the PCI ID Project at https://pci-ids.ucw.cz/.
 
 ### github.com/NVIDIA/nvidia-container-toolkit
 
-* License: Apache-2.0
 * Module: github.com/NVIDIA/nvidia-container-toolkit
+* Version: v1.20.0
+* License: Apache-2.0
 
 #### LICENSE
 
+<https://github.com/NVIDIA/nvidia-container-toolkit/blob/v1.20.0/LICENSE>
+
 ```text
 
                                  Apache License
@@ -1581,11 +1620,14 @@ the PCI ID Project at https://pci-ids.ucw.cz/.
 
 ### github.com/beorn7/perks/quantile
 
-* License: MIT
 * Module: github.com/beorn7/perks
+* Version: v1.0.1
+* License: MIT
 
 #### LICENSE
 
+<https://github.com/beorn7/perks/blob/v1.0.1/LICENSE>
+
 ```text
 Copyright (C) 2013 Blake Mizerany
 
@@ -1613,11 +1655,14 @@ WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
 
 ### github.com/blang/semver/v4
 
-* License: MIT
 * Module: github.com/blang/semver/v4
+* Version: v4.0.0
+* License: MIT
 
 #### LICENSE
 
+<https://github.com/blang/semver/blob/v4.0.0/LICENSE>
+
 ```text
 The MIT License
 
@@ -1647,11 +1692,14 @@ THE SOFTWARE.
 
 ### github.com/cespare/xxhash/v2
 
-* License: MIT
 * Module: github.com/cespare/xxhash/v2
+* Version: v2.3.0
+* License: MIT
 
 #### LICENSE.txt
 
+<https://github.com/cespare/xxhash/blob/v2.3.0/LICENSE.txt>
+
 ```text
 Copyright (c) 2016 Caleb Spare
 
@@ -1681,11 +1729,14 @@ WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
 
 ### github.com/chai2010/gettext-go
 
-* License: BSD-3-Clause
 * Module: github.com/chai2010/gettext-go
+* Version: v1.0.2
+* License: BSD-3-Clause
 
 #### LICENSE
 
+<https://github.com/chai2010/gettext-go/blob/v1.0.2/LICENSE>
+
 ```text
 Copyright 2013 ChaiShushan <chaishushan{AT}gmail.com>. All rights reserved.
 
@@ -1720,11 +1771,14 @@ OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
 ### github.com/cyphar/filepath-securejoin
 
-* License: BSD-3-Clause / MPL-2.0
 * Module: github.com/cyphar/filepath-securejoin
+* Version: v0.7.0
+* License: BSD-3-Clause / MPL-2.0
 
 #### COPYING.md
 
+<https://github.com/cyphar/filepath-securejoin/blob/v0.7.0/COPYING.md>
+
 ````text
 ## COPYING ##
 
@@ -2178,6 +2232,8 @@ Exhibit B - "Incompatible With Secondary Licenses" Notice
 
 #### LICENSE.BSD
 
+<https://github.com/cyphar/filepath-securejoin/blob/v0.7.0/LICENSE.BSD>
+
 ```text
 Copyright (C) 2014-2015 Docker Inc & Go Authors. All rights reserved.
 Copyright (C) 2017-2024 SUSE LLC. All rights reserved.
@@ -2212,6 +2268,8 @@ OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
 #### LICENSE.MPL-2.0
 
+<https://github.com/cyphar/filepath-securejoin/blob/v0.7.0/LICENSE.MPL-2.0>
+
 ```text
 Mozilla Public License Version 2.0
 ==================================
@@ -2592,11 +2650,14 @@ Exhibit B - "Incompatible With Secondary Licenses" Notice
 
 ### github.com/davecgh/go-spew/spew
 
-* License: ISC
 * Module: github.com/davecgh/go-spew
+* Version: v1.1.2-0.20180830191138-d8f796af33cc
+* License: ISC
 
 #### LICENSE
 
+<https://github.com/davecgh/go-spew/blob/d8f796af33cc/LICENSE>
+
 ```text
 ISC License
 
@@ -2619,11 +2680,14 @@ OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
 
 ### github.com/docker/libtrust
 
-* License: Apache-2.0
 * Module: github.com/docker/libtrust
+* Version: v0.0.0-20160708172513-aabc10ec26b7
+* License: Apache-2.0
 
 #### LICENSE
 
+<https://github.com/docker-archive-public/docker.libtrust/blob/aabc10ec26b7/LICENSE>
+
 ```text
 
                                  Apache License
@@ -2822,11 +2886,14 @@ OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
 
 ### github.com/emicklei/go-restful/v3
 
-* License: MIT
 * Module: github.com/emicklei/go-restful/v3
+* Version: v3.13.0
+* License: MIT
 
 #### LICENSE
 
+<https://github.com/emicklei/go-restful/blob/v3.13.0/LICENSE>
+
 ```text
 Copyright (c) 2012,2013 Ernest Micklei
 
@@ -2855,11 +2922,14 @@ WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
 
 ### github.com/evanphx/json-patch/v5
 
-* License: BSD-3-Clause
 * Module: github.com/evanphx/json-patch/v5
+* Version: v5.9.11
+* License: BSD-3-Clause
 
 #### LICENSE
 
+<https://github.com/evanphx/json-patch/blob/v5.9.11/LICENSE>
+
 ```text
 Copyright (c) 2014, Evan Phoenix
 All rights reserved.
@@ -2892,11 +2962,14 @@ OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
 ### github.com/exponent-io/jsonpath
 
-* License: MIT
 * Module: github.com/exponent-io/jsonpath
+* Version: v0.0.0-20210407135951-1de76d718b3f
+* License: MIT
 
 #### LICENSE
 
+<https://github.com/exponent-io/jsonpath/blob/1de76d718b3f/LICENSE>
+
 ```text
 The MIT License (MIT)
 
@@ -2925,11 +2998,14 @@ SOFTWARE.
 
 ### github.com/fsnotify/fsnotify
 
-* License: BSD-3-Clause
 * Module: github.com/fsnotify/fsnotify
+* Version: v1.9.0
+* License: BSD-3-Clause
 
 #### LICENSE
 
+<https://github.com/fsnotify/fsnotify/blob/v1.9.0/LICENSE>
+
 ```text
 Copyright © 2012 The Go Authors. All rights reserved.
 Copyright © fsnotify Authors. All rights reserved.
@@ -2962,11 +3038,14 @@ SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
 ### github.com/fxamacker/cbor/v2
 
-* License: MIT
 * Module: github.com/fxamacker/cbor/v2
+* Version: v2.9.2
+* License: MIT
 
 #### LICENSE
 
+<https://github.com/fxamacker/cbor/blob/v2.9.2/LICENSE>
+
 ```text
 MIT License
 
@@ -2994,11 +3073,14 @@ SOFTWARE.
 
 ### github.com/go-errors/errors
 
-* License: MIT
 * Module: github.com/go-errors/errors
+* Version: v1.5.1
+* License: MIT
 
 #### LICENSE.MIT
 
+<https://github.com/go-errors/errors/blob/v1.5.1/LICENSE.MIT>
+
 ```text
 Copyright (c) 2015 Conrad Irwin <conrad@bugsnag.com>
 
@@ -3013,11 +3095,14 @@ THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLI
 
 ### github.com/go-logr/logr
 
-* License: Apache-2.0
 * Module: github.com/go-logr/logr
+* Version: v1.4.4
+* License: Apache-2.0
 
 #### LICENSE
 
+<https://github.com/go-logr/logr/blob/v1.4.4/LICENSE>
+
 ```text
                                  Apache License
                            Version 2.0, January 2004
@@ -3226,11 +3311,14 @@ THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLI
 
 ### github.com/go-logr/zapr
 
-* License: Apache-2.0
 * Module: github.com/go-logr/zapr
+* Version: v1.3.0
+* License: Apache-2.0
 
 #### LICENSE
 
+<https://github.com/go-logr/zapr/blob/v1.3.0/LICENSE>
+
 ```text
                                  Apache License
                            Version 2.0, January 2004
@@ -3439,11 +3527,14 @@ THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLI
 
 ### github.com/go-openapi/jsonpointer
 
-* License: Apache-2.0
 * Module: github.com/go-openapi/jsonpointer
+* Version: v0.22.4
+* License: Apache-2.0
 
 #### LICENSE
 
+<https://github.com/go-openapi/jsonpointer/blob/v0.22.4/LICENSE>
+
 ```text
                                  Apache License
                            Version 2.0, January 2004
@@ -3651,6 +3742,8 @@ THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLI
 
 #### NOTICE
 
+<https://github.com/go-openapi/jsonpointer/blob/v0.22.4/NOTICE>
+
 ```text
 Copyright 2015-2025 go-swagger maintainers
 
@@ -3697,11 +3790,14 @@ limitations under the License.
 
 ### github.com/go-openapi/jsonreference
 
-* License: Apache-2.0
 * Module: github.com/go-openapi/jsonreference
+* Version: v0.21.4
+* License: Apache-2.0
 
 #### LICENSE
 
+<https://github.com/go-openapi/jsonreference/blob/v0.21.4/LICENSE>
+
 ```text
 
                                  Apache License
@@ -3910,6 +4006,8 @@ limitations under the License.
 
 #### NOTICE
 
+<https://github.com/go-openapi/jsonreference/blob/v0.21.4/NOTICE>
+
 ```text
 Copyright 2015-2025 go-swagger maintainers
 
@@ -3956,11 +4054,14 @@ limitations under the License.
 
 ### github.com/go-openapi/swag
 
-* License: Apache-2.0
 * Module: github.com/go-openapi/swag
+* Version: v0.25.4
+* License: Apache-2.0
 
 #### LICENSE
 
+<https://github.com/go-openapi/swag/blob/v0.25.4/LICENSE>
+
 ```text
 
                                  Apache License
@@ -4170,11 +4271,14 @@ limitations under the License.
 
 ### github.com/go-openapi/swag/cmdutils
 
-* License: Apache-2.0
 * Module: github.com/go-openapi/swag/cmdutils
+* Version: v0.25.4
+* License: Apache-2.0
 
 #### LICENSE
 
+<https://github.com/go-openapi/swag/blob/cmdutils/v0.25.4/LICENSE>
+
 ```text
 
                                  Apache License
@@ -4384,11 +4488,14 @@ limitations under the License.
 
 ### github.com/go-openapi/swag/conv
 
-* License: Apache-2.0
 * Module: github.com/go-openapi/swag/conv
+* Version: v0.25.4
+* License: Apache-2.0
 
 #### LICENSE
 
+<https://github.com/go-openapi/swag/blob/conv/v0.25.4/LICENSE>
+
 ```text
 
                                  Apache License
@@ -4598,11 +4705,14 @@ limitations under the License.
 
 ### github.com/go-openapi/swag/fileutils
 
-* License: Apache-2.0
 * Module: github.com/go-openapi/swag/fileutils
+* Version: v0.25.4
+* License: Apache-2.0
 
 #### LICENSE
 
+<https://github.com/go-openapi/swag/blob/fileutils/v0.25.4/LICENSE>
+
 ```text
 
                                  Apache License
@@ -4812,11 +4922,14 @@ limitations under the License.
 
 ### github.com/go-openapi/swag/jsonname
 
-* License: Apache-2.0
 * Module: github.com/go-openapi/swag/jsonname
+* Version: v0.25.4
+* License: Apache-2.0
 
 #### LICENSE
 
+<https://github.com/go-openapi/swag/blob/jsonname/v0.25.4/LICENSE>
+
 ```text
 
                                  Apache License
@@ -5026,11 +5139,14 @@ limitations under the License.
 
 ### github.com/go-openapi/swag/jsonutils
 
-* License: Apache-2.0
 * Module: github.com/go-openapi/swag/jsonutils
+* Version: v0.25.4
+* License: Apache-2.0
 
 #### LICENSE
 
+<https://github.com/go-openapi/swag/blob/jsonutils/v0.25.4/LICENSE>
+
 ```text
 
                                  Apache License
@@ -5240,11 +5356,14 @@ limitations under the License.
 
 ### github.com/go-openapi/swag/loading
 
-* License: Apache-2.0
 * Module: github.com/go-openapi/swag/loading
+* Version: v0.25.4
+* License: Apache-2.0
 
 #### LICENSE
 
+<https://github.com/go-openapi/swag/blob/loading/v0.25.4/LICENSE>
+
 ```text
 
                                  Apache License
@@ -5454,11 +5573,14 @@ limitations under the License.
 
 ### github.com/go-openapi/swag/mangling
 
-* License: Apache-2.0
 * Module: github.com/go-openapi/swag/mangling
+* Version: v0.25.4
+* License: Apache-2.0
 
 #### LICENSE
 
+<https://github.com/go-openapi/swag/blob/mangling/v0.25.4/LICENSE>
+
 ```text
 
                                  Apache License
@@ -5668,11 +5790,14 @@ limitations under the License.
 
 ### github.com/go-openapi/swag/netutils
 
-* License: Apache-2.0
 * Module: github.com/go-openapi/swag/netutils
+* Version: v0.25.4
+* License: Apache-2.0
 
 #### LICENSE
 
+<https://github.com/go-openapi/swag/blob/netutils/v0.25.4/LICENSE>
+
 ```text
 
                                  Apache License
@@ -5882,11 +6007,14 @@ limitations under the License.
 
 ### github.com/go-openapi/swag/stringutils
 
-* License: Apache-2.0
 * Module: github.com/go-openapi/swag/stringutils
+* Version: v0.25.4
+* License: Apache-2.0
 
 #### LICENSE
 
+<https://github.com/go-openapi/swag/blob/stringutils/v0.25.4/LICENSE>
+
 ```text
 
                                  Apache License
@@ -6096,11 +6224,14 @@ limitations under the License.
 
 ### github.com/go-openapi/swag/typeutils
 
-* License: Apache-2.0
 * Module: github.com/go-openapi/swag/typeutils
+* Version: v0.25.4
+* License: Apache-2.0
 
 #### LICENSE
 
+<https://github.com/go-openapi/swag/blob/typeutils/v0.25.4/LICENSE>
+
 ```text
 
                                  Apache License
@@ -6310,11 +6441,14 @@ limitations under the License.
 
 ### github.com/go-openapi/swag/yamlutils
 
-* License: Apache-2.0
 * Module: github.com/go-openapi/swag/yamlutils
+* Version: v0.25.4
+* License: Apache-2.0
 
 #### LICENSE
 
+<https://github.com/go-openapi/swag/blob/yamlutils/v0.25.4/LICENSE>
+
 ```text
 
                                  Apache License
@@ -6524,11 +6658,14 @@ limitations under the License.
 
 ### github.com/google/btree
 
-* License: Apache-2.0
 * Module: github.com/google/btree
+* Version: v1.1.3
+* License: Apache-2.0
 
 #### LICENSE
 
+<https://github.com/google/btree/blob/v1.1.3/LICENSE>
+
 ```text
 
                                  Apache License
@@ -6738,11 +6875,14 @@ limitations under the License.
 
 ### github.com/google/gnostic-models
 
-* License: Apache-2.0
 * Module: github.com/google/gnostic-models
+* Version: v0.7.1
+* License: Apache-2.0
 
 #### LICENSE
 
+<https://github.com/google/gnostic-models/blob/v0.7.1/LICENSE>
+
 ```text
 
                                  Apache License
@@ -6953,11 +7093,14 @@ limitations under the License.
 
 ### github.com/google/uuid
 
-* License: BSD-3-Clause
 * Module: github.com/google/uuid
+* Version: v1.6.0
+* License: BSD-3-Clause
 
 #### LICENSE
 
+<https://github.com/google/uuid/blob/v1.6.0/LICENSE>
+
 ```text
 Copyright (c) 2009,2014 Google Inc. All rights reserved.
 
@@ -6992,11 +7135,14 @@ OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
 ### github.com/huandu/xstrings
 
-* License: MIT
 * Module: github.com/huandu/xstrings
+* Version: v1.5.0
+* License: MIT
 
 #### LICENSE
 
+<https://github.com/huandu/xstrings/blob/v1.5.0/LICENSE>
+
 ```text
 The MIT License (MIT)
 
@@ -7026,11 +7172,14 @@ SOFTWARE.
 
 ### github.com/json-iterator/go
 
-* License: MIT
 * Module: github.com/json-iterator/go
+* Version: v1.1.12
+* License: MIT
 
 #### LICENSE
 
+<https://github.com/json-iterator/go/blob/v1.1.12/LICENSE>
+
 ```text
 MIT License
 
@@ -7059,11 +7208,14 @@ SOFTWARE.
 
 ### github.com/klauspost/compress
 
-* License: Apache-2.0 / BSD-3-Clause / MIT
 * Module: github.com/klauspost/compress
+* Version: v1.19.1
+* License: Apache-2.0 / BSD-3-Clause / MIT
 
 #### LICENSE
 
+<https://github.com/klauspost/compress/blob/v1.19.1/LICENSE>
+
 ```text
 Copyright (c) 2012 The Go Authors. All rights reserved.
 Copyright (c) 2019 Klaus Post. All rights reserved.
@@ -7375,11 +7527,14 @@ THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLI
 
 ### github.com/klauspost/compress/internal/snapref
 
-* License: BSD-3-Clause
 * Module: github.com/klauspost/compress
+* Version: v1.19.1
+* License: BSD-3-Clause
 
 #### LICENSE
 
+<https://github.com/klauspost/compress/blob/v1.19.1/internal/snapref/LICENSE>
+
 ```text
 Copyright (c) 2011 The Snappy-Go Authors. All rights reserved.
 
@@ -7414,11 +7569,14 @@ OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
 ### github.com/klauspost/compress/zstd/internal/xxhash
 
-* License: MIT
 * Module: github.com/klauspost/compress
+* Version: v1.19.1
+* License: MIT
 
 #### LICENSE.txt
 
+<https://github.com/klauspost/compress/blob/v1.19.1/zstd/internal/xxhash/LICENSE.txt>
+
 ```text
 Copyright (c) 2016 Caleb Spare
 
@@ -7448,11 +7606,14 @@ WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
 
 ### github.com/liggitt/tabwriter
 
-* License: BSD-3-Clause
 * Module: github.com/liggitt/tabwriter
+* Version: v0.0.0-20181228230101-89fcab3d43de
+* License: BSD-3-Clause
 
 #### LICENSE
 
+<https://github.com/liggitt/tabwriter/blob/89fcab3d43de/LICENSE>
+
 ```text
 Copyright (c) 2009 The Go Authors. All rights reserved.
 
@@ -7487,11 +7648,14 @@ OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
 ### github.com/mitchellh/copystructure
 
-* License: MIT
 * Module: github.com/mitchellh/copystructure
+* Version: v1.2.0
+* License: MIT
 
 #### LICENSE
 
+<https://github.com/mitchellh/copystructure/blob/v1.2.0/LICENSE>
+
 ```text
 The MIT License (MIT)
 
@@ -7520,11 +7684,14 @@ THE SOFTWARE.
 
 ### github.com/mitchellh/go-wordwrap
 
-* License: MIT
 * Module: github.com/mitchellh/go-wordwrap
+* Version: v1.0.1
+* License: MIT
 
 #### LICENSE.md
 
+<https://github.com/mitchellh/go-wordwrap/blob/v1.0.1/LICENSE.md>
+
 ```text
 The MIT License (MIT)
 
@@ -7553,11 +7720,14 @@ THE SOFTWARE.
 
 ### github.com/mitchellh/reflectwalk
 
-* License: MIT
 * Module: github.com/mitchellh/reflectwalk
+* Version: v1.0.2
+* License: MIT
 
 #### LICENSE
 
+<https://github.com/mitchellh/reflectwalk/blob/v1.0.2/LICENSE>
+
 ```text
 The MIT License (MIT)
 
@@ -7586,11 +7756,14 @@ THE SOFTWARE.
 
 ### github.com/moby/term
 
-* License: Apache-2.0
 * Module: github.com/moby/term
+* Version: v0.5.2
+* License: Apache-2.0
 
 #### LICENSE
 
+<https://github.com/moby/term/blob/v0.5.2/LICENSE>
+
 ```text
 
                                  Apache License
@@ -7789,11 +7962,14 @@ THE SOFTWARE.
 
 ### github.com/modern-go/concurrent
 
-* License: Apache-2.0
 * Module: github.com/modern-go/concurrent
+* Version: v0.0.0-20180306012644-bacd9c7ef1dd
+* License: Apache-2.0
 
 #### LICENSE
 
+<https://github.com/modern-go/concurrent/blob/bacd9c7ef1dd/LICENSE>
+
 ```text
                                  Apache License
                            Version 2.0, January 2004
@@ -8002,11 +8178,14 @@ THE SOFTWARE.
 
 ### github.com/modern-go/reflect2
 
-* License: Apache-2.0
 * Module: github.com/modern-go/reflect2
+* Version: v1.0.3-0.20250322232337-35a7c28c31ee
+* License: Apache-2.0
 
 #### LICENSE
 
+<https://github.com/modern-go/reflect2/blob/35a7c28c31ee/LICENSE>
+
 ```text
                                  Apache License
                            Version 2.0, January 2004
@@ -8215,11 +8394,14 @@ THE SOFTWARE.
 
 ### github.com/monochromegane/go-gitignore
 
-* License: MIT
 * Module: github.com/monochromegane/go-gitignore
+* Version: v0.0.0-20200626010858-205db1a8cc00
+* License: MIT
 
 #### LICENSE
 
+<https://github.com/monochromegane/go-gitignore/blob/205db1a8cc00/LICENSE>
+
 ```text
 The MIT License (MIT)
 
@@ -8248,11 +8430,14 @@ SOFTWARE.
 
 ### github.com/munnerz/goautoneg
 
-* License: BSD-3-Clause
 * Module: github.com/munnerz/goautoneg
+* Version: v0.0.0-20191010083416-a7dc8b61c822
+* License: BSD-3-Clause
 
 #### LICENSE
 
+<https://github.com/munnerz/goautoneg/blob/a7dc8b61c822/LICENSE>
+
 ```text
 Copyright (c) 2011, Open Knowledge Foundation Ltd.
 All rights reserved.
@@ -8291,11 +8476,14 @@ OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
 ### github.com/opencontainers/cgroups/devices/config
 
-* License: Apache-2.0
 * Module: github.com/opencontainers/cgroups
+* Version: v0.0.7
+* License: Apache-2.0
 
 #### LICENSE
 
+<https://github.com/opencontainers/cgroups/blob/v0.0.7/LICENSE>
+
 ```text
                                  Apache License
                            Version 2.0, January 2004
@@ -8504,11 +8692,14 @@ OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
 ### github.com/opencontainers/go-digest
 
-* License: Apache-2.0
 * Module: github.com/opencontainers/go-digest
+* Version: v1.0.0
+* License: Apache-2.0
 
 #### LICENSE
 
+<https://github.com/opencontainers/go-digest/blob/v1.0.0/LICENSE>
+
 ```text
 
                                  Apache License
@@ -8708,11 +8899,14 @@ OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
 ### github.com/opencontainers/runc/libcontainer/devices
 
-* License: Apache-2.0
 * Module: github.com/opencontainers/runc
+* Version: v1.4.3
+* License: Apache-2.0
 
 #### LICENSE
 
+<https://github.com/opencontainers/runc/blob/v1.4.3/LICENSE>
+
 ```text
 
                                  Apache License
@@ -8910,6 +9104,8 @@ OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
 #### NOTICE
 
+<https://github.com/opencontainers/runc/blob/v1.4.3/NOTICE>
+
 ```text
 runc
 
@@ -8934,11 +9130,14 @@ See also http://www.apache.org/dev/crypto.html and/or seek legal counsel.
 
 ### github.com/openshift/api
 
-* License: Apache-2.0
 * Module: github.com/openshift/api
+* Version: v0.0.0-20260727141720-967cc4c36c9b
+* License: Apache-2.0
 
 #### LICENSE
 
+<https://github.com/openshift/api/blob/967cc4c36c9b/LICENSE>
+
 ```text
 
                                  Apache License
@@ -9137,11 +9336,14 @@ See also http://www.apache.org/dev/crypto.html and/or seek legal counsel.
 
 ### github.com/openshift/client-go
 
-* License: Apache-2.0
 * Module: github.com/openshift/client-go
+* Version: v0.0.0-20260723174158-ae2315de9d73
+* License: Apache-2.0
 
 #### LICENSE
 
+<https://github.com/openshift/client-go/blob/ae2315de9d73/LICENSE>
+
 ```text
 
                                  Apache License
@@ -9340,11 +9542,14 @@ See also http://www.apache.org/dev/crypto.html and/or seek legal counsel.
 
 ### github.com/operator-framework/api/pkg
 
-* License: Apache-2.0
 * Module: github.com/operator-framework/api
+* Version: v0.45.0
+* License: Apache-2.0
 
 #### LICENSE
 
+<https://github.com/operator-framework/api/blob/v0.45.0/LICENSE>
+
 ```text
                                  Apache License
                            Version 2.0, January 2004
@@ -9553,11 +9758,14 @@ See also http://www.apache.org/dev/crypto.html and/or seek legal counsel.
 
 ### github.com/peterbourgon/diskv
 
-* License: MIT
 * Module: github.com/peterbourgon/diskv
+* Version: v2.0.1+incompatible
+* License: MIT
 
 #### LICENSE
 
+<https://github.com/peterbourgon/diskv/blob/v2.0.1/LICENSE>
+
 ```text
 Copyright (c) 2011-2012 Peter Bourgon
 
@@ -9584,11 +9792,14 @@ THE SOFTWARE.
 
 ### github.com/pmezard/go-difflib/difflib
 
-* License: BSD-3-Clause
 * Module: github.com/pmezard/go-difflib
+* Version: v1.0.1-0.20181226105442-5d4384ee4fb2
+* License: BSD-3-Clause
 
 #### LICENSE
 
+<https://github.com/pmezard/go-difflib/blob/5d4384ee4fb2/LICENSE>
+
 ```text
 Copyright (c) 2013, Patrick Mezard
 All rights reserved.
@@ -9623,11 +9834,14 @@ SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
 ### github.com/prometheus-operator/prometheus-operator/pkg/apis/monitoring
 
-* License: Apache-2.0
 * Module: github.com/prometheus-operator/prometheus-operator/pkg/apis/monitoring
+* Version: v0.93.1
+* License: Apache-2.0
 
 #### LICENSE
 
+<https://github.com/prometheus-operator/prometheus-operator/blob/pkg/apis/monitoring/v0.93.1/LICENSE>
+
 ```text
 Apache License
                            Version 2.0, January 2004
@@ -9836,11 +10050,14 @@ Apache License
 
 ### github.com/prometheus/client_golang/internal/github.com/golang/gddo/httputil
 
-* License: BSD-3-Clause
 * Module: github.com/prometheus/client_golang
+* Version: v1.24.1
+* License: BSD-3-Clause
 
 #### LICENSE
 
+<https://github.com/prometheus/client_golang/blob/v1.24.1/internal/github.com/golang/gddo/LICENSE>
+
 ```text
 Copyright (c) 2013 The Go Authors. All rights reserved.
 
@@ -9875,11 +10092,14 @@ OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
 ### github.com/prometheus/client_golang/prometheus
 
-* License: Apache-2.0
 * Module: github.com/prometheus/client_golang
+* Version: v1.24.1
+* License: Apache-2.0
 
 #### LICENSE
 
+<https://github.com/prometheus/client_golang/blob/v1.24.1/LICENSE>
+
 ```text
                                  Apache License
                            Version 2.0, January 2004
@@ -10087,6 +10307,8 @@ OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
 #### NOTICE
 
+<https://github.com/prometheus/client_golang/blob/v1.24.1/NOTICE>
+
 ```text
 Prometheus instrumentation library for Go applications
 Copyright 2012-2015 The Prometheus Authors
@@ -10112,11 +10334,14 @@ See source code for license details.
 
 ### github.com/prometheus/client_model/go
 
-* License: Apache-2.0
 * Module: github.com/prometheus/client_model
+* Version: v0.6.2
+* License: Apache-2.0
 
 #### LICENSE
 
+<https://github.com/prometheus/client_model/blob/v0.6.2/LICENSE>
+
 ```text
                                  Apache License
                            Version 2.0, January 2004
@@ -10324,6 +10549,8 @@ See source code for license details.
 
 #### NOTICE
 
+<https://github.com/prometheus/client_model/blob/v0.6.2/NOTICE>
+
 ```text
 Data model artifacts for Prometheus.
 Copyright 2012-2015 The Prometheus Authors
@@ -10336,11 +10563,14 @@ SoundCloud Ltd. (http://soundcloud.com/).
 
 ### github.com/prometheus/common
 
-* License: Apache-2.0
 * Module: github.com/prometheus/common
+* Version: v0.70.1
+* License: Apache-2.0
 
 #### LICENSE
 
+<https://github.com/prometheus/common/blob/v0.70.1/LICENSE>
+
 ```text
                                  Apache License
                            Version 2.0, January 2004
@@ -10548,6 +10778,8 @@ SoundCloud Ltd. (http://soundcloud.com/).
 
 #### NOTICE
 
+<https://github.com/prometheus/common/blob/v0.70.1/NOTICE>
+
 ```text
 Common libraries shared by Prometheus Go components.
 Copyright 2015 The Prometheus Authors
@@ -10560,11 +10792,14 @@ SoundCloud Ltd. (http://soundcloud.com/).
 
 ### github.com/prometheus/procfs
 
-* License: Apache-2.0
 * Module: github.com/prometheus/procfs
+* Version: v0.21.1
+* License: Apache-2.0
 
 #### LICENSE
 
+<https://github.com/prometheus/procfs/blob/v0.21.1/LICENSE>
+
 ```text
                                  Apache License
                            Version 2.0, January 2004
@@ -10772,6 +11007,8 @@ SoundCloud Ltd. (http://soundcloud.com/).
 
 #### NOTICE
 
+<https://github.com/prometheus/procfs/blob/v0.21.1/NOTICE>
+
 ```text
 procfs provides functions to retrieve system, kernel and process
 metrics from the pseudo-filesystem proc.
@@ -10786,11 +11023,14 @@ SoundCloud Ltd. (http://soundcloud.com/).
 
 ### github.com/regclient/regclient
 
-* License: Apache-2.0
 * Module: github.com/regclient/regclient
+* Version: v0.11.5
+* License: Apache-2.0
 
 #### LICENSE
 
+<https://github.com/regclient/regclient/blob/v0.11.5/LICENSE>
+
 ```text
 
                                  Apache License
@@ -10989,11 +11229,14 @@ SoundCloud Ltd. (http://soundcloud.com/).
 
 ### github.com/russross/blackfriday/v2
 
-* License: BSD-2-Clause
 * Module: github.com/russross/blackfriday/v2
+* Version: v2.1.0
+* License: BSD-2-Clause
 
 #### LICENSE.txt
 
+<https://github.com/russross/blackfriday/blob/v2.1.0/LICENSE.txt>
+
 ```text
 Blackfriday is distributed under the Simplified BSD License:
 
@@ -11030,11 +11273,14 @@ Blackfriday is distributed under the Simplified BSD License:
 
 ### github.com/shopspring/decimal
 
-* License: MIT
 * Module: github.com/shopspring/decimal
+* Version: v1.4.0
+* License: MIT
 
 #### LICENSE
 
+<https://github.com/shopspring/decimal/blob/v1.4.0/LICENSE>
+
 ```text
 The MIT License (MIT)
 
@@ -11087,11 +11333,14 @@ CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
 
 ### github.com/sirupsen/logrus
 
-* License: MIT
 * Module: github.com/sirupsen/logrus
+* Version: v1.10.1
+* License: MIT
 
 #### LICENSE
 
+<https://github.com/sirupsen/logrus/blob/v1.10.1/LICENSE>
+
 ```text
 The MIT License (MIT)
 
@@ -11120,11 +11369,14 @@ THE SOFTWARE.
 
 ### github.com/spf13/cast
 
-* License: MIT
 * Module: github.com/spf13/cast
+* Version: v1.7.0
+* License: MIT
 
 #### LICENSE
 
+<https://github.com/spf13/cast/blob/v1.7.0/LICENSE>
+
 ```text
 The MIT License (MIT)
 
@@ -11152,11 +11404,14 @@ SOFTWARE.
 
 ### github.com/spf13/cobra
 
-* License: Apache-2.0
 * Module: github.com/spf13/cobra
+* Version: v1.10.2
+* License: Apache-2.0
 
 #### LICENSE.txt
 
+<https://github.com/spf13/cobra/blob/v1.10.2/LICENSE.txt>
+
 ```text
                                 Apache License
                            Version 2.0, January 2004
@@ -11338,11 +11593,14 @@ SOFTWARE.
 
 ### github.com/spf13/pflag
 
-* License: BSD-3-Clause
 * Module: github.com/spf13/pflag
+* Version: v1.0.10
+* License: BSD-3-Clause
 
 #### LICENSE
 
+<https://github.com/spf13/pflag/blob/v1.0.10/LICENSE>
+
 ```text
 Copyright (c) 2012 Alex Ogier. All rights reserved.
 Copyright (c) 2012 The Go Authors. All rights reserved.
@@ -11378,11 +11636,14 @@ OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
 ### github.com/stretchr/testify/assert/yaml
 
-* License: MIT
 * Module: github.com/stretchr/testify
+* Version: v1.12.0
+* License: MIT
 
 #### LICENSE
 
+<https://github.com/stretchr/testify/blob/v1.12.0/LICENSE>
+
 ```text
 MIT License
 
@@ -11411,11 +11672,14 @@ SOFTWARE.
 
 ### github.com/ulikunitz/xz
 
-* License: BSD-3-Clause
 * Module: github.com/ulikunitz/xz
+* Version: v0.5.15
+* License: BSD-3-Clause
 
 #### LICENSE
 
+<https://github.com/ulikunitz/xz/blob/v0.5.15/LICENSE>
+
 ```text
 Copyright (c) 2014-2022  Ulrich Kunitz
 All rights reserved.
@@ -11449,11 +11713,14 @@ OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
 ### github.com/urfave/cli/v3
 
-* License: MIT
 * Module: github.com/urfave/cli/v3
+* Version: v3.10.1
+* License: MIT
 
 #### LICENSE
 
+<https://github.com/urfave/cli/blob/v3.10.1/LICENSE>
+
 ```text
 MIT License
 
@@ -11482,11 +11749,14 @@ SOFTWARE.
 
 ### github.com/x448/float16
 
-* License: MIT
 * Module: github.com/x448/float16
+* Version: v0.8.4
+* License: MIT
 
 #### LICENSE
 
+<https://github.com/x448/float16/blob/v0.8.4/LICENSE>
+
 ```text
 MIT License
 
@@ -11516,11 +11786,14 @@ SOFTWARE.
 
 ### github.com/xlab/treeprint
 
-* License: MIT
 * Module: github.com/xlab/treeprint
+* Version: v1.2.0
+* License: MIT
 
 #### LICENSE
 
+<https://github.com/xlab/treeprint/blob/v1.2.0/LICENSE>
+
 ```text
 The MIT License (MIT)
 Copyright © 2016 Maxim Kupriianov <max@kc.vc>
@@ -11548,11 +11821,14 @@ THE SOFTWARE.
 
 ### go.uber.org/multierr
 
-* License: MIT
 * Module: go.uber.org/multierr
+* Version: v1.11.0
+* License: MIT
 
 #### LICENSE.txt
 
+<https://github.com/uber-go/multierr/blob/v1.11.0/LICENSE.txt>
+
 ```text
 Copyright (c) 2017-2021 Uber Technologies, Inc.
 
@@ -11579,11 +11855,14 @@ THE SOFTWARE.
 
 ### go.uber.org/zap
 
-* License: MIT
 * Module: go.uber.org/zap
+* Version: v1.28.0
+* License: MIT
 
 #### LICENSE
 
+<https://github.com/uber-go/zap/blob/v1.28.0/LICENSE>
+
 ```text
 Copyright (c) 2016-2024 Uber Technologies, Inc.
 
@@ -11610,11 +11889,14 @@ THE SOFTWARE.
 
 ### go.yaml.in/yaml/v2
 
-* License: Apache-2.0
 * Module: go.yaml.in/yaml/v2
+* Version: v2.4.4
+* License: Apache-2.0
 
 #### LICENSE
 
+<https://github.com/yaml/go-yaml/blob/v2.4.4/LICENSE>
+
 ```text
                                  Apache License
                            Version 2.0, January 2004
@@ -11822,6 +12104,8 @@ THE SOFTWARE.
 
 #### NOTICE
 
+<https://github.com/yaml/go-yaml/blob/v2.4.4/NOTICE>
+
 ```text
 Copyright 2011-2016 Canonical Ltd.
 
@@ -11842,11 +12126,14 @@ limitations under the License.
 
 ### go.yaml.in/yaml/v3
 
-* License: MIT
 * Module: go.yaml.in/yaml/v3
+* Version: v3.0.4
+* License: MIT
 
 #### LICENSE
 
+<https://github.com/yaml/go-yaml/blob/v3.0.4/LICENSE>
+
 ```text
 
 This project is covered by two different licenses: MIT and Apache.
@@ -11903,6 +12190,8 @@ limitations under the License.
 
 #### NOTICE
 
+<https://github.com/yaml/go-yaml/blob/v3.0.4/NOTICE>
+
 ```text
 Copyright 2011-2016 Canonical Ltd.
 
@@ -11923,11 +12212,14 @@ limitations under the License.
 
 ### golang.org/x/crypto
 
-* License: BSD-3-Clause
 * Module: golang.org/x/crypto
+* Version: v0.55.0
+* License: BSD-3-Clause
 
 #### LICENSE
 
+<https://go.googlesource.com/crypto/+/refs/tags/v0.55.0/LICENSE>
+
 ```text
 Copyright 2009 The Go Authors.
 
@@ -11962,11 +12254,14 @@ OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
 ### golang.org/x/mod/semver
 
-* License: BSD-3-Clause
 * Module: golang.org/x/mod
+* Version: v0.40.0
+* License: BSD-3-Clause
 
 #### LICENSE
 
+<https://go.googlesource.com/mod/+/refs/tags/v0.40.0/LICENSE>
+
 ```text
 Copyright 2009 The Go Authors.
 
@@ -12001,11 +12296,14 @@ OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
 ### golang.org/x/net
 
-* License: BSD-3-Clause
 * Module: golang.org/x/net
+* Version: v0.58.0
+* License: BSD-3-Clause
 
 #### LICENSE
 
+<https://go.googlesource.com/net/+/refs/tags/v0.58.0/LICENSE>
+
 ```text
 Copyright 2009 The Go Authors.
 
@@ -12040,11 +12338,14 @@ OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
 ### golang.org/x/oauth2
 
-* License: BSD-3-Clause
 * Module: golang.org/x/oauth2
+* Version: v0.36.0
+* License: BSD-3-Clause
 
 #### LICENSE
 
+<https://go.googlesource.com/oauth2/+/refs/tags/v0.36.0/LICENSE>
+
 ```text
 Copyright 2009 The Go Authors.
 
@@ -12079,11 +12380,14 @@ OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
 ### golang.org/x/sync/errgroup
 
-* License: BSD-3-Clause
 * Module: golang.org/x/sync
+* Version: v0.22.0
+* License: BSD-3-Clause
 
 #### LICENSE
 
+<https://go.googlesource.com/sync/+/refs/tags/v0.22.0/LICENSE>
+
 ```text
 Copyright 2009 The Go Authors.
 
@@ -12118,11 +12422,14 @@ OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
 ### golang.org/x/sys/unix
 
-* License: BSD-3-Clause
 * Module: golang.org/x/sys
+* Version: v0.47.0
+* License: BSD-3-Clause
 
 #### LICENSE
 
+<https://go.googlesource.com/sys/+/refs/tags/v0.47.0/LICENSE>
+
 ```text
 Copyright 2009 The Go Authors.
 
@@ -12157,11 +12464,14 @@ OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
 ### golang.org/x/term
 
-* License: BSD-3-Clause
 * Module: golang.org/x/term
+* Version: v0.45.0
+* License: BSD-3-Clause
 
 #### LICENSE
 
+<https://go.googlesource.com/term/+/refs/tags/v0.45.0/LICENSE>
+
 ```text
 Copyright 2009 The Go Authors.
 
@@ -12196,11 +12506,14 @@ OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
 ### golang.org/x/text
 
-* License: BSD-3-Clause
 * Module: golang.org/x/text
+* Version: v0.41.0
+* License: BSD-3-Clause
 
 #### LICENSE
 
+<https://go.googlesource.com/text/+/refs/tags/v0.41.0/LICENSE>
+
 ```text
 Copyright 2009 The Go Authors.
 
@@ -12235,11 +12548,14 @@ OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
 ### golang.org/x/time/rate
 
-* License: BSD-3-Clause
 * Module: golang.org/x/time
+* Version: v0.14.0
+* License: BSD-3-Clause
 
 #### LICENSE
 
+<https://go.googlesource.com/time/+/refs/tags/v0.14.0/LICENSE>
+
 ```text
 Copyright 2009 The Go Authors.
 
@@ -12274,11 +12590,14 @@ OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
 ### gomodules.xyz/jsonpatch/v2
 
-* License: Apache-2.0
 * Module: gomodules.xyz/jsonpatch/v2
+* Version: v2.4.0
+* License: Apache-2.0
 
 #### LICENSE
 
+<https://github.com/gomodules/jsonpatch/blob/v2.4.0/LICENSE>
+
 ```text
                                  Apache License
                            Version 2.0, January 2004
@@ -12488,11 +12807,14 @@ OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
 ### google.golang.org/protobuf
 
-* License: BSD-3-Clause
 * Module: google.golang.org/protobuf
+* Version: v1.36.12-0.20260120151049-f2248ac996af
+* License: BSD-3-Clause
 
 #### LICENSE
 
+<https://go.googlesource.com/protobuf/+/f2248ac996af/LICENSE>
+
 ```text
 Copyright (c) 2018 The Go Authors. All rights reserved.
 
@@ -12527,11 +12849,14 @@ OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
 ### gopkg.in/evanphx/json-patch.v4
 
-* License: BSD-3-Clause
 * Module: gopkg.in/evanphx/json-patch.v4
+* Version: v4.13.0
+* License: BSD-3-Clause
 
 #### LICENSE
 
+<https://github.com/evanphx/json-patch/blob/v4.13.0/LICENSE>
+
 ```text
 Copyright (c) 2014, Evan Phoenix
 All rights reserved.
@@ -12564,11 +12889,14 @@ OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
 ### gopkg.in/inf.v0
 
-* License: BSD-3-Clause
 * Module: gopkg.in/inf.v0
+* Version: v0.9.1
+* License: BSD-3-Clause
 
 #### LICENSE
 
+<https://github.com/go-inf/inf/blob/v0.9.1/LICENSE>
+
 ```text
 Copyright (c) 2012 Péter Surányi. Portions Copyright (c) 2009 The Go
 Authors. All rights reserved.
@@ -12604,11 +12932,14 @@ OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
 ### gopkg.in/yaml.v3
 
-* License: MIT
 * Module: gopkg.in/yaml.v3
+* Version: v3.0.1
+* License: MIT
 
 #### LICENSE
 
+<https://github.com/go-yaml/yaml/blob/v3.0.1/LICENSE>
+
 ```text
 
 This project is covered by two different licenses: MIT and Apache.
@@ -12665,6 +12996,8 @@ limitations under the License.
 
 #### NOTICE
 
+<https://github.com/go-yaml/yaml/blob/v3.0.1/NOTICE>
+
 ```text
 Copyright 2011-2016 Canonical Ltd.
 
@@ -12685,11 +13018,14 @@ limitations under the License.
 
 ### k8s.io/api
 
-* License: Apache-2.0
 * Module: k8s.io/api
+* Version: v0.36.4
+* License: Apache-2.0
 
 #### LICENSE
 
+<https://github.com/kubernetes/api/blob/v0.36.4/LICENSE>
+
 ```text
 
                                  Apache License
@@ -12899,11 +13235,14 @@ limitations under the License.
 
 ### k8s.io/apiextensions-apiserver/pkg
 
-* License: Apache-2.0
 * Module: k8s.io/apiextensions-apiserver
+* Version: v0.36.4
+* License: Apache-2.0
 
 #### LICENSE
 
+<https://github.com/kubernetes/apiextensions-apiserver/blob/v0.36.4/LICENSE>
+
 ```text
 
                                  Apache License
@@ -13113,11 +13452,14 @@ limitations under the License.
 
 ### k8s.io/apimachinery/pkg
 
-* License: Apache-2.0
 * Module: k8s.io/apimachinery
+* Version: v0.36.4
+* License: Apache-2.0
 
 #### LICENSE
 
+<https://github.com/kubernetes/apimachinery/blob/v0.36.4/LICENSE>
+
 ```text
 
                                  Apache License
@@ -13327,11 +13669,14 @@ limitations under the License.
 
 ### k8s.io/apimachinery/third_party/forked/golang
 
-* License: BSD-3-Clause
 * Module: k8s.io/apimachinery
+* Version: v0.36.4
+* License: BSD-3-Clause
 
 #### LICENSE
 
+<https://github.com/kubernetes/apimachinery/blob/v0.36.4/third_party/forked/golang/LICENSE>
+
 ```text
 Copyright (c) 2009 The Go Authors. All rights reserved.
 
@@ -13366,11 +13711,14 @@ OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
 ### k8s.io/cli-runtime/pkg
 
-* License: Apache-2.0
 * Module: k8s.io/cli-runtime
+* Version: v0.36.0
+* License: Apache-2.0
 
 #### LICENSE
 
+<https://github.com/kubernetes/cli-runtime/blob/v0.36.0/LICENSE>
+
 ```text
 
                                  Apache License
@@ -13580,11 +13928,14 @@ OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
 ### k8s.io/client-go
 
-* License: Apache-2.0
 * Module: k8s.io/client-go
+* Version: v0.36.4
+* License: Apache-2.0
 
 #### LICENSE
 
+<https://github.com/kubernetes/client-go/blob/v0.36.4/LICENSE>
+
 ```text
 
                                  Apache License
@@ -13794,11 +14145,14 @@ OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
 ### k8s.io/client-go/third_party/forked/golang/template
 
-* License: BSD-3-Clause
 * Module: k8s.io/client-go
+* Version: v0.36.4
+* License: BSD-3-Clause
 
 #### LICENSE
 
+<https://github.com/kubernetes/client-go/blob/v0.36.4/third_party/forked/golang/LICENSE>
+
 ```text
 Copyright (c) 2009 The Go Authors. All rights reserved.
 
@@ -13833,11 +14187,14 @@ OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
 ### k8s.io/client-go/third_party/forked/httpcache
 
-* License: MIT
 * Module: k8s.io/client-go
+* Version: v0.36.4
+* License: MIT
 
 #### LICENSE
 
+<https://github.com/kubernetes/client-go/blob/v0.36.4/third_party/forked/httpcache/LICENSE>
+
 ```text
 Copyright © 2012 Greg Jones (greg.jones@gmail.com)
 
@@ -13851,11 +14208,14 @@ THE SOFTWARE IS PROVIDED “AS IS”, WITHOUT WARRANTY OF ANY KIND, EXPRESS OR I
 
 ### k8s.io/component-base/version
 
-* License: Apache-2.0
 * Module: k8s.io/component-base
+* Version: v0.36.4
+* License: Apache-2.0
 
 #### LICENSE
 
+<https://github.com/kubernetes/component-base/blob/v0.36.4/LICENSE>
+
 ```text
 
                                  Apache License
@@ -14065,11 +14425,14 @@ THE SOFTWARE IS PROVIDED “AS IS”, WITHOUT WARRANTY OF ANY KIND, EXPRESS OR I
 
 ### k8s.io/klog/v2
 
-* License: Apache-2.0
 * Module: k8s.io/klog/v2
+* Version: v2.140.0
+* License: Apache-2.0
 
 #### LICENSE
 
+<https://github.com/kubernetes/klog/blob/v2.140.0/LICENSE>
+
 ```text
 Apache License
 Version 2.0, January 2004
@@ -14268,11 +14631,14 @@ third-party archives.
 
 ### k8s.io/kube-openapi/pkg
 
-* License: Apache-2.0
 * Module: k8s.io/kube-openapi
+* Version: v0.0.0-20260603220949-865597e52e25
+* License: Apache-2.0
 
 #### LICENSE
 
+<https://github.com/kubernetes/kube-openapi/blob/865597e52e25/LICENSE>
+
 ```text
 
                                  Apache License
@@ -14482,11 +14848,14 @@ third-party archives.
 
 ### k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json
 
-* License: BSD-3-Clause
 * Module: k8s.io/kube-openapi
+* Version: v0.0.0-20260603220949-865597e52e25
+* License: BSD-3-Clause
 
 #### LICENSE
 
+<https://github.com/kubernetes/kube-openapi/blob/865597e52e25/pkg/internal/third_party/go-json-experiment/json/LICENSE>
+
 ```text
 Copyright (c) 2020 The Go Authors. All rights reserved.
 
@@ -14521,11 +14890,14 @@ OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
 ### k8s.io/kube-openapi/pkg/validation/spec
 
-* License: Apache-2.0
 * Module: k8s.io/kube-openapi
+* Version: v0.0.0-20260603220949-865597e52e25
+* License: Apache-2.0
 
 #### LICENSE
 
+<https://github.com/kubernetes/kube-openapi/blob/865597e52e25/pkg/validation/spec/LICENSE>
+
 ```text
 
                                  Apache License
@@ -14735,11 +15107,14 @@ OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
 ### k8s.io/kubectl/pkg
 
-* License: Apache-2.0
 * Module: k8s.io/kubectl
+* Version: v0.36.0
+* License: Apache-2.0
 
 #### LICENSE
 
+<https://github.com/kubernetes/kubectl/blob/v0.36.0/LICENSE>
+
 ```text
                                  Apache License
                            Version 2.0, January 2004
@@ -14948,11 +15323,14 @@ OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
 ### k8s.io/utils
 
-* License: Apache-2.0
 * Module: k8s.io/utils
+* Version: v0.0.0-20260507154919-ff6756f316d2
+* License: Apache-2.0
 
 #### LICENSE
 
+<https://github.com/kubernetes/utils/blob/ff6756f316d2/LICENSE>
+
 ```text
 
                                  Apache License
@@ -15162,11 +15540,14 @@ OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
 ### k8s.io/utils/internal/third_party/forked/golang
 
-* License: BSD-3-Clause
 * Module: k8s.io/utils
+* Version: v0.0.0-20260507154919-ff6756f316d2
+* License: BSD-3-Clause
 
 #### LICENSE
 
+<https://github.com/kubernetes/utils/blob/ff6756f316d2/internal/third_party/forked/golang/LICENSE>
+
 ```text
 Copyright (c) 2012 The Go Authors. All rights reserved.
 
@@ -15201,11 +15582,14 @@ OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
 ### k8s.io/utils/third_party/forked/golang/btree
 
-* License: Apache-2.0
 * Module: k8s.io/utils
+* Version: v0.0.0-20260507154919-ff6756f316d2
+* License: Apache-2.0
 
 #### LICENSE
 
+<https://github.com/kubernetes/utils/blob/ff6756f316d2/third_party/forked/golang/btree/LICENSE>
+
 ```text
 
                                  Apache License
@@ -15414,11 +15798,14 @@ OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
 ### sigs.k8s.io/controller-runtime
 
-* License: Apache-2.0
 * Module: sigs.k8s.io/controller-runtime
+* Version: v0.24.1
+* License: Apache-2.0
 
 #### LICENSE
 
+<https://github.com/kubernetes-sigs/controller-runtime/blob/v0.24.1/LICENSE>
+
 ```text
                                  Apache License
                            Version 2.0, January 2004
@@ -15627,11 +16014,14 @@ OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
 ### sigs.k8s.io/json
 
-* License: Apache-2.0 / BSD-3-Clause
 * Module: sigs.k8s.io/json
+* Version: v0.0.0-20250730193827-2d320260d730
+* License: Apache-2.0 / BSD-3-Clause
 
 #### LICENSE
 
+<https://github.com/kubernetes-sigs/json/blob/2d320260d730/LICENSE>
+
 ```text
 Files other than internal/golang/* licensed under:
 
@@ -15877,11 +16267,14 @@ OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
 ### sigs.k8s.io/kustomize/api
 
-* License: Apache-2.0
 * Module: sigs.k8s.io/kustomize/api
+* Version: v0.21.1
+* License: Apache-2.0
 
 #### LICENSE
 
+<https://github.com/kubernetes-sigs/kustomize/blob/api/v0.21.1/LICENSE>
+
 ```text
                                  Apache License
                            Version 2.0, January 2004
@@ -16090,11 +16483,14 @@ OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
 ### sigs.k8s.io/kustomize/kyaml
 
-* License: Apache-2.0
 * Module: sigs.k8s.io/kustomize/kyaml
+* Version: v0.21.1
+* License: Apache-2.0
 
 #### LICENSE
 
+<https://github.com/kubernetes-sigs/kustomize/blob/kyaml/v0.21.1/LICENSE>
+
 ```text
                                  Apache License
                            Version 2.0, January 2004
@@ -16303,11 +16699,14 @@ OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
 ### sigs.k8s.io/randfill
 
-* License: Apache-2.0
 * Module: sigs.k8s.io/randfill
+* Version: v1.0.0
+* License: Apache-2.0
 
 #### LICENSE
 
+<https://github.com/kubernetes-sigs/randfill/blob/v1.0.0/LICENSE>
+
 ```text
                                  Apache License
                            Version 2.0, January 2004
@@ -16516,6 +16915,8 @@ OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
 #### NOTICE
 
+<https://github.com/kubernetes-sigs/randfill/blob/v1.0.0/NOTICE>
+
 ```text
 When donating the randfill project to the CNCF, we could not reach all the
 gofuzz contributors to sign the CNCF CLA. As such, according to the CNCF rules
@@ -16547,11 +16948,14 @@ Submitted on behalf of a third-party: @disconnect3d (Disconnect3d)
 
 ### sigs.k8s.io/structured-merge-diff/v6
 
-* License: Apache-2.0
 * Module: sigs.k8s.io/structured-merge-diff/v6
+* Version: v6.4.0
+* License: Apache-2.0
 
 #### LICENSE
 
+<https://github.com/kubernetes-sigs/structured-merge-diff/blob/v6.4.0/LICENSE>
+
 ```text
                                  Apache License
                            Version 2.0, January 2004
@@ -16760,11 +17164,14 @@ Submitted on behalf of a third-party: @disconnect3d (Disconnect3d)
 
 ### sigs.k8s.io/yaml
 
-* License: Apache-2.0 / BSD-3-Clause / MIT
 * Module: sigs.k8s.io/yaml
+* Version: v1.6.0
+* License: Apache-2.0 / BSD-3-Clause / MIT
 
 #### LICENSE
 
+<https://github.com/kubernetes-sigs/yaml/blob/v1.6.0/LICENSE>
+
 ```text
 The MIT License (MIT)
 
diff --git a/tools/generate-third-party-notices.sh b/tools/generate-third-party-notices.sh
index b45ba7935..40b4ad1e3 100755
--- a/tools/generate-third-party-notices.sh
+++ b/tools/generate-third-party-notices.sh
@@ -400,6 +400,13 @@ shipped; its dependencies are listed here as well rather than excluded. Go
 standard library packages are excluded; they are covered by the license of the
 Go distribution itself.
 
+Each dependency is listed with the module that owns it, the version
+redistributed, and a link to the license file in that version's upstream
+source. Every link was verified by fetching it and comparing its contents
+against the copy vendored here, so each one resolves to the same license text
+reproduced below. Dependencies vendored only to build or test the operator are
+not redistributed and are not listed.
+
 The `gpu-operator` image uses `nvcr.io/nvidia/distroless/cc` as a base image.
 All of the OSS packages and source included in this image can be found at
 <https://developer.nvidia.com/w/distroless-oss/index.html>. A statically

From e327a05714843b1d947f4659714ddcd329b10dbe Mon Sep 17 00:00:00 2001
From: Abrar Shivani <ashivani@nvidia.com>
Date: Mon, 24 Aug 2026 16:43:15 -0700
Subject: [PATCH 10/18] Close the remaining gaps in the third-party notices
 fail-closed chain

- location_cell and verify-license-urls.sh's per-package loop can each
  find zero license files without dying, producing a blank Location cell
  or a silent pass; both now fail closed.
- location_for treats an empty URL field as a match instead of a miss.
- emit_sections swallowed a license_dir_within_module failure and could
  publish a link resolved against the wrong directory; it now dies like
  location_cell.
- fence_for propagated grep's no-match exit status through pipefail,
  which is harmless today only because every caller is inside a command
  substitution.
- resolve-module-repos.sh died on any unresolved module, including the
  build/test-only ones out of scope for the notices document; downgraded
  to a warning since verify-license-urls.sh already enforces fail-closed
  for in-scope modules.
- test-tools wasn't wired into any CI-run target, so the regression tests
  guarding these paths never ran automatically; added it to CHECK_TARGETS.
- Three regression tests sourced the generator by a repo-root-relative
  path and passed vacuously outside the repo root; they now take the
  absolute path.
- Reworded the notices header sentence that contradicted the adjacent
  gpuop-cfg text to state the rule the tooling actually implements, and
  regenerated THIRD_PARTY_NOTICES.md (prose only; all 124 rows and every
  license text are unchanged).

Signed-off-by: Abrar Shivani <ashivani@nvidia.com>
---
 Makefile                                   |  2 +-
 THIRD_PARTY_NOTICES.md                     |  4 ++--
 tools/generate-third-party-notices.sh      | 13 +++++++++----
 tools/generate-third-party-notices_test.sh |  8 +++++---
 tools/resolve-module-repos.sh              | 16 +++++++++++++---
 tools/verify-license-urls.sh               |  7 +++++++
 6 files changed, 37 insertions(+), 13 deletions(-)

diff --git a/Makefile b/Makefile
index da601f75e..881e69e50 100644
--- a/Makefile
+++ b/Makefile
@@ -144,7 +144,7 @@ push-bundle-image: build-bundle-image
 CMDS := $(patsubst ./cmd/%/,%,$(sort $(dir $(wildcard ./cmd/*/))))
 CMD_TARGETS := $(patsubst %,cmd-%, $(CMDS))
 
-CHECK_TARGETS := lint license-check validate-modules validate-generated-assets
+CHECK_TARGETS := lint license-check validate-modules validate-generated-assets test-tools
 MAKE_TARGETS := build check coverage cmds $(CMD_TARGETS) $(CHECK_TARGETS)
 DOCKER_TARGETS := $(patsubst %,docker-%, $(MAKE_TARGETS))
 .PHONY: $(MAKE_TARGETS) $(DOCKER_TARGETS)
diff --git a/THIRD_PARTY_NOTICES.md b/THIRD_PARTY_NOTICES.md
index 705e86e2b..d961cf5aa 100644
--- a/THIRD_PARTY_NOTICES.md
+++ b/THIRD_PARTY_NOTICES.md
@@ -16,8 +16,8 @@ Each dependency is listed with the module that owns it, the version
 redistributed, and a link to the license file in that version's upstream
 source. Every link was verified by fetching it and comparing its contents
 against the copy vendored here, so each one resolves to the same license text
-reproduced below. Dependencies vendored only to build or test the operator are
-not redistributed and are not listed.
+reproduced below. Modules that no command under `cmd/` links — those vendored
+only for this module's own tests and build tooling — are not listed.
 
 The `gpu-operator` image uses `nvcr.io/nvidia/distroless/cc` as a base image.
 All of the OSS packages and source included in this image can be found at
diff --git a/tools/generate-third-party-notices.sh b/tools/generate-third-party-notices.sh
index 40b4ad1e3..83ef9ff61 100755
--- a/tools/generate-third-party-notices.sh
+++ b/tools/generate-third-party-notices.sh
@@ -52,7 +52,7 @@ fence_for() {
     # -a: a license holding a NUL byte would otherwise print "Binary file ...
     # matches" instead of the matches, on stdout or stderr depending on the grep.
     longest=$(LC_ALL=C grep -oaE '`+' "${file}" 2>/dev/null \
-        | awk '{ if (length($0) > m) m = length($0) } END { print m+0 }')
+        | awk '{ if (length($0) > m) m = length($0) } END { print m+0 }' || true)
     width=$(( longest + 1 ))
     (( width < 3 )) && width=3
     printf '%*s' "${width}" '' | tr ' ' '`'
@@ -303,6 +303,7 @@ location_for() {
     url="$(LC_ALL=C awk -F'\t' -v m="$1" -v v="$2" -v p="$3" \
         '$1 == m && $2 == v && $3 == p { print $4; found = 1; exit }
          END { exit !found }' "${LICENSE_URLS}")" || return 1
+    [[ -n "${url}" ]] || return 1
     printf '%s' "${url}"
 }
 
@@ -323,6 +324,8 @@ location_cell() {
                    "Run 'make third-party-notices-urls' (needs network) and commit the result."
         cell="${cell:+${cell} / }[${name}](${url})"
     done < <(license_files_for "${LICENSES_DIR}/${package}")
+    [[ -n "${cell}" ]] || die "no license file for ${package} under ${LICENSES_DIR}." \
+                              "Run 'make third-party-notices' and re-run."
     printf '%s' "${cell}"
 }
 
@@ -361,7 +364,9 @@ emit_sections() {
         if (( ${#files[@]} == 0 )); then
             printf 'License text unavailable. See upstream source for the full license.\n'
         else
-            relative="$(license_dir_within_module "${package}" "${module}")" || relative=""
+            relative="$(license_dir_within_module "${package}" "${module}")" \
+                || die "no license file found for ${package} under ${VENDOR_DIR}/${module}." \
+                       "Run 'go mod vendor' and re-run."
             for lf in "${files[@]}"; do
                 name="$(basename "${lf}")"
                 url="$(location_for "${module}" "${version}" "${relative:+${relative}/}${name}")" \
@@ -404,8 +409,8 @@ Each dependency is listed with the module that owns it, the version
 redistributed, and a link to the license file in that version's upstream
 source. Every link was verified by fetching it and comparing its contents
 against the copy vendored here, so each one resolves to the same license text
-reproduced below. Dependencies vendored only to build or test the operator are
-not redistributed and are not listed.
+reproduced below. Modules that no command under `cmd/` links — those vendored
+only for this module's own tests and build tooling — are not listed.
 
 The `gpu-operator` image uses `nvcr.io/nvidia/distroless/cc` as a base image.
 All of the OSS packages and source included in this image can be found at
diff --git a/tools/generate-third-party-notices_test.sh b/tools/generate-third-party-notices_test.sh
index ea38ae015..aca382f6c 100644
--- a/tools/generate-third-party-notices_test.sh
+++ b/tools/generate-third-party-notices_test.sh
@@ -75,7 +75,8 @@ assert_eq "https://example.invalid/xxhash" \
     "location_for finds a nested license path"
 assert_fails "location_for fails closed on a miss" \
     env LICENSE_URLS="${urls_fixture}" bash -c \
-    'source tools/generate-third-party-notices.sh; location_for github.com/nope v1.0.0 LICENSE'
+    'source "$1"; location_for github.com/nope v1.0.0 LICENSE' \
+    _ "${HERE}/generate-third-party-notices.sh"
 
 vendor_fixture="$(mktemp -d)"
 mkdir -p "${vendor_fixture}/github.com/klauspost/compress/zstd/internal/xxhash"
@@ -91,7 +92,8 @@ assert_eq "" \
     "license_dir_within_module is empty at the module root"
 assert_fails "license_dir_within_module fails when no license exists" \
     env VENDOR_DIR="${vendor_fixture}" bash -c \
-    'source tools/generate-third-party-notices.sh; license_dir_within_module github.com/absent/mod github.com/absent/mod'
+    'source "$1"; license_dir_within_module github.com/absent/mod github.com/absent/mod' \
+    _ "${HERE}/generate-third-party-notices.sh"
 
 render="$(mktemp -d)"
 mkdir -p "${render}/cache/github.com/klauspost/compress/zstd/internal/xxhash"
@@ -117,7 +119,7 @@ github.com/klauspost/compress/zstd/internal/xxhash,ignored,MIT,github.com/klausp
 IDX
 assert_fails "emit_index_table fails closed when the URL map has no entry for a row" \
     env LICENSE_URLS="${urls_fixture}" VENDOR_DIR="${vendor_fixture}" LICENSES_DIR="${render}/cache" \
-    bash -c 'source tools/generate-third-party-notices.sh; emit_index_table "$1"' _ "${mismatch_index}"
+    bash -c 'source "$1"; emit_index_table "$2"' _ "${HERE}/generate-third-party-notices.sh" "${mismatch_index}"
 
 section="$(LICENSE_URLS="${urls_fixture}" VENDOR_DIR="${vendor_fixture}" LICENSES_DIR="${render}/cache" \
     emit_sections "${render}/index.csv" "${render}/cache")"
diff --git a/tools/resolve-module-repos.sh b/tools/resolve-module-repos.sh
index d02b83114..c2f1a9513 100755
--- a/tools/resolve-module-repos.sh
+++ b/tools/resolve-module-repos.sh
@@ -86,6 +86,7 @@ main() {
     trap 'rm -f "${tmp}"' EXIT
 
     local module version info repo prefix subdir meta converted
+    local unresolved_modules=""
     while read -r module version; do
         [[ -z "${module}" ]] && continue
 
@@ -118,6 +119,7 @@ main() {
         if [[ -z "${repo}" ]]; then
             log "UNRESOLVED ${module}: no repository could be determined"
             unresolved=$(( unresolved + 1 ))
+            unresolved_modules="${unresolved_modules}${unresolved_modules:+ }${module}"
             continue
         fi
 
@@ -135,9 +137,17 @@ main() {
         printf '%s\t%s\t%s\n' "${module}" "${repo}" "${subdir}" >> "${tmp}"
     done < <(LC_ALL=C grep '^# ' "${MODULES_TXT}" | awk '{print $2, $3}')
 
-    (( unresolved == 0 )) || die \
-        "${unresolved} module(s) could not be resolved to a repository." \
-        "Re-run; if the failure persists the module's vanity host is unreachable."
+    # A warning, not a die: this resolves every module in modules.txt, including
+    # the ten-odd build/test-only ones out of scope for the notices document, so
+    # an unreachable vanity host on one of those must not block refreshing
+    # notices for an unrelated shipped bump. Fail-closed is still preserved —
+    # tools/verify-license-urls.sh dies when an IN-SCOPE module has no entry in
+    # this map. Do not turn this back into a die without also scoping the loop
+    # above to shipped modules only.
+    if (( unresolved > 0 )); then
+        log "WARNING: ${unresolved} module(s) could not be resolved to a repository: ${unresolved_modules}"
+        log "Re-run; if the warning persists the module's vanity host is unreachable."
+    fi
 
     {
         printf '# Upstream repository for each vendored module.\n'
diff --git a/tools/verify-license-urls.sh b/tools/verify-license-urls.sh
index e2a6c0d55..bc94c48aa 100644
--- a/tools/verify-license-urls.sh
+++ b/tools/verify-license-urls.sh
@@ -152,8 +152,10 @@ main() {
         relative="$(license_dir_within_module "${package}" "${module}")" \
             || die "no license file found for ${package} under ${VENDOR_DIR}/${module}."
 
+        local license_file_count=0
         while IFS= read -r lf; do
             [[ -z "${lf}" ]] && continue
+            license_file_count=$(( license_file_count + 1 ))
             name="$(basename "${lf}")"
             path_in_module="${relative:+${relative}/}${name}"
             [[ -f "${VENDOR_DIR}/${module}/${path_in_module}" ]] \
@@ -192,6 +194,11 @@ main() {
             fi
             printf '%s\t%s\t%s\t%s\n' "${module}" "${version}" "${path_in_module}" "${found}" >> "${tmp}"
         done < <(license_files_for "${LICENSES_DIR}/${package}")
+
+        if (( license_file_count == 0 )); then
+            log "UNVERIFIED ${module}@${version} — no license file found for ${package}"
+            failures=$(( failures + 1 ))
+        fi
     done < "${INDEX_FILE}"
 
     (( failures == 0 )) || die \

From 46006bb6c27de23323157f99c5aac7a0b21e831c Mon Sep 17 00:00:00 2001
From: Abrar Shivani <ashivani@nvidia.com>
Date: Mon, 24 Aug 2026 16:56:58 -0700
Subject: [PATCH 11/18] Silence shellcheck source/unused-variable notes in
 tools/

Add shellcheck disable=SC1091 alongside the existing source= directives
so shellcheck's static-only run (no -x) stays quiet about sourced
sibling scripts. Discard the unused license CSV field in
verify-license-urls.sh with _ instead of a named unused variable, and
mark the deliberately single-quoted bash -c bodies in the notices test
with disable=SC2016. No behavior changes.

Signed-off-by: Abrar Shivani <ashivani@nvidia.com>
---
 tools/generate-third-party-notices_test.sh | 12 ++++++++++--
 tools/license-url-lib_test.sh              |  2 ++
 tools/resolve-module-repos.sh              |  2 +-
 tools/verify-license-urls.sh               |  8 ++++----
 4 files changed, 17 insertions(+), 7 deletions(-)

diff --git a/tools/generate-third-party-notices_test.sh b/tools/generate-third-party-notices_test.sh
index aca382f6c..c6424b822 100644
--- a/tools/generate-third-party-notices_test.sh
+++ b/tools/generate-third-party-notices_test.sh
@@ -17,7 +17,7 @@
 set -uo pipefail
 
 HERE="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-# shellcheck source=tools/test-helpers.sh
+# shellcheck source=tools/test-helpers.sh disable=SC1091
 source "${HERE}/test-helpers.sh"
 
 # If the guard ever regresses, sourcing must not overwrite the committed
@@ -25,7 +25,7 @@ source "${HERE}/test-helpers.sh"
 OUTPUT="$(mktemp)"
 export OUTPUT
 
-# shellcheck source=tools/generate-third-party-notices.sh
+# shellcheck source=tools/generate-third-party-notices.sh disable=SC1091
 source "${HERE}/generate-third-party-notices.sh"
 
 # If the guard is missing, sourcing runs the generator and exits before here.
@@ -73,6 +73,8 @@ assert_eq "https://example.invalid/xxhash" \
     "$(LICENSE_URLS="${urls_fixture}" location_for \
         github.com/klauspost/compress v1.19.1 zstd/internal/xxhash/LICENSE.txt)" \
     "location_for finds a nested license path"
+# $1 is expanded by the child bash -c, not here.
+# shellcheck disable=SC2016
 assert_fails "location_for fails closed on a miss" \
     env LICENSE_URLS="${urls_fixture}" bash -c \
     'source "$1"; location_for github.com/nope v1.0.0 LICENSE' \
@@ -90,6 +92,8 @@ assert_eq "" \
     "$(VENDOR_DIR="${vendor_fixture}" license_dir_within_module \
         github.com/klauspost/compress github.com/klauspost/compress)" \
     "license_dir_within_module is empty at the module root"
+# $1 is expanded by the child bash -c, not here.
+# shellcheck disable=SC2016
 assert_fails "license_dir_within_module fails when no license exists" \
     env VENDOR_DIR="${vendor_fixture}" bash -c \
     'source "$1"; license_dir_within_module github.com/absent/mod github.com/absent/mod' \
@@ -106,6 +110,8 @@ assert_eq '| Package | Module | Version | License | Location |' \
     "$(LICENSE_URLS="${urls_fixture}" VENDOR_DIR="${vendor_fixture}" LICENSES_DIR="${render}/cache" \
        emit_index_table "${render}/index.csv" | sed -n 1p)" \
     "index header has five columns"
+# Expected literal Markdown, not shell expansion.
+# shellcheck disable=SC2016
 assert_eq '| `github.com/klauspost/compress/zstd/internal/xxhash` | `github.com/klauspost/compress` | v1.19.1 | MIT | [LICENSE.txt](https://example.invalid/xxhash) |' \
     "$(LICENSE_URLS="${urls_fixture}" VENDOR_DIR="${vendor_fixture}" LICENSES_DIR="${render}/cache" \
        emit_index_table "${render}/index.csv" | sed -n 3p)" \
@@ -117,6 +123,8 @@ mismatch_index="${render}/mismatch-index.csv"
 cat > "${mismatch_index}" <<'IDX'
 github.com/klauspost/compress/zstd/internal/xxhash,ignored,MIT,github.com/klauspost/compress,v9.9.9
 IDX
+# $1/$2 are expanded by the child bash -c, not here.
+# shellcheck disable=SC2016
 assert_fails "emit_index_table fails closed when the URL map has no entry for a row" \
     env LICENSE_URLS="${urls_fixture}" VENDOR_DIR="${vendor_fixture}" LICENSES_DIR="${render}/cache" \
     bash -c 'source "$1"; emit_index_table "$2"' _ "${HERE}/generate-third-party-notices.sh" "${mismatch_index}"
diff --git a/tools/license-url-lib_test.sh b/tools/license-url-lib_test.sh
index 99a1f577d..c5e64f512 100644
--- a/tools/license-url-lib_test.sh
+++ b/tools/license-url-lib_test.sh
@@ -16,7 +16,9 @@
 
 set -uo pipefail
 HERE="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+# shellcheck source=tools/test-helpers.sh disable=SC1091
 source "${HERE}/test-helpers.sh"
+# shellcheck source=tools/license-url-lib.sh disable=SC1091
 source "${HERE}/license-url-lib.sh"
 
 # The bug that silently broke proxy resolution for all ten uppercase modules.
diff --git a/tools/resolve-module-repos.sh b/tools/resolve-module-repos.sh
index c2f1a9513..ed46252d7 100755
--- a/tools/resolve-module-repos.sh
+++ b/tools/resolve-module-repos.sh
@@ -27,7 +27,7 @@
 set -euo pipefail
 
 HERE="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-# shellcheck source=tools/license-url-lib.sh
+# shellcheck source=tools/license-url-lib.sh disable=SC1091
 source "${HERE}/license-url-lib.sh"
 
 MODULES_TXT="${MODULES_TXT:-vendor/modules.txt}"
diff --git a/tools/verify-license-urls.sh b/tools/verify-license-urls.sh
index bc94c48aa..1e9bffdfd 100644
--- a/tools/verify-license-urls.sh
+++ b/tools/verify-license-urls.sh
@@ -27,9 +27,9 @@
 set -euo pipefail
 
 HERE="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-# shellcheck source=tools/license-url-lib.sh
+# shellcheck source=tools/license-url-lib.sh disable=SC1091
 source "${HERE}/license-url-lib.sh"
-# shellcheck source=tools/generate-third-party-notices.sh
+# shellcheck source=tools/generate-third-party-notices.sh disable=SC1091
 source "${HERE}/generate-third-party-notices.sh"
 
 REPOS_MAP="${REPOS_MAP:-tools/module-repos.tsv}"
@@ -105,9 +105,9 @@ main() {
     local tmp failures=0
     tmp="$(mktemp "${TMPDIR:-/tmp}/gpu-operator-urls.XXXXXX")"
 
-    local package _ license module version repo subdir relative
+    local package _ module version repo subdir relative
     local origin_tag origin_hash plain pseudo lf name path_in_module want_sha found
-    while IFS=, read -r package _ license module version; do
+    while IFS=, read -r package _ _ module version; do
         [[ -z "${package}" ]] && continue
 
         repo="$(repo_field "${module}" repo)" \

From edfea239cadaad2720a8f8bc7647f938e531e470 Mon Sep 17 00:00:00 2001
From: Abrar Shivani <ashivani@nvidia.com>
Date: Mon, 24 Aug 2026 17:27:36 -0700
Subject: [PATCH 12/18] Recover secondary license files dropped from
 third-party notices

license_files_for enumerated licenses from the go-licenses save cache,
which keeps only the single file go-licenses classifies as the license
per package. Sibling license files in the same vendor directory - a
second license, a PATENTS grant, a docs license - were silently
dropped, and tools/verify-license-urls.sh enumerated the same cache,
so the URL map agreed with the omission and nothing caught it.

Switch all three enumeration call sites to the governing directory in
vendor/ that license_dir_within_module already computes, rather than
the cache. Enumerating straight from vendor/ can now match a genuine
source file that starts with a license-shaped header (kube-openapi's
pkg/validation/spec/license.go), so license_files_for gets an
extension exclusion for common source file types.

Recovers 15 previously unattributed files: PATENTS grants for every
golang.org/x/* module and google.golang.org/protobuf, LICENSE.libyaml
for the embedded libyaml port in go.yaml.in/yaml/v2, LICENSE.docs in
opencontainers/go-digest, and PATENTS/AUTHORS files nested under
third_party subpackages of several k8s.io modules.

Signed-off-by: Abrar Shivani <ashivani@nvidia.com>
---
 THIRD_PARTY_NOTICES.md                     | 873 ++++++++++++++++++++-
 tools/generate-third-party-notices.sh      |  37 +-
 tools/generate-third-party-notices_test.sh |   7 +
 tools/license-urls.tsv                     |  15 +
 tools/verify-license-urls.sh               |   2 +-
 5 files changed, 905 insertions(+), 29 deletions(-)

diff --git a/THIRD_PARTY_NOTICES.md b/THIRD_PARTY_NOTICES.md
index d961cf5aa..1ce6116d0 100644
--- a/THIRD_PARTY_NOTICES.md
+++ b/THIRD_PARTY_NOTICES.md
@@ -88,7 +88,7 @@ carry.
 | `github.com/monochromegane/go-gitignore` | `github.com/monochromegane/go-gitignore` | v0.0.0-20200626010858-205db1a8cc00 | MIT | [LICENSE](https://github.com/monochromegane/go-gitignore/blob/205db1a8cc00/LICENSE) |
 | `github.com/munnerz/goautoneg` | `github.com/munnerz/goautoneg` | v0.0.0-20191010083416-a7dc8b61c822 | BSD-3-Clause | [LICENSE](https://github.com/munnerz/goautoneg/blob/a7dc8b61c822/LICENSE) |
 | `github.com/opencontainers/cgroups/devices/config` | `github.com/opencontainers/cgroups` | v0.0.7 | Apache-2.0 | [LICENSE](https://github.com/opencontainers/cgroups/blob/v0.0.7/LICENSE) |
-| `github.com/opencontainers/go-digest` | `github.com/opencontainers/go-digest` | v1.0.0 | Apache-2.0 | [LICENSE](https://github.com/opencontainers/go-digest/blob/v1.0.0/LICENSE) |
+| `github.com/opencontainers/go-digest` | `github.com/opencontainers/go-digest` | v1.0.0 | Apache-2.0 | [LICENSE](https://github.com/opencontainers/go-digest/blob/v1.0.0/LICENSE) / [LICENSE.docs](https://github.com/opencontainers/go-digest/blob/v1.0.0/LICENSE.docs) |
 | `github.com/opencontainers/runc/libcontainer/devices` | `github.com/opencontainers/runc` | v1.4.3 | Apache-2.0 | [LICENSE](https://github.com/opencontainers/runc/blob/v1.4.3/LICENSE) / [NOTICE](https://github.com/opencontainers/runc/blob/v1.4.3/NOTICE) |
 | `github.com/openshift/api` | `github.com/openshift/api` | v0.0.0-20260727141720-967cc4c36c9b | Apache-2.0 | [LICENSE](https://github.com/openshift/api/blob/967cc4c36c9b/LICENSE) |
 | `github.com/openshift/client-go` | `github.com/openshift/client-go` | v0.0.0-20260723174158-ae2315de9d73 | Apache-2.0 | [LICENSE](https://github.com/openshift/client-go/blob/ae2315de9d73/LICENSE) |
@@ -115,38 +115,38 @@ carry.
 | `github.com/xlab/treeprint` | `github.com/xlab/treeprint` | v1.2.0 | MIT | [LICENSE](https://github.com/xlab/treeprint/blob/v1.2.0/LICENSE) |
 | `go.uber.org/multierr` | `go.uber.org/multierr` | v1.11.0 | MIT | [LICENSE.txt](https://github.com/uber-go/multierr/blob/v1.11.0/LICENSE.txt) |
 | `go.uber.org/zap` | `go.uber.org/zap` | v1.28.0 | MIT | [LICENSE](https://github.com/uber-go/zap/blob/v1.28.0/LICENSE) |
-| `go.yaml.in/yaml/v2` | `go.yaml.in/yaml/v2` | v2.4.4 | Apache-2.0 | [LICENSE](https://github.com/yaml/go-yaml/blob/v2.4.4/LICENSE) / [NOTICE](https://github.com/yaml/go-yaml/blob/v2.4.4/NOTICE) |
+| `go.yaml.in/yaml/v2` | `go.yaml.in/yaml/v2` | v2.4.4 | Apache-2.0 | [LICENSE](https://github.com/yaml/go-yaml/blob/v2.4.4/LICENSE) / [LICENSE.libyaml](https://github.com/yaml/go-yaml/blob/v2.4.4/LICENSE.libyaml) / [NOTICE](https://github.com/yaml/go-yaml/blob/v2.4.4/NOTICE) |
 | `go.yaml.in/yaml/v3` | `go.yaml.in/yaml/v3` | v3.0.4 | MIT | [LICENSE](https://github.com/yaml/go-yaml/blob/v3.0.4/LICENSE) / [NOTICE](https://github.com/yaml/go-yaml/blob/v3.0.4/NOTICE) |
-| `golang.org/x/crypto` | `golang.org/x/crypto` | v0.55.0 | BSD-3-Clause | [LICENSE](https://go.googlesource.com/crypto/+/refs/tags/v0.55.0/LICENSE) |
-| `golang.org/x/mod/semver` | `golang.org/x/mod` | v0.40.0 | BSD-3-Clause | [LICENSE](https://go.googlesource.com/mod/+/refs/tags/v0.40.0/LICENSE) |
-| `golang.org/x/net` | `golang.org/x/net` | v0.58.0 | BSD-3-Clause | [LICENSE](https://go.googlesource.com/net/+/refs/tags/v0.58.0/LICENSE) |
+| `golang.org/x/crypto` | `golang.org/x/crypto` | v0.55.0 | BSD-3-Clause | [LICENSE](https://go.googlesource.com/crypto/+/refs/tags/v0.55.0/LICENSE) / [PATENTS](https://go.googlesource.com/crypto/+/refs/tags/v0.55.0/PATENTS) |
+| `golang.org/x/mod/semver` | `golang.org/x/mod` | v0.40.0 | BSD-3-Clause | [LICENSE](https://go.googlesource.com/mod/+/refs/tags/v0.40.0/LICENSE) / [PATENTS](https://go.googlesource.com/mod/+/refs/tags/v0.40.0/PATENTS) |
+| `golang.org/x/net` | `golang.org/x/net` | v0.58.0 | BSD-3-Clause | [LICENSE](https://go.googlesource.com/net/+/refs/tags/v0.58.0/LICENSE) / [PATENTS](https://go.googlesource.com/net/+/refs/tags/v0.58.0/PATENTS) |
 | `golang.org/x/oauth2` | `golang.org/x/oauth2` | v0.36.0 | BSD-3-Clause | [LICENSE](https://go.googlesource.com/oauth2/+/refs/tags/v0.36.0/LICENSE) |
-| `golang.org/x/sync/errgroup` | `golang.org/x/sync` | v0.22.0 | BSD-3-Clause | [LICENSE](https://go.googlesource.com/sync/+/refs/tags/v0.22.0/LICENSE) |
-| `golang.org/x/sys/unix` | `golang.org/x/sys` | v0.47.0 | BSD-3-Clause | [LICENSE](https://go.googlesource.com/sys/+/refs/tags/v0.47.0/LICENSE) |
-| `golang.org/x/term` | `golang.org/x/term` | v0.45.0 | BSD-3-Clause | [LICENSE](https://go.googlesource.com/term/+/refs/tags/v0.45.0/LICENSE) |
-| `golang.org/x/text` | `golang.org/x/text` | v0.41.0 | BSD-3-Clause | [LICENSE](https://go.googlesource.com/text/+/refs/tags/v0.41.0/LICENSE) |
-| `golang.org/x/time/rate` | `golang.org/x/time` | v0.14.0 | BSD-3-Clause | [LICENSE](https://go.googlesource.com/time/+/refs/tags/v0.14.0/LICENSE) |
+| `golang.org/x/sync/errgroup` | `golang.org/x/sync` | v0.22.0 | BSD-3-Clause | [LICENSE](https://go.googlesource.com/sync/+/refs/tags/v0.22.0/LICENSE) / [PATENTS](https://go.googlesource.com/sync/+/refs/tags/v0.22.0/PATENTS) |
+| `golang.org/x/sys/unix` | `golang.org/x/sys` | v0.47.0 | BSD-3-Clause | [LICENSE](https://go.googlesource.com/sys/+/refs/tags/v0.47.0/LICENSE) / [PATENTS](https://go.googlesource.com/sys/+/refs/tags/v0.47.0/PATENTS) |
+| `golang.org/x/term` | `golang.org/x/term` | v0.45.0 | BSD-3-Clause | [LICENSE](https://go.googlesource.com/term/+/refs/tags/v0.45.0/LICENSE) / [PATENTS](https://go.googlesource.com/term/+/refs/tags/v0.45.0/PATENTS) |
+| `golang.org/x/text` | `golang.org/x/text` | v0.41.0 | BSD-3-Clause | [LICENSE](https://go.googlesource.com/text/+/refs/tags/v0.41.0/LICENSE) / [PATENTS](https://go.googlesource.com/text/+/refs/tags/v0.41.0/PATENTS) |
+| `golang.org/x/time/rate` | `golang.org/x/time` | v0.14.0 | BSD-3-Clause | [LICENSE](https://go.googlesource.com/time/+/refs/tags/v0.14.0/LICENSE) / [PATENTS](https://go.googlesource.com/time/+/refs/tags/v0.14.0/PATENTS) |
 | `gomodules.xyz/jsonpatch/v2` | `gomodules.xyz/jsonpatch/v2` | v2.4.0 | Apache-2.0 | [LICENSE](https://github.com/gomodules/jsonpatch/blob/v2.4.0/LICENSE) |
-| `google.golang.org/protobuf` | `google.golang.org/protobuf` | v1.36.12-0.20260120151049-f2248ac996af | BSD-3-Clause | [LICENSE](https://go.googlesource.com/protobuf/+/f2248ac996af/LICENSE) |
+| `google.golang.org/protobuf` | `google.golang.org/protobuf` | v1.36.12-0.20260120151049-f2248ac996af | BSD-3-Clause | [LICENSE](https://go.googlesource.com/protobuf/+/f2248ac996af/LICENSE) / [PATENTS](https://go.googlesource.com/protobuf/+/f2248ac996af/PATENTS) |
 | `gopkg.in/evanphx/json-patch.v4` | `gopkg.in/evanphx/json-patch.v4` | v4.13.0 | BSD-3-Clause | [LICENSE](https://github.com/evanphx/json-patch/blob/v4.13.0/LICENSE) |
 | `gopkg.in/inf.v0` | `gopkg.in/inf.v0` | v0.9.1 | BSD-3-Clause | [LICENSE](https://github.com/go-inf/inf/blob/v0.9.1/LICENSE) |
 | `gopkg.in/yaml.v3` | `gopkg.in/yaml.v3` | v3.0.1 | MIT | [LICENSE](https://github.com/go-yaml/yaml/blob/v3.0.1/LICENSE) / [NOTICE](https://github.com/go-yaml/yaml/blob/v3.0.1/NOTICE) |
 | `k8s.io/api` | `k8s.io/api` | v0.36.4 | Apache-2.0 | [LICENSE](https://github.com/kubernetes/api/blob/v0.36.4/LICENSE) |
 | `k8s.io/apiextensions-apiserver/pkg` | `k8s.io/apiextensions-apiserver` | v0.36.4 | Apache-2.0 | [LICENSE](https://github.com/kubernetes/apiextensions-apiserver/blob/v0.36.4/LICENSE) |
 | `k8s.io/apimachinery/pkg` | `k8s.io/apimachinery` | v0.36.4 | Apache-2.0 | [LICENSE](https://github.com/kubernetes/apimachinery/blob/v0.36.4/LICENSE) |
-| `k8s.io/apimachinery/third_party/forked/golang` | `k8s.io/apimachinery` | v0.36.4 | BSD-3-Clause | [LICENSE](https://github.com/kubernetes/apimachinery/blob/v0.36.4/third_party/forked/golang/LICENSE) |
+| `k8s.io/apimachinery/third_party/forked/golang` | `k8s.io/apimachinery` | v0.36.4 | BSD-3-Clause | [LICENSE](https://github.com/kubernetes/apimachinery/blob/v0.36.4/third_party/forked/golang/LICENSE) / [PATENTS](https://github.com/kubernetes/apimachinery/blob/v0.36.4/third_party/forked/golang/PATENTS) |
 | `k8s.io/cli-runtime/pkg` | `k8s.io/cli-runtime` | v0.36.0 | Apache-2.0 | [LICENSE](https://github.com/kubernetes/cli-runtime/blob/v0.36.0/LICENSE) |
 | `k8s.io/client-go` | `k8s.io/client-go` | v0.36.4 | Apache-2.0 | [LICENSE](https://github.com/kubernetes/client-go/blob/v0.36.4/LICENSE) |
-| `k8s.io/client-go/third_party/forked/golang/template` | `k8s.io/client-go` | v0.36.4 | BSD-3-Clause | [LICENSE](https://github.com/kubernetes/client-go/blob/v0.36.4/third_party/forked/golang/LICENSE) |
+| `k8s.io/client-go/third_party/forked/golang/template` | `k8s.io/client-go` | v0.36.4 | BSD-3-Clause | [LICENSE](https://github.com/kubernetes/client-go/blob/v0.36.4/third_party/forked/golang/LICENSE) / [PATENTS](https://github.com/kubernetes/client-go/blob/v0.36.4/third_party/forked/golang/PATENTS) |
 | `k8s.io/client-go/third_party/forked/httpcache` | `k8s.io/client-go` | v0.36.4 | MIT | [LICENSE](https://github.com/kubernetes/client-go/blob/v0.36.4/third_party/forked/httpcache/LICENSE) |
 | `k8s.io/component-base/version` | `k8s.io/component-base` | v0.36.4 | Apache-2.0 | [LICENSE](https://github.com/kubernetes/component-base/blob/v0.36.4/LICENSE) |
 | `k8s.io/klog/v2` | `k8s.io/klog/v2` | v2.140.0 | Apache-2.0 | [LICENSE](https://github.com/kubernetes/klog/blob/v2.140.0/LICENSE) |
 | `k8s.io/kube-openapi/pkg` | `k8s.io/kube-openapi` | v0.0.0-20260603220949-865597e52e25 | Apache-2.0 | [LICENSE](https://github.com/kubernetes/kube-openapi/blob/865597e52e25/LICENSE) |
-| `k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json` | `k8s.io/kube-openapi` | v0.0.0-20260603220949-865597e52e25 | BSD-3-Clause | [LICENSE](https://github.com/kubernetes/kube-openapi/blob/865597e52e25/pkg/internal/third_party/go-json-experiment/json/LICENSE) |
+| `k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json` | `k8s.io/kube-openapi` | v0.0.0-20260603220949-865597e52e25 | BSD-3-Clause | [AUTHORS](https://github.com/kubernetes/kube-openapi/blob/865597e52e25/pkg/internal/third_party/go-json-experiment/json/AUTHORS) / [LICENSE](https://github.com/kubernetes/kube-openapi/blob/865597e52e25/pkg/internal/third_party/go-json-experiment/json/LICENSE) |
 | `k8s.io/kube-openapi/pkg/validation/spec` | `k8s.io/kube-openapi` | v0.0.0-20260603220949-865597e52e25 | Apache-2.0 | [LICENSE](https://github.com/kubernetes/kube-openapi/blob/865597e52e25/pkg/validation/spec/LICENSE) |
 | `k8s.io/kubectl/pkg` | `k8s.io/kubectl` | v0.36.0 | Apache-2.0 | [LICENSE](https://github.com/kubernetes/kubectl/blob/v0.36.0/LICENSE) |
 | `k8s.io/utils` | `k8s.io/utils` | v0.0.0-20260507154919-ff6756f316d2 | Apache-2.0 | [LICENSE](https://github.com/kubernetes/utils/blob/ff6756f316d2/LICENSE) |
-| `k8s.io/utils/internal/third_party/forked/golang` | `k8s.io/utils` | v0.0.0-20260507154919-ff6756f316d2 | BSD-3-Clause | [LICENSE](https://github.com/kubernetes/utils/blob/ff6756f316d2/internal/third_party/forked/golang/LICENSE) |
+| `k8s.io/utils/internal/third_party/forked/golang` | `k8s.io/utils` | v0.0.0-20260507154919-ff6756f316d2 | BSD-3-Clause | [LICENSE](https://github.com/kubernetes/utils/blob/ff6756f316d2/internal/third_party/forked/golang/LICENSE) / [PATENTS](https://github.com/kubernetes/utils/blob/ff6756f316d2/internal/third_party/forked/golang/PATENTS) |
 | `k8s.io/utils/third_party/forked/golang/btree` | `k8s.io/utils` | v0.0.0-20260507154919-ff6756f316d2 | Apache-2.0 | [LICENSE](https://github.com/kubernetes/utils/blob/ff6756f316d2/third_party/forked/golang/btree/LICENSE) |
 | `sigs.k8s.io/controller-runtime` | `sigs.k8s.io/controller-runtime` | v0.24.1 | Apache-2.0 | [LICENSE](https://github.com/kubernetes-sigs/controller-runtime/blob/v0.24.1/LICENSE) |
 | `sigs.k8s.io/json` | `sigs.k8s.io/json` | v0.0.0-20250730193827-2d320260d730 | Apache-2.0 / BSD-3-Clause | [LICENSE](https://github.com/kubernetes-sigs/json/blob/2d320260d730/LICENSE) |
@@ -8896,6 +8896,439 @@ OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
 ```
 
+#### LICENSE.docs
+
+<https://github.com/opencontainers/go-digest/blob/v1.0.0/LICENSE.docs>
+
+```text
+Attribution-ShareAlike 4.0 International
+
+=======================================================================
+
+Creative Commons Corporation ("Creative Commons") is not a law firm and
+does not provide legal services or legal advice. Distribution of
+Creative Commons public licenses does not create a lawyer-client or
+other relationship. Creative Commons makes its licenses and related
+information available on an "as-is" basis. Creative Commons gives no
+warranties regarding its licenses, any material licensed under their
+terms and conditions, or any related information. Creative Commons
+disclaims all liability for damages resulting from their use to the
+fullest extent possible.
+
+Using Creative Commons Public Licenses
+
+Creative Commons public licenses provide a standard set of terms and
+conditions that creators and other rights holders may use to share
+original works of authorship and other material subject to copyright
+and certain other rights specified in the public license below. The
+following considerations are for informational purposes only, are not
+exhaustive, and do not form part of our licenses.
+
+     Considerations for licensors: Our public licenses are
+     intended for use by those authorized to give the public
+     permission to use material in ways otherwise restricted by
+     copyright and certain other rights. Our licenses are
+     irrevocable. Licensors should read and understand the terms
+     and conditions of the license they choose before applying it.
+     Licensors should also secure all rights necessary before
+     applying our licenses so that the public can reuse the
+     material as expected. Licensors should clearly mark any
+     material not subject to the license. This includes other CC-
+     licensed material, or material used under an exception or
+     limitation to copyright. More considerations for licensors:
+	wiki.creativecommons.org/Considerations_for_licensors
+
+     Considerations for the public: By using one of our public
+     licenses, a licensor grants the public permission to use the
+     licensed material under specified terms and conditions. If
+     the licensor's permission is not necessary for any reason--for
+     example, because of any applicable exception or limitation to
+     copyright--then that use is not regulated by the license. Our
+     licenses grant only permissions under copyright and certain
+     other rights that a licensor has authority to grant. Use of
+     the licensed material may still be restricted for other
+     reasons, including because others have copyright or other
+     rights in the material. A licensor may make special requests,
+     such as asking that all changes be marked or described.
+     Although not required by our licenses, you are encouraged to
+     respect those requests where reasonable. More_considerations
+     for the public:
+	wiki.creativecommons.org/Considerations_for_licensees
+
+=======================================================================
+
+Creative Commons Attribution-ShareAlike 4.0 International Public
+License
+
+By exercising the Licensed Rights (defined below), You accept and agree
+to be bound by the terms and conditions of this Creative Commons
+Attribution-ShareAlike 4.0 International Public License ("Public
+License"). To the extent this Public License may be interpreted as a
+contract, You are granted the Licensed Rights in consideration of Your
+acceptance of these terms and conditions, and the Licensor grants You
+such rights in consideration of benefits the Licensor receives from
+making the Licensed Material available under these terms and
+conditions.
+
+
+Section 1 -- Definitions.
+
+  a. Adapted Material means material subject to Copyright and Similar
+     Rights that is derived from or based upon the Licensed Material
+     and in which the Licensed Material is translated, altered,
+     arranged, transformed, or otherwise modified in a manner requiring
+     permission under the Copyright and Similar Rights held by the
+     Licensor. For purposes of this Public License, where the Licensed
+     Material is a musical work, performance, or sound recording,
+     Adapted Material is always produced where the Licensed Material is
+     synched in timed relation with a moving image.
+
+  b. Adapter's License means the license You apply to Your Copyright
+     and Similar Rights in Your contributions to Adapted Material in
+     accordance with the terms and conditions of this Public License.
+
+  c. BY-SA Compatible License means a license listed at
+     creativecommons.org/compatiblelicenses, approved by Creative
+     Commons as essentially the equivalent of this Public License.
+
+  d. Copyright and Similar Rights means copyright and/or similar rights
+     closely related to copyright including, without limitation,
+     performance, broadcast, sound recording, and Sui Generis Database
+     Rights, without regard to how the rights are labeled or
+     categorized. For purposes of this Public License, the rights
+     specified in Section 2(b)(1)-(2) are not Copyright and Similar
+     Rights.
+
+  e. Effective Technological Measures means those measures that, in the
+     absence of proper authority, may not be circumvented under laws
+     fulfilling obligations under Article 11 of the WIPO Copyright
+     Treaty adopted on December 20, 1996, and/or similar international
+     agreements.
+
+  f. Exceptions and Limitations means fair use, fair dealing, and/or
+     any other exception or limitation to Copyright and Similar Rights
+     that applies to Your use of the Licensed Material.
+
+  g. License Elements means the license attributes listed in the name
+     of a Creative Commons Public License. The License Elements of this
+     Public License are Attribution and ShareAlike.
+
+  h. Licensed Material means the artistic or literary work, database,
+     or other material to which the Licensor applied this Public
+     License.
+
+  i. Licensed Rights means the rights granted to You subject to the
+     terms and conditions of this Public License, which are limited to
+     all Copyright and Similar Rights that apply to Your use of the
+     Licensed Material and that the Licensor has authority to license.
+
+  j. Licensor means the individual(s) or entity(ies) granting rights
+     under this Public License.
+
+  k. Share means to provide material to the public by any means or
+     process that requires permission under the Licensed Rights, such
+     as reproduction, public display, public performance, distribution,
+     dissemination, communication, or importation, and to make material
+     available to the public including in ways that members of the
+     public may access the material from a place and at a time
+     individually chosen by them.
+
+  l. Sui Generis Database Rights means rights other than copyright
+     resulting from Directive 96/9/EC of the European Parliament and of
+     the Council of 11 March 1996 on the legal protection of databases,
+     as amended and/or succeeded, as well as other essentially
+     equivalent rights anywhere in the world.
+
+  m. You means the individual or entity exercising the Licensed Rights
+     under this Public License. Your has a corresponding meaning.
+
+
+Section 2 -- Scope.
+
+  a. License grant.
+
+       1. Subject to the terms and conditions of this Public License,
+          the Licensor hereby grants You a worldwide, royalty-free,
+          non-sublicensable, non-exclusive, irrevocable license to
+          exercise the Licensed Rights in the Licensed Material to:
+
+            a. reproduce and Share the Licensed Material, in whole or
+               in part; and
+
+            b. produce, reproduce, and Share Adapted Material.
+
+       2. Exceptions and Limitations. For the avoidance of doubt, where
+          Exceptions and Limitations apply to Your use, this Public
+          License does not apply, and You do not need to comply with
+          its terms and conditions.
+
+       3. Term. The term of this Public License is specified in Section
+          6(a).
+
+       4. Media and formats; technical modifications allowed. The
+          Licensor authorizes You to exercise the Licensed Rights in
+          all media and formats whether now known or hereafter created,
+          and to make technical modifications necessary to do so. The
+          Licensor waives and/or agrees not to assert any right or
+          authority to forbid You from making technical modifications
+          necessary to exercise the Licensed Rights, including
+          technical modifications necessary to circumvent Effective
+          Technological Measures. For purposes of this Public License,
+          simply making modifications authorized by this Section 2(a)
+          (4) never produces Adapted Material.
+
+       5. Downstream recipients.
+
+            a. Offer from the Licensor -- Licensed Material. Every
+               recipient of the Licensed Material automatically
+               receives an offer from the Licensor to exercise the
+               Licensed Rights under the terms and conditions of this
+               Public License.
+
+            b. Additional offer from the Licensor -- Adapted Material.
+               Every recipient of Adapted Material from You
+               automatically receives an offer from the Licensor to
+               exercise the Licensed Rights in the Adapted Material
+               under the conditions of the Adapter's License You apply.
+
+            c. No downstream restrictions. You may not offer or impose
+               any additional or different terms or conditions on, or
+               apply any Effective Technological Measures to, the
+               Licensed Material if doing so restricts exercise of the
+               Licensed Rights by any recipient of the Licensed
+               Material.
+
+       6. No endorsement. Nothing in this Public License constitutes or
+          may be construed as permission to assert or imply that You
+          are, or that Your use of the Licensed Material is, connected
+          with, or sponsored, endorsed, or granted official status by,
+          the Licensor or others designated to receive attribution as
+          provided in Section 3(a)(1)(A)(i).
+
+  b. Other rights.
+
+       1. Moral rights, such as the right of integrity, are not
+          licensed under this Public License, nor are publicity,
+          privacy, and/or other similar personality rights; however, to
+          the extent possible, the Licensor waives and/or agrees not to
+          assert any such rights held by the Licensor to the limited
+          extent necessary to allow You to exercise the Licensed
+          Rights, but not otherwise.
+
+       2. Patent and trademark rights are not licensed under this
+          Public License.
+
+       3. To the extent possible, the Licensor waives any right to
+          collect royalties from You for the exercise of the Licensed
+          Rights, whether directly or through a collecting society
+          under any voluntary or waivable statutory or compulsory
+          licensing scheme. In all other cases the Licensor expressly
+          reserves any right to collect such royalties.
+
+
+Section 3 -- License Conditions.
+
+Your exercise of the Licensed Rights is expressly made subject to the
+following conditions.
+
+  a. Attribution.
+
+       1. If You Share the Licensed Material (including in modified
+          form), You must:
+
+            a. retain the following if it is supplied by the Licensor
+               with the Licensed Material:
+
+                 i. identification of the creator(s) of the Licensed
+                    Material and any others designated to receive
+                    attribution, in any reasonable manner requested by
+                    the Licensor (including by pseudonym if
+                    designated);
+
+                ii. a copyright notice;
+
+               iii. a notice that refers to this Public License;
+
+                iv. a notice that refers to the disclaimer of
+                    warranties;
+
+                 v. a URI or hyperlink to the Licensed Material to the
+                    extent reasonably practicable;
+
+            b. indicate if You modified the Licensed Material and
+               retain an indication of any previous modifications; and
+
+            c. indicate the Licensed Material is licensed under this
+               Public License, and include the text of, or the URI or
+               hyperlink to, this Public License.
+
+       2. You may satisfy the conditions in Section 3(a)(1) in any
+          reasonable manner based on the medium, means, and context in
+          which You Share the Licensed Material. For example, it may be
+          reasonable to satisfy the conditions by providing a URI or
+          hyperlink to a resource that includes the required
+          information.
+
+       3. If requested by the Licensor, You must remove any of the
+          information required by Section 3(a)(1)(A) to the extent
+          reasonably practicable.
+
+  b. ShareAlike.
+
+     In addition to the conditions in Section 3(a), if You Share
+     Adapted Material You produce, the following conditions also apply.
+
+       1. The Adapter's License You apply must be a Creative Commons
+          license with the same License Elements, this version or
+          later, or a BY-SA Compatible License.
+
+       2. You must include the text of, or the URI or hyperlink to, the
+          Adapter's License You apply. You may satisfy this condition
+          in any reasonable manner based on the medium, means, and
+          context in which You Share Adapted Material.
+
+       3. You may not offer or impose any additional or different terms
+          or conditions on, or apply any Effective Technological
+          Measures to, Adapted Material that restrict exercise of the
+          rights granted under the Adapter's License You apply.
+
+
+Section 4 -- Sui Generis Database Rights.
+
+Where the Licensed Rights include Sui Generis Database Rights that
+apply to Your use of the Licensed Material:
+
+  a. for the avoidance of doubt, Section 2(a)(1) grants You the right
+     to extract, reuse, reproduce, and Share all or a substantial
+     portion of the contents of the database;
+
+  b. if You include all or a substantial portion of the database
+     contents in a database in which You have Sui Generis Database
+     Rights, then the database in which You have Sui Generis Database
+     Rights (but not its individual contents) is Adapted Material,
+
+     including for purposes of Section 3(b); and
+  c. You must comply with the conditions in Section 3(a) if You Share
+     all or a substantial portion of the contents of the database.
+
+For the avoidance of doubt, this Section 4 supplements and does not
+replace Your obligations under this Public License where the Licensed
+Rights include other Copyright and Similar Rights.
+
+
+Section 5 -- Disclaimer of Warranties and Limitation of Liability.
+
+  a. UNLESS OTHERWISE SEPARATELY UNDERTAKEN BY THE LICENSOR, TO THE
+     EXTENT POSSIBLE, THE LICENSOR OFFERS THE LICENSED MATERIAL AS-IS
+     AND AS-AVAILABLE, AND MAKES NO REPRESENTATIONS OR WARRANTIES OF
+     ANY KIND CONCERNING THE LICENSED MATERIAL, WHETHER EXPRESS,
+     IMPLIED, STATUTORY, OR OTHER. THIS INCLUDES, WITHOUT LIMITATION,
+     WARRANTIES OF TITLE, MERCHANTABILITY, FITNESS FOR A PARTICULAR
+     PURPOSE, NON-INFRINGEMENT, ABSENCE OF LATENT OR OTHER DEFECTS,
+     ACCURACY, OR THE PRESENCE OR ABSENCE OF ERRORS, WHETHER OR NOT
+     KNOWN OR DISCOVERABLE. WHERE DISCLAIMERS OF WARRANTIES ARE NOT
+     ALLOWED IN FULL OR IN PART, THIS DISCLAIMER MAY NOT APPLY TO YOU.
+
+  b. TO THE EXTENT POSSIBLE, IN NO EVENT WILL THE LICENSOR BE LIABLE
+     TO YOU ON ANY LEGAL THEORY (INCLUDING, WITHOUT LIMITATION,
+     NEGLIGENCE) OR OTHERWISE FOR ANY DIRECT, SPECIAL, INDIRECT,
+     INCIDENTAL, CONSEQUENTIAL, PUNITIVE, EXEMPLARY, OR OTHER LOSSES,
+     COSTS, EXPENSES, OR DAMAGES ARISING OUT OF THIS PUBLIC LICENSE OR
+     USE OF THE LICENSED MATERIAL, EVEN IF THE LICENSOR HAS BEEN
+     ADVISED OF THE POSSIBILITY OF SUCH LOSSES, COSTS, EXPENSES, OR
+     DAMAGES. WHERE A LIMITATION OF LIABILITY IS NOT ALLOWED IN FULL OR
+     IN PART, THIS LIMITATION MAY NOT APPLY TO YOU.
+
+  c. The disclaimer of warranties and limitation of liability provided
+     above shall be interpreted in a manner that, to the extent
+     possible, most closely approximates an absolute disclaimer and
+     waiver of all liability.
+
+
+Section 6 -- Term and Termination.
+
+  a. This Public License applies for the term of the Copyright and
+     Similar Rights licensed here. However, if You fail to comply with
+     this Public License, then Your rights under this Public License
+     terminate automatically.
+
+  b. Where Your right to use the Licensed Material has terminated under
+     Section 6(a), it reinstates:
+
+       1. automatically as of the date the violation is cured, provided
+          it is cured within 30 days of Your discovery of the
+          violation; or
+
+       2. upon express reinstatement by the Licensor.
+
+     For the avoidance of doubt, this Section 6(b) does not affect any
+     right the Licensor may have to seek remedies for Your violations
+     of this Public License.
+
+  c. For the avoidance of doubt, the Licensor may also offer the
+     Licensed Material under separate terms or conditions or stop
+     distributing the Licensed Material at any time; however, doing so
+     will not terminate this Public License.
+
+  d. Sections 1, 5, 6, 7, and 8 survive termination of this Public
+     License.
+
+
+Section 7 -- Other Terms and Conditions.
+
+  a. The Licensor shall not be bound by any additional or different
+     terms or conditions communicated by You unless expressly agreed.
+
+  b. Any arrangements, understandings, or agreements regarding the
+     Licensed Material not stated herein are separate from and
+     independent of the terms and conditions of this Public License.
+
+
+Section 8 -- Interpretation.
+
+  a. For the avoidance of doubt, this Public License does not, and
+     shall not be interpreted to, reduce, limit, restrict, or impose
+     conditions on any use of the Licensed Material that could lawfully
+     be made without permission under this Public License.
+
+  b. To the extent possible, if any provision of this Public License is
+     deemed unenforceable, it shall be automatically reformed to the
+     minimum extent necessary to make it enforceable. If the provision
+     cannot be reformed, it shall be severed from this Public License
+     without affecting the enforceability of the remaining terms and
+     conditions.
+
+  c. No term or condition of this Public License will be waived and no
+     failure to comply consented to unless expressly agreed to by the
+     Licensor.
+
+  d. Nothing in this Public License constitutes or may be interpreted
+     as a limitation upon, or waiver of, any privileges and immunities
+     that apply to the Licensor or You, including from the legal
+     processes of any jurisdiction or authority.
+
+
+=======================================================================
+
+Creative Commons is not a party to its public licenses.
+Notwithstanding, Creative Commons may elect to apply one of its public
+licenses to material it publishes and in those instances will be
+considered the "Licensor." Except for the limited purpose of indicating
+that material is shared under a Creative Commons public license or as
+otherwise permitted by the Creative Commons policies published at
+creativecommons.org/policies, Creative Commons does not authorize the
+use of the trademark "Creative Commons" or any other trademark or logo
+of Creative Commons without its prior written consent including,
+without limitation, in connection with any unauthorized modifications
+to any of its public licenses or any other arrangements,
+understandings, or agreements concerning use of licensed material. For
+the avoidance of doubt, this paragraph does not form part of the public
+licenses.
+
+Creative Commons may be contacted at creativecommons.org.
+
+```
+
 
 ### github.com/opencontainers/runc/libcontainer/devices
 
@@ -12102,6 +12535,45 @@ THE SOFTWARE.
 
 ```
 
+#### LICENSE.libyaml
+
+<https://github.com/yaml/go-yaml/blob/v2.4.4/LICENSE.libyaml>
+
+```text
+The following files were ported to Go from C files of libyaml, and thus
+are still covered by their original copyright and license:
+
+    apic.go
+    emitterc.go
+    parserc.go
+    readerc.go
+    scannerc.go
+    writerc.go
+    yamlh.go
+    yamlprivateh.go
+
+Copyright (c) 2006 Kirill Simonov
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of
+this software and associated documentation files (the "Software"), to deal in
+the Software without restriction, including without limitation the rights to
+use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies
+of the Software, and to permit persons to whom the Software is furnished to do
+so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+
+```
+
 #### NOTICE
 
 <https://github.com/yaml/go-yaml/blob/v2.4.4/NOTICE>
@@ -12251,6 +12723,36 @@ OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
 ```
 
+#### PATENTS
+
+<https://go.googlesource.com/crypto/+/refs/tags/v0.55.0/PATENTS>
+
+```text
+Additional IP Rights Grant (Patents)
+
+"This implementation" means the copyrightable works distributed by
+Google as part of the Go project.
+
+Google hereby grants to You a perpetual, worldwide, non-exclusive,
+no-charge, royalty-free, irrevocable (except as stated in this section)
+patent license to make, have made, use, offer to sell, sell, import,
+transfer and otherwise run, modify and propagate the contents of this
+implementation of Go, where such license applies only to those patent
+claims, both currently owned or controlled by Google and acquired in
+the future, licensable by Google that are necessarily infringed by this
+implementation of Go.  This grant does not include claims that would be
+infringed only as a consequence of further modification of this
+implementation.  If you or your agent or exclusive licensee institute or
+order or agree to the institution of patent litigation against any
+entity (including a cross-claim or counterclaim in a lawsuit) alleging
+that this implementation of Go or any code incorporated within this
+implementation of Go constitutes direct or contributory patent
+infringement, or inducement of patent infringement, then any patent
+rights granted to you under this License for this implementation of Go
+shall terminate as of the date such litigation is filed.
+
+```
+
 
 ### golang.org/x/mod/semver
 
@@ -12293,6 +12795,36 @@ OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
 ```
 
+#### PATENTS
+
+<https://go.googlesource.com/mod/+/refs/tags/v0.40.0/PATENTS>
+
+```text
+Additional IP Rights Grant (Patents)
+
+"This implementation" means the copyrightable works distributed by
+Google as part of the Go project.
+
+Google hereby grants to You a perpetual, worldwide, non-exclusive,
+no-charge, royalty-free, irrevocable (except as stated in this section)
+patent license to make, have made, use, offer to sell, sell, import,
+transfer and otherwise run, modify and propagate the contents of this
+implementation of Go, where such license applies only to those patent
+claims, both currently owned or controlled by Google and acquired in
+the future, licensable by Google that are necessarily infringed by this
+implementation of Go.  This grant does not include claims that would be
+infringed only as a consequence of further modification of this
+implementation.  If you or your agent or exclusive licensee institute or
+order or agree to the institution of patent litigation against any
+entity (including a cross-claim or counterclaim in a lawsuit) alleging
+that this implementation of Go or any code incorporated within this
+implementation of Go constitutes direct or contributory patent
+infringement, or inducement of patent infringement, then any patent
+rights granted to you under this License for this implementation of Go
+shall terminate as of the date such litigation is filed.
+
+```
+
 
 ### golang.org/x/net
 
@@ -12335,6 +12867,36 @@ OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
 ```
 
+#### PATENTS
+
+<https://go.googlesource.com/net/+/refs/tags/v0.58.0/PATENTS>
+
+```text
+Additional IP Rights Grant (Patents)
+
+"This implementation" means the copyrightable works distributed by
+Google as part of the Go project.
+
+Google hereby grants to You a perpetual, worldwide, non-exclusive,
+no-charge, royalty-free, irrevocable (except as stated in this section)
+patent license to make, have made, use, offer to sell, sell, import,
+transfer and otherwise run, modify and propagate the contents of this
+implementation of Go, where such license applies only to those patent
+claims, both currently owned or controlled by Google and acquired in
+the future, licensable by Google that are necessarily infringed by this
+implementation of Go.  This grant does not include claims that would be
+infringed only as a consequence of further modification of this
+implementation.  If you or your agent or exclusive licensee institute or
+order or agree to the institution of patent litigation against any
+entity (including a cross-claim or counterclaim in a lawsuit) alleging
+that this implementation of Go or any code incorporated within this
+implementation of Go constitutes direct or contributory patent
+infringement, or inducement of patent infringement, then any patent
+rights granted to you under this License for this implementation of Go
+shall terminate as of the date such litigation is filed.
+
+```
+
 
 ### golang.org/x/oauth2
 
@@ -12419,6 +12981,36 @@ OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
 ```
 
+#### PATENTS
+
+<https://go.googlesource.com/sync/+/refs/tags/v0.22.0/PATENTS>
+
+```text
+Additional IP Rights Grant (Patents)
+
+"This implementation" means the copyrightable works distributed by
+Google as part of the Go project.
+
+Google hereby grants to You a perpetual, worldwide, non-exclusive,
+no-charge, royalty-free, irrevocable (except as stated in this section)
+patent license to make, have made, use, offer to sell, sell, import,
+transfer and otherwise run, modify and propagate the contents of this
+implementation of Go, where such license applies only to those patent
+claims, both currently owned or controlled by Google and acquired in
+the future, licensable by Google that are necessarily infringed by this
+implementation of Go.  This grant does not include claims that would be
+infringed only as a consequence of further modification of this
+implementation.  If you or your agent or exclusive licensee institute or
+order or agree to the institution of patent litigation against any
+entity (including a cross-claim or counterclaim in a lawsuit) alleging
+that this implementation of Go or any code incorporated within this
+implementation of Go constitutes direct or contributory patent
+infringement, or inducement of patent infringement, then any patent
+rights granted to you under this License for this implementation of Go
+shall terminate as of the date such litigation is filed.
+
+```
+
 
 ### golang.org/x/sys/unix
 
@@ -12461,6 +13053,36 @@ OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
 ```
 
+#### PATENTS
+
+<https://go.googlesource.com/sys/+/refs/tags/v0.47.0/PATENTS>
+
+```text
+Additional IP Rights Grant (Patents)
+
+"This implementation" means the copyrightable works distributed by
+Google as part of the Go project.
+
+Google hereby grants to You a perpetual, worldwide, non-exclusive,
+no-charge, royalty-free, irrevocable (except as stated in this section)
+patent license to make, have made, use, offer to sell, sell, import,
+transfer and otherwise run, modify and propagate the contents of this
+implementation of Go, where such license applies only to those patent
+claims, both currently owned or controlled by Google and acquired in
+the future, licensable by Google that are necessarily infringed by this
+implementation of Go.  This grant does not include claims that would be
+infringed only as a consequence of further modification of this
+implementation.  If you or your agent or exclusive licensee institute or
+order or agree to the institution of patent litigation against any
+entity (including a cross-claim or counterclaim in a lawsuit) alleging
+that this implementation of Go or any code incorporated within this
+implementation of Go constitutes direct or contributory patent
+infringement, or inducement of patent infringement, then any patent
+rights granted to you under this License for this implementation of Go
+shall terminate as of the date such litigation is filed.
+
+```
+
 
 ### golang.org/x/term
 
@@ -12503,6 +13125,36 @@ OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
 ```
 
+#### PATENTS
+
+<https://go.googlesource.com/term/+/refs/tags/v0.45.0/PATENTS>
+
+```text
+Additional IP Rights Grant (Patents)
+
+"This implementation" means the copyrightable works distributed by
+Google as part of the Go project.
+
+Google hereby grants to You a perpetual, worldwide, non-exclusive,
+no-charge, royalty-free, irrevocable (except as stated in this section)
+patent license to make, have made, use, offer to sell, sell, import,
+transfer and otherwise run, modify and propagate the contents of this
+implementation of Go, where such license applies only to those patent
+claims, both currently owned or controlled by Google and acquired in
+the future, licensable by Google that are necessarily infringed by this
+implementation of Go.  This grant does not include claims that would be
+infringed only as a consequence of further modification of this
+implementation.  If you or your agent or exclusive licensee institute or
+order or agree to the institution of patent litigation against any
+entity (including a cross-claim or counterclaim in a lawsuit) alleging
+that this implementation of Go or any code incorporated within this
+implementation of Go constitutes direct or contributory patent
+infringement, or inducement of patent infringement, then any patent
+rights granted to you under this License for this implementation of Go
+shall terminate as of the date such litigation is filed.
+
+```
+
 
 ### golang.org/x/text
 
@@ -12545,6 +13197,36 @@ OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
 ```
 
+#### PATENTS
+
+<https://go.googlesource.com/text/+/refs/tags/v0.41.0/PATENTS>
+
+```text
+Additional IP Rights Grant (Patents)
+
+"This implementation" means the copyrightable works distributed by
+Google as part of the Go project.
+
+Google hereby grants to You a perpetual, worldwide, non-exclusive,
+no-charge, royalty-free, irrevocable (except as stated in this section)
+patent license to make, have made, use, offer to sell, sell, import,
+transfer and otherwise run, modify and propagate the contents of this
+implementation of Go, where such license applies only to those patent
+claims, both currently owned or controlled by Google and acquired in
+the future, licensable by Google that are necessarily infringed by this
+implementation of Go.  This grant does not include claims that would be
+infringed only as a consequence of further modification of this
+implementation.  If you or your agent or exclusive licensee institute or
+order or agree to the institution of patent litigation against any
+entity (including a cross-claim or counterclaim in a lawsuit) alleging
+that this implementation of Go or any code incorporated within this
+implementation of Go constitutes direct or contributory patent
+infringement, or inducement of patent infringement, then any patent
+rights granted to you under this License for this implementation of Go
+shall terminate as of the date such litigation is filed.
+
+```
+
 
 ### golang.org/x/time/rate
 
@@ -12587,6 +13269,36 @@ OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
 ```
 
+#### PATENTS
+
+<https://go.googlesource.com/time/+/refs/tags/v0.14.0/PATENTS>
+
+```text
+Additional IP Rights Grant (Patents)
+
+"This implementation" means the copyrightable works distributed by
+Google as part of the Go project.
+
+Google hereby grants to You a perpetual, worldwide, non-exclusive,
+no-charge, royalty-free, irrevocable (except as stated in this section)
+patent license to make, have made, use, offer to sell, sell, import,
+transfer and otherwise run, modify and propagate the contents of this
+implementation of Go, where such license applies only to those patent
+claims, both currently owned or controlled by Google and acquired in
+the future, licensable by Google that are necessarily infringed by this
+implementation of Go.  This grant does not include claims that would be
+infringed only as a consequence of further modification of this
+implementation.  If you or your agent or exclusive licensee institute or
+order or agree to the institution of patent litigation against any
+entity (including a cross-claim or counterclaim in a lawsuit) alleging
+that this implementation of Go or any code incorporated within this
+implementation of Go constitutes direct or contributory patent
+infringement, or inducement of patent infringement, then any patent
+rights granted to you under this License for this implementation of Go
+shall terminate as of the date such litigation is filed.
+
+```
+
 
 ### gomodules.xyz/jsonpatch/v2
 
@@ -12846,6 +13558,36 @@ OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
 ```
 
+#### PATENTS
+
+<https://go.googlesource.com/protobuf/+/f2248ac996af/PATENTS>
+
+```text
+Additional IP Rights Grant (Patents)
+
+"This implementation" means the copyrightable works distributed by
+Google as part of the Go project.
+
+Google hereby grants to You a perpetual, worldwide, non-exclusive,
+no-charge, royalty-free, irrevocable (except as stated in this section)
+patent license to make, have made, use, offer to sell, sell, import,
+transfer and otherwise run, modify and propagate the contents of this
+implementation of Go, where such license applies only to those patent
+claims, both currently owned or controlled by Google and acquired in
+the future, licensable by Google that are necessarily infringed by this
+implementation of Go.  This grant does not include claims that would be
+infringed only as a consequence of further modification of this
+implementation.  If you or your agent or exclusive licensee institute or
+order or agree to the institution of patent litigation against any
+entity (including a cross-claim or counterclaim in a lawsuit) alleging
+that this implementation of Go or any code incorporated within this
+implementation of Go constitutes direct or contributory patent
+infringement, or inducement of patent infringement, then any patent
+rights granted to you under this License for this implementation of Go
+shall terminate as of the date such litigation is filed.
+
+```
+
 
 ### gopkg.in/evanphx/json-patch.v4
 
@@ -13708,6 +14450,36 @@ OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
 ```
 
+#### PATENTS
+
+<https://github.com/kubernetes/apimachinery/blob/v0.36.4/third_party/forked/golang/PATENTS>
+
+```text
+Additional IP Rights Grant (Patents)
+
+"This implementation" means the copyrightable works distributed by
+Google as part of the Go project.
+
+Google hereby grants to You a perpetual, worldwide, non-exclusive,
+no-charge, royalty-free, irrevocable (except as stated in this section)
+patent license to make, have made, use, offer to sell, sell, import,
+transfer and otherwise run, modify and propagate the contents of this
+implementation of Go, where such license applies only to those patent
+claims, both currently owned or controlled by Google and acquired in
+the future, licensable by Google that are necessarily infringed by this
+implementation of Go.  This grant does not include claims that would be
+infringed only as a consequence of further modification of this
+implementation.  If you or your agent or exclusive licensee institute or
+order or agree to the institution of patent litigation against any
+entity (including a cross-claim or counterclaim in a lawsuit) alleging
+that this implementation of Go or any code incorporated within this
+implementation of Go constitutes direct or contributory patent
+infringement, or inducement of patent infringement, then any patent
+rights granted to you under this License for this implementation of Go
+shall terminate as of the date such litigation is filed.
+
+```
+
 
 ### k8s.io/cli-runtime/pkg
 
@@ -14184,6 +14956,36 @@ OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
 ```
 
+#### PATENTS
+
+<https://github.com/kubernetes/client-go/blob/v0.36.4/third_party/forked/golang/PATENTS>
+
+```text
+Additional IP Rights Grant (Patents)
+
+"This implementation" means the copyrightable works distributed by
+Google as part of the Go project.
+
+Google hereby grants to You a perpetual, worldwide, non-exclusive,
+no-charge, royalty-free, irrevocable (except as stated in this section)
+patent license to make, have made, use, offer to sell, sell, import,
+transfer and otherwise run, modify and propagate the contents of this
+implementation of Go, where such license applies only to those patent
+claims, both currently owned or controlled by Google and acquired in
+the future, licensable by Google that are necessarily infringed by this
+implementation of Go.  This grant does not include claims that would be
+infringed only as a consequence of further modification of this
+implementation.  If you or your agent or exclusive licensee institute or
+order or agree to the institution of patent litigation against any
+entity (including a cross-claim or counterclaim in a lawsuit) alleging
+that this implementation of Go or any code incorporated within this
+implementation of Go constitutes direct or contributory patent
+infringement, or inducement of patent infringement, then any patent
+rights granted to you under this License for this implementation of Go
+shall terminate as of the date such litigation is filed.
+
+```
+
 
 ### k8s.io/client-go/third_party/forked/httpcache
 
@@ -14852,6 +15654,17 @@ third-party archives.
 * Version: v0.0.0-20260603220949-865597e52e25
 * License: BSD-3-Clause
 
+#### AUTHORS
+
+<https://github.com/kubernetes/kube-openapi/blob/865597e52e25/pkg/internal/third_party/go-json-experiment/json/AUTHORS>
+
+```text
+# This source code refers to The Go Authors for copyright purposes.
+# The master list of authors is in the main Go distribution,
+# visible at https://tip.golang.org/AUTHORS.
+
+```
+
 #### LICENSE
 
 <https://github.com/kubernetes/kube-openapi/blob/865597e52e25/pkg/internal/third_party/go-json-experiment/json/LICENSE>
@@ -15579,6 +16392,36 @@ OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
 ```
 
+#### PATENTS
+
+<https://github.com/kubernetes/utils/blob/ff6756f316d2/internal/third_party/forked/golang/PATENTS>
+
+```text
+Additional IP Rights Grant (Patents)
+
+"This implementation" means the copyrightable works distributed by
+Google as part of the Go project.
+
+Google hereby grants to You a perpetual, worldwide, non-exclusive,
+no-charge, royalty-free, irrevocable (except as stated in this section)
+patent license to make, have made, use, offer to sell, sell, import,
+transfer and otherwise run, modify and propagate the contents of this
+implementation of Go, where such license applies only to those patent
+claims, both currently owned or controlled by Google and acquired in
+the future, licensable by Google that are necessarily infringed by this
+implementation of Go.  This grant does not include claims that would be
+infringed only as a consequence of further modification of this
+implementation.  If you or your agent or exclusive licensee institute or
+order or agree to the institution of patent litigation against any
+entity (including a cross-claim or counterclaim in a lawsuit) alleging
+that this implementation of Go or any code incorporated within this
+implementation of Go constitutes direct or contributory patent
+infringement, or inducement of patent infringement, then any patent
+rights granted to you under this License for this implementation of Go
+shall terminate as of the date such litigation is filed.
+
+```
+
 
 ### k8s.io/utils/third_party/forked/golang/btree
 
diff --git a/tools/generate-third-party-notices.sh b/tools/generate-third-party-notices.sh
index 83ef9ff61..0c9257909 100755
--- a/tools/generate-third-party-notices.sh
+++ b/tools/generate-third-party-notices.sh
@@ -259,10 +259,18 @@ build_indexes() {
 # License-bearing files, sorted. Filter by name: for restricted licenses
 # 'go-licenses save' copies the whole module source, which does not belong here.
 license_files_for() {
-    local dir="$1" f
+    local dir="$1" f base
     [[ -d "${dir}" ]] || return 0
     while IFS= read -r -d '' f; do
-        if printf '%s' "$(basename "${f}")" \
+        base="$(basename "${f}")"
+        # Exclude source files: the name pattern below also matches source
+        # files that merely start with a license-shaped header, e.g.
+        # k8s.io/kube-openapi/pkg/validation/spec/license.go, a Go file
+        # beginning "// Copyright 2015 go-swagger maintainers".
+        case "${base}" in
+            *.go|*.c|*.h|*.s|*.py|*.sh|*.java|*.ts|*.js) continue ;;
+        esac
+        if printf '%s' "${base}" \
             | LC_ALL=C grep -qiE '^(licen[cs]e|notice|copying|copyright|authors|patents)([-._].*)?$'; then
             printf '%s\n' "${f}"
         fi
@@ -311,10 +319,11 @@ location_for() {
 # License column joins identifiers.
 location_cell() {
     local package="$1" module="$2" version="$3"
-    local relative name license_path url cell="" lf
+    local relative name license_path url cell="" lf govern_dir
     relative="$(license_dir_within_module "${package}" "${module}")" \
         || die "no license file found for ${package} under ${VENDOR_DIR}/${module}." \
                "Run 'go mod vendor' and re-run."
+    govern_dir="${VENDOR_DIR}/${module}${relative:+/${relative}}"
     while IFS= read -r lf; do
         [[ -z "${lf}" ]] && continue
         name="$(basename "${lf}")"
@@ -323,9 +332,9 @@ location_cell() {
             || die "${LICENSE_URLS} has no verified URL for ${module}@${version} ${license_path}." \
                    "Run 'make third-party-notices-urls' (needs network) and commit the result."
         cell="${cell:+${cell} / }[${name}](${url})"
-    done < <(license_files_for "${LICENSES_DIR}/${package}")
-    [[ -n "${cell}" ]] || die "no license file for ${package} under ${LICENSES_DIR}." \
-                              "Run 'make third-party-notices' and re-run."
+    done < <(license_files_for "${govern_dir}")
+    [[ -n "${cell}" ]] || die "no license file for ${package} under ${govern_dir}." \
+                              "Run 'go mod vendor' and re-run."
     printf '%s' "${cell}"
 }
 
@@ -345,8 +354,8 @@ emit_index_table() {
 }
 
 emit_sections() {
-    local index="$1" root="$2"
-    local package _ license module version files lf fence relative name url
+    local index="$1"
+    local package _ license module version files lf fence relative name url govern_dir
 
     while IFS=, read -r package _ license module version; do
         [[ -z "${package}" ]] && continue
@@ -356,17 +365,19 @@ emit_sections() {
         printf '* Version: %s\n' "${version:-unknown}"
         printf '* License: %s\n\n' "${license:-Unknown}"
 
+        relative="$(license_dir_within_module "${package}" "${module}")" \
+            || die "no license file found for ${package} under ${VENDOR_DIR}/${module}." \
+                   "Run 'go mod vendor' and re-run."
+        govern_dir="${VENDOR_DIR}/${module}${relative:+/${relative}}"
+
         files=()
         while IFS= read -r lf; do
             [[ -n "${lf}" ]] && files+=("${lf}")
-        done < <(license_files_for "${root}/${package}")
+        done < <(license_files_for "${govern_dir}")
 
         if (( ${#files[@]} == 0 )); then
             printf 'License text unavailable. See upstream source for the full license.\n'
         else
-            relative="$(license_dir_within_module "${package}" "${module}")" \
-                || die "no license file found for ${package} under ${VENDOR_DIR}/${module}." \
-                       "Run 'go mod vendor' and re-run."
             for lf in "${files[@]}"; do
                 name="$(basename "${lf}")"
                 url="$(location_for "${module}" "${version}" "${relative:+${relative}/}${name}")" \
@@ -430,7 +441,7 @@ EOF
 ## License Texts
 
 EOF
-        emit_sections "${INDEX_FILE}" "${LICENSES_DIR}"
+        emit_sections "${INDEX_FILE}"
     } > "${OUT_TMP}"
     # mktemp creates 0600, so fix the mode before the rename. mv, not cp: the
     # rename is atomic, so a failed run leaves the previous document intact.
diff --git a/tools/generate-third-party-notices_test.sh b/tools/generate-third-party-notices_test.sh
index c6424b822..60d946b3d 100644
--- a/tools/generate-third-party-notices_test.sh
+++ b/tools/generate-third-party-notices_test.sh
@@ -80,6 +80,13 @@ assert_fails "location_for fails closed on a miss" \
     'source "$1"; location_for github.com/nope v1.0.0 LICENSE' \
     _ "${HERE}/generate-third-party-notices.sh"
 
+license_files_fixture="$(mktemp -d)"
+touch "${license_files_fixture}/LICENSE" "${license_files_fixture}/LICENSE.md" "${license_files_fixture}/license.go"
+assert_eq "$(printf '%s/LICENSE\n%s/LICENSE.md' "${license_files_fixture}" "${license_files_fixture}")" \
+    "$(license_files_for "${license_files_fixture}")" \
+    "license_files_for excludes a Go source file even when its name matches"
+rm -rf "${license_files_fixture}"
+
 vendor_fixture="$(mktemp -d)"
 mkdir -p "${vendor_fixture}/github.com/klauspost/compress/zstd/internal/xxhash"
 touch "${vendor_fixture}/github.com/klauspost/compress/LICENSE"
diff --git a/tools/license-urls.tsv b/tools/license-urls.tsv
index aa26a0399..4d87caa0a 100644
--- a/tools/license-urls.tsv
+++ b/tools/license-urls.tsv
@@ -66,6 +66,7 @@ github.com/monochromegane/go-gitignore	v0.0.0-20200626010858-205db1a8cc00	LICENS
 github.com/munnerz/goautoneg	v0.0.0-20191010083416-a7dc8b61c822	LICENSE	https://github.com/munnerz/goautoneg/blob/a7dc8b61c822/LICENSE
 github.com/opencontainers/cgroups	v0.0.7	LICENSE	https://github.com/opencontainers/cgroups/blob/v0.0.7/LICENSE
 github.com/opencontainers/go-digest	v1.0.0	LICENSE	https://github.com/opencontainers/go-digest/blob/v1.0.0/LICENSE
+github.com/opencontainers/go-digest	v1.0.0	LICENSE.docs	https://github.com/opencontainers/go-digest/blob/v1.0.0/LICENSE.docs
 github.com/opencontainers/runc	v1.4.3	LICENSE	https://github.com/opencontainers/runc/blob/v1.4.3/LICENSE
 github.com/opencontainers/runc	v1.4.3	NOTICE	https://github.com/opencontainers/runc/blob/v1.4.3/NOTICE
 github.com/openshift/api	v0.0.0-20260727141720-967cc4c36c9b	LICENSE	https://github.com/openshift/api/blob/967cc4c36c9b/LICENSE
@@ -98,20 +99,30 @@ github.com/xlab/treeprint	v1.2.0	LICENSE	https://github.com/xlab/treeprint/blob/
 go.uber.org/multierr	v1.11.0	LICENSE.txt	https://github.com/uber-go/multierr/blob/v1.11.0/LICENSE.txt
 go.uber.org/zap	v1.28.0	LICENSE	https://github.com/uber-go/zap/blob/v1.28.0/LICENSE
 go.yaml.in/yaml/v2	v2.4.4	LICENSE	https://github.com/yaml/go-yaml/blob/v2.4.4/LICENSE
+go.yaml.in/yaml/v2	v2.4.4	LICENSE.libyaml	https://github.com/yaml/go-yaml/blob/v2.4.4/LICENSE.libyaml
 go.yaml.in/yaml/v2	v2.4.4	NOTICE	https://github.com/yaml/go-yaml/blob/v2.4.4/NOTICE
 go.yaml.in/yaml/v3	v3.0.4	LICENSE	https://github.com/yaml/go-yaml/blob/v3.0.4/LICENSE
 go.yaml.in/yaml/v3	v3.0.4	NOTICE	https://github.com/yaml/go-yaml/blob/v3.0.4/NOTICE
 golang.org/x/crypto	v0.55.0	LICENSE	https://go.googlesource.com/crypto/+/refs/tags/v0.55.0/LICENSE
+golang.org/x/crypto	v0.55.0	PATENTS	https://go.googlesource.com/crypto/+/refs/tags/v0.55.0/PATENTS
 golang.org/x/mod	v0.40.0	LICENSE	https://go.googlesource.com/mod/+/refs/tags/v0.40.0/LICENSE
+golang.org/x/mod	v0.40.0	PATENTS	https://go.googlesource.com/mod/+/refs/tags/v0.40.0/PATENTS
 golang.org/x/net	v0.58.0	LICENSE	https://go.googlesource.com/net/+/refs/tags/v0.58.0/LICENSE
+golang.org/x/net	v0.58.0	PATENTS	https://go.googlesource.com/net/+/refs/tags/v0.58.0/PATENTS
 golang.org/x/oauth2	v0.36.0	LICENSE	https://go.googlesource.com/oauth2/+/refs/tags/v0.36.0/LICENSE
 golang.org/x/sync	v0.22.0	LICENSE	https://go.googlesource.com/sync/+/refs/tags/v0.22.0/LICENSE
+golang.org/x/sync	v0.22.0	PATENTS	https://go.googlesource.com/sync/+/refs/tags/v0.22.0/PATENTS
 golang.org/x/sys	v0.47.0	LICENSE	https://go.googlesource.com/sys/+/refs/tags/v0.47.0/LICENSE
+golang.org/x/sys	v0.47.0	PATENTS	https://go.googlesource.com/sys/+/refs/tags/v0.47.0/PATENTS
 golang.org/x/term	v0.45.0	LICENSE	https://go.googlesource.com/term/+/refs/tags/v0.45.0/LICENSE
+golang.org/x/term	v0.45.0	PATENTS	https://go.googlesource.com/term/+/refs/tags/v0.45.0/PATENTS
 golang.org/x/text	v0.41.0	LICENSE	https://go.googlesource.com/text/+/refs/tags/v0.41.0/LICENSE
+golang.org/x/text	v0.41.0	PATENTS	https://go.googlesource.com/text/+/refs/tags/v0.41.0/PATENTS
 golang.org/x/time	v0.14.0	LICENSE	https://go.googlesource.com/time/+/refs/tags/v0.14.0/LICENSE
+golang.org/x/time	v0.14.0	PATENTS	https://go.googlesource.com/time/+/refs/tags/v0.14.0/PATENTS
 gomodules.xyz/jsonpatch/v2	v2.4.0	LICENSE	https://github.com/gomodules/jsonpatch/blob/v2.4.0/LICENSE
 google.golang.org/protobuf	v1.36.12-0.20260120151049-f2248ac996af	LICENSE	https://go.googlesource.com/protobuf/+/f2248ac996af/LICENSE
+google.golang.org/protobuf	v1.36.12-0.20260120151049-f2248ac996af	PATENTS	https://go.googlesource.com/protobuf/+/f2248ac996af/PATENTS
 gopkg.in/evanphx/json-patch.v4	v4.13.0	LICENSE	https://github.com/evanphx/json-patch/blob/v4.13.0/LICENSE
 gopkg.in/inf.v0	v0.9.1	LICENSE	https://github.com/go-inf/inf/blob/v0.9.1/LICENSE
 gopkg.in/yaml.v3	v3.0.1	LICENSE	https://github.com/go-yaml/yaml/blob/v3.0.1/LICENSE
@@ -120,18 +131,22 @@ k8s.io/api	v0.36.4	LICENSE	https://github.com/kubernetes/api/blob/v0.36.4/LICENS
 k8s.io/apiextensions-apiserver	v0.36.4	LICENSE	https://github.com/kubernetes/apiextensions-apiserver/blob/v0.36.4/LICENSE
 k8s.io/apimachinery	v0.36.4	LICENSE	https://github.com/kubernetes/apimachinery/blob/v0.36.4/LICENSE
 k8s.io/apimachinery	v0.36.4	third_party/forked/golang/LICENSE	https://github.com/kubernetes/apimachinery/blob/v0.36.4/third_party/forked/golang/LICENSE
+k8s.io/apimachinery	v0.36.4	third_party/forked/golang/PATENTS	https://github.com/kubernetes/apimachinery/blob/v0.36.4/third_party/forked/golang/PATENTS
 k8s.io/cli-runtime	v0.36.0	LICENSE	https://github.com/kubernetes/cli-runtime/blob/v0.36.0/LICENSE
 k8s.io/client-go	v0.36.4	LICENSE	https://github.com/kubernetes/client-go/blob/v0.36.4/LICENSE
 k8s.io/client-go	v0.36.4	third_party/forked/golang/LICENSE	https://github.com/kubernetes/client-go/blob/v0.36.4/third_party/forked/golang/LICENSE
+k8s.io/client-go	v0.36.4	third_party/forked/golang/PATENTS	https://github.com/kubernetes/client-go/blob/v0.36.4/third_party/forked/golang/PATENTS
 k8s.io/client-go	v0.36.4	third_party/forked/httpcache/LICENSE	https://github.com/kubernetes/client-go/blob/v0.36.4/third_party/forked/httpcache/LICENSE
 k8s.io/component-base	v0.36.4	LICENSE	https://github.com/kubernetes/component-base/blob/v0.36.4/LICENSE
 k8s.io/klog/v2	v2.140.0	LICENSE	https://github.com/kubernetes/klog/blob/v2.140.0/LICENSE
 k8s.io/kube-openapi	v0.0.0-20260603220949-865597e52e25	LICENSE	https://github.com/kubernetes/kube-openapi/blob/865597e52e25/LICENSE
+k8s.io/kube-openapi	v0.0.0-20260603220949-865597e52e25	pkg/internal/third_party/go-json-experiment/json/AUTHORS	https://github.com/kubernetes/kube-openapi/blob/865597e52e25/pkg/internal/third_party/go-json-experiment/json/AUTHORS
 k8s.io/kube-openapi	v0.0.0-20260603220949-865597e52e25	pkg/internal/third_party/go-json-experiment/json/LICENSE	https://github.com/kubernetes/kube-openapi/blob/865597e52e25/pkg/internal/third_party/go-json-experiment/json/LICENSE
 k8s.io/kube-openapi	v0.0.0-20260603220949-865597e52e25	pkg/validation/spec/LICENSE	https://github.com/kubernetes/kube-openapi/blob/865597e52e25/pkg/validation/spec/LICENSE
 k8s.io/kubectl	v0.36.0	LICENSE	https://github.com/kubernetes/kubectl/blob/v0.36.0/LICENSE
 k8s.io/utils	v0.0.0-20260507154919-ff6756f316d2	LICENSE	https://github.com/kubernetes/utils/blob/ff6756f316d2/LICENSE
 k8s.io/utils	v0.0.0-20260507154919-ff6756f316d2	internal/third_party/forked/golang/LICENSE	https://github.com/kubernetes/utils/blob/ff6756f316d2/internal/third_party/forked/golang/LICENSE
+k8s.io/utils	v0.0.0-20260507154919-ff6756f316d2	internal/third_party/forked/golang/PATENTS	https://github.com/kubernetes/utils/blob/ff6756f316d2/internal/third_party/forked/golang/PATENTS
 k8s.io/utils	v0.0.0-20260507154919-ff6756f316d2	third_party/forked/golang/btree/LICENSE	https://github.com/kubernetes/utils/blob/ff6756f316d2/third_party/forked/golang/btree/LICENSE
 sigs.k8s.io/controller-runtime	v0.24.1	LICENSE	https://github.com/kubernetes-sigs/controller-runtime/blob/v0.24.1/LICENSE
 sigs.k8s.io/json	v0.0.0-20250730193827-2d320260d730	LICENSE	https://github.com/kubernetes-sigs/json/blob/2d320260d730/LICENSE
diff --git a/tools/verify-license-urls.sh b/tools/verify-license-urls.sh
index 1e9bffdfd..40b64b400 100644
--- a/tools/verify-license-urls.sh
+++ b/tools/verify-license-urls.sh
@@ -193,7 +193,7 @@ main() {
                 continue
             fi
             printf '%s\t%s\t%s\t%s\n' "${module}" "${version}" "${path_in_module}" "${found}" >> "${tmp}"
-        done < <(license_files_for "${LICENSES_DIR}/${package}")
+        done < <(license_files_for "${VENDOR_DIR}/${module}${relative:+/${relative}}")
 
         if (( license_file_count == 0 )); then
             log "UNVERIFIED ${module}@${version} — no license file found for ${package}"

From 41bde6258f330852d78b42b135b80977b72d263d Mon Sep 17 00:00:00 2001
From: Abrar Shivani <ashivani@nvidia.com>
Date: Mon, 24 Aug 2026 17:35:12 -0700
Subject: [PATCH 13/18] Rename local variables in third-party notices tooling
 for clarity

Replace bare-adjective and abbreviated local variable names in
tools/generate-third-party-notices.sh, tools/verify-license-urls.sh, and
tools/resolve-module-repos.sh with names that carry their meaning (e.g.
lf -> license_file, tmp -> verified_urls_tmp_file / repos_tmp_file,
rsha -> remote_sha_value). Pure rename, no behavior change.

Signed-off-by: Abrar Shivani <ashivani@nvidia.com>
---
 tools/generate-third-party-notices.sh | 88 +++++++++++++--------------
 tools/resolve-module-repos.sh         | 45 +++++++-------
 tools/verify-license-urls.sh          | 44 +++++++-------
 3 files changed, 89 insertions(+), 88 deletions(-)

diff --git a/tools/generate-third-party-notices.sh b/tools/generate-third-party-notices.sh
index 0c9257909..6d195b10d 100755
--- a/tools/generate-third-party-notices.sh
+++ b/tools/generate-third-party-notices.sh
@@ -48,14 +48,14 @@ log() {
 # Licenses that are themselves Markdown close a fixed ``` fence early and invert
 # every block after it, so open with one backtick more than the file's longest run.
 fence_for() {
-    local file="$1" longest width
+    local file="$1" longest_backtick_run fence_width
     # -a: a license holding a NUL byte would otherwise print "Binary file ...
     # matches" instead of the matches, on stdout or stderr depending on the grep.
-    longest=$(LC_ALL=C grep -oaE '`+' "${file}" 2>/dev/null \
+    longest_backtick_run=$(LC_ALL=C grep -oaE '`+' "${file}" 2>/dev/null \
         | awk '{ if (length($0) > m) m = length($0) } END { print m+0 }' || true)
-    width=$(( longest + 1 ))
-    (( width < 3 )) && width=3
-    printf '%*s' "${width}" '' | tr ' ' '`'
+    fence_width=$(( longest_backtick_run + 1 ))
+    (( fence_width < 3 )) && fence_width=3
+    printf '%*s' "${fence_width}" '' | tr ' ' '`'
 }
 
 check_prerequisites() {
@@ -71,10 +71,10 @@ check_prerequisites() {
         die "go-licenses is not installed." "Install it with 'make install-tools'."
     fi
 
-    local f
-    for f in "${MULTI_ARCH_MK}" "${MODULES_TXT}"; do
-        [[ -f "${f}" ]] \
-            || die "${f} not found — run 'make third-party-notices' from the repo root."
+    local required_file
+    for required_file in "${MULTI_ARCH_MK}" "${MODULES_TXT}"; do
+        [[ -f "${required_file}" ]] \
+            || die "${required_file} not found — run 'make third-party-notices' from the repo root."
     done
 
     LOCAL_MODULE=$(go list -m 2>/dev/null || true)
@@ -113,10 +113,10 @@ prepare_workspace() {
     mkdir -p "${LICENSES_DIR}"
 
     # Explicit templates: macOS mktemp ignores TMPDIR without one.
-    local t="${TMPDIR:-/tmp}/gpu-operator-notices"
-    SAVE_ROOT="$(mktemp -d "${t}.XXXXXX")"
-    COMBINED_CSV="$(mktemp "${t}-csv.XXXXXX")"
-    INDEX_FILE="$(mktemp "${t}-idx.XXXXXX")"
+    local workspace_template="${TMPDIR:-/tmp}/gpu-operator-notices"
+    SAVE_ROOT="$(mktemp -d "${workspace_template}.XXXXXX")"
+    COMBINED_CSV="$(mktemp "${workspace_template}-csv.XXXXXX")"
+    INDEX_FILE="$(mktemp "${workspace_template}-idx.XXXXXX")"
 
     # Composed beside its destination, not under TMPDIR, so the last step is a
     # same-filesystem rename(2) rather than a copy-then-unlink.
@@ -259,22 +259,22 @@ build_indexes() {
 # License-bearing files, sorted. Filter by name: for restricted licenses
 # 'go-licenses save' copies the whole module source, which does not belong here.
 license_files_for() {
-    local dir="$1" f base
-    [[ -d "${dir}" ]] || return 0
-    while IFS= read -r -d '' f; do
-        base="$(basename "${f}")"
+    local search_dir="$1" license_file file_basename
+    [[ -d "${search_dir}" ]] || return 0
+    while IFS= read -r -d '' license_file; do
+        file_basename="$(basename "${license_file}")"
         # Exclude source files: the name pattern below also matches source
         # files that merely start with a license-shaped header, e.g.
         # k8s.io/kube-openapi/pkg/validation/spec/license.go, a Go file
         # beginning "// Copyright 2015 go-swagger maintainers".
-        case "${base}" in
+        case "${file_basename}" in
             *.go|*.c|*.h|*.s|*.py|*.sh|*.java|*.ts|*.js) continue ;;
         esac
-        if printf '%s' "${base}" \
+        if printf '%s' "${file_basename}" \
             | LC_ALL=C grep -qiE '^(licen[cs]e|notice|copying|copyright|authors|patents)([-._].*)?$'; then
-            printf '%s\n' "${f}"
+            printf '%s\n' "${license_file}"
         fi
-    done < <(find "${dir}" -maxdepth 1 -type f -print0 2>/dev/null | LC_ALL=C sort -z)
+    done < <(find "${search_dir}" -maxdepth 1 -type f -print0 2>/dev/null | LC_ALL=C sort -z)
 }
 
 LICENSE_URLS="${LICENSE_URLS:-tools/license-urls.tsv}"
@@ -319,21 +319,21 @@ location_for() {
 # License column joins identifiers.
 location_cell() {
     local package="$1" module="$2" version="$3"
-    local relative name license_path url cell="" lf govern_dir
-    relative="$(license_dir_within_module "${package}" "${module}")" \
+    local relative_license_dir license_file_name license_path url cell="" license_file governing_dir
+    relative_license_dir="$(license_dir_within_module "${package}" "${module}")" \
         || die "no license file found for ${package} under ${VENDOR_DIR}/${module}." \
                "Run 'go mod vendor' and re-run."
-    govern_dir="${VENDOR_DIR}/${module}${relative:+/${relative}}"
-    while IFS= read -r lf; do
-        [[ -z "${lf}" ]] && continue
-        name="$(basename "${lf}")"
-        license_path="${relative:+${relative}/}${name}"
+    governing_dir="${VENDOR_DIR}/${module}${relative_license_dir:+/${relative_license_dir}}"
+    while IFS= read -r license_file; do
+        [[ -z "${license_file}" ]] && continue
+        license_file_name="$(basename "${license_file}")"
+        license_path="${relative_license_dir:+${relative_license_dir}/}${license_file_name}"
         url="$(location_for "${module}" "${version}" "${license_path}")" \
             || die "${LICENSE_URLS} has no verified URL for ${module}@${version} ${license_path}." \
                    "Run 'make third-party-notices-urls' (needs network) and commit the result."
-        cell="${cell:+${cell} / }[${name}](${url})"
-    done < <(license_files_for "${govern_dir}")
-    [[ -n "${cell}" ]] || die "no license file for ${package} under ${govern_dir}." \
+        cell="${cell:+${cell} / }[${license_file_name}](${url})"
+    done < <(license_files_for "${governing_dir}")
+    [[ -n "${cell}" ]] || die "no license file for ${package} under ${governing_dir}." \
                               "Run 'go mod vendor' and re-run."
     printf '%s' "${cell}"
 }
@@ -355,7 +355,7 @@ emit_index_table() {
 
 emit_sections() {
     local index="$1"
-    local package _ license module version files lf fence relative name url govern_dir
+    local package _ license module version files license_file fence relative_license_dir license_file_name url governing_dir
 
     while IFS=, read -r package _ license module version; do
         [[ -z "${package}" ]] && continue
@@ -365,29 +365,29 @@ emit_sections() {
         printf '* Version: %s\n' "${version:-unknown}"
         printf '* License: %s\n\n' "${license:-Unknown}"
 
-        relative="$(license_dir_within_module "${package}" "${module}")" \
+        relative_license_dir="$(license_dir_within_module "${package}" "${module}")" \
             || die "no license file found for ${package} under ${VENDOR_DIR}/${module}." \
                    "Run 'go mod vendor' and re-run."
-        govern_dir="${VENDOR_DIR}/${module}${relative:+/${relative}}"
+        governing_dir="${VENDOR_DIR}/${module}${relative_license_dir:+/${relative_license_dir}}"
 
         files=()
-        while IFS= read -r lf; do
-            [[ -n "${lf}" ]] && files+=("${lf}")
-        done < <(license_files_for "${govern_dir}")
+        while IFS= read -r license_file; do
+            [[ -n "${license_file}" ]] && files+=("${license_file}")
+        done < <(license_files_for "${governing_dir}")
 
         if (( ${#files[@]} == 0 )); then
             printf 'License text unavailable. See upstream source for the full license.\n'
         else
-            for lf in "${files[@]}"; do
-                name="$(basename "${lf}")"
-                url="$(location_for "${module}" "${version}" "${relative:+${relative}/}${name}")" \
-                    || die "${LICENSE_URLS} has no verified URL for ${module}@${version} ${relative:+${relative}/}${name}." \
+            for license_file in "${files[@]}"; do
+                license_file_name="$(basename "${license_file}")"
+                url="$(location_for "${module}" "${version}" "${relative_license_dir:+${relative_license_dir}/}${license_file_name}")" \
+                    || die "${LICENSE_URLS} has no verified URL for ${module}@${version} ${relative_license_dir:+${relative_license_dir}/}${license_file_name}." \
                            "Run 'make third-party-notices-urls' (needs network) and commit the result."
-                fence="$(fence_for "${lf}")"
-                printf '#### %s\n\n' "${name}"
+                fence="$(fence_for "${license_file}")"
+                printf '#### %s\n\n' "${license_file_name}"
                 printf '<%s>\n\n' "${url}"
                 printf '%stext\n' "${fence}"
-                cat "${lf}"
+                cat "${license_file}"
                 echo
                 printf '%s\n' "${fence}"
                 echo
diff --git a/tools/resolve-module-repos.sh b/tools/resolve-module-repos.sh
index ed46252d7..58c7a16f9 100755
--- a/tools/resolve-module-repos.sh
+++ b/tools/resolve-module-repos.sh
@@ -81,27 +81,27 @@ main() {
     [[ -f "${MODULES_TXT}" ]] \
         || die "${MODULES_TXT} not found — run 'make third-party-notices-repos' from the repo root."
 
-    local tmp unresolved=0
-    tmp="$(mktemp "${TMPDIR:-/tmp}/gpu-operator-repos.XXXXXX")"
-    trap 'rm -f "${tmp}"' EXIT
+    local repos_tmp_file unresolved=0
+    repos_tmp_file="$(mktemp "${TMPDIR:-/tmp}/gpu-operator-repos.XXXXXX")"
+    trap 'rm -f "${repos_tmp_file}"' EXIT
 
-    local module version info repo prefix subdir meta converted
+    local module version module_info_json repo import_prefix subdir go_import_meta_content converted_repo_url
     local unresolved_modules=""
     while read -r module version; do
         [[ -z "${module}" ]] && continue
 
-        repo=""; prefix=""; subdir=""; info=""
+        repo=""; import_prefix=""; subdir=""; module_info_json=""
 
-        if info="$(fetch_retry "${PROXY}/$(proxy_escape "${module}")/@v/${version}.info")"; then
-            repo="$(origin_field "${info}" URL)"
-            subdir="$(origin_field "${info}" Subdir)"
+        if module_info_json="$(fetch_retry "${PROXY}/$(proxy_escape "${module}")/@v/${version}.info")"; then
+            repo="$(origin_field "${module_info_json}" URL)"
+            subdir="$(origin_field "${module_info_json}" Subdir)"
         fi
 
         if [[ -z "${repo}" ]]; then
-            meta="$(go_import_meta "${module}")" || meta=""
-            if [[ -n "${meta}" ]]; then
-                prefix="$(printf '%s' "${meta}" | awk '{print $1}')"
-                repo="$(printf '%s' "${meta}" | awk '{print $3}')"
+            go_import_meta_content="$(go_import_meta "${module}")" || go_import_meta_content=""
+            if [[ -n "${go_import_meta_content}" ]]; then
+                import_prefix="$(printf '%s' "${go_import_meta_content}" | awk '{print $1}')"
+                repo="$(printf '%s' "${go_import_meta_content}" | awk '{print $3}')"
             fi
         fi
 
@@ -111,8 +111,8 @@ main() {
         # gopkg.in points at itself and serves no blobs.
         case "${repo}" in
             https://gopkg.in/*|"")
-                converted="$(gopkg_in_repo "${module}")"
-                [[ -n "${converted}" ]] && repo="${converted}"
+                converted_repo_url="$(gopkg_in_repo "${module}")"
+                [[ -n "${converted_repo_url}" ]] && repo="${converted_repo_url}"
                 ;;
         esac
 
@@ -127,14 +127,14 @@ main() {
         # github path shape. The last matters because GitHub serves no
         # go-import, so a github submodule with no Origin would otherwise lose
         # its tag prefix and never verify.
-        if [[ -z "${subdir}" && -n "${prefix}" ]]; then
-            subdir="$(derived_subdir "${module}" "${prefix}")"
+        if [[ -z "${subdir}" && -n "${import_prefix}" ]]; then
+            subdir="$(derived_subdir "${module}" "${import_prefix}")"
         fi
         if [[ -z "${subdir}" ]]; then
             subdir="$(github_subdir_from_path "${module}")"
         fi
 
-        printf '%s\t%s\t%s\n' "${module}" "${repo}" "${subdir}" >> "${tmp}"
+        printf '%s\t%s\t%s\n' "${module}" "${repo}" "${subdir}" >> "${repos_tmp_file}"
     done < <(LC_ALL=C grep '^# ' "${MODULES_TXT}" | awk '{print $2, $3}')
 
     # A warning, not a die: this resolves every module in modules.txt, including
@@ -154,16 +154,17 @@ main() {
         printf '# Generated by tools/resolve-module-repos.sh from the module proxy Origin,\n'
         printf '# the go-import meta tag, and the github.com path shape. Not hand-edited.\n'
         printf '# module\trepo-url\tsubdir\n'
-        LC_ALL=C sort "${tmp}"
+        LC_ALL=C sort "${repos_tmp_file}"
     } > "${OUTPUT}"
 
     log "Wrote ${OUTPUT} ($(LC_ALL=C grep -vc '^#' "${OUTPUT}") modules)"
 
     # Exit here, not by falling off the end: the EXIT trap above references
-    # tmp, a variable local to this function. If main merely returns, the
-    # process's implicit exit fires that trap after tmp has gone out of
-    # scope, and 'set -u' turns the cleanup itself into an unbound-variable
-    # failure that clobbers this function's success with exit 1.
+    # repos_tmp_file, a variable local to this function. If main merely
+    # returns, the process's implicit exit fires that trap after
+    # repos_tmp_file has gone out of scope, and 'set -u' turns the cleanup
+    # itself into an unbound-variable failure that clobbers this function's
+    # success with exit 1.
     exit 0
 }
 
diff --git a/tools/verify-license-urls.sh b/tools/verify-license-urls.sh
index 40b64b400..3df4cbb17 100644
--- a/tools/verify-license-urls.sh
+++ b/tools/verify-license-urls.sh
@@ -102,11 +102,11 @@ main() {
     collect_licenses
     build_indexes
 
-    local tmp failures=0
-    tmp="$(mktemp "${TMPDIR:-/tmp}/gpu-operator-urls.XXXXXX")"
+    local verified_urls_tmp_file failures=0
+    verified_urls_tmp_file="$(mktemp "${TMPDIR:-/tmp}/gpu-operator-urls.XXXXXX")"
 
     local package _ module version repo subdir relative
-    local origin_tag origin_hash plain pseudo lf name path_in_module want_sha found
+    local origin_tag origin_hash plain_version pseudo_version_hash_value license_file name path_in_module want_sha found_url
     while IFS=, read -r package _ _ module version; do
         [[ -z "${package}" ]] && continue
 
@@ -124,22 +124,22 @@ main() {
         # commit only under its bare hash, so qualifying a hash the same way
         # 404s a pseudo-versioned module such as google.golang.org/protobuf.
         local tag_refs=() hash_refs=()
-        plain="$(normalize_version "${version}")"
-        pseudo="$(pseudo_version_hash "${version}")"
+        plain_version="$(normalize_version "${version}")"
+        pseudo_version_hash_value="$(pseudo_version_hash "${version}")"
         [[ -n "${origin_tag}" ]] && tag_refs+=( "${origin_tag}" )
-        if [[ -n "${pseudo}" ]]; then
-            hash_refs+=( "${pseudo}" )
+        if [[ -n "${pseudo_version_hash_value}" ]]; then
+            hash_refs+=( "${pseudo_version_hash_value}" )
         else
-            [[ -n "${subdir}" ]] && tag_refs+=( "${subdir}/${plain}" )
-            tag_refs+=( "${plain}" )
+            [[ -n "${subdir}" ]] && tag_refs+=( "${subdir}/${plain_version}" )
+            tag_refs+=( "${plain_version}" )
         fi
         [[ -n "${origin_hash}" ]] && hash_refs+=( "${origin_hash}" )
 
-        local refs=() r
+        local refs=() tag_ref
         if (( ${#tag_refs[@]} > 0 )); then
             case "${repo}" in
                 https://go.googlesource.com/*)
-                    for r in "${tag_refs[@]}"; do refs+=( "refs/tags/${r}" ); done
+                    for tag_ref in "${tag_refs[@]}"; do refs+=( "refs/tags/${tag_ref}" ); done
                     ;;
                 *)
                     refs+=( "${tag_refs[@]}" )
@@ -153,10 +153,10 @@ main() {
             || die "no license file found for ${package} under ${VENDOR_DIR}/${module}."
 
         local license_file_count=0
-        while IFS= read -r lf; do
-            [[ -z "${lf}" ]] && continue
+        while IFS= read -r license_file; do
+            [[ -z "${license_file}" ]] && continue
             license_file_count=$(( license_file_count + 1 ))
-            name="$(basename "${lf}")"
+            name="$(basename "${license_file}")"
             path_in_module="${relative:+${relative}/}${name}"
             [[ -f "${VENDOR_DIR}/${module}/${path_in_module}" ]] \
                 || die "${VENDOR_DIR}/${module}/${path_in_module} does not exist."
@@ -170,8 +170,8 @@ main() {
             [[ -n "${subdir}" ]] && paths+=( "${subdir}/${path_in_module}" )
             paths+=( "${path_in_module}" )
 
-            found=""
-            local try_ref try_path candidate rsha
+            found_url=""
+            local try_ref try_path candidate remote_sha_value
             for try_ref in "${refs[@]}"; do
                 for try_path in "${paths[@]}"; do
                     candidate="$(blob_url "${repo}" "${try_ref}" "${try_path}")"
@@ -180,19 +180,19 @@ main() {
                     # and sha256 of no bytes is a real, fixed hash value — so
                     # checking only the printed string would treat a failed
                     # fetch as a match against any zero-byte vendored file.
-                    if rsha="$(remote_sha "${candidate}")" && [[ "${rsha}" == "${want_sha}" ]]; then
-                        found="${candidate}"
+                    if remote_sha_value="$(remote_sha "${candidate}")" && [[ "${remote_sha_value}" == "${want_sha}" ]]; then
+                        found_url="${candidate}"
                         break 2
                     fi
                 done
             done
 
-            if [[ -z "${found}" ]]; then
+            if [[ -z "${found_url}" ]]; then
                 log "UNVERIFIED ${module}@${version} ${path_in_module}"
                 failures=$(( failures + 1 ))
                 continue
             fi
-            printf '%s\t%s\t%s\t%s\n' "${module}" "${version}" "${path_in_module}" "${found}" >> "${tmp}"
+            printf '%s\t%s\t%s\t%s\n' "${module}" "${version}" "${path_in_module}" "${found_url}" >> "${verified_urls_tmp_file}"
         done < <(license_files_for "${VENDOR_DIR}/${module}${relative:+/${relative}}")
 
         if (( license_file_count == 0 )); then
@@ -213,9 +213,9 @@ main() {
         printf '# sha256 matched against the vendored copy, so no entry is a dead or wrong link.\n'
         printf '# Covers the shipped set only: build- and test-only dependencies are excluded.\n'
         printf '# module\tversion\tlicense-path\turl\n'
-        LC_ALL=C sort -u "${tmp}"
+        LC_ALL=C sort -u "${verified_urls_tmp_file}"
     } > "${URLS_OUTPUT}"
-    rm -f "${tmp}"
+    rm -f "${verified_urls_tmp_file}"
 
     log "Wrote ${URLS_OUTPUT} ($(LC_ALL=C grep -vc '^#' "${URLS_OUTPUT}") verified URLs)"
     exit 0

From 3c21d803907efeeba8cbf0d1191de5a18b899fec Mon Sep 17 00:00:00 2001
From: Abrar Shivani <ashivani@nvidia.com>
Date: Mon, 24 Aug 2026 17:37:37 -0700
Subject: [PATCH 14/18] Trim comments that restate the code they sit above

The three function headers described what the code below already shows.
Keep only the rationale a reader cannot recover from the code: why the
name filter exists, why the nearest enclosing directory wins, and what
the link separator mirrors.

Signed-off-by: Abrar Shivani <ashivani@nvidia.com>
---
 tools/generate-third-party-notices.sh | 12 +++++-------
 1 file changed, 5 insertions(+), 7 deletions(-)

diff --git a/tools/generate-third-party-notices.sh b/tools/generate-third-party-notices.sh
index 6d195b10d..f09a2a4b7 100755
--- a/tools/generate-third-party-notices.sh
+++ b/tools/generate-third-party-notices.sh
@@ -256,8 +256,8 @@ build_indexes() {
     fi
 }
 
-# License-bearing files, sorted. Filter by name: for restricted licenses
-# 'go-licenses save' copies the whole module source, which does not belong here.
+# Filter by name: for restricted licenses 'go-licenses save' copies the whole
+# module source, which does not belong here.
 license_files_for() {
     local search_dir="$1" license_file file_basename
     [[ -d "${search_dir}" ]] || return 0
@@ -289,9 +289,8 @@ require_url_map() {
                "Run 'make third-party-notices-urls' (needs network) and commit the result."
 }
 
-# The directory whose license files govern PACKAGE, relative to MODULE. Walks
-# up from the package to the module root and takes the first directory holding
-# a license file, which is how go-licenses attributes them.
+# The first enclosing directory holding a license file wins, which is how
+# go-licenses attributes them.
 license_dir_within_module() {
     local module="$2" dir="$1" relative
     while :; do
@@ -315,8 +314,7 @@ location_for() {
     printf '%s' "${url}"
 }
 
-# ' / '-joined [filename](url) links, one per license file, mirroring how the
-# License column joins identifiers.
+# Mirrors how the License column joins identifiers.
 location_cell() {
     local package="$1" module="$2" version="$3"
     local relative_license_dir license_file_name license_path url cell="" license_file governing_dir

From cec0b75c4640bfe10f5a7c2e11a2e2ff7a68c368 Mon Sep 17 00:00:00 2001
From: Abrar Shivani <ashivani@nvidia.com>
Date: Mon, 24 Aug 2026 18:36:29 -0700
Subject: [PATCH 15/18] Add curated license-identifier override for
 dual-licensed modules

go-licenses classifies a license file as whichever license it scores
highest, so gopkg.in/yaml.v3, go.yaml.in/yaml/v3 and go.yaml.in/yaml/v2
each report only one identifier even though their license file(s) bundle
both Apache-2.0 and MIT grants. The license text was already reproduced
in full; only the reported identifier understated it.

Add tools/license-overrides.tsv, a hand-curated map of package to the
correct joined identifier, and wire it into both the index table and the
license sections so they agree. A stale-entry guard fails the build if an
override names a package that no longer appears in the generated index.

Signed-off-by: Abrar Shivani <ashivani@nvidia.com>
---
 THIRD_PARTY_NOTICES.md                     | 12 +++---
 tools/generate-third-party-notices.sh      | 39 ++++++++++++++++---
 tools/generate-third-party-notices_test.sh | 44 ++++++++++++++++++++--
 tools/license-overrides.tsv                | 16 ++++++++
 4 files changed, 96 insertions(+), 15 deletions(-)
 create mode 100644 tools/license-overrides.tsv

diff --git a/THIRD_PARTY_NOTICES.md b/THIRD_PARTY_NOTICES.md
index 1ce6116d0..a4fcc3c58 100644
--- a/THIRD_PARTY_NOTICES.md
+++ b/THIRD_PARTY_NOTICES.md
@@ -115,8 +115,8 @@ carry.
 | `github.com/xlab/treeprint` | `github.com/xlab/treeprint` | v1.2.0 | MIT | [LICENSE](https://github.com/xlab/treeprint/blob/v1.2.0/LICENSE) |
 | `go.uber.org/multierr` | `go.uber.org/multierr` | v1.11.0 | MIT | [LICENSE.txt](https://github.com/uber-go/multierr/blob/v1.11.0/LICENSE.txt) |
 | `go.uber.org/zap` | `go.uber.org/zap` | v1.28.0 | MIT | [LICENSE](https://github.com/uber-go/zap/blob/v1.28.0/LICENSE) |
-| `go.yaml.in/yaml/v2` | `go.yaml.in/yaml/v2` | v2.4.4 | Apache-2.0 | [LICENSE](https://github.com/yaml/go-yaml/blob/v2.4.4/LICENSE) / [LICENSE.libyaml](https://github.com/yaml/go-yaml/blob/v2.4.4/LICENSE.libyaml) / [NOTICE](https://github.com/yaml/go-yaml/blob/v2.4.4/NOTICE) |
-| `go.yaml.in/yaml/v3` | `go.yaml.in/yaml/v3` | v3.0.4 | MIT | [LICENSE](https://github.com/yaml/go-yaml/blob/v3.0.4/LICENSE) / [NOTICE](https://github.com/yaml/go-yaml/blob/v3.0.4/NOTICE) |
+| `go.yaml.in/yaml/v2` | `go.yaml.in/yaml/v2` | v2.4.4 | Apache-2.0 / MIT | [LICENSE](https://github.com/yaml/go-yaml/blob/v2.4.4/LICENSE) / [LICENSE.libyaml](https://github.com/yaml/go-yaml/blob/v2.4.4/LICENSE.libyaml) / [NOTICE](https://github.com/yaml/go-yaml/blob/v2.4.4/NOTICE) |
+| `go.yaml.in/yaml/v3` | `go.yaml.in/yaml/v3` | v3.0.4 | Apache-2.0 / MIT | [LICENSE](https://github.com/yaml/go-yaml/blob/v3.0.4/LICENSE) / [NOTICE](https://github.com/yaml/go-yaml/blob/v3.0.4/NOTICE) |
 | `golang.org/x/crypto` | `golang.org/x/crypto` | v0.55.0 | BSD-3-Clause | [LICENSE](https://go.googlesource.com/crypto/+/refs/tags/v0.55.0/LICENSE) / [PATENTS](https://go.googlesource.com/crypto/+/refs/tags/v0.55.0/PATENTS) |
 | `golang.org/x/mod/semver` | `golang.org/x/mod` | v0.40.0 | BSD-3-Clause | [LICENSE](https://go.googlesource.com/mod/+/refs/tags/v0.40.0/LICENSE) / [PATENTS](https://go.googlesource.com/mod/+/refs/tags/v0.40.0/PATENTS) |
 | `golang.org/x/net` | `golang.org/x/net` | v0.58.0 | BSD-3-Clause | [LICENSE](https://go.googlesource.com/net/+/refs/tags/v0.58.0/LICENSE) / [PATENTS](https://go.googlesource.com/net/+/refs/tags/v0.58.0/PATENTS) |
@@ -130,7 +130,7 @@ carry.
 | `google.golang.org/protobuf` | `google.golang.org/protobuf` | v1.36.12-0.20260120151049-f2248ac996af | BSD-3-Clause | [LICENSE](https://go.googlesource.com/protobuf/+/f2248ac996af/LICENSE) / [PATENTS](https://go.googlesource.com/protobuf/+/f2248ac996af/PATENTS) |
 | `gopkg.in/evanphx/json-patch.v4` | `gopkg.in/evanphx/json-patch.v4` | v4.13.0 | BSD-3-Clause | [LICENSE](https://github.com/evanphx/json-patch/blob/v4.13.0/LICENSE) |
 | `gopkg.in/inf.v0` | `gopkg.in/inf.v0` | v0.9.1 | BSD-3-Clause | [LICENSE](https://github.com/go-inf/inf/blob/v0.9.1/LICENSE) |
-| `gopkg.in/yaml.v3` | `gopkg.in/yaml.v3` | v3.0.1 | MIT | [LICENSE](https://github.com/go-yaml/yaml/blob/v3.0.1/LICENSE) / [NOTICE](https://github.com/go-yaml/yaml/blob/v3.0.1/NOTICE) |
+| `gopkg.in/yaml.v3` | `gopkg.in/yaml.v3` | v3.0.1 | Apache-2.0 / MIT | [LICENSE](https://github.com/go-yaml/yaml/blob/v3.0.1/LICENSE) / [NOTICE](https://github.com/go-yaml/yaml/blob/v3.0.1/NOTICE) |
 | `k8s.io/api` | `k8s.io/api` | v0.36.4 | Apache-2.0 | [LICENSE](https://github.com/kubernetes/api/blob/v0.36.4/LICENSE) |
 | `k8s.io/apiextensions-apiserver/pkg` | `k8s.io/apiextensions-apiserver` | v0.36.4 | Apache-2.0 | [LICENSE](https://github.com/kubernetes/apiextensions-apiserver/blob/v0.36.4/LICENSE) |
 | `k8s.io/apimachinery/pkg` | `k8s.io/apimachinery` | v0.36.4 | Apache-2.0 | [LICENSE](https://github.com/kubernetes/apimachinery/blob/v0.36.4/LICENSE) |
@@ -12324,7 +12324,7 @@ THE SOFTWARE.
 
 * Module: go.yaml.in/yaml/v2
 * Version: v2.4.4
-* License: Apache-2.0
+* License: Apache-2.0 / MIT
 
 #### LICENSE
 
@@ -12600,7 +12600,7 @@ limitations under the License.
 
 * Module: go.yaml.in/yaml/v3
 * Version: v3.0.4
-* License: MIT
+* License: Apache-2.0 / MIT
 
 #### LICENSE
 
@@ -13676,7 +13676,7 @@ OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
 * Module: gopkg.in/yaml.v3
 * Version: v3.0.1
-* License: MIT
+* License: Apache-2.0 / MIT
 
 #### LICENSE
 
diff --git a/tools/generate-third-party-notices.sh b/tools/generate-third-party-notices.sh
index f09a2a4b7..bbe038f8d 100755
--- a/tools/generate-third-party-notices.sh
+++ b/tools/generate-third-party-notices.sh
@@ -72,7 +72,7 @@ check_prerequisites() {
     fi
 
     local required_file
-    for required_file in "${MULTI_ARCH_MK}" "${MODULES_TXT}"; do
+    for required_file in "${MULTI_ARCH_MK}" "${MODULES_TXT}" "${LICENSE_OVERRIDES}"; do
         [[ -f "${required_file}" ]] \
             || die "${required_file} not found — run 'make third-party-notices' from the repo root."
     done
@@ -254,6 +254,22 @@ build_indexes() {
         die "go-licenses could not identify a license for some dependencies." \
             "Check the entries reported as Unknown before committing the file."
     fi
+
+    check_override_coverage "${INDEX_FILE}"
+}
+
+# A dropped dependency would otherwise leave its row in LICENSE_OVERRIDES
+# silently asserting a license for a package no longer shipped.
+check_override_coverage() {
+    local index="$1" override_package
+    while IFS=$'\t' read -r override_package _ _; do
+        case "${override_package}" in
+            ''|'#'*) continue ;;
+        esac
+        LC_ALL=C cut -d, -f1 "${index}" | LC_ALL=C grep -qFx "${override_package}" \
+            || die "${LICENSE_OVERRIDES} has a row for ${override_package}, which is not in the generated index." \
+                   "Remove that row from ${LICENSE_OVERRIDES} — the dependency was likely dropped."
+    done < "${LICENSE_OVERRIDES}"
 }
 
 # Filter by name: for restricted licenses 'go-licenses save' copies the whole
@@ -278,6 +294,7 @@ license_files_for() {
 }
 
 LICENSE_URLS="${LICENSE_URLS:-tools/license-urls.tsv}"
+LICENSE_OVERRIDES="${LICENSE_OVERRIDES:-tools/license-overrides.tsv}"
 VENDOR_DIR="${VENDOR_DIR:-vendor}"
 
 # Separate from check_prerequisites: tools/verify-license-urls.sh reuses the
@@ -289,6 +306,16 @@ require_url_map() {
                "Run 'make third-party-notices-urls' (needs network) and commit the result."
 }
 
+# A single license file can bundle more than one license, which go-licenses
+# reports as whichever one it scores highest; LICENSE_OVERRIDES corrects the
+# identifier by hand without touching the license text, which is unaffected.
+license_identifier_for() {
+    local package="$1" default_identifier="$2" override_identifier
+    override_identifier="$(LC_ALL=C awk -F'\t' -v pkg="${package}" \
+        '$1 == pkg { print $2; exit }' "${LICENSE_OVERRIDES}")"
+    printf '%s' "${override_identifier:-${default_identifier}}"
+}
+
 # The first enclosing directory holding a license file wins, which is how
 # go-licenses attributes them.
 license_dir_within_module() {
@@ -337,31 +364,33 @@ location_cell() {
 }
 
 emit_index_table() {
-    local index="$1" package _ license module version location
+    local index="$1" package _ license module version location license_identifier
     printf '| Package | Module | Version | License | Location |\n'
     printf '|---------|--------|---------|---------|----------|\n'
 
     while IFS=, read -r package _ license module version; do
         [[ -z "${package}" ]] && continue
         location="$(location_cell "${package}" "${module}" "${version}")"
+        license_identifier="$(license_identifier_for "${package}" "${license:-Unknown}")"
         # shellcheck disable=SC2016  # backticks are literal markdown here.
         printf '| `%s` | `%s` | %s | %s | %s |\n' \
             "${package}" "${module:-unknown}" "${version:-unknown}" \
-            "${license:-Unknown}" "${location}"
+            "${license_identifier}" "${location}"
     done < "${index}"
 }
 
 emit_sections() {
     local index="$1"
-    local package _ license module version files license_file fence relative_license_dir license_file_name url governing_dir
+    local package _ license module version files license_file fence relative_license_dir license_file_name url governing_dir license_identifier
 
     while IFS=, read -r package _ license module version; do
         [[ -z "${package}" ]] && continue
 
+        license_identifier="$(license_identifier_for "${package}" "${license:-Unknown}")"
         printf '### %s\n\n' "${package}"
         printf '* Module: %s\n' "${module:-unknown}"
         printf '* Version: %s\n' "${version:-unknown}"
-        printf '* License: %s\n\n' "${license:-Unknown}"
+        printf '* License: %s\n\n' "${license_identifier}"
 
         relative_license_dir="$(license_dir_within_module "${package}" "${module}")" \
             || die "no license file found for ${package} under ${VENDOR_DIR}/${module}." \
diff --git a/tools/generate-third-party-notices_test.sh b/tools/generate-third-party-notices_test.sh
index 60d946b3d..da0079931 100644
--- a/tools/generate-third-party-notices_test.sh
+++ b/tools/generate-third-party-notices_test.sh
@@ -69,6 +69,12 @@ urls_fixture="$(mktemp)"
 printf 'github.com/klauspost/compress\tv1.19.1\tLICENSE\thttps://example.invalid/root\n' > "${urls_fixture}"
 printf 'github.com/klauspost/compress\tv1.19.1\tzstd/internal/xxhash/LICENSE.txt\thttps://example.invalid/xxhash\n' >> "${urls_fixture}"
 
+# No rows: exercises license_identifier_for's not-found path so the fixtures
+# below that do not care about overrides are unaffected by them, without
+# depending on the LICENSE_OVERRIDES default resolving from the test's cwd.
+empty_overrides_fixture="$(mktemp)"
+printf '# no overrides\n' > "${empty_overrides_fixture}"
+
 assert_eq "https://example.invalid/xxhash" \
     "$(LICENSE_URLS="${urls_fixture}" location_for \
         github.com/klauspost/compress v1.19.1 zstd/internal/xxhash/LICENSE.txt)" \
@@ -115,13 +121,13 @@ IDX
 
 assert_eq '| Package | Module | Version | License | Location |' \
     "$(LICENSE_URLS="${urls_fixture}" VENDOR_DIR="${vendor_fixture}" LICENSES_DIR="${render}/cache" \
-       emit_index_table "${render}/index.csv" | sed -n 1p)" \
+       LICENSE_OVERRIDES="${empty_overrides_fixture}" emit_index_table "${render}/index.csv" | sed -n 1p)" \
     "index header has five columns"
 # Expected literal Markdown, not shell expansion.
 # shellcheck disable=SC2016
 assert_eq '| `github.com/klauspost/compress/zstd/internal/xxhash` | `github.com/klauspost/compress` | v1.19.1 | MIT | [LICENSE.txt](https://example.invalid/xxhash) |' \
     "$(LICENSE_URLS="${urls_fixture}" VENDOR_DIR="${vendor_fixture}" LICENSES_DIR="${render}/cache" \
-       emit_index_table "${render}/index.csv" | sed -n 3p)" \
+       LICENSE_OVERRIDES="${empty_overrides_fixture}" emit_index_table "${render}/index.csv" | sed -n 3p)" \
     "index row labels the link by filename"
 
 # Regression: a package whose module/version pair has no entry in the URL map
@@ -134,16 +140,46 @@ IDX
 # shellcheck disable=SC2016
 assert_fails "emit_index_table fails closed when the URL map has no entry for a row" \
     env LICENSE_URLS="${urls_fixture}" VENDOR_DIR="${vendor_fixture}" LICENSES_DIR="${render}/cache" \
+    LICENSE_OVERRIDES="${empty_overrides_fixture}" \
     bash -c 'source "$1"; emit_index_table "$2"' _ "${HERE}/generate-third-party-notices.sh" "${mismatch_index}"
 
 section="$(LICENSE_URLS="${urls_fixture}" VENDOR_DIR="${vendor_fixture}" LICENSES_DIR="${render}/cache" \
-    emit_sections "${render}/index.csv" "${render}/cache")"
+    LICENSE_OVERRIDES="${empty_overrides_fixture}" emit_sections "${render}/index.csv" "${render}/cache")"
 assert_eq "* Module: github.com/klauspost/compress" "$(printf '%s' "${section}" | sed -n 3p)" "section names the module"
 assert_eq "* Version: v1.19.1" "$(printf '%s' "${section}" | sed -n 4p)" "section names the version"
 assert_eq "<https://example.invalid/xxhash>" \
     "$(printf '%s' "${section}" | LC_ALL=C grep -m1 '^<http')" "section prints the file URL"
 
+overrides_fixture="$(mktemp)"
+cat > "${overrides_fixture}" <<'OVERRIDES'
+# package	license	reason
+github.com/klauspost/compress	Apache-2.0 / MIT	test fixture
+github.com/klauspost/compress/zstd/internal/xxhash	Apache-2.0 / MIT	test fixture
+OVERRIDES
+
+assert_eq "Apache-2.0 / MIT" \
+    "$(LICENSE_OVERRIDES="${overrides_fixture}" license_identifier_for github.com/klauspost/compress Apache-2.0)" \
+    "license_identifier_for returns the override for a package that has one"
+assert_eq "MIT" \
+    "$(LICENSE_OVERRIDES="${overrides_fixture}" license_identifier_for k8s.io/api MIT)" \
+    "license_identifier_for returns the passed-in default for a package without an override"
+
+# Expected literal Markdown, not shell expansion.
+# shellcheck disable=SC2016
+assert_eq '| `github.com/klauspost/compress/zstd/internal/xxhash` | `github.com/klauspost/compress` | v1.19.1 | Apache-2.0 / MIT | [LICENSE.txt](https://example.invalid/xxhash) |' \
+    "$(LICENSE_URLS="${urls_fixture}" VENDOR_DIR="${vendor_fixture}" LICENSES_DIR="${render}/cache" \
+       LICENSE_OVERRIDES="${overrides_fixture}" emit_index_table "${render}/index.csv" | sed -n 3p)" \
+    "emit_index_table renders the overridden identifier in the License column"
+
+stale_overrides="$(mktemp)"
+printf 'github.com/absent/package\tApache-2.0 / MIT\ttest fixture\n' > "${stale_overrides}"
+# $1/$2 are expanded by the child bash -c, not here.
+# shellcheck disable=SC2016
+assert_fails "check_override_coverage fails when an override names a package absent from the index" \
+    env LICENSE_OVERRIDES="${stale_overrides}" bash -c \
+    'source "$1"; check_override_coverage "$2"' _ "${HERE}/generate-third-party-notices.sh" "${render}/index.csv"
+
 rm -rf "${vendor_fixture}" "${render}"
-rm -f "${modules_fixture}" "${index_input}" "${urls_fixture}"
+rm -f "${modules_fixture}" "${index_input}" "${urls_fixture}" "${empty_overrides_fixture}" "${overrides_fixture}" "${stale_overrides}"
 
 finish
diff --git a/tools/license-overrides.tsv b/tools/license-overrides.tsv
new file mode 100644
index 000000000..ef79a3e7a
--- /dev/null
+++ b/tools/license-overrides.tsv
@@ -0,0 +1,16 @@
+# Curated license identifiers for packages whose license file bundles more
+# than one license as a single document. go-licenses classifies such a file
+# as whichever license it scores highest and reports only that one, so the
+# reported identifier understates the terms even though the license text
+# reproduced in THIRD_PARTY_NOTICES.md already carries every license in full.
+#
+# Add a row here only when you have read the vendored license file yourself
+# and confirmed by eye which licenses it actually contains — do not derive
+# an entry by grepping license text for phrases, which cannot reliably tell
+# similar licenses apart (e.g. BSD-2-Clause vs BSD-3-Clause) and risks adding
+# a wrong claim to a legal document.
+#
+# package	license	reason
+go.yaml.in/yaml/v2	Apache-2.0 / MIT	ships LICENSE (Apache-2.0) and LICENSE.libyaml (MIT) as two files; go-licenses reports only the Apache-2.0 LICENSE
+go.yaml.in/yaml/v3	Apache-2.0 / MIT	single LICENSE file has a full-text MIT section plus a short-form Apache-2.0 grant; go-licenses reports only MIT
+gopkg.in/yaml.v3	Apache-2.0 / MIT	single LICENSE file has a full-text MIT section plus a short-form Apache-2.0 grant; go-licenses reports only MIT

From 99032878fb8234c1a11de7deea98f37e377de9b1 Mon Sep 17 00:00:00 2001
From: Abrar Shivani <ashivani@nvidia.com>
Date: Tue, 25 Aug 2026 12:30:32 -0700
Subject: [PATCH 16/18] Drop Module column from the third-party notices index
 table

The index table repeats the module path next to the package path even
when they match, which is true for most rows. Package and Location
already identify the dependency, and the Module bullet in each
package's detail section still explains the cases where the package
path and module diverge, so the index no longer needs the column.

Signed-off-by: Abrar Shivani <ashivani@nvidia.com>
---
 THIRD_PARTY_NOTICES.md                     | 252 ++++++++++-----------
 tools/generate-third-party-notices.sh      |   8 +-
 tools/generate-third-party-notices_test.sh |   8 +-
 3 files changed, 134 insertions(+), 134 deletions(-)

diff --git a/THIRD_PARTY_NOTICES.md b/THIRD_PARTY_NOTICES.md
index a4fcc3c58..c7b7900e3 100644
--- a/THIRD_PARTY_NOTICES.md
+++ b/THIRD_PARTY_NOTICES.md
@@ -29,132 +29,132 @@ carry.
 
 ## Dependency Index
 
-| Package | Module | Version | License | Location |
-|---------|--------|---------|---------|----------|
-| `dario.cat/mergo` | `dario.cat/mergo` | v1.0.1 | BSD-3-Clause | [LICENSE](https://github.com/imdario/mergo/blob/v1.0.1/LICENSE) |
-| `github.com/MakeNowJust/heredoc` | `github.com/MakeNowJust/heredoc` | v1.0.0 | MIT | [LICENSE](https://github.com/makenowjust/heredoc/blob/v1.0.0/LICENSE) |
-| `github.com/Masterminds/goutils` | `github.com/Masterminds/goutils` | v1.1.1 | Apache-2.0 | [LICENSE.txt](https://github.com/Masterminds/goutils/blob/v1.1.1/LICENSE.txt) |
-| `github.com/Masterminds/semver/v3` | `github.com/Masterminds/semver/v3` | v3.5.0 | MIT | [LICENSE.txt](https://github.com/Masterminds/semver/blob/v3.5.0/LICENSE.txt) |
-| `github.com/Masterminds/sprig/v3` | `github.com/Masterminds/sprig/v3` | v3.3.0 | MIT | [LICENSE.txt](https://github.com/Masterminds/sprig/blob/v3.3.0/LICENSE.txt) |
-| `github.com/Mellanox/maintenance-operator/api/v1alpha1` | `github.com/Mellanox/maintenance-operator/api` | v0.3.0 | Apache-2.0 | [LICENSE](https://github.com/Mellanox/maintenance-operator/blob/api/v0.3.0/LICENSE) |
-| `github.com/NVIDIA/go-nvlib/pkg` | `github.com/NVIDIA/go-nvlib` | v0.12.0 | Apache-2.0 | [LICENSE](https://github.com/NVIDIA/go-nvlib/blob/v0.12.0/LICENSE) / [NOTICE](https://github.com/NVIDIA/go-nvlib/blob/v0.12.0/NOTICE) |
-| `github.com/NVIDIA/k8s-kata-manager/api/v1alpha1/config` | `github.com/NVIDIA/k8s-kata-manager` | v0.2.3 | Apache-2.0 | [LICENSE](https://github.com/NVIDIA/k8s-kata-manager/blob/v0.2.3/LICENSE) |
-| `github.com/NVIDIA/k8s-operator-libs` | `github.com/NVIDIA/k8s-operator-libs` | v0.0.0-20260629200812-d720f2557494 | Apache-2.0 | [LICENSE](https://github.com/NVIDIA/k8s-operator-libs/blob/d720f2557494/LICENSE) |
-| `github.com/NVIDIA/nvidia-container-toolkit` | `github.com/NVIDIA/nvidia-container-toolkit` | v1.20.0 | Apache-2.0 | [LICENSE](https://github.com/NVIDIA/nvidia-container-toolkit/blob/v1.20.0/LICENSE) |
-| `github.com/beorn7/perks/quantile` | `github.com/beorn7/perks` | v1.0.1 | MIT | [LICENSE](https://github.com/beorn7/perks/blob/v1.0.1/LICENSE) |
-| `github.com/blang/semver/v4` | `github.com/blang/semver/v4` | v4.0.0 | MIT | [LICENSE](https://github.com/blang/semver/blob/v4.0.0/LICENSE) |
-| `github.com/cespare/xxhash/v2` | `github.com/cespare/xxhash/v2` | v2.3.0 | MIT | [LICENSE.txt](https://github.com/cespare/xxhash/blob/v2.3.0/LICENSE.txt) |
-| `github.com/chai2010/gettext-go` | `github.com/chai2010/gettext-go` | v1.0.2 | BSD-3-Clause | [LICENSE](https://github.com/chai2010/gettext-go/blob/v1.0.2/LICENSE) |
-| `github.com/cyphar/filepath-securejoin` | `github.com/cyphar/filepath-securejoin` | v0.7.0 | BSD-3-Clause / MPL-2.0 | [COPYING.md](https://github.com/cyphar/filepath-securejoin/blob/v0.7.0/COPYING.md) / [LICENSE.BSD](https://github.com/cyphar/filepath-securejoin/blob/v0.7.0/LICENSE.BSD) / [LICENSE.MPL-2.0](https://github.com/cyphar/filepath-securejoin/blob/v0.7.0/LICENSE.MPL-2.0) |
-| `github.com/davecgh/go-spew/spew` | `github.com/davecgh/go-spew` | v1.1.2-0.20180830191138-d8f796af33cc | ISC | [LICENSE](https://github.com/davecgh/go-spew/blob/d8f796af33cc/LICENSE) |
-| `github.com/docker/libtrust` | `github.com/docker/libtrust` | v0.0.0-20160708172513-aabc10ec26b7 | Apache-2.0 | [LICENSE](https://github.com/docker-archive-public/docker.libtrust/blob/aabc10ec26b7/LICENSE) |
-| `github.com/emicklei/go-restful/v3` | `github.com/emicklei/go-restful/v3` | v3.13.0 | MIT | [LICENSE](https://github.com/emicklei/go-restful/blob/v3.13.0/LICENSE) |
-| `github.com/evanphx/json-patch/v5` | `github.com/evanphx/json-patch/v5` | v5.9.11 | BSD-3-Clause | [LICENSE](https://github.com/evanphx/json-patch/blob/v5.9.11/LICENSE) |
-| `github.com/exponent-io/jsonpath` | `github.com/exponent-io/jsonpath` | v0.0.0-20210407135951-1de76d718b3f | MIT | [LICENSE](https://github.com/exponent-io/jsonpath/blob/1de76d718b3f/LICENSE) |
-| `github.com/fsnotify/fsnotify` | `github.com/fsnotify/fsnotify` | v1.9.0 | BSD-3-Clause | [LICENSE](https://github.com/fsnotify/fsnotify/blob/v1.9.0/LICENSE) |
-| `github.com/fxamacker/cbor/v2` | `github.com/fxamacker/cbor/v2` | v2.9.2 | MIT | [LICENSE](https://github.com/fxamacker/cbor/blob/v2.9.2/LICENSE) |
-| `github.com/go-errors/errors` | `github.com/go-errors/errors` | v1.5.1 | MIT | [LICENSE.MIT](https://github.com/go-errors/errors/blob/v1.5.1/LICENSE.MIT) |
-| `github.com/go-logr/logr` | `github.com/go-logr/logr` | v1.4.4 | Apache-2.0 | [LICENSE](https://github.com/go-logr/logr/blob/v1.4.4/LICENSE) |
-| `github.com/go-logr/zapr` | `github.com/go-logr/zapr` | v1.3.0 | Apache-2.0 | [LICENSE](https://github.com/go-logr/zapr/blob/v1.3.0/LICENSE) |
-| `github.com/go-openapi/jsonpointer` | `github.com/go-openapi/jsonpointer` | v0.22.4 | Apache-2.0 | [LICENSE](https://github.com/go-openapi/jsonpointer/blob/v0.22.4/LICENSE) / [NOTICE](https://github.com/go-openapi/jsonpointer/blob/v0.22.4/NOTICE) |
-| `github.com/go-openapi/jsonreference` | `github.com/go-openapi/jsonreference` | v0.21.4 | Apache-2.0 | [LICENSE](https://github.com/go-openapi/jsonreference/blob/v0.21.4/LICENSE) / [NOTICE](https://github.com/go-openapi/jsonreference/blob/v0.21.4/NOTICE) |
-| `github.com/go-openapi/swag` | `github.com/go-openapi/swag` | v0.25.4 | Apache-2.0 | [LICENSE](https://github.com/go-openapi/swag/blob/v0.25.4/LICENSE) |
-| `github.com/go-openapi/swag/cmdutils` | `github.com/go-openapi/swag/cmdutils` | v0.25.4 | Apache-2.0 | [LICENSE](https://github.com/go-openapi/swag/blob/cmdutils/v0.25.4/LICENSE) |
-| `github.com/go-openapi/swag/conv` | `github.com/go-openapi/swag/conv` | v0.25.4 | Apache-2.0 | [LICENSE](https://github.com/go-openapi/swag/blob/conv/v0.25.4/LICENSE) |
-| `github.com/go-openapi/swag/fileutils` | `github.com/go-openapi/swag/fileutils` | v0.25.4 | Apache-2.0 | [LICENSE](https://github.com/go-openapi/swag/blob/fileutils/v0.25.4/LICENSE) |
-| `github.com/go-openapi/swag/jsonname` | `github.com/go-openapi/swag/jsonname` | v0.25.4 | Apache-2.0 | [LICENSE](https://github.com/go-openapi/swag/blob/jsonname/v0.25.4/LICENSE) |
-| `github.com/go-openapi/swag/jsonutils` | `github.com/go-openapi/swag/jsonutils` | v0.25.4 | Apache-2.0 | [LICENSE](https://github.com/go-openapi/swag/blob/jsonutils/v0.25.4/LICENSE) |
-| `github.com/go-openapi/swag/loading` | `github.com/go-openapi/swag/loading` | v0.25.4 | Apache-2.0 | [LICENSE](https://github.com/go-openapi/swag/blob/loading/v0.25.4/LICENSE) |
-| `github.com/go-openapi/swag/mangling` | `github.com/go-openapi/swag/mangling` | v0.25.4 | Apache-2.0 | [LICENSE](https://github.com/go-openapi/swag/blob/mangling/v0.25.4/LICENSE) |
-| `github.com/go-openapi/swag/netutils` | `github.com/go-openapi/swag/netutils` | v0.25.4 | Apache-2.0 | [LICENSE](https://github.com/go-openapi/swag/blob/netutils/v0.25.4/LICENSE) |
-| `github.com/go-openapi/swag/stringutils` | `github.com/go-openapi/swag/stringutils` | v0.25.4 | Apache-2.0 | [LICENSE](https://github.com/go-openapi/swag/blob/stringutils/v0.25.4/LICENSE) |
-| `github.com/go-openapi/swag/typeutils` | `github.com/go-openapi/swag/typeutils` | v0.25.4 | Apache-2.0 | [LICENSE](https://github.com/go-openapi/swag/blob/typeutils/v0.25.4/LICENSE) |
-| `github.com/go-openapi/swag/yamlutils` | `github.com/go-openapi/swag/yamlutils` | v0.25.4 | Apache-2.0 | [LICENSE](https://github.com/go-openapi/swag/blob/yamlutils/v0.25.4/LICENSE) |
-| `github.com/google/btree` | `github.com/google/btree` | v1.1.3 | Apache-2.0 | [LICENSE](https://github.com/google/btree/blob/v1.1.3/LICENSE) |
-| `github.com/google/gnostic-models` | `github.com/google/gnostic-models` | v0.7.1 | Apache-2.0 | [LICENSE](https://github.com/google/gnostic-models/blob/v0.7.1/LICENSE) |
-| `github.com/google/uuid` | `github.com/google/uuid` | v1.6.0 | BSD-3-Clause | [LICENSE](https://github.com/google/uuid/blob/v1.6.0/LICENSE) |
-| `github.com/huandu/xstrings` | `github.com/huandu/xstrings` | v1.5.0 | MIT | [LICENSE](https://github.com/huandu/xstrings/blob/v1.5.0/LICENSE) |
-| `github.com/json-iterator/go` | `github.com/json-iterator/go` | v1.1.12 | MIT | [LICENSE](https://github.com/json-iterator/go/blob/v1.1.12/LICENSE) |
-| `github.com/klauspost/compress` | `github.com/klauspost/compress` | v1.19.1 | Apache-2.0 / BSD-3-Clause / MIT | [LICENSE](https://github.com/klauspost/compress/blob/v1.19.1/LICENSE) |
-| `github.com/klauspost/compress/internal/snapref` | `github.com/klauspost/compress` | v1.19.1 | BSD-3-Clause | [LICENSE](https://github.com/klauspost/compress/blob/v1.19.1/internal/snapref/LICENSE) |
-| `github.com/klauspost/compress/zstd/internal/xxhash` | `github.com/klauspost/compress` | v1.19.1 | MIT | [LICENSE.txt](https://github.com/klauspost/compress/blob/v1.19.1/zstd/internal/xxhash/LICENSE.txt) |
-| `github.com/liggitt/tabwriter` | `github.com/liggitt/tabwriter` | v0.0.0-20181228230101-89fcab3d43de | BSD-3-Clause | [LICENSE](https://github.com/liggitt/tabwriter/blob/89fcab3d43de/LICENSE) |
-| `github.com/mitchellh/copystructure` | `github.com/mitchellh/copystructure` | v1.2.0 | MIT | [LICENSE](https://github.com/mitchellh/copystructure/blob/v1.2.0/LICENSE) |
-| `github.com/mitchellh/go-wordwrap` | `github.com/mitchellh/go-wordwrap` | v1.0.1 | MIT | [LICENSE.md](https://github.com/mitchellh/go-wordwrap/blob/v1.0.1/LICENSE.md) |
-| `github.com/mitchellh/reflectwalk` | `github.com/mitchellh/reflectwalk` | v1.0.2 | MIT | [LICENSE](https://github.com/mitchellh/reflectwalk/blob/v1.0.2/LICENSE) |
-| `github.com/moby/term` | `github.com/moby/term` | v0.5.2 | Apache-2.0 | [LICENSE](https://github.com/moby/term/blob/v0.5.2/LICENSE) |
-| `github.com/modern-go/concurrent` | `github.com/modern-go/concurrent` | v0.0.0-20180306012644-bacd9c7ef1dd | Apache-2.0 | [LICENSE](https://github.com/modern-go/concurrent/blob/bacd9c7ef1dd/LICENSE) |
-| `github.com/modern-go/reflect2` | `github.com/modern-go/reflect2` | v1.0.3-0.20250322232337-35a7c28c31ee | Apache-2.0 | [LICENSE](https://github.com/modern-go/reflect2/blob/35a7c28c31ee/LICENSE) |
-| `github.com/monochromegane/go-gitignore` | `github.com/monochromegane/go-gitignore` | v0.0.0-20200626010858-205db1a8cc00 | MIT | [LICENSE](https://github.com/monochromegane/go-gitignore/blob/205db1a8cc00/LICENSE) |
-| `github.com/munnerz/goautoneg` | `github.com/munnerz/goautoneg` | v0.0.0-20191010083416-a7dc8b61c822 | BSD-3-Clause | [LICENSE](https://github.com/munnerz/goautoneg/blob/a7dc8b61c822/LICENSE) |
-| `github.com/opencontainers/cgroups/devices/config` | `github.com/opencontainers/cgroups` | v0.0.7 | Apache-2.0 | [LICENSE](https://github.com/opencontainers/cgroups/blob/v0.0.7/LICENSE) |
-| `github.com/opencontainers/go-digest` | `github.com/opencontainers/go-digest` | v1.0.0 | Apache-2.0 | [LICENSE](https://github.com/opencontainers/go-digest/blob/v1.0.0/LICENSE) / [LICENSE.docs](https://github.com/opencontainers/go-digest/blob/v1.0.0/LICENSE.docs) |
-| `github.com/opencontainers/runc/libcontainer/devices` | `github.com/opencontainers/runc` | v1.4.3 | Apache-2.0 | [LICENSE](https://github.com/opencontainers/runc/blob/v1.4.3/LICENSE) / [NOTICE](https://github.com/opencontainers/runc/blob/v1.4.3/NOTICE) |
-| `github.com/openshift/api` | `github.com/openshift/api` | v0.0.0-20260727141720-967cc4c36c9b | Apache-2.0 | [LICENSE](https://github.com/openshift/api/blob/967cc4c36c9b/LICENSE) |
-| `github.com/openshift/client-go` | `github.com/openshift/client-go` | v0.0.0-20260723174158-ae2315de9d73 | Apache-2.0 | [LICENSE](https://github.com/openshift/client-go/blob/ae2315de9d73/LICENSE) |
-| `github.com/operator-framework/api/pkg` | `github.com/operator-framework/api` | v0.45.0 | Apache-2.0 | [LICENSE](https://github.com/operator-framework/api/blob/v0.45.0/LICENSE) |
-| `github.com/peterbourgon/diskv` | `github.com/peterbourgon/diskv` | v2.0.1+incompatible | MIT | [LICENSE](https://github.com/peterbourgon/diskv/blob/v2.0.1/LICENSE) |
-| `github.com/pmezard/go-difflib/difflib` | `github.com/pmezard/go-difflib` | v1.0.1-0.20181226105442-5d4384ee4fb2 | BSD-3-Clause | [LICENSE](https://github.com/pmezard/go-difflib/blob/5d4384ee4fb2/LICENSE) |
-| `github.com/prometheus-operator/prometheus-operator/pkg/apis/monitoring` | `github.com/prometheus-operator/prometheus-operator/pkg/apis/monitoring` | v0.93.1 | Apache-2.0 | [LICENSE](https://github.com/prometheus-operator/prometheus-operator/blob/pkg/apis/monitoring/v0.93.1/LICENSE) |
-| `github.com/prometheus/client_golang/internal/github.com/golang/gddo/httputil` | `github.com/prometheus/client_golang` | v1.24.1 | BSD-3-Clause | [LICENSE](https://github.com/prometheus/client_golang/blob/v1.24.1/internal/github.com/golang/gddo/LICENSE) |
-| `github.com/prometheus/client_golang/prometheus` | `github.com/prometheus/client_golang` | v1.24.1 | Apache-2.0 | [LICENSE](https://github.com/prometheus/client_golang/blob/v1.24.1/LICENSE) / [NOTICE](https://github.com/prometheus/client_golang/blob/v1.24.1/NOTICE) |
-| `github.com/prometheus/client_model/go` | `github.com/prometheus/client_model` | v0.6.2 | Apache-2.0 | [LICENSE](https://github.com/prometheus/client_model/blob/v0.6.2/LICENSE) / [NOTICE](https://github.com/prometheus/client_model/blob/v0.6.2/NOTICE) |
-| `github.com/prometheus/common` | `github.com/prometheus/common` | v0.70.1 | Apache-2.0 | [LICENSE](https://github.com/prometheus/common/blob/v0.70.1/LICENSE) / [NOTICE](https://github.com/prometheus/common/blob/v0.70.1/NOTICE) |
-| `github.com/prometheus/procfs` | `github.com/prometheus/procfs` | v0.21.1 | Apache-2.0 | [LICENSE](https://github.com/prometheus/procfs/blob/v0.21.1/LICENSE) / [NOTICE](https://github.com/prometheus/procfs/blob/v0.21.1/NOTICE) |
-| `github.com/regclient/regclient` | `github.com/regclient/regclient` | v0.11.5 | Apache-2.0 | [LICENSE](https://github.com/regclient/regclient/blob/v0.11.5/LICENSE) |
-| `github.com/russross/blackfriday/v2` | `github.com/russross/blackfriday/v2` | v2.1.0 | BSD-2-Clause | [LICENSE.txt](https://github.com/russross/blackfriday/blob/v2.1.0/LICENSE.txt) |
-| `github.com/shopspring/decimal` | `github.com/shopspring/decimal` | v1.4.0 | MIT | [LICENSE](https://github.com/shopspring/decimal/blob/v1.4.0/LICENSE) |
-| `github.com/sirupsen/logrus` | `github.com/sirupsen/logrus` | v1.10.1 | MIT | [LICENSE](https://github.com/sirupsen/logrus/blob/v1.10.1/LICENSE) |
-| `github.com/spf13/cast` | `github.com/spf13/cast` | v1.7.0 | MIT | [LICENSE](https://github.com/spf13/cast/blob/v1.7.0/LICENSE) |
-| `github.com/spf13/cobra` | `github.com/spf13/cobra` | v1.10.2 | Apache-2.0 | [LICENSE.txt](https://github.com/spf13/cobra/blob/v1.10.2/LICENSE.txt) |
-| `github.com/spf13/pflag` | `github.com/spf13/pflag` | v1.0.10 | BSD-3-Clause | [LICENSE](https://github.com/spf13/pflag/blob/v1.0.10/LICENSE) |
-| `github.com/stretchr/testify/assert/yaml` | `github.com/stretchr/testify` | v1.12.0 | MIT | [LICENSE](https://github.com/stretchr/testify/blob/v1.12.0/LICENSE) |
-| `github.com/ulikunitz/xz` | `github.com/ulikunitz/xz` | v0.5.15 | BSD-3-Clause | [LICENSE](https://github.com/ulikunitz/xz/blob/v0.5.15/LICENSE) |
-| `github.com/urfave/cli/v3` | `github.com/urfave/cli/v3` | v3.10.1 | MIT | [LICENSE](https://github.com/urfave/cli/blob/v3.10.1/LICENSE) |
-| `github.com/x448/float16` | `github.com/x448/float16` | v0.8.4 | MIT | [LICENSE](https://github.com/x448/float16/blob/v0.8.4/LICENSE) |
-| `github.com/xlab/treeprint` | `github.com/xlab/treeprint` | v1.2.0 | MIT | [LICENSE](https://github.com/xlab/treeprint/blob/v1.2.0/LICENSE) |
-| `go.uber.org/multierr` | `go.uber.org/multierr` | v1.11.0 | MIT | [LICENSE.txt](https://github.com/uber-go/multierr/blob/v1.11.0/LICENSE.txt) |
-| `go.uber.org/zap` | `go.uber.org/zap` | v1.28.0 | MIT | [LICENSE](https://github.com/uber-go/zap/blob/v1.28.0/LICENSE) |
-| `go.yaml.in/yaml/v2` | `go.yaml.in/yaml/v2` | v2.4.4 | Apache-2.0 / MIT | [LICENSE](https://github.com/yaml/go-yaml/blob/v2.4.4/LICENSE) / [LICENSE.libyaml](https://github.com/yaml/go-yaml/blob/v2.4.4/LICENSE.libyaml) / [NOTICE](https://github.com/yaml/go-yaml/blob/v2.4.4/NOTICE) |
-| `go.yaml.in/yaml/v3` | `go.yaml.in/yaml/v3` | v3.0.4 | Apache-2.0 / MIT | [LICENSE](https://github.com/yaml/go-yaml/blob/v3.0.4/LICENSE) / [NOTICE](https://github.com/yaml/go-yaml/blob/v3.0.4/NOTICE) |
-| `golang.org/x/crypto` | `golang.org/x/crypto` | v0.55.0 | BSD-3-Clause | [LICENSE](https://go.googlesource.com/crypto/+/refs/tags/v0.55.0/LICENSE) / [PATENTS](https://go.googlesource.com/crypto/+/refs/tags/v0.55.0/PATENTS) |
-| `golang.org/x/mod/semver` | `golang.org/x/mod` | v0.40.0 | BSD-3-Clause | [LICENSE](https://go.googlesource.com/mod/+/refs/tags/v0.40.0/LICENSE) / [PATENTS](https://go.googlesource.com/mod/+/refs/tags/v0.40.0/PATENTS) |
-| `golang.org/x/net` | `golang.org/x/net` | v0.58.0 | BSD-3-Clause | [LICENSE](https://go.googlesource.com/net/+/refs/tags/v0.58.0/LICENSE) / [PATENTS](https://go.googlesource.com/net/+/refs/tags/v0.58.0/PATENTS) |
-| `golang.org/x/oauth2` | `golang.org/x/oauth2` | v0.36.0 | BSD-3-Clause | [LICENSE](https://go.googlesource.com/oauth2/+/refs/tags/v0.36.0/LICENSE) |
-| `golang.org/x/sync/errgroup` | `golang.org/x/sync` | v0.22.0 | BSD-3-Clause | [LICENSE](https://go.googlesource.com/sync/+/refs/tags/v0.22.0/LICENSE) / [PATENTS](https://go.googlesource.com/sync/+/refs/tags/v0.22.0/PATENTS) |
-| `golang.org/x/sys/unix` | `golang.org/x/sys` | v0.47.0 | BSD-3-Clause | [LICENSE](https://go.googlesource.com/sys/+/refs/tags/v0.47.0/LICENSE) / [PATENTS](https://go.googlesource.com/sys/+/refs/tags/v0.47.0/PATENTS) |
-| `golang.org/x/term` | `golang.org/x/term` | v0.45.0 | BSD-3-Clause | [LICENSE](https://go.googlesource.com/term/+/refs/tags/v0.45.0/LICENSE) / [PATENTS](https://go.googlesource.com/term/+/refs/tags/v0.45.0/PATENTS) |
-| `golang.org/x/text` | `golang.org/x/text` | v0.41.0 | BSD-3-Clause | [LICENSE](https://go.googlesource.com/text/+/refs/tags/v0.41.0/LICENSE) / [PATENTS](https://go.googlesource.com/text/+/refs/tags/v0.41.0/PATENTS) |
-| `golang.org/x/time/rate` | `golang.org/x/time` | v0.14.0 | BSD-3-Clause | [LICENSE](https://go.googlesource.com/time/+/refs/tags/v0.14.0/LICENSE) / [PATENTS](https://go.googlesource.com/time/+/refs/tags/v0.14.0/PATENTS) |
-| `gomodules.xyz/jsonpatch/v2` | `gomodules.xyz/jsonpatch/v2` | v2.4.0 | Apache-2.0 | [LICENSE](https://github.com/gomodules/jsonpatch/blob/v2.4.0/LICENSE) |
-| `google.golang.org/protobuf` | `google.golang.org/protobuf` | v1.36.12-0.20260120151049-f2248ac996af | BSD-3-Clause | [LICENSE](https://go.googlesource.com/protobuf/+/f2248ac996af/LICENSE) / [PATENTS](https://go.googlesource.com/protobuf/+/f2248ac996af/PATENTS) |
-| `gopkg.in/evanphx/json-patch.v4` | `gopkg.in/evanphx/json-patch.v4` | v4.13.0 | BSD-3-Clause | [LICENSE](https://github.com/evanphx/json-patch/blob/v4.13.0/LICENSE) |
-| `gopkg.in/inf.v0` | `gopkg.in/inf.v0` | v0.9.1 | BSD-3-Clause | [LICENSE](https://github.com/go-inf/inf/blob/v0.9.1/LICENSE) |
-| `gopkg.in/yaml.v3` | `gopkg.in/yaml.v3` | v3.0.1 | Apache-2.0 / MIT | [LICENSE](https://github.com/go-yaml/yaml/blob/v3.0.1/LICENSE) / [NOTICE](https://github.com/go-yaml/yaml/blob/v3.0.1/NOTICE) |
-| `k8s.io/api` | `k8s.io/api` | v0.36.4 | Apache-2.0 | [LICENSE](https://github.com/kubernetes/api/blob/v0.36.4/LICENSE) |
-| `k8s.io/apiextensions-apiserver/pkg` | `k8s.io/apiextensions-apiserver` | v0.36.4 | Apache-2.0 | [LICENSE](https://github.com/kubernetes/apiextensions-apiserver/blob/v0.36.4/LICENSE) |
-| `k8s.io/apimachinery/pkg` | `k8s.io/apimachinery` | v0.36.4 | Apache-2.0 | [LICENSE](https://github.com/kubernetes/apimachinery/blob/v0.36.4/LICENSE) |
-| `k8s.io/apimachinery/third_party/forked/golang` | `k8s.io/apimachinery` | v0.36.4 | BSD-3-Clause | [LICENSE](https://github.com/kubernetes/apimachinery/blob/v0.36.4/third_party/forked/golang/LICENSE) / [PATENTS](https://github.com/kubernetes/apimachinery/blob/v0.36.4/third_party/forked/golang/PATENTS) |
-| `k8s.io/cli-runtime/pkg` | `k8s.io/cli-runtime` | v0.36.0 | Apache-2.0 | [LICENSE](https://github.com/kubernetes/cli-runtime/blob/v0.36.0/LICENSE) |
-| `k8s.io/client-go` | `k8s.io/client-go` | v0.36.4 | Apache-2.0 | [LICENSE](https://github.com/kubernetes/client-go/blob/v0.36.4/LICENSE) |
-| `k8s.io/client-go/third_party/forked/golang/template` | `k8s.io/client-go` | v0.36.4 | BSD-3-Clause | [LICENSE](https://github.com/kubernetes/client-go/blob/v0.36.4/third_party/forked/golang/LICENSE) / [PATENTS](https://github.com/kubernetes/client-go/blob/v0.36.4/third_party/forked/golang/PATENTS) |
-| `k8s.io/client-go/third_party/forked/httpcache` | `k8s.io/client-go` | v0.36.4 | MIT | [LICENSE](https://github.com/kubernetes/client-go/blob/v0.36.4/third_party/forked/httpcache/LICENSE) |
-| `k8s.io/component-base/version` | `k8s.io/component-base` | v0.36.4 | Apache-2.0 | [LICENSE](https://github.com/kubernetes/component-base/blob/v0.36.4/LICENSE) |
-| `k8s.io/klog/v2` | `k8s.io/klog/v2` | v2.140.0 | Apache-2.0 | [LICENSE](https://github.com/kubernetes/klog/blob/v2.140.0/LICENSE) |
-| `k8s.io/kube-openapi/pkg` | `k8s.io/kube-openapi` | v0.0.0-20260603220949-865597e52e25 | Apache-2.0 | [LICENSE](https://github.com/kubernetes/kube-openapi/blob/865597e52e25/LICENSE) |
-| `k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json` | `k8s.io/kube-openapi` | v0.0.0-20260603220949-865597e52e25 | BSD-3-Clause | [AUTHORS](https://github.com/kubernetes/kube-openapi/blob/865597e52e25/pkg/internal/third_party/go-json-experiment/json/AUTHORS) / [LICENSE](https://github.com/kubernetes/kube-openapi/blob/865597e52e25/pkg/internal/third_party/go-json-experiment/json/LICENSE) |
-| `k8s.io/kube-openapi/pkg/validation/spec` | `k8s.io/kube-openapi` | v0.0.0-20260603220949-865597e52e25 | Apache-2.0 | [LICENSE](https://github.com/kubernetes/kube-openapi/blob/865597e52e25/pkg/validation/spec/LICENSE) |
-| `k8s.io/kubectl/pkg` | `k8s.io/kubectl` | v0.36.0 | Apache-2.0 | [LICENSE](https://github.com/kubernetes/kubectl/blob/v0.36.0/LICENSE) |
-| `k8s.io/utils` | `k8s.io/utils` | v0.0.0-20260507154919-ff6756f316d2 | Apache-2.0 | [LICENSE](https://github.com/kubernetes/utils/blob/ff6756f316d2/LICENSE) |
-| `k8s.io/utils/internal/third_party/forked/golang` | `k8s.io/utils` | v0.0.0-20260507154919-ff6756f316d2 | BSD-3-Clause | [LICENSE](https://github.com/kubernetes/utils/blob/ff6756f316d2/internal/third_party/forked/golang/LICENSE) / [PATENTS](https://github.com/kubernetes/utils/blob/ff6756f316d2/internal/third_party/forked/golang/PATENTS) |
-| `k8s.io/utils/third_party/forked/golang/btree` | `k8s.io/utils` | v0.0.0-20260507154919-ff6756f316d2 | Apache-2.0 | [LICENSE](https://github.com/kubernetes/utils/blob/ff6756f316d2/third_party/forked/golang/btree/LICENSE) |
-| `sigs.k8s.io/controller-runtime` | `sigs.k8s.io/controller-runtime` | v0.24.1 | Apache-2.0 | [LICENSE](https://github.com/kubernetes-sigs/controller-runtime/blob/v0.24.1/LICENSE) |
-| `sigs.k8s.io/json` | `sigs.k8s.io/json` | v0.0.0-20250730193827-2d320260d730 | Apache-2.0 / BSD-3-Clause | [LICENSE](https://github.com/kubernetes-sigs/json/blob/2d320260d730/LICENSE) |
-| `sigs.k8s.io/kustomize/api` | `sigs.k8s.io/kustomize/api` | v0.21.1 | Apache-2.0 | [LICENSE](https://github.com/kubernetes-sigs/kustomize/blob/api/v0.21.1/LICENSE) |
-| `sigs.k8s.io/kustomize/kyaml` | `sigs.k8s.io/kustomize/kyaml` | v0.21.1 | Apache-2.0 | [LICENSE](https://github.com/kubernetes-sigs/kustomize/blob/kyaml/v0.21.1/LICENSE) |
-| `sigs.k8s.io/randfill` | `sigs.k8s.io/randfill` | v1.0.0 | Apache-2.0 | [LICENSE](https://github.com/kubernetes-sigs/randfill/blob/v1.0.0/LICENSE) / [NOTICE](https://github.com/kubernetes-sigs/randfill/blob/v1.0.0/NOTICE) |
-| `sigs.k8s.io/structured-merge-diff/v6` | `sigs.k8s.io/structured-merge-diff/v6` | v6.4.0 | Apache-2.0 | [LICENSE](https://github.com/kubernetes-sigs/structured-merge-diff/blob/v6.4.0/LICENSE) |
-| `sigs.k8s.io/yaml` | `sigs.k8s.io/yaml` | v1.6.0 | Apache-2.0 / BSD-3-Clause / MIT | [LICENSE](https://github.com/kubernetes-sigs/yaml/blob/v1.6.0/LICENSE) |
+| Package | Version | License | Location |
+|---------|---------|---------|----------|
+| `dario.cat/mergo` | v1.0.1 | BSD-3-Clause | [LICENSE](https://github.com/imdario/mergo/blob/v1.0.1/LICENSE) |
+| `github.com/MakeNowJust/heredoc` | v1.0.0 | MIT | [LICENSE](https://github.com/makenowjust/heredoc/blob/v1.0.0/LICENSE) |
+| `github.com/Masterminds/goutils` | v1.1.1 | Apache-2.0 | [LICENSE.txt](https://github.com/Masterminds/goutils/blob/v1.1.1/LICENSE.txt) |
+| `github.com/Masterminds/semver/v3` | v3.5.0 | MIT | [LICENSE.txt](https://github.com/Masterminds/semver/blob/v3.5.0/LICENSE.txt) |
+| `github.com/Masterminds/sprig/v3` | v3.3.0 | MIT | [LICENSE.txt](https://github.com/Masterminds/sprig/blob/v3.3.0/LICENSE.txt) |
+| `github.com/Mellanox/maintenance-operator/api/v1alpha1` | v0.3.0 | Apache-2.0 | [LICENSE](https://github.com/Mellanox/maintenance-operator/blob/api/v0.3.0/LICENSE) |
+| `github.com/NVIDIA/go-nvlib/pkg` | v0.12.0 | Apache-2.0 | [LICENSE](https://github.com/NVIDIA/go-nvlib/blob/v0.12.0/LICENSE) / [NOTICE](https://github.com/NVIDIA/go-nvlib/blob/v0.12.0/NOTICE) |
+| `github.com/NVIDIA/k8s-kata-manager/api/v1alpha1/config` | v0.2.3 | Apache-2.0 | [LICENSE](https://github.com/NVIDIA/k8s-kata-manager/blob/v0.2.3/LICENSE) |
+| `github.com/NVIDIA/k8s-operator-libs` | v0.0.0-20260629200812-d720f2557494 | Apache-2.0 | [LICENSE](https://github.com/NVIDIA/k8s-operator-libs/blob/d720f2557494/LICENSE) |
+| `github.com/NVIDIA/nvidia-container-toolkit` | v1.20.0 | Apache-2.0 | [LICENSE](https://github.com/NVIDIA/nvidia-container-toolkit/blob/v1.20.0/LICENSE) |
+| `github.com/beorn7/perks/quantile` | v1.0.1 | MIT | [LICENSE](https://github.com/beorn7/perks/blob/v1.0.1/LICENSE) |
+| `github.com/blang/semver/v4` | v4.0.0 | MIT | [LICENSE](https://github.com/blang/semver/blob/v4.0.0/LICENSE) |
+| `github.com/cespare/xxhash/v2` | v2.3.0 | MIT | [LICENSE.txt](https://github.com/cespare/xxhash/blob/v2.3.0/LICENSE.txt) |
+| `github.com/chai2010/gettext-go` | v1.0.2 | BSD-3-Clause | [LICENSE](https://github.com/chai2010/gettext-go/blob/v1.0.2/LICENSE) |
+| `github.com/cyphar/filepath-securejoin` | v0.7.0 | BSD-3-Clause / MPL-2.0 | [COPYING.md](https://github.com/cyphar/filepath-securejoin/blob/v0.7.0/COPYING.md) / [LICENSE.BSD](https://github.com/cyphar/filepath-securejoin/blob/v0.7.0/LICENSE.BSD) / [LICENSE.MPL-2.0](https://github.com/cyphar/filepath-securejoin/blob/v0.7.0/LICENSE.MPL-2.0) |
+| `github.com/davecgh/go-spew/spew` | v1.1.2-0.20180830191138-d8f796af33cc | ISC | [LICENSE](https://github.com/davecgh/go-spew/blob/d8f796af33cc/LICENSE) |
+| `github.com/docker/libtrust` | v0.0.0-20160708172513-aabc10ec26b7 | Apache-2.0 | [LICENSE](https://github.com/docker-archive-public/docker.libtrust/blob/aabc10ec26b7/LICENSE) |
+| `github.com/emicklei/go-restful/v3` | v3.13.0 | MIT | [LICENSE](https://github.com/emicklei/go-restful/blob/v3.13.0/LICENSE) |
+| `github.com/evanphx/json-patch/v5` | v5.9.11 | BSD-3-Clause | [LICENSE](https://github.com/evanphx/json-patch/blob/v5.9.11/LICENSE) |
+| `github.com/exponent-io/jsonpath` | v0.0.0-20210407135951-1de76d718b3f | MIT | [LICENSE](https://github.com/exponent-io/jsonpath/blob/1de76d718b3f/LICENSE) |
+| `github.com/fsnotify/fsnotify` | v1.9.0 | BSD-3-Clause | [LICENSE](https://github.com/fsnotify/fsnotify/blob/v1.9.0/LICENSE) |
+| `github.com/fxamacker/cbor/v2` | v2.9.2 | MIT | [LICENSE](https://github.com/fxamacker/cbor/blob/v2.9.2/LICENSE) |
+| `github.com/go-errors/errors` | v1.5.1 | MIT | [LICENSE.MIT](https://github.com/go-errors/errors/blob/v1.5.1/LICENSE.MIT) |
+| `github.com/go-logr/logr` | v1.4.4 | Apache-2.0 | [LICENSE](https://github.com/go-logr/logr/blob/v1.4.4/LICENSE) |
+| `github.com/go-logr/zapr` | v1.3.0 | Apache-2.0 | [LICENSE](https://github.com/go-logr/zapr/blob/v1.3.0/LICENSE) |
+| `github.com/go-openapi/jsonpointer` | v0.22.4 | Apache-2.0 | [LICENSE](https://github.com/go-openapi/jsonpointer/blob/v0.22.4/LICENSE) / [NOTICE](https://github.com/go-openapi/jsonpointer/blob/v0.22.4/NOTICE) |
+| `github.com/go-openapi/jsonreference` | v0.21.4 | Apache-2.0 | [LICENSE](https://github.com/go-openapi/jsonreference/blob/v0.21.4/LICENSE) / [NOTICE](https://github.com/go-openapi/jsonreference/blob/v0.21.4/NOTICE) |
+| `github.com/go-openapi/swag` | v0.25.4 | Apache-2.0 | [LICENSE](https://github.com/go-openapi/swag/blob/v0.25.4/LICENSE) |
+| `github.com/go-openapi/swag/cmdutils` | v0.25.4 | Apache-2.0 | [LICENSE](https://github.com/go-openapi/swag/blob/cmdutils/v0.25.4/LICENSE) |
+| `github.com/go-openapi/swag/conv` | v0.25.4 | Apache-2.0 | [LICENSE](https://github.com/go-openapi/swag/blob/conv/v0.25.4/LICENSE) |
+| `github.com/go-openapi/swag/fileutils` | v0.25.4 | Apache-2.0 | [LICENSE](https://github.com/go-openapi/swag/blob/fileutils/v0.25.4/LICENSE) |
+| `github.com/go-openapi/swag/jsonname` | v0.25.4 | Apache-2.0 | [LICENSE](https://github.com/go-openapi/swag/blob/jsonname/v0.25.4/LICENSE) |
+| `github.com/go-openapi/swag/jsonutils` | v0.25.4 | Apache-2.0 | [LICENSE](https://github.com/go-openapi/swag/blob/jsonutils/v0.25.4/LICENSE) |
+| `github.com/go-openapi/swag/loading` | v0.25.4 | Apache-2.0 | [LICENSE](https://github.com/go-openapi/swag/blob/loading/v0.25.4/LICENSE) |
+| `github.com/go-openapi/swag/mangling` | v0.25.4 | Apache-2.0 | [LICENSE](https://github.com/go-openapi/swag/blob/mangling/v0.25.4/LICENSE) |
+| `github.com/go-openapi/swag/netutils` | v0.25.4 | Apache-2.0 | [LICENSE](https://github.com/go-openapi/swag/blob/netutils/v0.25.4/LICENSE) |
+| `github.com/go-openapi/swag/stringutils` | v0.25.4 | Apache-2.0 | [LICENSE](https://github.com/go-openapi/swag/blob/stringutils/v0.25.4/LICENSE) |
+| `github.com/go-openapi/swag/typeutils` | v0.25.4 | Apache-2.0 | [LICENSE](https://github.com/go-openapi/swag/blob/typeutils/v0.25.4/LICENSE) |
+| `github.com/go-openapi/swag/yamlutils` | v0.25.4 | Apache-2.0 | [LICENSE](https://github.com/go-openapi/swag/blob/yamlutils/v0.25.4/LICENSE) |
+| `github.com/google/btree` | v1.1.3 | Apache-2.0 | [LICENSE](https://github.com/google/btree/blob/v1.1.3/LICENSE) |
+| `github.com/google/gnostic-models` | v0.7.1 | Apache-2.0 | [LICENSE](https://github.com/google/gnostic-models/blob/v0.7.1/LICENSE) |
+| `github.com/google/uuid` | v1.6.0 | BSD-3-Clause | [LICENSE](https://github.com/google/uuid/blob/v1.6.0/LICENSE) |
+| `github.com/huandu/xstrings` | v1.5.0 | MIT | [LICENSE](https://github.com/huandu/xstrings/blob/v1.5.0/LICENSE) |
+| `github.com/json-iterator/go` | v1.1.12 | MIT | [LICENSE](https://github.com/json-iterator/go/blob/v1.1.12/LICENSE) |
+| `github.com/klauspost/compress` | v1.19.1 | Apache-2.0 / BSD-3-Clause / MIT | [LICENSE](https://github.com/klauspost/compress/blob/v1.19.1/LICENSE) |
+| `github.com/klauspost/compress/internal/snapref` | v1.19.1 | BSD-3-Clause | [LICENSE](https://github.com/klauspost/compress/blob/v1.19.1/internal/snapref/LICENSE) |
+| `github.com/klauspost/compress/zstd/internal/xxhash` | v1.19.1 | MIT | [LICENSE.txt](https://github.com/klauspost/compress/blob/v1.19.1/zstd/internal/xxhash/LICENSE.txt) |
+| `github.com/liggitt/tabwriter` | v0.0.0-20181228230101-89fcab3d43de | BSD-3-Clause | [LICENSE](https://github.com/liggitt/tabwriter/blob/89fcab3d43de/LICENSE) |
+| `github.com/mitchellh/copystructure` | v1.2.0 | MIT | [LICENSE](https://github.com/mitchellh/copystructure/blob/v1.2.0/LICENSE) |
+| `github.com/mitchellh/go-wordwrap` | v1.0.1 | MIT | [LICENSE.md](https://github.com/mitchellh/go-wordwrap/blob/v1.0.1/LICENSE.md) |
+| `github.com/mitchellh/reflectwalk` | v1.0.2 | MIT | [LICENSE](https://github.com/mitchellh/reflectwalk/blob/v1.0.2/LICENSE) |
+| `github.com/moby/term` | v0.5.2 | Apache-2.0 | [LICENSE](https://github.com/moby/term/blob/v0.5.2/LICENSE) |
+| `github.com/modern-go/concurrent` | v0.0.0-20180306012644-bacd9c7ef1dd | Apache-2.0 | [LICENSE](https://github.com/modern-go/concurrent/blob/bacd9c7ef1dd/LICENSE) |
+| `github.com/modern-go/reflect2` | v1.0.3-0.20250322232337-35a7c28c31ee | Apache-2.0 | [LICENSE](https://github.com/modern-go/reflect2/blob/35a7c28c31ee/LICENSE) |
+| `github.com/monochromegane/go-gitignore` | v0.0.0-20200626010858-205db1a8cc00 | MIT | [LICENSE](https://github.com/monochromegane/go-gitignore/blob/205db1a8cc00/LICENSE) |
+| `github.com/munnerz/goautoneg` | v0.0.0-20191010083416-a7dc8b61c822 | BSD-3-Clause | [LICENSE](https://github.com/munnerz/goautoneg/blob/a7dc8b61c822/LICENSE) |
+| `github.com/opencontainers/cgroups/devices/config` | v0.0.7 | Apache-2.0 | [LICENSE](https://github.com/opencontainers/cgroups/blob/v0.0.7/LICENSE) |
+| `github.com/opencontainers/go-digest` | v1.0.0 | Apache-2.0 | [LICENSE](https://github.com/opencontainers/go-digest/blob/v1.0.0/LICENSE) / [LICENSE.docs](https://github.com/opencontainers/go-digest/blob/v1.0.0/LICENSE.docs) |
+| `github.com/opencontainers/runc/libcontainer/devices` | v1.4.3 | Apache-2.0 | [LICENSE](https://github.com/opencontainers/runc/blob/v1.4.3/LICENSE) / [NOTICE](https://github.com/opencontainers/runc/blob/v1.4.3/NOTICE) |
+| `github.com/openshift/api` | v0.0.0-20260727141720-967cc4c36c9b | Apache-2.0 | [LICENSE](https://github.com/openshift/api/blob/967cc4c36c9b/LICENSE) |
+| `github.com/openshift/client-go` | v0.0.0-20260723174158-ae2315de9d73 | Apache-2.0 | [LICENSE](https://github.com/openshift/client-go/blob/ae2315de9d73/LICENSE) |
+| `github.com/operator-framework/api/pkg` | v0.45.0 | Apache-2.0 | [LICENSE](https://github.com/operator-framework/api/blob/v0.45.0/LICENSE) |
+| `github.com/peterbourgon/diskv` | v2.0.1+incompatible | MIT | [LICENSE](https://github.com/peterbourgon/diskv/blob/v2.0.1/LICENSE) |
+| `github.com/pmezard/go-difflib/difflib` | v1.0.1-0.20181226105442-5d4384ee4fb2 | BSD-3-Clause | [LICENSE](https://github.com/pmezard/go-difflib/blob/5d4384ee4fb2/LICENSE) |
+| `github.com/prometheus-operator/prometheus-operator/pkg/apis/monitoring` | v0.93.1 | Apache-2.0 | [LICENSE](https://github.com/prometheus-operator/prometheus-operator/blob/pkg/apis/monitoring/v0.93.1/LICENSE) |
+| `github.com/prometheus/client_golang/internal/github.com/golang/gddo/httputil` | v1.24.1 | BSD-3-Clause | [LICENSE](https://github.com/prometheus/client_golang/blob/v1.24.1/internal/github.com/golang/gddo/LICENSE) |
+| `github.com/prometheus/client_golang/prometheus` | v1.24.1 | Apache-2.0 | [LICENSE](https://github.com/prometheus/client_golang/blob/v1.24.1/LICENSE) / [NOTICE](https://github.com/prometheus/client_golang/blob/v1.24.1/NOTICE) |
+| `github.com/prometheus/client_model/go` | v0.6.2 | Apache-2.0 | [LICENSE](https://github.com/prometheus/client_model/blob/v0.6.2/LICENSE) / [NOTICE](https://github.com/prometheus/client_model/blob/v0.6.2/NOTICE) |
+| `github.com/prometheus/common` | v0.70.1 | Apache-2.0 | [LICENSE](https://github.com/prometheus/common/blob/v0.70.1/LICENSE) / [NOTICE](https://github.com/prometheus/common/blob/v0.70.1/NOTICE) |
+| `github.com/prometheus/procfs` | v0.21.1 | Apache-2.0 | [LICENSE](https://github.com/prometheus/procfs/blob/v0.21.1/LICENSE) / [NOTICE](https://github.com/prometheus/procfs/blob/v0.21.1/NOTICE) |
+| `github.com/regclient/regclient` | v0.11.5 | Apache-2.0 | [LICENSE](https://github.com/regclient/regclient/blob/v0.11.5/LICENSE) |
+| `github.com/russross/blackfriday/v2` | v2.1.0 | BSD-2-Clause | [LICENSE.txt](https://github.com/russross/blackfriday/blob/v2.1.0/LICENSE.txt) |
+| `github.com/shopspring/decimal` | v1.4.0 | MIT | [LICENSE](https://github.com/shopspring/decimal/blob/v1.4.0/LICENSE) |
+| `github.com/sirupsen/logrus` | v1.10.1 | MIT | [LICENSE](https://github.com/sirupsen/logrus/blob/v1.10.1/LICENSE) |
+| `github.com/spf13/cast` | v1.7.0 | MIT | [LICENSE](https://github.com/spf13/cast/blob/v1.7.0/LICENSE) |
+| `github.com/spf13/cobra` | v1.10.2 | Apache-2.0 | [LICENSE.txt](https://github.com/spf13/cobra/blob/v1.10.2/LICENSE.txt) |
+| `github.com/spf13/pflag` | v1.0.10 | BSD-3-Clause | [LICENSE](https://github.com/spf13/pflag/blob/v1.0.10/LICENSE) |
+| `github.com/stretchr/testify/assert/yaml` | v1.12.0 | MIT | [LICENSE](https://github.com/stretchr/testify/blob/v1.12.0/LICENSE) |
+| `github.com/ulikunitz/xz` | v0.5.15 | BSD-3-Clause | [LICENSE](https://github.com/ulikunitz/xz/blob/v0.5.15/LICENSE) |
+| `github.com/urfave/cli/v3` | v3.10.1 | MIT | [LICENSE](https://github.com/urfave/cli/blob/v3.10.1/LICENSE) |
+| `github.com/x448/float16` | v0.8.4 | MIT | [LICENSE](https://github.com/x448/float16/blob/v0.8.4/LICENSE) |
+| `github.com/xlab/treeprint` | v1.2.0 | MIT | [LICENSE](https://github.com/xlab/treeprint/blob/v1.2.0/LICENSE) |
+| `go.uber.org/multierr` | v1.11.0 | MIT | [LICENSE.txt](https://github.com/uber-go/multierr/blob/v1.11.0/LICENSE.txt) |
+| `go.uber.org/zap` | v1.28.0 | MIT | [LICENSE](https://github.com/uber-go/zap/blob/v1.28.0/LICENSE) |
+| `go.yaml.in/yaml/v2` | v2.4.4 | Apache-2.0 / MIT | [LICENSE](https://github.com/yaml/go-yaml/blob/v2.4.4/LICENSE) / [LICENSE.libyaml](https://github.com/yaml/go-yaml/blob/v2.4.4/LICENSE.libyaml) / [NOTICE](https://github.com/yaml/go-yaml/blob/v2.4.4/NOTICE) |
+| `go.yaml.in/yaml/v3` | v3.0.4 | Apache-2.0 / MIT | [LICENSE](https://github.com/yaml/go-yaml/blob/v3.0.4/LICENSE) / [NOTICE](https://github.com/yaml/go-yaml/blob/v3.0.4/NOTICE) |
+| `golang.org/x/crypto` | v0.55.0 | BSD-3-Clause | [LICENSE](https://go.googlesource.com/crypto/+/refs/tags/v0.55.0/LICENSE) / [PATENTS](https://go.googlesource.com/crypto/+/refs/tags/v0.55.0/PATENTS) |
+| `golang.org/x/mod/semver` | v0.40.0 | BSD-3-Clause | [LICENSE](https://go.googlesource.com/mod/+/refs/tags/v0.40.0/LICENSE) / [PATENTS](https://go.googlesource.com/mod/+/refs/tags/v0.40.0/PATENTS) |
+| `golang.org/x/net` | v0.58.0 | BSD-3-Clause | [LICENSE](https://go.googlesource.com/net/+/refs/tags/v0.58.0/LICENSE) / [PATENTS](https://go.googlesource.com/net/+/refs/tags/v0.58.0/PATENTS) |
+| `golang.org/x/oauth2` | v0.36.0 | BSD-3-Clause | [LICENSE](https://go.googlesource.com/oauth2/+/refs/tags/v0.36.0/LICENSE) |
+| `golang.org/x/sync/errgroup` | v0.22.0 | BSD-3-Clause | [LICENSE](https://go.googlesource.com/sync/+/refs/tags/v0.22.0/LICENSE) / [PATENTS](https://go.googlesource.com/sync/+/refs/tags/v0.22.0/PATENTS) |
+| `golang.org/x/sys/unix` | v0.47.0 | BSD-3-Clause | [LICENSE](https://go.googlesource.com/sys/+/refs/tags/v0.47.0/LICENSE) / [PATENTS](https://go.googlesource.com/sys/+/refs/tags/v0.47.0/PATENTS) |
+| `golang.org/x/term` | v0.45.0 | BSD-3-Clause | [LICENSE](https://go.googlesource.com/term/+/refs/tags/v0.45.0/LICENSE) / [PATENTS](https://go.googlesource.com/term/+/refs/tags/v0.45.0/PATENTS) |
+| `golang.org/x/text` | v0.41.0 | BSD-3-Clause | [LICENSE](https://go.googlesource.com/text/+/refs/tags/v0.41.0/LICENSE) / [PATENTS](https://go.googlesource.com/text/+/refs/tags/v0.41.0/PATENTS) |
+| `golang.org/x/time/rate` | v0.14.0 | BSD-3-Clause | [LICENSE](https://go.googlesource.com/time/+/refs/tags/v0.14.0/LICENSE) / [PATENTS](https://go.googlesource.com/time/+/refs/tags/v0.14.0/PATENTS) |
+| `gomodules.xyz/jsonpatch/v2` | v2.4.0 | Apache-2.0 | [LICENSE](https://github.com/gomodules/jsonpatch/blob/v2.4.0/LICENSE) |
+| `google.golang.org/protobuf` | v1.36.12-0.20260120151049-f2248ac996af | BSD-3-Clause | [LICENSE](https://go.googlesource.com/protobuf/+/f2248ac996af/LICENSE) / [PATENTS](https://go.googlesource.com/protobuf/+/f2248ac996af/PATENTS) |
+| `gopkg.in/evanphx/json-patch.v4` | v4.13.0 | BSD-3-Clause | [LICENSE](https://github.com/evanphx/json-patch/blob/v4.13.0/LICENSE) |
+| `gopkg.in/inf.v0` | v0.9.1 | BSD-3-Clause | [LICENSE](https://github.com/go-inf/inf/blob/v0.9.1/LICENSE) |
+| `gopkg.in/yaml.v3` | v3.0.1 | Apache-2.0 / MIT | [LICENSE](https://github.com/go-yaml/yaml/blob/v3.0.1/LICENSE) / [NOTICE](https://github.com/go-yaml/yaml/blob/v3.0.1/NOTICE) |
+| `k8s.io/api` | v0.36.4 | Apache-2.0 | [LICENSE](https://github.com/kubernetes/api/blob/v0.36.4/LICENSE) |
+| `k8s.io/apiextensions-apiserver/pkg` | v0.36.4 | Apache-2.0 | [LICENSE](https://github.com/kubernetes/apiextensions-apiserver/blob/v0.36.4/LICENSE) |
+| `k8s.io/apimachinery/pkg` | v0.36.4 | Apache-2.0 | [LICENSE](https://github.com/kubernetes/apimachinery/blob/v0.36.4/LICENSE) |
+| `k8s.io/apimachinery/third_party/forked/golang` | v0.36.4 | BSD-3-Clause | [LICENSE](https://github.com/kubernetes/apimachinery/blob/v0.36.4/third_party/forked/golang/LICENSE) / [PATENTS](https://github.com/kubernetes/apimachinery/blob/v0.36.4/third_party/forked/golang/PATENTS) |
+| `k8s.io/cli-runtime/pkg` | v0.36.0 | Apache-2.0 | [LICENSE](https://github.com/kubernetes/cli-runtime/blob/v0.36.0/LICENSE) |
+| `k8s.io/client-go` | v0.36.4 | Apache-2.0 | [LICENSE](https://github.com/kubernetes/client-go/blob/v0.36.4/LICENSE) |
+| `k8s.io/client-go/third_party/forked/golang/template` | v0.36.4 | BSD-3-Clause | [LICENSE](https://github.com/kubernetes/client-go/blob/v0.36.4/third_party/forked/golang/LICENSE) / [PATENTS](https://github.com/kubernetes/client-go/blob/v0.36.4/third_party/forked/golang/PATENTS) |
+| `k8s.io/client-go/third_party/forked/httpcache` | v0.36.4 | MIT | [LICENSE](https://github.com/kubernetes/client-go/blob/v0.36.4/third_party/forked/httpcache/LICENSE) |
+| `k8s.io/component-base/version` | v0.36.4 | Apache-2.0 | [LICENSE](https://github.com/kubernetes/component-base/blob/v0.36.4/LICENSE) |
+| `k8s.io/klog/v2` | v2.140.0 | Apache-2.0 | [LICENSE](https://github.com/kubernetes/klog/blob/v2.140.0/LICENSE) |
+| `k8s.io/kube-openapi/pkg` | v0.0.0-20260603220949-865597e52e25 | Apache-2.0 | [LICENSE](https://github.com/kubernetes/kube-openapi/blob/865597e52e25/LICENSE) |
+| `k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json` | v0.0.0-20260603220949-865597e52e25 | BSD-3-Clause | [AUTHORS](https://github.com/kubernetes/kube-openapi/blob/865597e52e25/pkg/internal/third_party/go-json-experiment/json/AUTHORS) / [LICENSE](https://github.com/kubernetes/kube-openapi/blob/865597e52e25/pkg/internal/third_party/go-json-experiment/json/LICENSE) |
+| `k8s.io/kube-openapi/pkg/validation/spec` | v0.0.0-20260603220949-865597e52e25 | Apache-2.0 | [LICENSE](https://github.com/kubernetes/kube-openapi/blob/865597e52e25/pkg/validation/spec/LICENSE) |
+| `k8s.io/kubectl/pkg` | v0.36.0 | Apache-2.0 | [LICENSE](https://github.com/kubernetes/kubectl/blob/v0.36.0/LICENSE) |
+| `k8s.io/utils` | v0.0.0-20260507154919-ff6756f316d2 | Apache-2.0 | [LICENSE](https://github.com/kubernetes/utils/blob/ff6756f316d2/LICENSE) |
+| `k8s.io/utils/internal/third_party/forked/golang` | v0.0.0-20260507154919-ff6756f316d2 | BSD-3-Clause | [LICENSE](https://github.com/kubernetes/utils/blob/ff6756f316d2/internal/third_party/forked/golang/LICENSE) / [PATENTS](https://github.com/kubernetes/utils/blob/ff6756f316d2/internal/third_party/forked/golang/PATENTS) |
+| `k8s.io/utils/third_party/forked/golang/btree` | v0.0.0-20260507154919-ff6756f316d2 | Apache-2.0 | [LICENSE](https://github.com/kubernetes/utils/blob/ff6756f316d2/third_party/forked/golang/btree/LICENSE) |
+| `sigs.k8s.io/controller-runtime` | v0.24.1 | Apache-2.0 | [LICENSE](https://github.com/kubernetes-sigs/controller-runtime/blob/v0.24.1/LICENSE) |
+| `sigs.k8s.io/json` | v0.0.0-20250730193827-2d320260d730 | Apache-2.0 / BSD-3-Clause | [LICENSE](https://github.com/kubernetes-sigs/json/blob/2d320260d730/LICENSE) |
+| `sigs.k8s.io/kustomize/api` | v0.21.1 | Apache-2.0 | [LICENSE](https://github.com/kubernetes-sigs/kustomize/blob/api/v0.21.1/LICENSE) |
+| `sigs.k8s.io/kustomize/kyaml` | v0.21.1 | Apache-2.0 | [LICENSE](https://github.com/kubernetes-sigs/kustomize/blob/kyaml/v0.21.1/LICENSE) |
+| `sigs.k8s.io/randfill` | v1.0.0 | Apache-2.0 | [LICENSE](https://github.com/kubernetes-sigs/randfill/blob/v1.0.0/LICENSE) / [NOTICE](https://github.com/kubernetes-sigs/randfill/blob/v1.0.0/NOTICE) |
+| `sigs.k8s.io/structured-merge-diff/v6` | v6.4.0 | Apache-2.0 | [LICENSE](https://github.com/kubernetes-sigs/structured-merge-diff/blob/v6.4.0/LICENSE) |
+| `sigs.k8s.io/yaml` | v1.6.0 | Apache-2.0 / BSD-3-Clause / MIT | [LICENSE](https://github.com/kubernetes-sigs/yaml/blob/v1.6.0/LICENSE) |
 
 ## License Texts
 
diff --git a/tools/generate-third-party-notices.sh b/tools/generate-third-party-notices.sh
index bbe038f8d..44d00b4c4 100755
--- a/tools/generate-third-party-notices.sh
+++ b/tools/generate-third-party-notices.sh
@@ -365,16 +365,16 @@ location_cell() {
 
 emit_index_table() {
     local index="$1" package _ license module version location license_identifier
-    printf '| Package | Module | Version | License | Location |\n'
-    printf '|---------|--------|---------|---------|----------|\n'
+    printf '| Package | Version | License | Location |\n'
+    printf '|---------|---------|---------|----------|\n'
 
     while IFS=, read -r package _ license module version; do
         [[ -z "${package}" ]] && continue
         location="$(location_cell "${package}" "${module}" "${version}")"
         license_identifier="$(license_identifier_for "${package}" "${license:-Unknown}")"
         # shellcheck disable=SC2016  # backticks are literal markdown here.
-        printf '| `%s` | `%s` | %s | %s | %s |\n' \
-            "${package}" "${module:-unknown}" "${version:-unknown}" \
+        printf '| `%s` | %s | %s | %s |\n' \
+            "${package}" "${version:-unknown}" \
             "${license_identifier}" "${location}"
     done < "${index}"
 }
diff --git a/tools/generate-third-party-notices_test.sh b/tools/generate-third-party-notices_test.sh
index da0079931..aecac6b7b 100644
--- a/tools/generate-third-party-notices_test.sh
+++ b/tools/generate-third-party-notices_test.sh
@@ -119,13 +119,13 @@ cat > "${render}/index.csv" <<'IDX'
 github.com/klauspost/compress/zstd/internal/xxhash,ignored,MIT,github.com/klauspost/compress,v1.19.1
 IDX
 
-assert_eq '| Package | Module | Version | License | Location |' \
+assert_eq '| Package | Version | License | Location |' \
     "$(LICENSE_URLS="${urls_fixture}" VENDOR_DIR="${vendor_fixture}" LICENSES_DIR="${render}/cache" \
        LICENSE_OVERRIDES="${empty_overrides_fixture}" emit_index_table "${render}/index.csv" | sed -n 1p)" \
-    "index header has five columns"
+    "index header has four columns"
 # Expected literal Markdown, not shell expansion.
 # shellcheck disable=SC2016
-assert_eq '| `github.com/klauspost/compress/zstd/internal/xxhash` | `github.com/klauspost/compress` | v1.19.1 | MIT | [LICENSE.txt](https://example.invalid/xxhash) |' \
+assert_eq '| `github.com/klauspost/compress/zstd/internal/xxhash` | v1.19.1 | MIT | [LICENSE.txt](https://example.invalid/xxhash) |' \
     "$(LICENSE_URLS="${urls_fixture}" VENDOR_DIR="${vendor_fixture}" LICENSES_DIR="${render}/cache" \
        LICENSE_OVERRIDES="${empty_overrides_fixture}" emit_index_table "${render}/index.csv" | sed -n 3p)" \
     "index row labels the link by filename"
@@ -166,7 +166,7 @@ assert_eq "MIT" \
 
 # Expected literal Markdown, not shell expansion.
 # shellcheck disable=SC2016
-assert_eq '| `github.com/klauspost/compress/zstd/internal/xxhash` | `github.com/klauspost/compress` | v1.19.1 | Apache-2.0 / MIT | [LICENSE.txt](https://example.invalid/xxhash) |' \
+assert_eq '| `github.com/klauspost/compress/zstd/internal/xxhash` | v1.19.1 | Apache-2.0 / MIT | [LICENSE.txt](https://example.invalid/xxhash) |' \
     "$(LICENSE_URLS="${urls_fixture}" VENDOR_DIR="${vendor_fixture}" LICENSES_DIR="${render}/cache" \
        LICENSE_OVERRIDES="${overrides_fixture}" emit_index_table "${render}/index.csv" | sed -n 3p)" \
     "emit_index_table renders the overridden identifier in the License column"

From dffc54fc99bab2fda48f680ace2da8bbecd1c236 Mon Sep 17 00:00:00 2001
From: Abrar Shivani <ashivani@nvidia.com>
Date: Tue, 25 Aug 2026 12:34:53 -0700
Subject: [PATCH 17/18] Drop the Module bullet from the third-party notices
 detail sections

Follows the removal of the Module column from the index table: the
module a package belongs to is no longer shown anywhere in the
generated notices, so drop the remaining per-section bullet and
reword the header prose that described it.

Signed-off-by: Abrar Shivani <ashivani@nvidia.com>
---
 THIRD_PARTY_NOTICES.md                     | 130 +--------------------
 tools/generate-third-party-notices.sh      |   7 +-
 tools/generate-third-party-notices_test.sh |   5 +-
 3 files changed, 9 insertions(+), 133 deletions(-)

diff --git a/THIRD_PARTY_NOTICES.md b/THIRD_PARTY_NOTICES.md
index c7b7900e3..20b6d9161 100644
--- a/THIRD_PARTY_NOTICES.md
+++ b/THIRD_PARTY_NOTICES.md
@@ -12,9 +12,9 @@ shipped; its dependencies are listed here as well rather than excluded. Go
 standard library packages are excluded; they are covered by the license of the
 Go distribution itself.
 
-Each dependency is listed with the module that owns it, the version
-redistributed, and a link to the license file in that version's upstream
-source. Every link was verified by fetching it and comparing its contents
+Each dependency is listed with the version redistributed and a link to the
+license file in that version's upstream source. Every link was verified by
+fetching it and comparing its contents
 against the copy vendored here, so each one resolves to the same license text
 reproduced below. Modules that no command under `cmd/` links — those vendored
 only for this module's own tests and build tooling — are not listed.
@@ -160,7 +160,6 @@ carry.
 
 ### dario.cat/mergo
 
-* Module: dario.cat/mergo
 * Version: v1.0.1
 * License: BSD-3-Clause
 
@@ -203,7 +202,6 @@ OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
 ### github.com/MakeNowJust/heredoc
 
-* Module: github.com/MakeNowJust/heredoc
 * Version: v1.0.0
 * License: MIT
 
@@ -239,7 +237,6 @@ THE SOFTWARE.
 
 ### github.com/Masterminds/goutils
 
-* Module: github.com/Masterminds/goutils
 * Version: v1.1.1
 * License: Apache-2.0
 
@@ -456,7 +453,6 @@ THE SOFTWARE.
 
 ### github.com/Masterminds/semver/v3
 
-* Module: github.com/Masterminds/semver/v3
 * Version: v3.5.0
 * License: MIT
 
@@ -490,7 +486,6 @@ THE SOFTWARE.
 
 ### github.com/Masterminds/sprig/v3
 
-* Module: github.com/Masterminds/sprig/v3
 * Version: v3.3.0
 * License: MIT
 
@@ -524,7 +519,6 @@ THE SOFTWARE.
 
 ### github.com/Mellanox/maintenance-operator/api/v1alpha1
 
-* Module: github.com/Mellanox/maintenance-operator/api
 * Version: v0.3.0
 * License: Apache-2.0
 
@@ -740,7 +734,6 @@ THE SOFTWARE.
 
 ### github.com/NVIDIA/go-nvlib/pkg
 
-* Module: github.com/NVIDIA/go-nvlib
 * Version: v0.12.0
 * License: Apache-2.0
 
@@ -969,7 +962,6 @@ the PCI ID Project at https://pci-ids.ucw.cz/.
 
 ### github.com/NVIDIA/k8s-kata-manager/api/v1alpha1/config
 
-* Module: github.com/NVIDIA/k8s-kata-manager
 * Version: v0.2.3
 * License: Apache-2.0
 
@@ -1186,7 +1178,6 @@ the PCI ID Project at https://pci-ids.ucw.cz/.
 
 ### github.com/NVIDIA/k8s-operator-libs
 
-* Module: github.com/NVIDIA/k8s-operator-libs
 * Version: v0.0.0-20260629200812-d720f2557494
 * License: Apache-2.0
 
@@ -1403,7 +1394,6 @@ the PCI ID Project at https://pci-ids.ucw.cz/.
 
 ### github.com/NVIDIA/nvidia-container-toolkit
 
-* Module: github.com/NVIDIA/nvidia-container-toolkit
 * Version: v1.20.0
 * License: Apache-2.0
 
@@ -1620,7 +1610,6 @@ the PCI ID Project at https://pci-ids.ucw.cz/.
 
 ### github.com/beorn7/perks/quantile
 
-* Module: github.com/beorn7/perks
 * Version: v1.0.1
 * License: MIT
 
@@ -1655,7 +1644,6 @@ WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
 
 ### github.com/blang/semver/v4
 
-* Module: github.com/blang/semver/v4
 * Version: v4.0.0
 * License: MIT
 
@@ -1692,7 +1680,6 @@ THE SOFTWARE.
 
 ### github.com/cespare/xxhash/v2
 
-* Module: github.com/cespare/xxhash/v2
 * Version: v2.3.0
 * License: MIT
 
@@ -1729,7 +1716,6 @@ WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
 
 ### github.com/chai2010/gettext-go
 
-* Module: github.com/chai2010/gettext-go
 * Version: v1.0.2
 * License: BSD-3-Clause
 
@@ -1771,7 +1757,6 @@ OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
 ### github.com/cyphar/filepath-securejoin
 
-* Module: github.com/cyphar/filepath-securejoin
 * Version: v0.7.0
 * License: BSD-3-Clause / MPL-2.0
 
@@ -2650,7 +2635,6 @@ Exhibit B - "Incompatible With Secondary Licenses" Notice
 
 ### github.com/davecgh/go-spew/spew
 
-* Module: github.com/davecgh/go-spew
 * Version: v1.1.2-0.20180830191138-d8f796af33cc
 * License: ISC
 
@@ -2680,7 +2664,6 @@ OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
 
 ### github.com/docker/libtrust
 
-* Module: github.com/docker/libtrust
 * Version: v0.0.0-20160708172513-aabc10ec26b7
 * License: Apache-2.0
 
@@ -2886,7 +2869,6 @@ OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
 
 ### github.com/emicklei/go-restful/v3
 
-* Module: github.com/emicklei/go-restful/v3
 * Version: v3.13.0
 * License: MIT
 
@@ -2922,7 +2904,6 @@ WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
 
 ### github.com/evanphx/json-patch/v5
 
-* Module: github.com/evanphx/json-patch/v5
 * Version: v5.9.11
 * License: BSD-3-Clause
 
@@ -2962,7 +2943,6 @@ OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
 ### github.com/exponent-io/jsonpath
 
-* Module: github.com/exponent-io/jsonpath
 * Version: v0.0.0-20210407135951-1de76d718b3f
 * License: MIT
 
@@ -2998,7 +2978,6 @@ SOFTWARE.
 
 ### github.com/fsnotify/fsnotify
 
-* Module: github.com/fsnotify/fsnotify
 * Version: v1.9.0
 * License: BSD-3-Clause
 
@@ -3038,7 +3017,6 @@ SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
 ### github.com/fxamacker/cbor/v2
 
-* Module: github.com/fxamacker/cbor/v2
 * Version: v2.9.2
 * License: MIT
 
@@ -3073,7 +3051,6 @@ SOFTWARE.
 
 ### github.com/go-errors/errors
 
-* Module: github.com/go-errors/errors
 * Version: v1.5.1
 * License: MIT
 
@@ -3095,7 +3072,6 @@ THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLI
 
 ### github.com/go-logr/logr
 
-* Module: github.com/go-logr/logr
 * Version: v1.4.4
 * License: Apache-2.0
 
@@ -3311,7 +3287,6 @@ THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLI
 
 ### github.com/go-logr/zapr
 
-* Module: github.com/go-logr/zapr
 * Version: v1.3.0
 * License: Apache-2.0
 
@@ -3527,7 +3502,6 @@ THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLI
 
 ### github.com/go-openapi/jsonpointer
 
-* Module: github.com/go-openapi/jsonpointer
 * Version: v0.22.4
 * License: Apache-2.0
 
@@ -3790,7 +3764,6 @@ limitations under the License.
 
 ### github.com/go-openapi/jsonreference
 
-* Module: github.com/go-openapi/jsonreference
 * Version: v0.21.4
 * License: Apache-2.0
 
@@ -4054,7 +4027,6 @@ limitations under the License.
 
 ### github.com/go-openapi/swag
 
-* Module: github.com/go-openapi/swag
 * Version: v0.25.4
 * License: Apache-2.0
 
@@ -4271,7 +4243,6 @@ limitations under the License.
 
 ### github.com/go-openapi/swag/cmdutils
 
-* Module: github.com/go-openapi/swag/cmdutils
 * Version: v0.25.4
 * License: Apache-2.0
 
@@ -4488,7 +4459,6 @@ limitations under the License.
 
 ### github.com/go-openapi/swag/conv
 
-* Module: github.com/go-openapi/swag/conv
 * Version: v0.25.4
 * License: Apache-2.0
 
@@ -4705,7 +4675,6 @@ limitations under the License.
 
 ### github.com/go-openapi/swag/fileutils
 
-* Module: github.com/go-openapi/swag/fileutils
 * Version: v0.25.4
 * License: Apache-2.0
 
@@ -4922,7 +4891,6 @@ limitations under the License.
 
 ### github.com/go-openapi/swag/jsonname
 
-* Module: github.com/go-openapi/swag/jsonname
 * Version: v0.25.4
 * License: Apache-2.0
 
@@ -5139,7 +5107,6 @@ limitations under the License.
 
 ### github.com/go-openapi/swag/jsonutils
 
-* Module: github.com/go-openapi/swag/jsonutils
 * Version: v0.25.4
 * License: Apache-2.0
 
@@ -5356,7 +5323,6 @@ limitations under the License.
 
 ### github.com/go-openapi/swag/loading
 
-* Module: github.com/go-openapi/swag/loading
 * Version: v0.25.4
 * License: Apache-2.0
 
@@ -5573,7 +5539,6 @@ limitations under the License.
 
 ### github.com/go-openapi/swag/mangling
 
-* Module: github.com/go-openapi/swag/mangling
 * Version: v0.25.4
 * License: Apache-2.0
 
@@ -5790,7 +5755,6 @@ limitations under the License.
 
 ### github.com/go-openapi/swag/netutils
 
-* Module: github.com/go-openapi/swag/netutils
 * Version: v0.25.4
 * License: Apache-2.0
 
@@ -6007,7 +5971,6 @@ limitations under the License.
 
 ### github.com/go-openapi/swag/stringutils
 
-* Module: github.com/go-openapi/swag/stringutils
 * Version: v0.25.4
 * License: Apache-2.0
 
@@ -6224,7 +6187,6 @@ limitations under the License.
 
 ### github.com/go-openapi/swag/typeutils
 
-* Module: github.com/go-openapi/swag/typeutils
 * Version: v0.25.4
 * License: Apache-2.0
 
@@ -6441,7 +6403,6 @@ limitations under the License.
 
 ### github.com/go-openapi/swag/yamlutils
 
-* Module: github.com/go-openapi/swag/yamlutils
 * Version: v0.25.4
 * License: Apache-2.0
 
@@ -6658,7 +6619,6 @@ limitations under the License.
 
 ### github.com/google/btree
 
-* Module: github.com/google/btree
 * Version: v1.1.3
 * License: Apache-2.0
 
@@ -6875,7 +6835,6 @@ limitations under the License.
 
 ### github.com/google/gnostic-models
 
-* Module: github.com/google/gnostic-models
 * Version: v0.7.1
 * License: Apache-2.0
 
@@ -7093,7 +7052,6 @@ limitations under the License.
 
 ### github.com/google/uuid
 
-* Module: github.com/google/uuid
 * Version: v1.6.0
 * License: BSD-3-Clause
 
@@ -7135,7 +7093,6 @@ OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
 ### github.com/huandu/xstrings
 
-* Module: github.com/huandu/xstrings
 * Version: v1.5.0
 * License: MIT
 
@@ -7172,7 +7129,6 @@ SOFTWARE.
 
 ### github.com/json-iterator/go
 
-* Module: github.com/json-iterator/go
 * Version: v1.1.12
 * License: MIT
 
@@ -7208,7 +7164,6 @@ SOFTWARE.
 
 ### github.com/klauspost/compress
 
-* Module: github.com/klauspost/compress
 * Version: v1.19.1
 * License: Apache-2.0 / BSD-3-Clause / MIT
 
@@ -7527,7 +7482,6 @@ THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLI
 
 ### github.com/klauspost/compress/internal/snapref
 
-* Module: github.com/klauspost/compress
 * Version: v1.19.1
 * License: BSD-3-Clause
 
@@ -7569,7 +7523,6 @@ OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
 ### github.com/klauspost/compress/zstd/internal/xxhash
 
-* Module: github.com/klauspost/compress
 * Version: v1.19.1
 * License: MIT
 
@@ -7606,7 +7559,6 @@ WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
 
 ### github.com/liggitt/tabwriter
 
-* Module: github.com/liggitt/tabwriter
 * Version: v0.0.0-20181228230101-89fcab3d43de
 * License: BSD-3-Clause
 
@@ -7648,7 +7600,6 @@ OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
 ### github.com/mitchellh/copystructure
 
-* Module: github.com/mitchellh/copystructure
 * Version: v1.2.0
 * License: MIT
 
@@ -7684,7 +7635,6 @@ THE SOFTWARE.
 
 ### github.com/mitchellh/go-wordwrap
 
-* Module: github.com/mitchellh/go-wordwrap
 * Version: v1.0.1
 * License: MIT
 
@@ -7720,7 +7670,6 @@ THE SOFTWARE.
 
 ### github.com/mitchellh/reflectwalk
 
-* Module: github.com/mitchellh/reflectwalk
 * Version: v1.0.2
 * License: MIT
 
@@ -7756,7 +7705,6 @@ THE SOFTWARE.
 
 ### github.com/moby/term
 
-* Module: github.com/moby/term
 * Version: v0.5.2
 * License: Apache-2.0
 
@@ -7962,7 +7910,6 @@ THE SOFTWARE.
 
 ### github.com/modern-go/concurrent
 
-* Module: github.com/modern-go/concurrent
 * Version: v0.0.0-20180306012644-bacd9c7ef1dd
 * License: Apache-2.0
 
@@ -8178,7 +8125,6 @@ THE SOFTWARE.
 
 ### github.com/modern-go/reflect2
 
-* Module: github.com/modern-go/reflect2
 * Version: v1.0.3-0.20250322232337-35a7c28c31ee
 * License: Apache-2.0
 
@@ -8394,7 +8340,6 @@ THE SOFTWARE.
 
 ### github.com/monochromegane/go-gitignore
 
-* Module: github.com/monochromegane/go-gitignore
 * Version: v0.0.0-20200626010858-205db1a8cc00
 * License: MIT
 
@@ -8430,7 +8375,6 @@ SOFTWARE.
 
 ### github.com/munnerz/goautoneg
 
-* Module: github.com/munnerz/goautoneg
 * Version: v0.0.0-20191010083416-a7dc8b61c822
 * License: BSD-3-Clause
 
@@ -8476,7 +8420,6 @@ OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
 ### github.com/opencontainers/cgroups/devices/config
 
-* Module: github.com/opencontainers/cgroups
 * Version: v0.0.7
 * License: Apache-2.0
 
@@ -8692,7 +8635,6 @@ OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
 ### github.com/opencontainers/go-digest
 
-* Module: github.com/opencontainers/go-digest
 * Version: v1.0.0
 * License: Apache-2.0
 
@@ -9332,7 +9274,6 @@ Creative Commons may be contacted at creativecommons.org.
 
 ### github.com/opencontainers/runc/libcontainer/devices
 
-* Module: github.com/opencontainers/runc
 * Version: v1.4.3
 * License: Apache-2.0
 
@@ -9563,7 +9504,6 @@ See also http://www.apache.org/dev/crypto.html and/or seek legal counsel.
 
 ### github.com/openshift/api
 
-* Module: github.com/openshift/api
 * Version: v0.0.0-20260727141720-967cc4c36c9b
 * License: Apache-2.0
 
@@ -9769,7 +9709,6 @@ See also http://www.apache.org/dev/crypto.html and/or seek legal counsel.
 
 ### github.com/openshift/client-go
 
-* Module: github.com/openshift/client-go
 * Version: v0.0.0-20260723174158-ae2315de9d73
 * License: Apache-2.0
 
@@ -9975,7 +9914,6 @@ See also http://www.apache.org/dev/crypto.html and/or seek legal counsel.
 
 ### github.com/operator-framework/api/pkg
 
-* Module: github.com/operator-framework/api
 * Version: v0.45.0
 * License: Apache-2.0
 
@@ -10191,7 +10129,6 @@ See also http://www.apache.org/dev/crypto.html and/or seek legal counsel.
 
 ### github.com/peterbourgon/diskv
 
-* Module: github.com/peterbourgon/diskv
 * Version: v2.0.1+incompatible
 * License: MIT
 
@@ -10225,7 +10162,6 @@ THE SOFTWARE.
 
 ### github.com/pmezard/go-difflib/difflib
 
-* Module: github.com/pmezard/go-difflib
 * Version: v1.0.1-0.20181226105442-5d4384ee4fb2
 * License: BSD-3-Clause
 
@@ -10267,7 +10203,6 @@ SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
 ### github.com/prometheus-operator/prometheus-operator/pkg/apis/monitoring
 
-* Module: github.com/prometheus-operator/prometheus-operator/pkg/apis/monitoring
 * Version: v0.93.1
 * License: Apache-2.0
 
@@ -10483,7 +10418,6 @@ Apache License
 
 ### github.com/prometheus/client_golang/internal/github.com/golang/gddo/httputil
 
-* Module: github.com/prometheus/client_golang
 * Version: v1.24.1
 * License: BSD-3-Clause
 
@@ -10525,7 +10459,6 @@ OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
 ### github.com/prometheus/client_golang/prometheus
 
-* Module: github.com/prometheus/client_golang
 * Version: v1.24.1
 * License: Apache-2.0
 
@@ -10767,7 +10700,6 @@ See source code for license details.
 
 ### github.com/prometheus/client_model/go
 
-* Module: github.com/prometheus/client_model
 * Version: v0.6.2
 * License: Apache-2.0
 
@@ -10996,7 +10928,6 @@ SoundCloud Ltd. (http://soundcloud.com/).
 
 ### github.com/prometheus/common
 
-* Module: github.com/prometheus/common
 * Version: v0.70.1
 * License: Apache-2.0
 
@@ -11225,7 +11156,6 @@ SoundCloud Ltd. (http://soundcloud.com/).
 
 ### github.com/prometheus/procfs
 
-* Module: github.com/prometheus/procfs
 * Version: v0.21.1
 * License: Apache-2.0
 
@@ -11456,7 +11386,6 @@ SoundCloud Ltd. (http://soundcloud.com/).
 
 ### github.com/regclient/regclient
 
-* Module: github.com/regclient/regclient
 * Version: v0.11.5
 * License: Apache-2.0
 
@@ -11662,7 +11591,6 @@ SoundCloud Ltd. (http://soundcloud.com/).
 
 ### github.com/russross/blackfriday/v2
 
-* Module: github.com/russross/blackfriday/v2
 * Version: v2.1.0
 * License: BSD-2-Clause
 
@@ -11706,7 +11634,6 @@ Blackfriday is distributed under the Simplified BSD License:
 
 ### github.com/shopspring/decimal
 
-* Module: github.com/shopspring/decimal
 * Version: v1.4.0
 * License: MIT
 
@@ -11766,7 +11693,6 @@ CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
 
 ### github.com/sirupsen/logrus
 
-* Module: github.com/sirupsen/logrus
 * Version: v1.10.1
 * License: MIT
 
@@ -11802,7 +11728,6 @@ THE SOFTWARE.
 
 ### github.com/spf13/cast
 
-* Module: github.com/spf13/cast
 * Version: v1.7.0
 * License: MIT
 
@@ -11837,7 +11762,6 @@ SOFTWARE.
 
 ### github.com/spf13/cobra
 
-* Module: github.com/spf13/cobra
 * Version: v1.10.2
 * License: Apache-2.0
 
@@ -12026,7 +11950,6 @@ SOFTWARE.
 
 ### github.com/spf13/pflag
 
-* Module: github.com/spf13/pflag
 * Version: v1.0.10
 * License: BSD-3-Clause
 
@@ -12069,7 +11992,6 @@ OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
 ### github.com/stretchr/testify/assert/yaml
 
-* Module: github.com/stretchr/testify
 * Version: v1.12.0
 * License: MIT
 
@@ -12105,7 +12027,6 @@ SOFTWARE.
 
 ### github.com/ulikunitz/xz
 
-* Module: github.com/ulikunitz/xz
 * Version: v0.5.15
 * License: BSD-3-Clause
 
@@ -12146,7 +12067,6 @@ OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
 ### github.com/urfave/cli/v3
 
-* Module: github.com/urfave/cli/v3
 * Version: v3.10.1
 * License: MIT
 
@@ -12182,7 +12102,6 @@ SOFTWARE.
 
 ### github.com/x448/float16
 
-* Module: github.com/x448/float16
 * Version: v0.8.4
 * License: MIT
 
@@ -12219,7 +12138,6 @@ SOFTWARE.
 
 ### github.com/xlab/treeprint
 
-* Module: github.com/xlab/treeprint
 * Version: v1.2.0
 * License: MIT
 
@@ -12254,7 +12172,6 @@ THE SOFTWARE.
 
 ### go.uber.org/multierr
 
-* Module: go.uber.org/multierr
 * Version: v1.11.0
 * License: MIT
 
@@ -12288,7 +12205,6 @@ THE SOFTWARE.
 
 ### go.uber.org/zap
 
-* Module: go.uber.org/zap
 * Version: v1.28.0
 * License: MIT
 
@@ -12322,7 +12238,6 @@ THE SOFTWARE.
 
 ### go.yaml.in/yaml/v2
 
-* Module: go.yaml.in/yaml/v2
 * Version: v2.4.4
 * License: Apache-2.0 / MIT
 
@@ -12598,7 +12513,6 @@ limitations under the License.
 
 ### go.yaml.in/yaml/v3
 
-* Module: go.yaml.in/yaml/v3
 * Version: v3.0.4
 * License: Apache-2.0 / MIT
 
@@ -12684,7 +12598,6 @@ limitations under the License.
 
 ### golang.org/x/crypto
 
-* Module: golang.org/x/crypto
 * Version: v0.55.0
 * License: BSD-3-Clause
 
@@ -12756,7 +12669,6 @@ shall terminate as of the date such litigation is filed.
 
 ### golang.org/x/mod/semver
 
-* Module: golang.org/x/mod
 * Version: v0.40.0
 * License: BSD-3-Clause
 
@@ -12828,7 +12740,6 @@ shall terminate as of the date such litigation is filed.
 
 ### golang.org/x/net
 
-* Module: golang.org/x/net
 * Version: v0.58.0
 * License: BSD-3-Clause
 
@@ -12900,7 +12811,6 @@ shall terminate as of the date such litigation is filed.
 
 ### golang.org/x/oauth2
 
-* Module: golang.org/x/oauth2
 * Version: v0.36.0
 * License: BSD-3-Clause
 
@@ -12942,7 +12852,6 @@ OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
 ### golang.org/x/sync/errgroup
 
-* Module: golang.org/x/sync
 * Version: v0.22.0
 * License: BSD-3-Clause
 
@@ -13014,7 +12923,6 @@ shall terminate as of the date such litigation is filed.
 
 ### golang.org/x/sys/unix
 
-* Module: golang.org/x/sys
 * Version: v0.47.0
 * License: BSD-3-Clause
 
@@ -13086,7 +12994,6 @@ shall terminate as of the date such litigation is filed.
 
 ### golang.org/x/term
 
-* Module: golang.org/x/term
 * Version: v0.45.0
 * License: BSD-3-Clause
 
@@ -13158,7 +13065,6 @@ shall terminate as of the date such litigation is filed.
 
 ### golang.org/x/text
 
-* Module: golang.org/x/text
 * Version: v0.41.0
 * License: BSD-3-Clause
 
@@ -13230,7 +13136,6 @@ shall terminate as of the date such litigation is filed.
 
 ### golang.org/x/time/rate
 
-* Module: golang.org/x/time
 * Version: v0.14.0
 * License: BSD-3-Clause
 
@@ -13302,7 +13207,6 @@ shall terminate as of the date such litigation is filed.
 
 ### gomodules.xyz/jsonpatch/v2
 
-* Module: gomodules.xyz/jsonpatch/v2
 * Version: v2.4.0
 * License: Apache-2.0
 
@@ -13519,7 +13423,6 @@ shall terminate as of the date such litigation is filed.
 
 ### google.golang.org/protobuf
 
-* Module: google.golang.org/protobuf
 * Version: v1.36.12-0.20260120151049-f2248ac996af
 * License: BSD-3-Clause
 
@@ -13591,7 +13494,6 @@ shall terminate as of the date such litigation is filed.
 
 ### gopkg.in/evanphx/json-patch.v4
 
-* Module: gopkg.in/evanphx/json-patch.v4
 * Version: v4.13.0
 * License: BSD-3-Clause
 
@@ -13631,7 +13533,6 @@ OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
 ### gopkg.in/inf.v0
 
-* Module: gopkg.in/inf.v0
 * Version: v0.9.1
 * License: BSD-3-Clause
 
@@ -13674,7 +13575,6 @@ OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
 ### gopkg.in/yaml.v3
 
-* Module: gopkg.in/yaml.v3
 * Version: v3.0.1
 * License: Apache-2.0 / MIT
 
@@ -13760,7 +13660,6 @@ limitations under the License.
 
 ### k8s.io/api
 
-* Module: k8s.io/api
 * Version: v0.36.4
 * License: Apache-2.0
 
@@ -13977,7 +13876,6 @@ limitations under the License.
 
 ### k8s.io/apiextensions-apiserver/pkg
 
-* Module: k8s.io/apiextensions-apiserver
 * Version: v0.36.4
 * License: Apache-2.0
 
@@ -14194,7 +14092,6 @@ limitations under the License.
 
 ### k8s.io/apimachinery/pkg
 
-* Module: k8s.io/apimachinery
 * Version: v0.36.4
 * License: Apache-2.0
 
@@ -14411,7 +14308,6 @@ limitations under the License.
 
 ### k8s.io/apimachinery/third_party/forked/golang
 
-* Module: k8s.io/apimachinery
 * Version: v0.36.4
 * License: BSD-3-Clause
 
@@ -14483,7 +14379,6 @@ shall terminate as of the date such litigation is filed.
 
 ### k8s.io/cli-runtime/pkg
 
-* Module: k8s.io/cli-runtime
 * Version: v0.36.0
 * License: Apache-2.0
 
@@ -14700,7 +14595,6 @@ shall terminate as of the date such litigation is filed.
 
 ### k8s.io/client-go
 
-* Module: k8s.io/client-go
 * Version: v0.36.4
 * License: Apache-2.0
 
@@ -14917,7 +14811,6 @@ shall terminate as of the date such litigation is filed.
 
 ### k8s.io/client-go/third_party/forked/golang/template
 
-* Module: k8s.io/client-go
 * Version: v0.36.4
 * License: BSD-3-Clause
 
@@ -14989,7 +14882,6 @@ shall terminate as of the date such litigation is filed.
 
 ### k8s.io/client-go/third_party/forked/httpcache
 
-* Module: k8s.io/client-go
 * Version: v0.36.4
 * License: MIT
 
@@ -15010,7 +14902,6 @@ THE SOFTWARE IS PROVIDED “AS IS”, WITHOUT WARRANTY OF ANY KIND, EXPRESS OR I
 
 ### k8s.io/component-base/version
 
-* Module: k8s.io/component-base
 * Version: v0.36.4
 * License: Apache-2.0
 
@@ -15227,7 +15118,6 @@ THE SOFTWARE IS PROVIDED “AS IS”, WITHOUT WARRANTY OF ANY KIND, EXPRESS OR I
 
 ### k8s.io/klog/v2
 
-* Module: k8s.io/klog/v2
 * Version: v2.140.0
 * License: Apache-2.0
 
@@ -15433,7 +15323,6 @@ third-party archives.
 
 ### k8s.io/kube-openapi/pkg
 
-* Module: k8s.io/kube-openapi
 * Version: v0.0.0-20260603220949-865597e52e25
 * License: Apache-2.0
 
@@ -15650,7 +15539,6 @@ third-party archives.
 
 ### k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json
 
-* Module: k8s.io/kube-openapi
 * Version: v0.0.0-20260603220949-865597e52e25
 * License: BSD-3-Clause
 
@@ -15703,7 +15591,6 @@ OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
 ### k8s.io/kube-openapi/pkg/validation/spec
 
-* Module: k8s.io/kube-openapi
 * Version: v0.0.0-20260603220949-865597e52e25
 * License: Apache-2.0
 
@@ -15920,7 +15807,6 @@ OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
 ### k8s.io/kubectl/pkg
 
-* Module: k8s.io/kubectl
 * Version: v0.36.0
 * License: Apache-2.0
 
@@ -16136,7 +16022,6 @@ OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
 ### k8s.io/utils
 
-* Module: k8s.io/utils
 * Version: v0.0.0-20260507154919-ff6756f316d2
 * License: Apache-2.0
 
@@ -16353,7 +16238,6 @@ OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
 ### k8s.io/utils/internal/third_party/forked/golang
 
-* Module: k8s.io/utils
 * Version: v0.0.0-20260507154919-ff6756f316d2
 * License: BSD-3-Clause
 
@@ -16425,7 +16309,6 @@ shall terminate as of the date such litigation is filed.
 
 ### k8s.io/utils/third_party/forked/golang/btree
 
-* Module: k8s.io/utils
 * Version: v0.0.0-20260507154919-ff6756f316d2
 * License: Apache-2.0
 
@@ -16641,7 +16524,6 @@ shall terminate as of the date such litigation is filed.
 
 ### sigs.k8s.io/controller-runtime
 
-* Module: sigs.k8s.io/controller-runtime
 * Version: v0.24.1
 * License: Apache-2.0
 
@@ -16857,7 +16739,6 @@ shall terminate as of the date such litigation is filed.
 
 ### sigs.k8s.io/json
 
-* Module: sigs.k8s.io/json
 * Version: v0.0.0-20250730193827-2d320260d730
 * License: Apache-2.0 / BSD-3-Clause
 
@@ -17110,7 +16991,6 @@ OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
 ### sigs.k8s.io/kustomize/api
 
-* Module: sigs.k8s.io/kustomize/api
 * Version: v0.21.1
 * License: Apache-2.0
 
@@ -17326,7 +17206,6 @@ OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
 ### sigs.k8s.io/kustomize/kyaml
 
-* Module: sigs.k8s.io/kustomize/kyaml
 * Version: v0.21.1
 * License: Apache-2.0
 
@@ -17542,7 +17421,6 @@ OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
 ### sigs.k8s.io/randfill
 
-* Module: sigs.k8s.io/randfill
 * Version: v1.0.0
 * License: Apache-2.0
 
@@ -17791,7 +17669,6 @@ Submitted on behalf of a third-party: @disconnect3d (Disconnect3d)
 
 ### sigs.k8s.io/structured-merge-diff/v6
 
-* Module: sigs.k8s.io/structured-merge-diff/v6
 * Version: v6.4.0
 * License: Apache-2.0
 
@@ -18007,7 +17884,6 @@ Submitted on behalf of a third-party: @disconnect3d (Disconnect3d)
 
 ### sigs.k8s.io/yaml
 
-* Module: sigs.k8s.io/yaml
 * Version: v1.6.0
 * License: Apache-2.0 / BSD-3-Clause / MIT
 
diff --git a/tools/generate-third-party-notices.sh b/tools/generate-third-party-notices.sh
index 44d00b4c4..1ac89f20c 100755
--- a/tools/generate-third-party-notices.sh
+++ b/tools/generate-third-party-notices.sh
@@ -388,7 +388,6 @@ emit_sections() {
 
         license_identifier="$(license_identifier_for "${package}" "${license:-Unknown}")"
         printf '### %s\n\n' "${package}"
-        printf '* Module: %s\n' "${module:-unknown}"
         printf '* Version: %s\n' "${version:-unknown}"
         printf '* License: %s\n\n' "${license_identifier}"
 
@@ -443,9 +442,9 @@ shipped; its dependencies are listed here as well rather than excluded. Go
 standard library packages are excluded; they are covered by the license of the
 Go distribution itself.
 
-Each dependency is listed with the module that owns it, the version
-redistributed, and a link to the license file in that version's upstream
-source. Every link was verified by fetching it and comparing its contents
+Each dependency is listed with the version redistributed and a link to the
+license file in that version's upstream source. Every link was verified by
+fetching it and comparing its contents
 against the copy vendored here, so each one resolves to the same license text
 reproduced below. Modules that no command under `cmd/` links — those vendored
 only for this module's own tests and build tooling — are not listed.
diff --git a/tools/generate-third-party-notices_test.sh b/tools/generate-third-party-notices_test.sh
index aecac6b7b..e05518438 100644
--- a/tools/generate-third-party-notices_test.sh
+++ b/tools/generate-third-party-notices_test.sh
@@ -145,8 +145,9 @@ assert_fails "emit_index_table fails closed when the URL map has no entry for a
 
 section="$(LICENSE_URLS="${urls_fixture}" VENDOR_DIR="${vendor_fixture}" LICENSES_DIR="${render}/cache" \
     LICENSE_OVERRIDES="${empty_overrides_fixture}" emit_sections "${render}/index.csv" "${render}/cache")"
-assert_eq "* Module: github.com/klauspost/compress" "$(printf '%s' "${section}" | sed -n 3p)" "section names the module"
-assert_eq "* Version: v1.19.1" "$(printf '%s' "${section}" | sed -n 4p)" "section names the version"
+assert_eq "* Version: v1.19.1" "$(printf '%s' "${section}" | sed -n 3p)" "section names the version"
+assert_eq "* License: MIT" "$(printf '%s' "${section}" | sed -n 4p)" "section names the license"
+assert_eq "0" "$(printf '%s' "${section}" | LC_ALL=C grep -c '^\* Module: ')" "section no longer names the module"
 assert_eq "<https://example.invalid/xxhash>" \
     "$(printf '%s' "${section}" | LC_ALL=C grep -m1 '^<http')" "section prints the file URL"
 

From 3476d8ad4b32752e754f91d58b44a34e3b45416d Mon Sep 17 00:00:00 2001
From: Abrar Shivani <ashivani@nvidia.com>
Date: Tue, 25 Aug 2026 12:38:18 -0700
Subject: [PATCH 18/18] Reflow the notices header sentence and drop its em
 dashes

The rewording after the Module bullet was removed left a short line, and
the em dashes did not match the surrounding paragraphs, which use
semicolons.

Signed-off-by: Abrar Shivani <ashivani@nvidia.com>
---
 THIRD_PARTY_NOTICES.md                | 8 ++++----
 tools/generate-third-party-notices.sh | 8 ++++----
 2 files changed, 8 insertions(+), 8 deletions(-)

diff --git a/THIRD_PARTY_NOTICES.md b/THIRD_PARTY_NOTICES.md
index 20b6d9161..7dedbfa54 100644
--- a/THIRD_PARTY_NOTICES.md
+++ b/THIRD_PARTY_NOTICES.md
@@ -14,10 +14,10 @@ Go distribution itself.
 
 Each dependency is listed with the version redistributed and a link to the
 license file in that version's upstream source. Every link was verified by
-fetching it and comparing its contents
-against the copy vendored here, so each one resolves to the same license text
-reproduced below. Modules that no command under `cmd/` links — those vendored
-only for this module's own tests and build tooling — are not listed.
+fetching it and comparing its contents against the copy vendored here, so each
+one resolves to the same license text reproduced below. Modules that no command
+under `cmd/` links are not listed; those are vendored only for this module's own
+tests and build tooling.
 
 The `gpu-operator` image uses `nvcr.io/nvidia/distroless/cc` as a base image.
 All of the OSS packages and source included in this image can be found at
diff --git a/tools/generate-third-party-notices.sh b/tools/generate-third-party-notices.sh
index 1ac89f20c..dbd0944dd 100755
--- a/tools/generate-third-party-notices.sh
+++ b/tools/generate-third-party-notices.sh
@@ -444,10 +444,10 @@ Go distribution itself.
 
 Each dependency is listed with the version redistributed and a link to the
 license file in that version's upstream source. Every link was verified by
-fetching it and comparing its contents
-against the copy vendored here, so each one resolves to the same license text
-reproduced below. Modules that no command under `cmd/` links — those vendored
-only for this module's own tests and build tooling — are not listed.
+fetching it and comparing its contents against the copy vendored here, so each
+one resolves to the same license text reproduced below. Modules that no command
+under `cmd/` links are not listed; those are vendored only for this module's own
+tests and build tooling.
 
 The `gpu-operator` image uses `nvcr.io/nvidia/distroless/cc` as a base image.
 All of the OSS packages and source included in this image can be found at