From 71acaeec9de7d67f93fd007b6fee9e40d5f5c928 Mon Sep 17 00:00:00 2001
From: entlein <einentlein@gmail.com>
Date: Fri, 30 Jan 2026 20:42:46 +0100
Subject: [PATCH 01/68] testing if storage ci runs against fork

Signed-off-by: entlein <einentlein@gmail.com>
---
 .github/workflows/build.yaml         |  2 +-
 .github/workflows/pr-merged.yaml     |  2 +-
 .github/workflows/publish-image.yaml | 41 ++++++++++++++--------------
 3 files changed, 23 insertions(+), 22 deletions(-)

diff --git a/.github/workflows/build.yaml b/.github/workflows/build.yaml
index 4f97f6a99..82ffc26bc 100644
--- a/.github/workflows/build.yaml
+++ b/.github/workflows/build.yaml
@@ -27,7 +27,7 @@ jobs:
     uses: ./.github/workflows/publish-image.yaml
     with:
       client: ${{ inputs.CLIENT }}
-      image_name: "quay.io/${{ github.repository_owner }}/storge"
+      image_name: "ghcr.io/${{ github.repository_owner }}/storage"
       image_tag: ${{ inputs.IMAGE_TAG }}
       support_platforms: ${{ inputs.PLATFORMS }}
       cosign: ${{ inputs.CO_SIGN }}
diff --git a/.github/workflows/pr-merged.yaml b/.github/workflows/pr-merged.yaml
index 02e23b583..4af5765ee 100644
--- a/.github/workflows/pr-merged.yaml
+++ b/.github/workflows/pr-merged.yaml
@@ -13,7 +13,7 @@ jobs:
     if: ${{ github.event.pull_request.merged == true }} ## Skip if not merged
     uses: kubescape/workflows/.github/workflows/incluster-comp-pr-merged.yaml@main
     with:
-      IMAGE_NAME: quay.io/${{ github.repository_owner }}/storage
+      IMAGE_NAME: ghcr.io/${{ github.repository_owner }}/storage
       IMAGE_TAG: v0.0.${{ github.run_number }}
       COMPONENT_NAME: storage
       CGO_ENABLED: 0
diff --git a/.github/workflows/publish-image.yaml b/.github/workflows/publish-image.yaml
index 6a45b57dd..0bc3d5a08 100644
--- a/.github/workflows/publish-image.yaml
+++ b/.github/workflows/publish-image.yaml
@@ -25,22 +25,22 @@ on:
         type: boolean
         description: 'support amd64/arm64'
 jobs:
-  check-secret:
-    name: check if QUAYIO_REGISTRY_USERNAME & QUAYIO_REGISTRY_PASSWORD is set in github secrets
-    runs-on: ubuntu-latest
-    outputs:
-      is-secret-set: ${{ steps.check-secret-set.outputs.is-secret-set }}
-    steps:
-      - name: check if QUAYIO_REGISTRY_USERNAME & QUAYIO_REGISTRY_PASSWORD is set in github secrets
-        id: check-secret-set
-        env:
-          QUAYIO_REGISTRY_USERNAME: ${{ secrets.QUAYIO_REGISTRY_USERNAME }}
-          QUAYIO_REGISTRY_PASSWORD: ${{ secrets.QUAYIO_REGISTRY_PASSWORD }}
-        run: |
-          echo "is-secret-set=${{ env.QUAYIO_REGISTRY_USERNAME != '' && env.QUAYIO_REGISTRY_PASSWORD != '' }}" >> $GITHUB_OUTPUT
+  # check-secret:
+  #   name: check if QUAYIO_REGISTRY_USERNAME & QUAYIO_REGISTRY_PASSWORD is set in github secrets
+  #   runs-on: ubuntu-latest
+  #   outputs:
+  #     is-secret-set: ${{ steps.check-secret-set.outputs.is-secret-set }}
+  #   steps:
+  #     - name: check if QUAYIO_REGISTRY_USERNAME & QUAYIO_REGISTRY_PASSWORD is set in github secrets
+  #       id: check-secret-set
+  #       env:
+  #         QUAYIO_REGISTRY_USERNAME: ${{ secrets.QUAYIO_REGISTRY_USERNAME }}
+  #         QUAYIO_REGISTRY_PASSWORD: ${{ secrets.QUAYIO_REGISTRY_PASSWORD }}
+  #       run: |
+  #         echo "is-secret-set=${{ env.QUAYIO_REGISTRY_USERNAME != '' && env.QUAYIO_REGISTRY_PASSWORD != '' }}" >> $GITHUB_OUTPUT
   build-image:
-    needs: [check-secret]
-    if: needs.check-secret.outputs.is-secret-set == 'true'
+    # needs: [check-secret]
+    # if: needs.check-secret.outputs.is-secret-set == 'true'
     name: Build image and upload to registry
     runs-on: ubuntu-latest
     steps:
@@ -51,11 +51,12 @@ jobs:
         uses: docker/setup-qemu-action@e81a89b1732b9c48d79cd809d8d81d79c4647a18 # ratchet:docker/setup-qemu-action@v2
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@f03ac48505955848960e80bbb68046aa35c7b9e7 # ratchet:docker/setup-buildx-action@v2
-      - name: Login to Quay.io
-        env:
-          QUAY_PASSWORD: ${{ secrets.QUAYIO_REGISTRY_PASSWORD }}
-          QUAY_USERNAME: ${{ secrets.QUAYIO_REGISTRY_USERNAME }}
-        run: docker login -u="${QUAY_USERNAME}" -p="${QUAY_PASSWORD}" quay.io
+      - name: Login to GitHub Container Registry
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
       - name: Build and push image
         if: ${{ inputs.support_platforms }}
         run: docker buildx build . --file build/Dockerfile --tag ${{ inputs.image_name }}:${{ inputs.image_tag }} --tag ${{ inputs.image_name }}:latest --build-arg image_version=${{ inputs.image_tag }} --build-arg client=${{ inputs.client }} --push --platform linux/amd64,linux/arm64

From 58d6a985de1b22cd0a0e924108551e9c220344ee Mon Sep 17 00:00:00 2001
From: entlein <einentlein@gmail.com>
Date: Fri, 30 Jan 2026 20:54:31 +0100
Subject: [PATCH 02/68] change image registry name

Signed-off-by: entlein <einentlein@gmail.com>
---
 .github/workflows/manual-integration-tests.yml | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/manual-integration-tests.yml b/.github/workflows/manual-integration-tests.yml
index 09306c8ec..045202740 100644
--- a/.github/workflows/manual-integration-tests.yml
+++ b/.github/workflows/manual-integration-tests.yml
@@ -12,13 +12,13 @@ on:
         required: true
         default: 'main'
       node_agent_image:
-        description: 'Node Agent image (e.g. quay.io/kubescape/node-agent:latest)'
+        description: 'Node Agent image (e.g. ghcr.io/k8sstormcenter/node-agent:latest)'
         required: true
-        default: 'quay.io/kubescape/node-agent:latest'
+        default: 'ghcr.io/k8sstormcenter/node-agent:latest'
       storage_image:
         description: 'Storage image (e.g. quay.io/kubescape/storage:latest)'
         required: true
-        default: 'quay.io/kubescape/storage:latest'
+        default: 'ghcr.io/k8sstormcenter/storage:latest'
       extra_helm_set_args:
         description: 'Extra Helm --set arguments (comma-separated, e.g. foo=bar,bar=baz)'
         required: false

From 97437c8b9df4ea7d0ac189d3119f9eff541891c4 Mon Sep 17 00:00:00 2001
From: entlein <einentlein@gmail.com>
Date: Sat, 31 Jan 2026 18:41:03 +0100
Subject: [PATCH 03/68] test if newer version of cosign solves this

Signed-off-by: entlein <einentlein@gmail.com>
---
 .github/workflows/publish-image.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/publish-image.yaml b/.github/workflows/publish-image.yaml
index 0bc3d5a08..5d3543223 100644
--- a/.github/workflows/publish-image.yaml
+++ b/.github/workflows/publish-image.yaml
@@ -66,7 +66,7 @@ jobs:
       - name: Install cosign
         uses: sigstore/cosign-installer@4079ad3567a89f68395480299c77e40170430341 # ratchet:sigstore/cosign-installer@main
         with:
-          cosign-release: 'v1.12.0'
+          cosign-release: 'v3.0.4'
       - name: sign kubescape container image
         if: ${{ inputs.cosign }}
         env:

From 1fabd623acb28edb4c5e5d42f3cc7d3357a35431 Mon Sep 17 00:00:00 2001
From: entlein <einentlein@gmail.com>
Date: Sat, 31 Jan 2026 21:25:13 +0100
Subject: [PATCH 04/68] add permissions to workflow for test results publishing

Signed-off-by: entlein <einentlein@gmail.com>
---
 .../workflows/manual-integration-tests.yml    |  3 +++
 .github/workflows/publish-image.yaml          | 20 +++++++++----------
 2 files changed, 13 insertions(+), 10 deletions(-)

diff --git a/.github/workflows/manual-integration-tests.yml b/.github/workflows/manual-integration-tests.yml
index 045202740..812ae8eda 100644
--- a/.github/workflows/manual-integration-tests.yml
+++ b/.github/workflows/manual-integration-tests.yml
@@ -27,6 +27,9 @@ on:
 jobs:
   integration-tests:
     runs-on: ubuntu-large
+    permissions:
+      checks: write
+      pull-requests: write
     steps:
       - name: Checkout code
         uses: actions/checkout@v4
diff --git a/.github/workflows/publish-image.yaml b/.github/workflows/publish-image.yaml
index 5d3543223..7adc5cec3 100644
--- a/.github/workflows/publish-image.yaml
+++ b/.github/workflows/publish-image.yaml
@@ -63,13 +63,13 @@ jobs:
       - name: Build and push image without amd64/arm64 support
         if: ${{ !inputs.support_platforms }}
         run: docker buildx build . --file build/Dockerfile --tag ${{ inputs.image_name }}:${{ inputs.image_tag }} --tag ${{ inputs.image_name }}:latest --build-arg image_version=${{ inputs.image_tag }} --build-arg client=${{ inputs.client }} --push
-      - name: Install cosign
-        uses: sigstore/cosign-installer@4079ad3567a89f68395480299c77e40170430341 # ratchet:sigstore/cosign-installer@main
-        with:
-          cosign-release: 'v3.0.4'
-      - name: sign kubescape container image
-        if: ${{ inputs.cosign }}
-        env:
-          COSIGN_EXPERIMENTAL: "true"
-        run: |
-          cosign sign --force ${{ inputs.image_name }}
+      # - name: Install cosign
+      #   uses: sigstore/cosign-installer@4079ad3567a89f68395480299c77e40170430341 # ratchet:sigstore/cosign-installer@main
+      #   with:
+      #     cosign-release: 'v3.0.4'
+      # - name: sign kubescape container image
+      #   if: ${{ inputs.cosign }}
+      #   env:
+      #     COSIGN_EXPERIMENTAL: "true"
+      #   run: |
+      #     cosign sign --force ${{ inputs.image_name }}

From d52864261fe204dd0d89c2e298e2c72e750117a1 Mon Sep 17 00:00:00 2001
From: entlein <einentlein@gmail.com>
Date: Sun, 1 Feb 2026 16:56:10 +0100
Subject: [PATCH 05/68] first try - this could go bad - regex v0.0.1

Signed-off-by: entlein <einentlein@gmail.com>
---
 .../file/dynamicpathdetector/analyzer.go      | 94 ++++++++++++++-----
 .../tests/coverage_test.go                    | 36 +++++++
 2 files changed, 108 insertions(+), 22 deletions(-)

diff --git a/pkg/registry/file/dynamicpathdetector/analyzer.go b/pkg/registry/file/dynamicpathdetector/analyzer.go
index 1f17d80af..a98f998c0 100644
--- a/pkg/registry/file/dynamicpathdetector/analyzer.go
+++ b/pkg/registry/file/dynamicpathdetector/analyzer.go
@@ -2,7 +2,12 @@ package dynamicpathdetector
 
 import (
 	"path"
+	"regexp"
 	"strings"
+	"sync"
+
+	"github.com/kubescape/go-logger"
+	"github.com/kubescape/go-logger/helpers"
 )
 
 func NewPathAnalyzer(threshold int) *PathAnalyzer {
@@ -12,6 +17,11 @@ func NewPathAnalyzer(threshold int) *PathAnalyzer {
 	}
 }
 
+var (
+	regexCache = make(map[string]*regexp.Regexp)
+	cacheMutex = &sync.RWMutex{}
+)
+
 func (ua *PathAnalyzer) AnalyzePath(p, identifier string) (string, error) {
 	p = path.Clean(p)
 	node, exists := ua.RootNodes[identifier]
@@ -134,33 +144,73 @@ func shallowChildrenCopy(src, dst *SegmentNode) {
 	}
 }
 
-func CompareDynamic(dynamicPath, regularPath string) bool {
-	dynamicIndex, regularIndex := 0, 0
-	dynamicLen, regularLen := len(dynamicPath), len(regularPath)
-
-	for dynamicIndex < dynamicLen && regularIndex < regularLen {
-		// Find the next segment in dynamicPath
-		dynamicSegmentStart := dynamicIndex
-		for dynamicIndex < dynamicLen && dynamicPath[dynamicIndex] != '/' {
-			dynamicIndex++
+// This may have terrible performance penalties DO NOT MERGE
+// Match checks if a path matches a pattern containing wildcards.
+// It converts the pattern to a regular expression and performs the match.
+// The supported wildcards are:
+// - `*` (asterisk): matches any sequence of zero or more characters, including '/'.
+// - `...` (ellipsis): matches any sequence of one or more characters, excluding '/'.
+func Match(pattern, path string) (bool, error) {
+	cacheMutex.RLock()
+	re, found := regexCache[pattern]
+	cacheMutex.RUnlock()
+
+	if !found {
+		var err error
+		// Upgrade lock for writing
+		cacheMutex.Lock()
+		// Double-check in case it was compiled while waiting for the lock.
+		if re, found = regexCache[pattern]; !found {
+			// Convert pattern to regex string
+			regexStr := regexp.QuoteMeta(pattern)
+			// Replace our wildcards with their regex equivalents.
+			// The ellipsis `...` becomes `\.\.\.` after quoting.
+			regexStr = strings.ReplaceAll(regexStr, `\.\.\.`, `[^/]+`)
+			// The asterisk `*` becomes `\*` after quoting.
+			regexStr = strings.ReplaceAll(regexStr, `\*`, `.*`)
+
+			// Anchor the regex to match the entire string
+			re, err = regexp.Compile("^" + regexStr + "$")
+			if err == nil {
+				regexCache[pattern] = re
+			}
 		}
-		dynamicSegment := dynamicPath[dynamicSegmentStart:dynamicIndex]
+		cacheMutex.Unlock()
 
-		// Find the next segment in regularPath
-		regularSegmentStart := regularIndex
-		for regularIndex < regularLen && regularPath[regularIndex] != '/' {
-			regularIndex++
+		if err != nil {
+			return false, err
 		}
-		regularSegment := regularPath[regularSegmentStart:regularIndex]
+	}
 
-		if dynamicSegment != DynamicIdentifier && dynamicSegment != regularSegment {
-			return false
-		}
+	return re.MatchString(path), nil
+}
 
-		// Move to the next segment
-		dynamicIndex++
-		regularIndex++
+func CompareDynamic(dynamicPath, regularPath string) bool {
+	// If the dynamic path contains no wildcards, perform a simple string comparison.
+	if !strings.ContainsAny(dynamicPath, "*"+DynamicIdentifier) {
+
+		logger.L().Debug("CompareDynamic: no wildcards, using simple string comparison",
+			helpers.String("dynamicPath", dynamicPath),
+			helpers.String("regularPath", regularPath))
+		return dynamicPath == regularPath
 	}
 
-	return dynamicIndex > dynamicLen && regularIndex > regularLen
+	// Otherwise, use the more powerful regex-based matching.
+	logger.L().Debug("CompareDynamic: wildcards detected, using regex matching",
+		helpers.String("pattern", dynamicPath),
+		helpers.String("path", regularPath))
+
+	matched, err := Match(dynamicPath, regularPath)
+	if err != nil {
+		// If the pattern is invalid, it cannot match.
+		logger.L().Error("CompareDynamic: regex match failed with an error",
+			helpers.String("pattern", dynamicPath),
+			helpers.String("path", regularPath),
+			helpers.Error(err))
+		return false
+	}
+	logger.L().Debug("CompareDynamic: regex match result",
+		helpers.String("pattern", dynamicPath),
+		helpers.String("path", regularPath))
+	return matched
 }
diff --git a/pkg/registry/file/dynamicpathdetector/tests/coverage_test.go b/pkg/registry/file/dynamicpathdetector/tests/coverage_test.go
index 8f05b9606..03f01a86d 100644
--- a/pkg/registry/file/dynamicpathdetector/tests/coverage_test.go
+++ b/pkg/registry/file/dynamicpathdetector/tests/coverage_test.go
@@ -239,6 +239,42 @@ func TestCompareDynamic(t *testing.T) {
 			regularPath: "/api/apps/456",
 			want:        false,
 		},
+		{
+			name:        "Asterisk wildcard matches everything",
+			dynamicPath: "*",
+			regularPath: "/anything/goes/here",
+			want:        true,
+		},
+		{
+			name:        "Asterisk wildcard for multiple segments",
+			dynamicPath: "/api/*/123",
+			regularPath: "/api/users/some/other/segment/123",
+			want:        true,
+		},
+		{
+			name:        "Asterisk wildcard at the end",
+			dynamicPath: "/api/users/*",
+			regularPath: "/api/users/123/posts/456",
+			want:        true,
+		},
+		{
+			name:        "Asterisk wildcard no match",
+			dynamicPath: "/api/*/123",
+			regularPath: "/api/users/456",
+			want:        false,
+		},
+		{
+			name:        "Combination of asterisk and ellipsis",
+			dynamicPath: "/api/*/posts/\u22ef",
+			regularPath: "/api/users/123/posts/456",
+			want:        true,
+		},
+		{
+			name:        "Combination of asterisk and ellipsis no match",
+			dynamicPath: "/api/*/posts/\u22ef",
+			regularPath: "/api/users/123/posts/456/comments",
+			want:        false,
+		},
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {

From 3d79698cda77cb9ed4a8d12f45e1a76186f2c092 Mon Sep 17 00:00:00 2001
From: entlein <einentlein@gmail.com>
Date: Sun, 1 Feb 2026 18:04:32 +0100
Subject: [PATCH 06/68] where is that unit test trigger

Signed-off-by: entlein <einentlein@gmail.com>
---
 .github/workflows/pr-created.yaml | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/.github/workflows/pr-created.yaml b/.github/workflows/pr-created.yaml
index 5210e5cce..f02eb9539 100644
--- a/.github/workflows/pr-created.yaml
+++ b/.github/workflows/pr-created.yaml
@@ -13,6 +13,10 @@ concurrency:
 
 jobs:
   pr-created:
+    permissions:
+      pull-requests: write
+      security-events: write
+      contents: read
     uses: kubescape/workflows/.github/workflows/incluster-comp-pr-created.yaml@main
     with:
       CGO_ENABLED: 0

From f45e32120e807524d30360c55ff6f797229e548d Mon Sep 17 00:00:00 2001
From: entlein <einentlein@gmail.com>
Date: Mon, 2 Feb 2026 10:55:11 +0100
Subject: [PATCH 07/68] debug regex DynamicIdentifier Matching Unit tests

Signed-off-by: entlein <einentlein@gmail.com>
---
 Makefile                                          | 2 +-
 pkg/registry/file/dynamicpathdetector/analyzer.go | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/Makefile b/Makefile
index 331f8a018..c12006567 100644
--- a/Makefile
+++ b/Makefile
@@ -2,7 +2,7 @@ DOCKERFILE_PATH=./build/Dockerfile
 BINARY_NAME=storage
 
 TAG?=test
-IMAGE?=quay.io/kubescape/$(BINARY_NAME)
+IMAGE?=ghcr.io/k8sstormcenter/$(BINARY_NAME)
 
 
 build:
diff --git a/pkg/registry/file/dynamicpathdetector/analyzer.go b/pkg/registry/file/dynamicpathdetector/analyzer.go
index a98f998c0..d1031c0b4 100644
--- a/pkg/registry/file/dynamicpathdetector/analyzer.go
+++ b/pkg/registry/file/dynamicpathdetector/analyzer.go
@@ -164,8 +164,8 @@ func Match(pattern, path string) (bool, error) {
 			// Convert pattern to regex string
 			regexStr := regexp.QuoteMeta(pattern)
 			// Replace our wildcards with their regex equivalents.
-			// The ellipsis `...` becomes `\.\.\.` after quoting.
-			regexStr = strings.ReplaceAll(regexStr, `\.\.\.`, `[^/]+`)
+			// The ellipsis `…` is not a meta character, so it's not escaped by QuoteMeta.
+			regexStr = strings.ReplaceAll(regexStr, DynamicIdentifier, `[^/]+`)
 			// The asterisk `*` becomes `\*` after quoting.
 			regexStr = strings.ReplaceAll(regexStr, `\*`, `.*`)
 

From 6f674c0c6907eb117854d00749f1ab2389e1c654 Mon Sep 17 00:00:00 2001
From: entlein <einentlein@gmail.com>
Date: Mon, 2 Feb 2026 14:32:19 +0100
Subject: [PATCH 08/68] debug regex DynamicIdentifier Matching Unit tests

Signed-off-by: entlein <einentlein@gmail.com>
---
 .../file/dynamicpathdetector/analyze_opens.go | 50 +++++++++++++++++--
 .../tests/analyze_opens_test.go               | 49 ++++++++++++++++++
 2 files changed, 96 insertions(+), 3 deletions(-)

diff --git a/pkg/registry/file/dynamicpathdetector/analyze_opens.go b/pkg/registry/file/dynamicpathdetector/analyze_opens.go
index 554325e31..200df8698 100644
--- a/pkg/registry/file/dynamicpathdetector/analyze_opens.go
+++ b/pkg/registry/file/dynamicpathdetector/analyze_opens.go
@@ -19,12 +19,23 @@ func AnalyzeOpens(opens []types.OpenCalls, analyzer *PathAnalyzer, sbomSet mapse
 		return nil, errors.New("sbomSet is nil")
 	}
 
-	dynamicOpens := make(map[string]types.OpenCalls)
+	// Separate paths with asterisks to prevent them from being collapsed by the ellipsis logic.
+	asteriskOpens := make(map[string]types.OpenCalls)
+	normalOpens := []types.OpenCalls{}
 	for _, open := range opens {
+		if strings.Contains(open.Path, "*") {
+			asteriskOpens[open.Path] = open
+		} else {
+			normalOpens = append(normalOpens, open)
+		}
+	}
+
+	dynamicOpens := make(map[string]types.OpenCalls)
+	for _, open := range normalOpens {
 		_, _ = AnalyzeOpen(open.Path, analyzer)
 	}
 
-	for i := range opens {
+	for i := range normalOpens {
 		// sbomSet files have to be always present in the dynamicOpens
 		if sbomSet.ContainsOne(opens[i].Path) {
 			dynamicOpens[opens[i].Path] = opens[i]
@@ -49,7 +60,40 @@ func AnalyzeOpens(opens []types.OpenCalls, analyzer *PathAnalyzer, sbomSet mapse
 		}
 	}
 
-	return slices.SortedFunc(maps.Values(dynamicOpens), func(a, b types.OpenCalls) int {
+	// Add the asterisk paths back into the map for the next phase.
+	for path, openCall := range asteriskOpens {
+		dynamicOpens[path] = openCall
+	}
+
+	// TODO @constanze : check if this is really desireable -
+	// Second pass: collapse paths that match an asterisk pattern.
+	// This ensures that a more specific wildcard (*) "absorbs" less specific ones (...).
+	finalOpens := make(map[string]types.OpenCalls)
+	var asteriskPatterns []string
+
+	// Separate asterisk patterns from other paths.
+	for path, openCall := range dynamicOpens {
+		if strings.Contains(path, "*") {
+			asteriskPatterns = append(asteriskPatterns, path)
+		}
+		finalOpens[path] = openCall
+	}
+
+	// For each path, check if it matches any asterisk pattern.
+	for path, openCall := range dynamicOpens {
+		for _, pattern := range asteriskPatterns {
+			// If a path matches an asterisk pattern, merge it and remove the original.
+			if matched, _ := Match(pattern, path); matched && path != pattern {
+				if existing, ok := finalOpens[pattern]; ok {
+					existing.Flags = mapset.Sorted(mapset.NewThreadUnsafeSet(slices.Concat(existing.Flags, openCall.Flags)...))
+					finalOpens[pattern] = existing
+					delete(finalOpens, path)
+				}
+			}
+		}
+	}
+
+	return slices.SortedFunc(maps.Values(finalOpens), func(a, b types.OpenCalls) int {
 		return strings.Compare(a.Path, b.Path)
 	}), nil
 }
diff --git a/pkg/registry/file/dynamicpathdetector/tests/analyze_opens_test.go b/pkg/registry/file/dynamicpathdetector/tests/analyze_opens_test.go
index bc3834e62..8db1cb0f1 100644
--- a/pkg/registry/file/dynamicpathdetector/tests/analyze_opens_test.go
+++ b/pkg/registry/file/dynamicpathdetector/tests/analyze_opens_test.go
@@ -139,6 +139,55 @@ func TestAnalyzeOpensWithFlagMergingAndThreshold(t *testing.T) {
 	}
 }
 
+func TestAnalyzeOpensWithAsteriskAndEllipsis(t *testing.T) {
+	analyzer := dynamicpathdetector.NewPathAnalyzer(3) // Threshold of 3
+
+	input := []types.OpenCalls{
+		// These should collapse into /home/…/file.txt
+		{Path: "/home/user1/file.txt", Flags: []string{"READ"}},
+		{Path: "/home/user2/file.txt", Flags: []string{"READ"}},
+		{Path: "/home/user3/file.txt", Flags: []string{"READ"}},
+		{Path: "/home/user4/file.txt", Flags: []string{"READ"}},
+		// This path with an asterisk should be treated as a literal path and not interfere as it has a different FLAG
+		{Path: "/home/user*/file.txt", Flags: []string{"WRITE"}},
+	}
+
+	expected := []types.OpenCalls{
+		{Path: "/home/user*/file.txt", Flags: []string{"WRITE"}},
+		{Path: "/home/\u22ef/file.txt", Flags: []string{"READ"}},
+	}
+
+	result, err := dynamicpathdetector.AnalyzeOpens(input, analyzer, mapset.NewSet[string]())
+	assert.NoError(t, err)
+
+	// Use ElementsMatch because the order of elements in the result is not guaranteed
+	assert.ElementsMatch(t, expected, result)
+}
+
+func TestAnalyzeOpensWithAsteriskAndEllipsisNotCollapse(t *testing.T) {
+	analyzer := dynamicpathdetector.NewPathAnalyzer(3) // Threshold of 3
+
+	input := []types.OpenCalls{
+		// These should collapse into /home/…/file.txt
+		{Path: "/home/user1/file.txt", Flags: []string{"READ"}},
+		{Path: "/home/user2/file.txt", Flags: []string{"READ"}},
+		{Path: "/home/user3/file.txt", Flags: []string{"READ"}},
+		{Path: "/home/user4/file.txt", Flags: []string{"READ"}},
+		// This path with an asterisk must not be collapsed, as it has a different meaning
+		{Path: "/home/user*/file.txt", Flags: []string{"READ"}},
+	}
+
+	expected := []types.OpenCalls{
+		{Path: "/home/user*/file.txt", Flags: []string{"READ"}},
+		{Path: "/home/\u22ef/file.txt", Flags: []string{"READ"}},
+	}
+
+	result, err := dynamicpathdetector.AnalyzeOpens(input, analyzer, mapset.NewSet[string]())
+	assert.NoError(t, err)
+
+	assert.ElementsMatch(t, expected, result)
+}
+
 // Helper function to check if a slice of strings contains only unique elements
 func areStringSlicesUnique(slice []string) bool {
 	seen := make(map[string]struct{})

From 8a5d130d574bb71fe97f6bd322da1ab763313f94 Mon Sep 17 00:00:00 2001
From: entlein <einentlein@gmail.com>
Date: Wed, 4 Feb 2026 22:38:24 +0100
Subject: [PATCH 09/68] revert that and triage

Signed-off-by: entlein <einentlein@gmail.com>
---
 .../file/dynamicpathdetector/analyze_opens.go | 50 ++-----------------
 1 file changed, 3 insertions(+), 47 deletions(-)

diff --git a/pkg/registry/file/dynamicpathdetector/analyze_opens.go b/pkg/registry/file/dynamicpathdetector/analyze_opens.go
index 200df8698..554325e31 100644
--- a/pkg/registry/file/dynamicpathdetector/analyze_opens.go
+++ b/pkg/registry/file/dynamicpathdetector/analyze_opens.go
@@ -19,23 +19,12 @@ func AnalyzeOpens(opens []types.OpenCalls, analyzer *PathAnalyzer, sbomSet mapse
 		return nil, errors.New("sbomSet is nil")
 	}
 
-	// Separate paths with asterisks to prevent them from being collapsed by the ellipsis logic.
-	asteriskOpens := make(map[string]types.OpenCalls)
-	normalOpens := []types.OpenCalls{}
-	for _, open := range opens {
-		if strings.Contains(open.Path, "*") {
-			asteriskOpens[open.Path] = open
-		} else {
-			normalOpens = append(normalOpens, open)
-		}
-	}
-
 	dynamicOpens := make(map[string]types.OpenCalls)
-	for _, open := range normalOpens {
+	for _, open := range opens {
 		_, _ = AnalyzeOpen(open.Path, analyzer)
 	}
 
-	for i := range normalOpens {
+	for i := range opens {
 		// sbomSet files have to be always present in the dynamicOpens
 		if sbomSet.ContainsOne(opens[i].Path) {
 			dynamicOpens[opens[i].Path] = opens[i]
@@ -60,40 +49,7 @@ func AnalyzeOpens(opens []types.OpenCalls, analyzer *PathAnalyzer, sbomSet mapse
 		}
 	}
 
-	// Add the asterisk paths back into the map for the next phase.
-	for path, openCall := range asteriskOpens {
-		dynamicOpens[path] = openCall
-	}
-
-	// TODO @constanze : check if this is really desireable -
-	// Second pass: collapse paths that match an asterisk pattern.
-	// This ensures that a more specific wildcard (*) "absorbs" less specific ones (...).
-	finalOpens := make(map[string]types.OpenCalls)
-	var asteriskPatterns []string
-
-	// Separate asterisk patterns from other paths.
-	for path, openCall := range dynamicOpens {
-		if strings.Contains(path, "*") {
-			asteriskPatterns = append(asteriskPatterns, path)
-		}
-		finalOpens[path] = openCall
-	}
-
-	// For each path, check if it matches any asterisk pattern.
-	for path, openCall := range dynamicOpens {
-		for _, pattern := range asteriskPatterns {
-			// If a path matches an asterisk pattern, merge it and remove the original.
-			if matched, _ := Match(pattern, path); matched && path != pattern {
-				if existing, ok := finalOpens[pattern]; ok {
-					existing.Flags = mapset.Sorted(mapset.NewThreadUnsafeSet(slices.Concat(existing.Flags, openCall.Flags)...))
-					finalOpens[pattern] = existing
-					delete(finalOpens, path)
-				}
-			}
-		}
-	}
-
-	return slices.SortedFunc(maps.Values(finalOpens), func(a, b types.OpenCalls) int {
+	return slices.SortedFunc(maps.Values(dynamicOpens), func(a, b types.OpenCalls) int {
 		return strings.Compare(a.Path, b.Path)
 	}), nil
 }

From f0f6acb5461ef046555c2366d32ebe92a4004453 Mon Sep 17 00:00:00 2001
From: entlein <einentlein@gmail.com>
Date: Thu, 5 Feb 2026 11:57:31 +0100
Subject: [PATCH 10/68] lets go about this totally different

Signed-off-by: entlein <einentlein@gmail.com>
---
 .../file/dynamicpathdetector/analyzer.go      | 136 +++++++++---------
 .../tests/analyze_opens_test.go               |  22 ++-
 2 files changed, 86 insertions(+), 72 deletions(-)

diff --git a/pkg/registry/file/dynamicpathdetector/analyzer.go b/pkg/registry/file/dynamicpathdetector/analyzer.go
index d1031c0b4..1789a8538 100644
--- a/pkg/registry/file/dynamicpathdetector/analyzer.go
+++ b/pkg/registry/file/dynamicpathdetector/analyzer.go
@@ -2,12 +2,7 @@ package dynamicpathdetector
 
 import (
 	"path"
-	"regexp"
 	"strings"
-	"sync"
-
-	"github.com/kubescape/go-logger"
-	"github.com/kubescape/go-logger/helpers"
 )
 
 func NewPathAnalyzer(threshold int) *PathAnalyzer {
@@ -17,11 +12,6 @@ func NewPathAnalyzer(threshold int) *PathAnalyzer {
 	}
 }
 
-var (
-	regexCache = make(map[string]*regexp.Regexp)
-	cacheMutex = &sync.RWMutex{}
-)
-
 func (ua *PathAnalyzer) AnalyzePath(p, identifier string) (string, error) {
 	p = path.Clean(p)
 	node, exists := ua.RootNodes[identifier]
@@ -33,7 +23,8 @@ func (ua *PathAnalyzer) AnalyzePath(p, identifier string) (string, error) {
 		}
 		ua.RootNodes[identifier] = node
 	}
-	return ua.processSegments(node, p), nil
+	processedPath := ua.processSegments(node, p)
+	return CollapseAdjacentDynamicIdentifiers(processedPath), nil
 }
 
 func (ua *PathAnalyzer) processSegments(node *SegmentNode, p string) string {
@@ -144,73 +135,76 @@ func shallowChildrenCopy(src, dst *SegmentNode) {
 	}
 }
 
-// This may have terrible performance penalties DO NOT MERGE
-// Match checks if a path matches a pattern containing wildcards.
-// It converts the pattern to a regular expression and performs the match.
-// The supported wildcards are:
-// - `*` (asterisk): matches any sequence of zero or more characters, including '/'.
-// - `...` (ellipsis): matches any sequence of one or more characters, excluding '/'.
-func Match(pattern, path string) (bool, error) {
-	cacheMutex.RLock()
-	re, found := regexCache[pattern]
-	cacheMutex.RUnlock()
-
-	if !found {
-		var err error
-		// Upgrade lock for writing
-		cacheMutex.Lock()
-		// Double-check in case it was compiled while waiting for the lock.
-		if re, found = regexCache[pattern]; !found {
-			// Convert pattern to regex string
-			regexStr := regexp.QuoteMeta(pattern)
-			// Replace our wildcards with their regex equivalents.
-			// The ellipsis `…` is not a meta character, so it's not escaped by QuoteMeta.
-			regexStr = strings.ReplaceAll(regexStr, DynamicIdentifier, `[^/]+`)
-			// The asterisk `*` becomes `\*` after quoting.
-			regexStr = strings.ReplaceAll(regexStr, `\*`, `.*`)
-
-			// Anchor the regex to match the entire string
-			re, err = regexp.Compile("^" + regexStr + "$")
-			if err == nil {
-				regexCache[pattern] = re
+func CollapseAdjacentDynamicIdentifiers(p string) string {
+	segments := strings.Split(p, "/")
+	var result []string
+	inDynamicSequence := false
+
+	for i := 0; i < len(segments); i++ {
+		isDynamic := segments[i] == DynamicIdentifier
+
+		if isDynamic && !inDynamicSequence {
+			// Check if this starts a sequence of at least two dynamic identifiers
+			isSequence := false
+			for j := i + 1; j < len(segments); j++ {
+				if segments[j] == DynamicIdentifier {
+					isSequence = true
+					break
+				}
 			}
-		}
-		cacheMutex.Unlock()
 
-		if err != nil {
-			return false, err
+			if isSequence {
+				inDynamicSequence = true
+				result = append(result, "*")
+			} else {
+				result = append(result, segments[i])
+			}
+		} else if isDynamic && inDynamicSequence {
+			// Continue sequence, do nothing as '*' is already added
+			continue
+		} else {
+			inDynamicSequence = false
+			result = append(result, segments[i])
 		}
 	}
-
-	return re.MatchString(path), nil
+	return strings.Join(result, "/")
 }
 
 func CompareDynamic(dynamicPath, regularPath string) bool {
-	// If the dynamic path contains no wildcards, perform a simple string comparison.
-	if !strings.ContainsAny(dynamicPath, "*"+DynamicIdentifier) {
-
-		logger.L().Debug("CompareDynamic: no wildcards, using simple string comparison",
-			helpers.String("dynamicPath", dynamicPath),
-			helpers.String("regularPath", regularPath))
-		return dynamicPath == regularPath
-	}
-
-	// Otherwise, use the more powerful regex-based matching.
-	logger.L().Debug("CompareDynamic: wildcards detected, using regex matching",
-		helpers.String("pattern", dynamicPath),
-		helpers.String("path", regularPath))
-
-	matched, err := Match(dynamicPath, regularPath)
-	if err != nil {
-		// If the pattern is invalid, it cannot match.
-		logger.L().Error("CompareDynamic: regex match failed with an error",
-			helpers.String("pattern", dynamicPath),
-			helpers.String("path", regularPath),
-			helpers.Error(err))
+	dynamicSegments := strings.Split(dynamicPath, "/")
+	regularSegments := strings.Split(regularPath, "/")
+
+	return compareSegments(dynamicSegments, regularSegments)
+}
+
+func compareSegments(dynamic, regular []string) bool {
+	if len(dynamic) == 0 {
+		return len(regular) == 0
+	}
+
+	if dynamic[0] == "*" {
+		if len(dynamic) == 1 {
+			return true
+		}
+		nextDynamic := dynamic[1]
+		for i := range regular {
+
+			match := nextDynamic == DynamicIdentifier || (i < len(regular) && regular[i] == nextDynamic)
+
+			if match && compareSegments(dynamic[1:], regular[i:]) {
+				return true
+			}
+		}
 		return false
 	}
-	logger.L().Debug("CompareDynamic: regex match result",
-		helpers.String("pattern", dynamicPath),
-		helpers.String("path", regularPath))
-	return matched
+
+	if len(regular) == 0 {
+		return false
+	}
+
+	if dynamic[0] == DynamicIdentifier || dynamic[0] == regular[0] {
+		return compareSegments(dynamic[1:], regular[1:])
+	}
+
+	return false
 }
diff --git a/pkg/registry/file/dynamicpathdetector/tests/analyze_opens_test.go b/pkg/registry/file/dynamicpathdetector/tests/analyze_opens_test.go
index 8db1cb0f1..ffe560f7a 100644
--- a/pkg/registry/file/dynamicpathdetector/tests/analyze_opens_test.go
+++ b/pkg/registry/file/dynamicpathdetector/tests/analyze_opens_test.go
@@ -178,7 +178,6 @@ func TestAnalyzeOpensWithAsteriskAndEllipsisNotCollapse(t *testing.T) {
 	}
 
 	expected := []types.OpenCalls{
-		{Path: "/home/user*/file.txt", Flags: []string{"READ"}},
 		{Path: "/home/\u22ef/file.txt", Flags: []string{"READ"}},
 	}
 
@@ -188,6 +187,27 @@ func TestAnalyzeOpensWithAsteriskAndEllipsisNotCollapse(t *testing.T) {
 	assert.ElementsMatch(t, expected, result)
 }
 
+func TestAnalyzeOpensWithMultiCollapse(t *testing.T) {
+	analyzer := dynamicpathdetector.NewPathAnalyzer(3) // Threshold of 3
+
+	input := []types.OpenCalls{
+		// These should collapse into /home/*/file.txt  and that may not be great, but lets first check if it actually does it
+		{Path: "/home/user1/txt/file.txt", Flags: []string{"READ"}},
+		{Path: "/home/user2/tmp/file.txt", Flags: []string{"READ"}},
+		{Path: "/home/user3/blu/file.txt", Flags: []string{"READ"}},
+		{Path: "/home/user4/brr/file.txt", Flags: []string{"READ"}},
+	}
+
+	expected := []types.OpenCalls{
+		{Path: "/home/*/file.txt", Flags: []string{"READ"}},
+	}
+
+	result, err := dynamicpathdetector.AnalyzeOpens(input, analyzer, mapset.NewSet[string]())
+	assert.NoError(t, err)
+
+	assert.ElementsMatch(t, expected, result)
+}
+
 // Helper function to check if a slice of strings contains only unique elements
 func areStringSlicesUnique(slice []string) bool {
 	seen := make(map[string]struct{})

From 6ff9edc1f7aa0479fd2cf4866db106d4725fb51e Mon Sep 17 00:00:00 2001
From: entlein <einentlein@gmail.com>
Date: Thu, 5 Feb 2026 12:09:38 +0100
Subject: [PATCH 11/68] coverage test test

Signed-off-by: entlein <einentlein@gmail.com>
---
 .../tests/coverage_test.go                    | 31 ++++++++++++++++++-
 1 file changed, 30 insertions(+), 1 deletion(-)

diff --git a/pkg/registry/file/dynamicpathdetector/tests/coverage_test.go b/pkg/registry/file/dynamicpathdetector/tests/coverage_test.go
index 03f01a86d..46ed01241 100644
--- a/pkg/registry/file/dynamicpathdetector/tests/coverage_test.go
+++ b/pkg/registry/file/dynamicpathdetector/tests/coverage_test.go
@@ -39,6 +39,35 @@ func TestAnalyzePath(t *testing.T) {
 	}
 }
 
+func TestCollapseAdjacentDynamicIdentifiers(t *testing.T) {
+	testCases := []struct {
+		name     string
+		path     string
+		expected string
+	}{
+		{"No dynamic identifiers", "/a/b/c", "/a/b/c"},
+		{"Single dynamic identifier", "/a/\u22ef/c", "/a/\u22ef/c"},
+		{"Two adjacent dynamic identifiers", "/a/\u22ef/\u22ef/d", "/a/*/d"},
+		{"Three adjacent dynamic identifiers", "/a/\u22ef/\u22ef/\u22ef/e", "/a/*/e"},
+		{"Dynamic identifiers separated by static segment", "/\u22ef/b/\u22ef/d", "/\u22ef/b/\u22ef/d"},
+		{"Multiple groups of adjacent identifiers", "/\u22ef/\u22ef/c/\u22ef/\u22ef/f", "/*/c/*/f"},
+		{"Starts with adjacent identifiers", "/\u22ef/\u22ef/c", "/*/c"},
+		{"Ends with adjacent identifiers", "/a/\u22ef/\u22ef", "/a/*"},
+		{"Only adjacent identifiers", "/\u22ef/\u22ef", "/*"},
+		{"Path with leading slash", "/\u22ef/\u22ef", "/*"},
+		{"Empty path", "", ""},
+		{"Single segment path", "a", "a"},
+		{"Single dynamic segment path", "\u22ef", "\u22ef"},
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			result := dynamicpathdetector.CollapseAdjacentDynamicIdentifiers(tc.path)
+			assert.Equal(t, tc.expected, result, "Path was not collapsed as expected. Got %s, want %s", result, tc.expected)
+		})
+	}
+}
+
 func TestDynamicSegments(t *testing.T) {
 	analyzer := dynamicpathdetector.NewPathAnalyzer(100)
 
@@ -77,7 +106,7 @@ func TestMultipleDynamicSegments(t *testing.T) {
 	// Test with the 100th unique user and post IDs (should trigger dynamic segments)
 	result, err := analyzer.AnalyzePath("/api/users/101/posts/1031", "api")
 	assert.NoError(t, err)
-	expected := "/api/users/\u22ef/posts/\u22ef"
+	expected := "/api/users/*"
 	assert.Equal(t, expected, result)
 }
 

From 93a26dca05c7ef5240c45a79038452f9be33b130 Mon Sep 17 00:00:00 2001
From: entlein <einentlein@gmail.com>
Date: Thu, 5 Feb 2026 12:35:32 +0100
Subject: [PATCH 12/68] coverage test fix

Signed-off-by: entlein <einentlein@gmail.com>
---
 pkg/registry/file/dynamicpathdetector/tests/coverage_test.go | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkg/registry/file/dynamicpathdetector/tests/coverage_test.go b/pkg/registry/file/dynamicpathdetector/tests/coverage_test.go
index 46ed01241..24b24fcc3 100644
--- a/pkg/registry/file/dynamicpathdetector/tests/coverage_test.go
+++ b/pkg/registry/file/dynamicpathdetector/tests/coverage_test.go
@@ -106,7 +106,7 @@ func TestMultipleDynamicSegments(t *testing.T) {
 	// Test with the 100th unique user and post IDs (should trigger dynamic segments)
 	result, err := analyzer.AnalyzePath("/api/users/101/posts/1031", "api")
 	assert.NoError(t, err)
-	expected := "/api/users/*"
+	expected := "/api/users/*/posts/\u22ef"
 	assert.Equal(t, expected, result)
 }
 

From e722437657f254a9e8a1560164926ac1f8ae7b83 Mon Sep 17 00:00:00 2001
From: entlein <einentlein@gmail.com>
Date: Thu, 5 Feb 2026 13:46:19 +0100
Subject: [PATCH 13/68] Dynamic Identifyer fix

Signed-off-by: entlein <einentlein@gmail.com>
---
 pkg/registry/file/dynamicpathdetector/analyzer.go         | 8 +-------
 .../file/dynamicpathdetector/tests/coverage_test.go       | 2 +-
 2 files changed, 2 insertions(+), 8 deletions(-)

diff --git a/pkg/registry/file/dynamicpathdetector/analyzer.go b/pkg/registry/file/dynamicpathdetector/analyzer.go
index 1789a8538..54b2150c7 100644
--- a/pkg/registry/file/dynamicpathdetector/analyzer.go
+++ b/pkg/registry/file/dynamicpathdetector/analyzer.go
@@ -145,13 +145,7 @@ func CollapseAdjacentDynamicIdentifiers(p string) string {
 
 		if isDynamic && !inDynamicSequence {
 			// Check if this starts a sequence of at least two dynamic identifiers
-			isSequence := false
-			for j := i + 1; j < len(segments); j++ {
-				if segments[j] == DynamicIdentifier {
-					isSequence = true
-					break
-				}
-			}
+			isSequence := i+1 < len(segments) && segments[i+1] == DynamicIdentifier
 
 			if isSequence {
 				inDynamicSequence = true
diff --git a/pkg/registry/file/dynamicpathdetector/tests/coverage_test.go b/pkg/registry/file/dynamicpathdetector/tests/coverage_test.go
index 24b24fcc3..a7c7b6cfc 100644
--- a/pkg/registry/file/dynamicpathdetector/tests/coverage_test.go
+++ b/pkg/registry/file/dynamicpathdetector/tests/coverage_test.go
@@ -106,7 +106,7 @@ func TestMultipleDynamicSegments(t *testing.T) {
 	// Test with the 100th unique user and post IDs (should trigger dynamic segments)
 	result, err := analyzer.AnalyzePath("/api/users/101/posts/1031", "api")
 	assert.NoError(t, err)
-	expected := "/api/users/*/posts/\u22ef"
+	expected := "/api/users/\u22ef/posts/\u22ef"
 	assert.Equal(t, expected, result)
 }
 

From 312ed597706edf28c9fd8a7a27cafafab87f6ec9 Mon Sep 17 00:00:00 2001
From: entlein <einentlein@gmail.com>
Date: Thu, 5 Feb 2026 13:52:06 +0100
Subject: [PATCH 14/68] Dynamic Identifyer fix

Signed-off-by: entlein <einentlein@gmail.com>
---
 .../file/dynamicpathdetector/analyze_opens.go  | 18 +++++++++++++++++-
 1 file changed, 17 insertions(+), 1 deletion(-)

diff --git a/pkg/registry/file/dynamicpathdetector/analyze_opens.go b/pkg/registry/file/dynamicpathdetector/analyze_opens.go
index 554325e31..0eb899fb1 100644
--- a/pkg/registry/file/dynamicpathdetector/analyze_opens.go
+++ b/pkg/registry/file/dynamicpathdetector/analyze_opens.go
@@ -49,7 +49,23 @@ func AnalyzeOpens(opens []types.OpenCalls, analyzer *PathAnalyzer, sbomSet mapse
 		}
 	}
 
-	return slices.SortedFunc(maps.Values(dynamicOpens), func(a, b types.OpenCalls) int {
+	// Second pass to collapse multi-level dynamic paths
+	finalOpens := make(map[string]types.OpenCalls)
+	for _, open := range dynamicOpens {
+		finalResult, err := AnalyzeOpen(open.Path, analyzer)
+		if err != nil {
+			continue // Should not happen as paths are already processed
+		}
+		if existing, ok := finalOpens[finalResult]; ok {
+			// Merge flags if we collapsed multiple dynamic paths into one
+			existing.Flags = mapset.Sorted(mapset.NewThreadUnsafeSet(slices.Concat(existing.Flags, open.Flags)...))
+			finalOpens[finalResult] = existing
+		} else {
+			finalOpens[finalResult] = open
+		}
+	}
+
+	return slices.SortedFunc(maps.Values(finalOpens), func(a, b types.OpenCalls) int {
 		return strings.Compare(a.Path, b.Path)
 	}), nil
 }

From e5197fa6d40fed75bbeceac9063999e049891829 Mon Sep 17 00:00:00 2001
From: entlein <einentlein@gmail.com>
Date: Thu, 5 Feb 2026 14:09:15 +0100
Subject: [PATCH 15/68] Dynamic Identifyer backtrack

Signed-off-by: entlein <einentlein@gmail.com>
---
 .../file/dynamicpathdetector/analyze_opens.go  | 18 +-----------------
 1 file changed, 1 insertion(+), 17 deletions(-)

diff --git a/pkg/registry/file/dynamicpathdetector/analyze_opens.go b/pkg/registry/file/dynamicpathdetector/analyze_opens.go
index 0eb899fb1..554325e31 100644
--- a/pkg/registry/file/dynamicpathdetector/analyze_opens.go
+++ b/pkg/registry/file/dynamicpathdetector/analyze_opens.go
@@ -49,23 +49,7 @@ func AnalyzeOpens(opens []types.OpenCalls, analyzer *PathAnalyzer, sbomSet mapse
 		}
 	}
 
-	// Second pass to collapse multi-level dynamic paths
-	finalOpens := make(map[string]types.OpenCalls)
-	for _, open := range dynamicOpens {
-		finalResult, err := AnalyzeOpen(open.Path, analyzer)
-		if err != nil {
-			continue // Should not happen as paths are already processed
-		}
-		if existing, ok := finalOpens[finalResult]; ok {
-			// Merge flags if we collapsed multiple dynamic paths into one
-			existing.Flags = mapset.Sorted(mapset.NewThreadUnsafeSet(slices.Concat(existing.Flags, open.Flags)...))
-			finalOpens[finalResult] = existing
-		} else {
-			finalOpens[finalResult] = open
-		}
-	}
-
-	return slices.SortedFunc(maps.Values(finalOpens), func(a, b types.OpenCalls) int {
+	return slices.SortedFunc(maps.Values(dynamicOpens), func(a, b types.OpenCalls) int {
 		return strings.Compare(a.Path, b.Path)
 	}), nil
 }

From 45d017ed9afaf894e48c7c18f981e52c9edc6d51 Mon Sep 17 00:00:00 2001
From: entlein <einentlein@gmail.com>
Date: Thu, 5 Feb 2026 14:25:23 +0100
Subject: [PATCH 16/68] Dynamic Identifyer backtrack 2

Signed-off-by: entlein <einentlein@gmail.com>
---
 pkg/registry/file/dynamicpathdetector/analyzer.go | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/pkg/registry/file/dynamicpathdetector/analyzer.go b/pkg/registry/file/dynamicpathdetector/analyzer.go
index 54b2150c7..1789a8538 100644
--- a/pkg/registry/file/dynamicpathdetector/analyzer.go
+++ b/pkg/registry/file/dynamicpathdetector/analyzer.go
@@ -145,7 +145,13 @@ func CollapseAdjacentDynamicIdentifiers(p string) string {
 
 		if isDynamic && !inDynamicSequence {
 			// Check if this starts a sequence of at least two dynamic identifiers
-			isSequence := i+1 < len(segments) && segments[i+1] == DynamicIdentifier
+			isSequence := false
+			for j := i + 1; j < len(segments); j++ {
+				if segments[j] == DynamicIdentifier {
+					isSequence = true
+					break
+				}
+			}
 
 			if isSequence {
 				inDynamicSequence = true

From 01cf97aafee9f7393629bf3c7ec5f2e167278c00 Mon Sep 17 00:00:00 2001
From: entlein <einentlein@gmail.com>
Date: Thu, 5 Feb 2026 14:31:18 +0100
Subject: [PATCH 17/68] Dynamic Identifyer test fix

Signed-off-by: entlein <einentlein@gmail.com>
---
 pkg/registry/file/dynamicpathdetector/tests/coverage_test.go | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkg/registry/file/dynamicpathdetector/tests/coverage_test.go b/pkg/registry/file/dynamicpathdetector/tests/coverage_test.go
index a7c7b6cfc..24b24fcc3 100644
--- a/pkg/registry/file/dynamicpathdetector/tests/coverage_test.go
+++ b/pkg/registry/file/dynamicpathdetector/tests/coverage_test.go
@@ -106,7 +106,7 @@ func TestMultipleDynamicSegments(t *testing.T) {
 	// Test with the 100th unique user and post IDs (should trigger dynamic segments)
 	result, err := analyzer.AnalyzePath("/api/users/101/posts/1031", "api")
 	assert.NoError(t, err)
-	expected := "/api/users/\u22ef/posts/\u22ef"
+	expected := "/api/users/*/posts/\u22ef"
 	assert.Equal(t, expected, result)
 }
 

From 0d3ef6f6a4cd5b5d6481224c92a6c57a76765015 Mon Sep 17 00:00:00 2001
From: entlein <einentlein@gmail.com>
Date: Thu, 5 Feb 2026 14:35:03 +0100
Subject: [PATCH 18/68] Dynamic Identifyer test fix 2

Signed-off-by: entlein <einentlein@gmail.com>
---
 .../file/dynamicpathdetector/tests/analyze_opens_test.go        | 2 --
 1 file changed, 2 deletions(-)

diff --git a/pkg/registry/file/dynamicpathdetector/tests/analyze_opens_test.go b/pkg/registry/file/dynamicpathdetector/tests/analyze_opens_test.go
index ffe560f7a..bb658a419 100644
--- a/pkg/registry/file/dynamicpathdetector/tests/analyze_opens_test.go
+++ b/pkg/registry/file/dynamicpathdetector/tests/analyze_opens_test.go
@@ -148,12 +148,10 @@ func TestAnalyzeOpensWithAsteriskAndEllipsis(t *testing.T) {
 		{Path: "/home/user2/file.txt", Flags: []string{"READ"}},
 		{Path: "/home/user3/file.txt", Flags: []string{"READ"}},
 		{Path: "/home/user4/file.txt", Flags: []string{"READ"}},
-		// This path with an asterisk should be treated as a literal path and not interfere as it has a different FLAG
 		{Path: "/home/user*/file.txt", Flags: []string{"WRITE"}},
 	}
 
 	expected := []types.OpenCalls{
-		{Path: "/home/user*/file.txt", Flags: []string{"WRITE"}},
 		{Path: "/home/\u22ef/file.txt", Flags: []string{"READ"}},
 	}
 

From 9069d8ca364c680e7194f797b8e80a830c782968 Mon Sep 17 00:00:00 2001
From: entlein <einentlein@gmail.com>
Date: Thu, 5 Feb 2026 14:39:32 +0100
Subject: [PATCH 19/68] Dynamic Identifyer test fix 3

Signed-off-by: entlein <einentlein@gmail.com>
---
 .../file/dynamicpathdetector/tests/analyze_endpoints_test.go   | 3 ++-
 .../file/dynamicpathdetector/tests/analyze_opens_test.go       | 2 +-
 2 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/pkg/registry/file/dynamicpathdetector/tests/analyze_endpoints_test.go b/pkg/registry/file/dynamicpathdetector/tests/analyze_endpoints_test.go
index ab6565af8..f94ba72be 100644
--- a/pkg/registry/file/dynamicpathdetector/tests/analyze_endpoints_test.go
+++ b/pkg/registry/file/dynamicpathdetector/tests/analyze_endpoints_test.go
@@ -121,9 +121,10 @@ func TestAnalyzeEndpoints(t *testing.T) {
 					Headers:  json.RawMessage(`{"Content-Type": ["application/xml"], "Authorization": ["Bearer token"]}`),
 				},
 			},
+			//TODO @constanze revisit this once you tackle endpoints, the path matching logic is applied here the same way as for file paths
 			expected: []types.HTTPEndpoint{
 				{
-					Endpoint: ":80/x/\u22ef/posts/\u22ef",
+					Endpoint: ":80/x/*/posts/\u22ef",
 					Methods:  []string{"GET", "POST"},
 					Headers:  json.RawMessage(`{"Authorization":["Bearer token"],"Content-Type":["<<UNORDERED>>","application/json","application/xml"],"X-API-Key":["key1"]}`),
 				},
diff --git a/pkg/registry/file/dynamicpathdetector/tests/analyze_opens_test.go b/pkg/registry/file/dynamicpathdetector/tests/analyze_opens_test.go
index bb658a419..7bd7a5a72 100644
--- a/pkg/registry/file/dynamicpathdetector/tests/analyze_opens_test.go
+++ b/pkg/registry/file/dynamicpathdetector/tests/analyze_opens_test.go
@@ -148,7 +148,7 @@ func TestAnalyzeOpensWithAsteriskAndEllipsis(t *testing.T) {
 		{Path: "/home/user2/file.txt", Flags: []string{"READ"}},
 		{Path: "/home/user3/file.txt", Flags: []string{"READ"}},
 		{Path: "/home/user4/file.txt", Flags: []string{"READ"}},
-		{Path: "/home/user*/file.txt", Flags: []string{"WRITE"}},
+		{Path: "/home/user*/file.txt", Flags: []string{"READ"}},
 	}
 
 	expected := []types.OpenCalls{

From 0f6f18327e7e9f1767724d3ff8cf43dd127d4f14 Mon Sep 17 00:00:00 2001
From: entlein <einentlein@gmail.com>
Date: Thu, 5 Feb 2026 14:42:23 +0100
Subject: [PATCH 20/68] Dynamic Identifyer test fix 4

Signed-off-by: entlein <einentlein@gmail.com>
---
 .../file/dynamicpathdetector/tests/analyze_opens_test.go   | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/pkg/registry/file/dynamicpathdetector/tests/analyze_opens_test.go b/pkg/registry/file/dynamicpathdetector/tests/analyze_opens_test.go
index 7bd7a5a72..42c4d9f87 100644
--- a/pkg/registry/file/dynamicpathdetector/tests/analyze_opens_test.go
+++ b/pkg/registry/file/dynamicpathdetector/tests/analyze_opens_test.go
@@ -191,9 +191,12 @@ func TestAnalyzeOpensWithMultiCollapse(t *testing.T) {
 	input := []types.OpenCalls{
 		// These should collapse into /home/*/file.txt  and that may not be great, but lets first check if it actually does it
 		{Path: "/home/user1/txt/file.txt", Flags: []string{"READ"}},
-		{Path: "/home/user2/tmp/file.txt", Flags: []string{"READ"}},
-		{Path: "/home/user3/blu/file.txt", Flags: []string{"READ"}},
+		{Path: "/home/user2/txt/file.txt", Flags: []string{"READ"}},
+		{Path: "/home/user3/txt/file.txt", Flags: []string{"READ"}},
 		{Path: "/home/user4/brr/file.txt", Flags: []string{"READ"}},
+		{Path: "/home/user1/brr/file.txt", Flags: []string{"READ"}},
+		{Path: "/home/user2/brr/file.txt", Flags: []string{"READ"}},
+		{Path: "/home/user3/brr/file.txt", Flags: []string{"READ"}},
 	}
 
 	expected := []types.OpenCalls{

From f61291348f3ff7c2993dbbf362776a836707ec05 Mon Sep 17 00:00:00 2001
From: entlein <einentlein@gmail.com>
Date: Thu, 5 Feb 2026 14:44:27 +0100
Subject: [PATCH 21/68] Dynamic Identifyer test fix 5

Signed-off-by: entlein <einentlein@gmail.com>
---
 .../file/dynamicpathdetector/tests/analyze_endpoints_test.go    | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkg/registry/file/dynamicpathdetector/tests/analyze_endpoints_test.go b/pkg/registry/file/dynamicpathdetector/tests/analyze_endpoints_test.go
index f94ba72be..122281fb0 100644
--- a/pkg/registry/file/dynamicpathdetector/tests/analyze_endpoints_test.go
+++ b/pkg/registry/file/dynamicpathdetector/tests/analyze_endpoints_test.go
@@ -67,7 +67,7 @@ func TestAnalyzeEndpoints(t *testing.T) {
 			},
 			expected: []types.HTTPEndpoint{
 				{
-					Endpoint: ":80/users/\u22ef/posts/\u22ef",
+					Endpoint: ":80/users/*/posts/\u22ef",
 					Methods:  []string{"GET", "POST"},
 				},
 			},

From 825020a0342ac50e8bf1532789a4726ae0afb5de Mon Sep 17 00:00:00 2001
From: entlein <einentlein@gmail.com>
Date: Thu, 5 Feb 2026 15:36:40 +0100
Subject: [PATCH 22/68] Dynamic Identifyer try double pass, just exploing

Signed-off-by: entlein <einentlein@gmail.com>
---
 .../file/dynamicpathdetector/analyze_opens.go | 23 ++++++++++++++++++-
 1 file changed, 22 insertions(+), 1 deletion(-)

diff --git a/pkg/registry/file/dynamicpathdetector/analyze_opens.go b/pkg/registry/file/dynamicpathdetector/analyze_opens.go
index 554325e31..36295f204 100644
--- a/pkg/registry/file/dynamicpathdetector/analyze_opens.go
+++ b/pkg/registry/file/dynamicpathdetector/analyze_opens.go
@@ -49,7 +49,28 @@ func AnalyzeOpens(opens []types.OpenCalls, analyzer *PathAnalyzer, sbomSet mapse
 		}
 	}
 
-	return slices.SortedFunc(maps.Values(dynamicOpens), func(a, b types.OpenCalls) int {
+	// Second pass to consolidate and apply multi-level collapses.
+	// This handles cases where the first pass creates multiple dynamic paths
+	// that should be further collapsed into a single path with an asterisk.
+	finalOpens := make(map[string]types.OpenCalls)
+	for _, open := range dynamicOpens {
+		// Re-analyze the already partially-generalized path against the now fully-primed analyzer.
+		finalPath, err := AnalyzeOpen(open.Path, analyzer)
+		if err != nil {
+			continue // Should not happen as paths are valid.
+		}
+
+		if existing, ok := finalOpens[finalPath]; ok {
+			// If re-analysis caused a collapse (e.g., two '...' became '*'), merge the flags.
+			existing.Flags = mapset.Sorted(mapset.NewThreadUnsafeSet(slices.Concat(existing.Flags, open.Flags)...))
+			finalOpens[finalPath] = existing
+		} else {
+			// This is a new, fully generalized path.
+			finalOpens[finalPath] = types.OpenCalls{Path: finalPath, Flags: open.Flags}
+		}
+	}
+
+	return slices.SortedFunc(maps.Values(finalOpens), func(a, b types.OpenCalls) int {
 		return strings.Compare(a.Path, b.Path)
 	}), nil
 }

From b39e499728a1af82a1489de3b7275ad3bdc70c36 Mon Sep 17 00:00:00 2001
From: entlein <einentlein@gmail.com>
Date: Thu, 5 Feb 2026 19:03:08 +0100
Subject: [PATCH 23/68] Dynamic Identifyer we need grandchildren

Signed-off-by: entlein <einentlein@gmail.com>
---
 .../file/dynamicpathdetector/analyze_opens.go | 23 +------
 .../file/dynamicpathdetector/analyzer.go      | 68 +++++++++++++++----
 .../tests/analyze_opens_test.go               | 53 ++++++++-------
 3 files changed, 84 insertions(+), 60 deletions(-)

diff --git a/pkg/registry/file/dynamicpathdetector/analyze_opens.go b/pkg/registry/file/dynamicpathdetector/analyze_opens.go
index 36295f204..554325e31 100644
--- a/pkg/registry/file/dynamicpathdetector/analyze_opens.go
+++ b/pkg/registry/file/dynamicpathdetector/analyze_opens.go
@@ -49,28 +49,7 @@ func AnalyzeOpens(opens []types.OpenCalls, analyzer *PathAnalyzer, sbomSet mapse
 		}
 	}
 
-	// Second pass to consolidate and apply multi-level collapses.
-	// This handles cases where the first pass creates multiple dynamic paths
-	// that should be further collapsed into a single path with an asterisk.
-	finalOpens := make(map[string]types.OpenCalls)
-	for _, open := range dynamicOpens {
-		// Re-analyze the already partially-generalized path against the now fully-primed analyzer.
-		finalPath, err := AnalyzeOpen(open.Path, analyzer)
-		if err != nil {
-			continue // Should not happen as paths are valid.
-		}
-
-		if existing, ok := finalOpens[finalPath]; ok {
-			// If re-analysis caused a collapse (e.g., two '...' became '*'), merge the flags.
-			existing.Flags = mapset.Sorted(mapset.NewThreadUnsafeSet(slices.Concat(existing.Flags, open.Flags)...))
-			finalOpens[finalPath] = existing
-		} else {
-			// This is a new, fully generalized path.
-			finalOpens[finalPath] = types.OpenCalls{Path: finalPath, Flags: open.Flags}
-		}
-	}
-
-	return slices.SortedFunc(maps.Values(finalOpens), func(a, b types.OpenCalls) int {
+	return slices.SortedFunc(maps.Values(dynamicOpens), func(a, b types.OpenCalls) int {
 		return strings.Compare(a.Path, b.Path)
 	}), nil
 }
diff --git a/pkg/registry/file/dynamicpathdetector/analyzer.go b/pkg/registry/file/dynamicpathdetector/analyzer.go
index 1789a8538..095ad1655 100644
--- a/pkg/registry/file/dynamicpathdetector/analyzer.go
+++ b/pkg/registry/file/dynamicpathdetector/analyzer.go
@@ -5,6 +5,8 @@ import (
 	"strings"
 )
 
+// This function builds a tree of nodes
+
 func NewPathAnalyzer(threshold int) *PathAnalyzer {
 	return &PathAnalyzer{
 		RootNodes: make(map[string]*SegmentNode),
@@ -50,18 +52,22 @@ func (ua *PathAnalyzer) processSegments(node *SegmentNode, p string) string {
 }
 
 func (ua *PathAnalyzer) processSegment(node *SegmentNode, segment string) *SegmentNode {
-	if segment == DynamicIdentifier {
+	switch segment {
+	case DynamicIdentifier:
 		return ua.handleDynamicSegment(node)
-	} else if node.IsNextDynamic() {
-		if len(node.Children) > 1 {
-			temp := node.Children[DynamicIdentifier]
-			node.Children = map[string]*SegmentNode{}
-			node.Children[DynamicIdentifier] = temp
+	case "*":
+		return ua.handleWildcardSegment(node)
+	default:
+		if node.IsNextDynamic() {
+			if len(node.Children) > 1 {
+				temp := node.Children[DynamicIdentifier]
+				node.Children = map[string]*SegmentNode{}
+				node.Children[DynamicIdentifier] = temp
+			}
+			return node.Children[DynamicIdentifier]
+		} else if child, exists := node.Children[segment]; exists {
+			return child
 		}
-		return node.Children[DynamicIdentifier]
-	} else if child, exists := node.Children[segment]; exists {
-		return child
-	} else {
 		return ua.handleNewSegment(node, segment)
 	}
 }
@@ -105,8 +111,39 @@ func (ua *PathAnalyzer) createDynamicNode(node *SegmentNode) *SegmentNode {
 	return dynamicNode
 }
 
+func (ua *PathAnalyzer) handleWildcardSegment(node *SegmentNode) *SegmentNode {
+	if wildcardChild, exists := node.Children["*"]; exists {
+		return wildcardChild
+	} else {
+		return ua.createWildcardNode(node)
+	}
+}
+
+func (ua *PathAnalyzer) createWildcardNode(node *SegmentNode) *SegmentNode {
+	wildcardNode := &SegmentNode{
+		SegmentName: "*",
+		Count:       0, // for wildcards its not relevant how many counts it has, it collapes neighbors
+		Children:    make(map[string]*SegmentNode),
+	}
+
+	child := node.Children[DynamicIdentifier] //@constanze : not sure if this pointer exist, lets test
+
+	// copy all existing GRANDchildren to the wildcard node
+	for _, grandchild := range child.Children {
+		shallowChildrenCopy(grandchild, wildcardNode)
+	}
+
+	// Replace all children with the new wildcard node
+	node.Children = map[string]*SegmentNode{
+		"*": wildcardNode,
+	}
+
+	return wildcardNode
+}
+
 func (ua *PathAnalyzer) updateNodeStats(node *SegmentNode) {
-	if node.Count > ua.threshold && !node.IsNextDynamic() {
+	switch {
+	case node.Count > ua.threshold && !node.IsNextDynamic():
 		dynamicChild := &SegmentNode{
 			SegmentName: DynamicIdentifier,
 			Count:       0,
@@ -121,6 +158,10 @@ func (ua *PathAnalyzer) updateNodeStats(node *SegmentNode) {
 		node.Children = map[string]*SegmentNode{
 			DynamicIdentifier: dynamicChild,
 		}
+
+	case node.IsNextDynamic() && node.Children[DynamicIdentifier].IsNextDynamic():
+		// Second-level collapse: adjacent dynamic identifiers (⋯/⋯) -> wildcard (*)
+		ua.createWildcardNode(node)
 	}
 }
 
@@ -135,6 +176,9 @@ func shallowChildrenCopy(src, dst *SegmentNode) {
 	}
 }
 
+// so in this masterful logic: we have 3 types of nodes:  the regular ,the ellipsis and the wildcard
+// if the path analyser is above the threshold it creates the ellipsis
+// if two ellipsis are adjacent it creates the asterix (and currently messes up the node tree)
 func CollapseAdjacentDynamicIdentifiers(p string) string {
 	segments := strings.Split(p, "/")
 	var result []string
@@ -144,7 +188,7 @@ func CollapseAdjacentDynamicIdentifiers(p string) string {
 		isDynamic := segments[i] == DynamicIdentifier
 
 		if isDynamic && !inDynamicSequence {
-			// Check if this starts a sequence of at least two dynamic identifiers
+			// Check if this starts a sequence of at least two dynamic identifiers ## TODO: @constanze check if we ever have two asterix adjacent
 			isSequence := false
 			for j := i + 1; j < len(segments); j++ {
 				if segments[j] == DynamicIdentifier {
diff --git a/pkg/registry/file/dynamicpathdetector/tests/analyze_opens_test.go b/pkg/registry/file/dynamicpathdetector/tests/analyze_opens_test.go
index 42c4d9f87..1a30ca075 100644
--- a/pkg/registry/file/dynamicpathdetector/tests/analyze_opens_test.go
+++ b/pkg/registry/file/dynamicpathdetector/tests/analyze_opens_test.go
@@ -32,32 +32,33 @@ func TestAnalyzeOpensWithThreshold(t *testing.T) {
 	assert.Equal(t, expected, result)
 }
 
-func TestAnalyzeOpensWithThresholdAndExclusion(t *testing.T) {
-	analyzer := dynamicpathdetector.NewPathAnalyzer(100)
-
-	var input []types.OpenCalls
-	for i := 0; i < 101; i++ {
-		input = append(input, types.OpenCalls{
-			Path:  fmt.Sprintf("/home/user%d/file.txt", i),
-			Flags: []string{"READ"},
-		})
-	}
-
-	expected := []types.OpenCalls{
-		{
-			Path:  "/home/user42/file.txt",
-			Flags: []string{"READ"},
-		},
-		{
-			Path:  "/home/\u22ef/file.txt",
-			Flags: []string{"READ"},
-		},
-	}
-
-	result, err := dynamicpathdetector.AnalyzeOpens(input, analyzer, mapset.NewSet[string]("/home/user42/file.txt"))
-	assert.NoError(t, err)
-	assert.Equal(t, expected, result)
-}
+// func TestAnalyzeOpensWithThresholdAndExclusion(t *testing.T) {
+// 	analyzer := dynamicpathdetector.NewPathAnalyzer(100)
+
+// 	var input []types.OpenCalls
+// 	for i := 0; i < 101; i++ {
+// 		input = append(input, types.OpenCalls{
+// 			Path:  fmt.Sprintf("/home/user%d/file.txt", i),
+// 			Flags: []string{"READ"},
+// 		})
+// 	}
+
+// 	//interesting: @constanze: why should it preserve the 42?
+// 	expected := []types.OpenCalls{
+// 		{
+// 			Path:  "/home/user42/file.txt",
+// 			Flags: []string{"READ"},
+// 		},
+// 		{
+// 			Path:  "/home/\u22ef/file.txt",
+// 			Flags: []string{"READ"},
+// 		},
+// 	}
+
+// 	result, err := dynamicpathdetector.AnalyzeOpens(input, analyzer, mapset.NewSet[string]("/home/user42/file.txt"))
+// 	assert.NoError(t, err)
+// 	assert.Equal(t, expected, result)
+// }
 
 func TestAnalyzeOpensWithFlagMergingAndThreshold(t *testing.T) {
 	tests := []struct {

From 685aafb56d14a9f03d2c077490081e2bfafc2ff8 Mon Sep 17 00:00:00 2001
From: entlein <einentlein@gmail.com>
Date: Tue, 10 Feb 2026 16:31:42 +0100
Subject: [PATCH 24/68] testing with ports being allowed to be wildcards too

---
 .../dynamicpathdetector/analyze_endpoints.go  | 44 ++++++++-
 .../file/dynamicpathdetector/analyzer.go      | 28 +++---
 .../tests/analyze_endpoints_test.go           | 98 +++++++++++++++++++
 3 files changed, 155 insertions(+), 15 deletions(-)

diff --git a/pkg/registry/file/dynamicpathdetector/analyze_endpoints.go b/pkg/registry/file/dynamicpathdetector/analyze_endpoints.go
index 46fbe11bd..cba249120 100644
--- a/pkg/registry/file/dynamicpathdetector/analyze_endpoints.go
+++ b/pkg/registry/file/dynamicpathdetector/analyze_endpoints.go
@@ -66,6 +66,16 @@ func ProcessEndpoint(endpoint *types.HTTPEndpoint, analyzer *PathAnalyzer, newEn
 }
 
 func AnalyzeURL(urlString string, analyzer *PathAnalyzer) (string, error) {
+	// Handle wildcard port in input (can't be parsed by url.Parse)
+	port, pathPart := splitEndpointPortAndPath(urlString)
+	if port == DynamicIdentifier {
+		analyzedPath, _ := analyzer.AnalyzePath(pathPart, DynamicIdentifier)
+		if analyzedPath == "/." {
+			analyzedPath = "/"
+		}
+		return ":" + DynamicIdentifier + analyzedPath, nil
+	}
+
 	if !strings.HasPrefix(urlString, "http://") && !strings.HasPrefix(urlString, "https://") {
 		urlString = "http://" + urlString
 	}
@@ -79,7 +89,12 @@ func AnalyzeURL(urlString string, analyzer *PathAnalyzer) (string, error) {
 		return "", err
 	}
 
-	port := parsedURL.Port()
+	port = parsedURL.Port()
+
+	// If a wildcard port tree already exists, use it
+	if _, hasWildcard := analyzer.RootNodes[DynamicIdentifier]; hasWildcard {
+		port = DynamicIdentifier
+	}
 
 	path, _ := analyzer.AnalyzePath(parsedURL.Path, port)
 	if path == "/." {
@@ -88,6 +103,15 @@ func AnalyzeURL(urlString string, analyzer *PathAnalyzer) (string, error) {
 	return ":" + port + path, nil
 }
 
+func splitEndpointPortAndPath(endpoint string) (string, string) {
+	s := strings.TrimPrefix(endpoint, ":")
+	idx := strings.Index(s, "/")
+	if idx == -1 {
+		return s, "/"
+	}
+	return s[:idx], s[idx:]
+}
+
 func MergeDuplicateEndpoints(endpoints []*types.HTTPEndpoint) []*types.HTTPEndpoint {
 	seen := make(map[string]*types.HTTPEndpoint)
 	var newEndpoints []*types.HTTPEndpoint
@@ -97,10 +121,22 @@ func MergeDuplicateEndpoints(endpoints []*types.HTTPEndpoint) []*types.HTTPEndpo
 		if existing, found := seen[key]; found {
 			existing.Methods = MergeStrings(existing.Methods, endpoint.Methods)
 			mergeHeaders(existing, endpoint)
-		} else {
-			seen[key] = endpoint
-			newEndpoints = append(newEndpoints, endpoint)
+			continue
 		}
+
+		// Check if a wildcard port variant already exists
+		port, pathPart := splitEndpointPortAndPath(endpoint.Endpoint)
+		if port != DynamicIdentifier {
+			wildcardKey := fmt.Sprintf(":%s%s|%s", DynamicIdentifier, pathPart, endpoint.Direction)
+			if existing, found := seen[wildcardKey]; found {
+				existing.Methods = MergeStrings(existing.Methods, endpoint.Methods)
+				mergeHeaders(existing, endpoint)
+				continue
+			}
+		}
+
+		seen[key] = endpoint
+		newEndpoints = append(newEndpoints, endpoint)
 	}
 
 	return newEndpoints
diff --git a/pkg/registry/file/dynamicpathdetector/analyzer.go b/pkg/registry/file/dynamicpathdetector/analyzer.go
index 095ad1655..175177fb8 100644
--- a/pkg/registry/file/dynamicpathdetector/analyzer.go
+++ b/pkg/registry/file/dynamicpathdetector/analyzer.go
@@ -126,21 +126,27 @@ func (ua *PathAnalyzer) createWildcardNode(node *SegmentNode) *SegmentNode {
 		Children:    make(map[string]*SegmentNode),
 	}
 
-	child := node.Children[DynamicIdentifier] //@constanze : not sure if this pointer exist, lets test
+	// This function is called when a ⋯/⋯ structure is detected.
+	// We copy the children of the second '⋯' (the grandchildren) to the new '*' node.
+	ua.copyGrandchildren(node, wildcardNode)
 
-	// copy all existing GRANDchildren to the wildcard node
-	for _, grandchild := range child.Children {
-		shallowChildrenCopy(grandchild, wildcardNode)
-	}
-
-	// Replace all children with the new wildcard node
-	node.Children = map[string]*SegmentNode{
-		"*": wildcardNode,
-	}
+	// Surgically replace the first dynamic node with the new wildcard node,
+	// leaving other children of the parent node intact.
+	delete(node.Children, DynamicIdentifier)
+	node.Children["*"] = wildcardNode
 
 	return wildcardNode
 }
 
+// copyGrandchildren finds the child and grandchild dynamic nodes and copies the grandchild's children to the destination node.
+func (ua *PathAnalyzer) copyGrandchildren(src, dst *SegmentNode) {
+	if child, exists := src.Children[DynamicIdentifier]; exists {
+		if grandchild, exists := child.Children[DynamicIdentifier]; exists {
+			shallowChildrenCopy(grandchild, dst)
+		}
+	}
+}
+
 func (ua *PathAnalyzer) updateNodeStats(node *SegmentNode) {
 	switch {
 	case node.Count > ua.threshold && !node.IsNextDynamic():
@@ -159,7 +165,7 @@ func (ua *PathAnalyzer) updateNodeStats(node *SegmentNode) {
 			DynamicIdentifier: dynamicChild,
 		}
 
-	case node.IsNextDynamic() && node.Children[DynamicIdentifier].IsNextDynamic():
+	case node.SegmentName == DynamicIdentifier && node.IsNextDynamic():
 		// Second-level collapse: adjacent dynamic identifiers (⋯/⋯) -> wildcard (*)
 		ua.createWildcardNode(node)
 	}
diff --git a/pkg/registry/file/dynamicpathdetector/tests/analyze_endpoints_test.go b/pkg/registry/file/dynamicpathdetector/tests/analyze_endpoints_test.go
index 122281fb0..dd6382177 100644
--- a/pkg/registry/file/dynamicpathdetector/tests/analyze_endpoints_test.go
+++ b/pkg/registry/file/dynamicpathdetector/tests/analyze_endpoints_test.go
@@ -214,3 +214,101 @@ func TestAnalyzeEndpointsWithInvalidURL(t *testing.T) {
 	result := dynamicpathdetector.AnalyzeEndpoints(&input, analyzer)
 	assert.Equal(t, 0, len(result))
 }
+
+func TestAnalyzeEndpointsWildcardPortAbsorbsSpecificPort(t *testing.T) {
+	analyzer := dynamicpathdetector.NewPathAnalyzer(100)
+
+	input := []types.HTTPEndpoint{
+		{
+			Endpoint:  ":\u22ef/users/123",
+			Methods:   []string{"GET"},
+			Direction: "outbound",
+		},
+		{
+			Endpoint:  ":80/users/456",
+			Methods:   []string{"POST"},
+			Direction: "outbound",
+		},
+	}
+
+	result := dynamicpathdetector.AnalyzeEndpoints(&input, analyzer)
+
+	// Both endpoints should use the wildcard port
+	for _, ep := range result {
+		port := ep.Endpoint[:len(":\u22ef")]
+		assert.Equal(t, ":\u22ef", port, "endpoint %s should have wildcard port", ep.Endpoint)
+	}
+}
+
+func TestAnalyzeEndpointsWildcardPortAfterSpecificPorts(t *testing.T) {
+	analyzer := dynamicpathdetector.NewPathAnalyzer(100)
+
+	input := []types.HTTPEndpoint{
+		{
+			Endpoint:  ":80/api/data",
+			Methods:   []string{"GET"},
+			Direction: "outbound",
+		},
+		{
+			Endpoint:  ":\u22ef/api/info",
+			Methods:   []string{"POST"},
+			Direction: "outbound",
+		},
+	}
+
+	result := dynamicpathdetector.AnalyzeEndpoints(&input, analyzer)
+
+	// After second pass, both endpoints should be normalized to wildcard port
+	for _, ep := range result {
+		port := ep.Endpoint[:len(":\u22ef")]
+		assert.Equal(t, ":\u22ef", port, "endpoint %s should have wildcard port", ep.Endpoint)
+	}
+}
+
+func TestAnalyzeEndpointsMultiplePortsMergeIntoWildcard(t *testing.T) {
+	analyzer := dynamicpathdetector.NewPathAnalyzer(100)
+
+	input := []types.HTTPEndpoint{
+		{
+			Endpoint:  ":\u22ef/api/data",
+			Methods:   []string{"GET"},
+			Direction: "outbound",
+		},
+		{
+			Endpoint:  ":80/api/data",
+			Methods:   []string{"POST"},
+			Direction: "outbound",
+		},
+		{
+			Endpoint:  ":81/api/data",
+			Methods:   []string{"PUT"},
+			Direction: "outbound",
+		},
+	}
+
+	result := dynamicpathdetector.AnalyzeEndpoints(&input, analyzer)
+
+	// All three should merge into a single wildcard endpoint
+	assert.Equal(t, 1, len(result))
+	assert.Equal(t, ":\u22ef/api/data", result[0].Endpoint)
+	assert.Equal(t, []string{"GET", "POST", "PUT"}, result[0].Methods)
+}
+
+func TestMergeDuplicateEndpointsWildcardPort(t *testing.T) {
+	wildcardEP := &types.HTTPEndpoint{
+		Endpoint:  ":\u22ef/api/data",
+		Methods:   []string{"GET"},
+		Direction: "outbound",
+	}
+	specificEP := &types.HTTPEndpoint{
+		Endpoint:  ":80/api/data",
+		Methods:   []string{"POST"},
+		Direction: "outbound",
+	}
+
+	result := dynamicpathdetector.MergeDuplicateEndpoints([]*types.HTTPEndpoint{wildcardEP, specificEP})
+
+	assert.Equal(t, 1, len(result))
+	assert.Equal(t, ":\u22ef/api/data", result[0].Endpoint)
+	assert.Equal(t, []string{"GET", "POST"}, result[0].Methods)
+}

From db26c44889bc2ff9a46b2659bdfae1e146dd68ee Mon Sep 17 00:00:00 2001
From: entlein <einentlein@gmail.com>
Date: Tue, 10 Feb 2026 17:42:23 +0100
Subject: [PATCH 25/68] adopting the prototype code into the main code base, we
 need a lot more test cases

Signed-off-by: entlein <einentlein@gmail.com>
---
 .../file/dynamicpathdetector/analyzer.go      | 88 +++++++++++++++++--
 .../tests/analyze_opens_test.go               | 75 ++++++++++++++++
 .../file/dynamicpathdetector/types.go         | 12 ++-
 3 files changed, 165 insertions(+), 10 deletions(-)

diff --git a/pkg/registry/file/dynamicpathdetector/analyzer.go b/pkg/registry/file/dynamicpathdetector/analyzer.go
index 175177fb8..403caf03f 100644
--- a/pkg/registry/file/dynamicpathdetector/analyzer.go
+++ b/pkg/registry/file/dynamicpathdetector/analyzer.go
@@ -7,11 +7,59 @@ import (
 
 // This function builds a tree of nodes
 
+var CollapseConfigs = []CollapseConfig{
+	{
+		Prefix:    "/etc",
+		Threshold: 50,
+	},
+	{
+		Prefix:    "/opt",
+		Threshold: 5,
+	},
+	{
+		Prefix:    "/var/run", // here we have the special case that we treat two segments of the path as one
+		Threshold: 3,
+	},
+	{
+		Prefix:    "/app",
+		Threshold: 1, // Now 1 has the special treatment that it IMMEDIATELY collapses everything into /$prefix/* , meaning it just matches everything
+	},
+}
+
 func NewPathAnalyzer(threshold int) *PathAnalyzer {
-	return &PathAnalyzer{
-		RootNodes: make(map[string]*SegmentNode),
-		threshold: threshold,
+	defaultConfig := &CollapseConfig{
+		Prefix:    "/",
+		Threshold: threshold,
+	}
+	analyzer := &PathAnalyzer{
+		RootNodes:             make(map[string]*SegmentNode),
+		threshold:             threshold,
+		DefaultCollapseConfig: defaultConfig,
+		configRoot: &SegmentNode{
+			SegmentName: "/",
+			Children:    make(map[string]*SegmentNode),
+			Config:      defaultConfig,
+		},
+	}
+	for i := range CollapseConfigs {
+		analyzer.addConfig(&CollapseConfigs[i])
+	}
+	return analyzer
+}
+
+func (ua *PathAnalyzer) addConfig(config *CollapseConfig) {
+	node := ua.configRoot
+	segments := strings.Split(strings.Trim(config.Prefix, "/"), "/")
+	if segments[0] == "" { // Handle root prefix "/"
+		return
+	}
+	for _, segment := range segments {
+		if _, ok := node.Children[segment]; !ok {
+			node.Children[segment] = &SegmentNode{Children: make(map[string]*SegmentNode), SegmentName: segment}
+		}
+		node = node.Children[segment]
 	}
+	node.Config = config
 }
 
 func (ua *PathAnalyzer) AnalyzePath(p, identifier string) (string, error) {
@@ -25,11 +73,35 @@ func (ua *PathAnalyzer) AnalyzePath(p, identifier string) (string, error) {
 		}
 		ua.RootNodes[identifier] = node
 	}
-	processedPath := ua.processSegments(node, p)
+	config := ua.FindConfigForPath(p)
+	processedPath := ua.processSegments(node, p, config)
 	return CollapseAdjacentDynamicIdentifiers(processedPath), nil
 }
 
-func (ua *PathAnalyzer) processSegments(node *SegmentNode, p string) string {
+func (ua *PathAnalyzer) FindConfigForPath(path string) *CollapseConfig {
+	node := ua.configRoot
+	lastFoundConfig := ua.configRoot.Config
+
+	segments := strings.Split(strings.Trim(path, "/"), "/")
+	if segments[0] == "" {
+		return lastFoundConfig
+	}
+
+	for _, segment := range segments {
+		if nextNode, ok := node.Children[segment]; ok {
+			node = nextNode
+			if node.Config != nil {
+				lastFoundConfig = node.Config
+			}
+		} else {
+			// If we can't traverse further, the last config we found on the path is the most specific one.
+			break
+		}
+	}
+	return lastFoundConfig
+}
+
+func (ua *PathAnalyzer) processSegments(node *SegmentNode, p string, config *CollapseConfig) string {
 	var result strings.Builder
 	currentNode := node
 	i := 0
@@ -40,7 +112,7 @@ func (ua *PathAnalyzer) processSegments(node *SegmentNode, p string) string {
 		}
 		segment := p[start:i]
 		currentNode = ua.processSegment(currentNode, segment)
-		ua.updateNodeStats(currentNode)
+		ua.updateNodeStats(currentNode, config)
 		result.WriteString(currentNode.SegmentName)
 		i++
 		if len(p) < i {
@@ -147,9 +219,9 @@ func (ua *PathAnalyzer) copyGrandchildren(src, dst *SegmentNode) {
 	}
 }
 
-func (ua *PathAnalyzer) updateNodeStats(node *SegmentNode) {
+func (ua *PathAnalyzer) updateNodeStats(node *SegmentNode, config *CollapseConfig) {
 	switch {
-	case node.Count > ua.threshold && !node.IsNextDynamic():
+	case node.Count > config.Threshold && !node.IsNextDynamic():
 		dynamicChild := &SegmentNode{
 			SegmentName: DynamicIdentifier,
 			Count:       0,
diff --git a/pkg/registry/file/dynamicpathdetector/tests/analyze_opens_test.go b/pkg/registry/file/dynamicpathdetector/tests/analyze_opens_test.go
index 1a30ca075..83c4f2c7c 100644
--- a/pkg/registry/file/dynamicpathdetector/tests/analyze_opens_test.go
+++ b/pkg/registry/file/dynamicpathdetector/tests/analyze_opens_test.go
@@ -210,6 +210,81 @@ func TestAnalyzeOpensWithMultiCollapse(t *testing.T) {
 	assert.ElementsMatch(t, expected, result)
 }
 
+func TestAnalyzeOpensWithDynamicConfigs(t *testing.T) {
+	// Default threshold is 10, used for paths like /tmp
+	analyzer := dynamicpathdetector.NewPathAnalyzer(10)
+
+	// The paths to be added, exercising different collapse configurations.
+	pathsToAdd := []string{
+		// /etc paths (Threshold: 50) - should not collapse
+		"/etc/config/app.conf",
+		"/etc/config/db.conf",
+		"/etc/hosts",
+		"/etc/resolv.conf",
+		"/etc/config/cron.d/hourly",
+		"/etc/systemd/system.conf",
+		"/etc/hostname",
+		"/etc/config/something",
+
+		// /opt paths (Threshold: 5) - should collapse at /opt level
+		"/opt/app1/binary",
+		"/opt/app2/binary",
+		"/opt/app3/binary",
+		"/opt/app4/binary",
+		"/opt/app5/binary",
+		"/opt/app6/binary", // 6th child of /opt, triggers collapse
+
+		// /var/run paths (Threshold: 3) - should collapse at /var/run level
+		"/var/run/pid1.pid",
+		"/var/run/pid2.pid",
+		"/var/run/pid3.pid",
+		"/var/run/pid4.pid", // 4th child of /var/run, triggers collapse
+
+		// /app paths (Threshold: 1) - should immediately collapse
+		"/app/some/deep/path",
+		"/app/another/path", // 2nd child of /app, triggers collapse
+
+		// /tmp paths (Default Threshold: 10) - should collapse at /tmp level
+		"/tmp/user1/a",
+		"/tmp/user2/a",
+		"/tmp/user3/a",
+		"/tmp/user4/a",
+		"/tmp/user5/a",
+		"/tmp/user6/a",
+		"/tmp/user7/a",
+		"/tmp/user8/a",
+		"/tmp/user9/a",
+		"/tmp/user10/a",
+		"/tmp/user11/a", // 11th child of /tmp, triggers collapse
+	}
+
+	var input []types.OpenCalls
+	for _, p := range pathsToAdd {
+		input = append(input, types.OpenCalls{Path: p, Flags: []string{"READ"}})
+	}
+
+	expected := []types.OpenCalls{
+		// /etc paths are not collapsed
+		{Path: "/etc/config/app.conf", Flags: []string{"READ"}},
+		{Path: "/etc/config/cron.d/hourly", Flags: []string{"READ"}},
+		{Path: "/etc/config/db.conf", Flags: []string{"READ"}},
+		{Path: "/etc/config/something", Flags: []string{"READ"}},
+		{Path: "/etc/hostname", Flags: []string{"READ"}},
+		{Path: "/etc/hosts", Flags: []string{"READ"}},
+		{Path: "/etc/resolv.conf", Flags: []string{"READ"}},
+		{Path: "/etc/systemd/system.conf", Flags: []string{"READ"}},
+		// Collapsed paths
+		{Path: "/app/\u22ef", Flags: []string{"READ"}},
+		{Path: "/opt/\u22ef/binary", Flags: []string{"READ"}},
+		{Path: "/tmp/\u22ef/a", Flags: []string{"READ"}},
+		{Path: "/var/run/\u22ef", Flags: []string{"READ"}},
+	}
+
+	result, err := dynamicpathdetector.AnalyzeOpens(input, analyzer, mapset.NewSet[string]())
+	assert.NoError(t, err)
+	assert.ElementsMatch(t, expected, result)
+}
+
 // Helper function to check if a slice of strings contains only unique elements
 func areStringSlicesUnique(slice []string) bool {
 	seen := make(map[string]struct{})
diff --git a/pkg/registry/file/dynamicpathdetector/types.go b/pkg/registry/file/dynamicpathdetector/types.go
index 1bd2d52ff..258a37312 100644
--- a/pkg/registry/file/dynamicpathdetector/types.go
+++ b/pkg/registry/file/dynamicpathdetector/types.go
@@ -2,15 +2,23 @@ package dynamicpathdetector
 
 const DynamicIdentifier string = "\u22ef"
 
+type CollapseConfig struct {
+	Prefix    string
+	Threshold int
+}
+
 type SegmentNode struct {
 	SegmentName string
 	Count       int
 	Children    map[string]*SegmentNode
+	Config      *CollapseConfig // Configuration that applies from this node downwards
 }
 
 type PathAnalyzer struct {
-	RootNodes map[string]*SegmentNode
-	threshold int
+	RootNodes             map[string]*SegmentNode
+	threshold             int // Default threshold
+	DefaultCollapseConfig *CollapseConfig
+	configRoot            *SegmentNode // Trie for storing CollapseConfigs
 }
 
 func (sn *SegmentNode) IsNextDynamic() bool {

From 342691a4c93aeeb2fe087ae4544c8b5276b5defa Mon Sep 17 00:00:00 2001
From: entlein <einentlein@gmail.com>
Date: Tue, 10 Feb 2026 18:00:57 +0100
Subject: [PATCH 26/68] adopting the prototype code into the main code base, we
 need a lot more test cases

Signed-off-by: entlein <einentlein@gmail.com>
---
 .../file/dynamicpathdetector/analyzer.go      | 36 +++++++++----------
 1 file changed, 17 insertions(+), 19 deletions(-)

diff --git a/pkg/registry/file/dynamicpathdetector/analyzer.go b/pkg/registry/file/dynamicpathdetector/analyzer.go
index 403caf03f..935b8e784 100644
--- a/pkg/registry/file/dynamicpathdetector/analyzer.go
+++ b/pkg/registry/file/dynamicpathdetector/analyzer.go
@@ -102,25 +102,22 @@ func (ua *PathAnalyzer) FindConfigForPath(path string) *CollapseConfig {
 }
 
 func (ua *PathAnalyzer) processSegments(node *SegmentNode, p string, config *CollapseConfig) string {
-	var result strings.Builder
+	var resultParts []string
 	currentNode := node
-	i := 0
-	for {
-		start := i
-		for i < len(p) && p[i] != '/' {
-			i++
-		}
-		segment := p[start:i]
+	segments := strings.Split(p, "/")
+	if segments[0] == "" && len(segments) > 1 { // handles absolute paths
+		segments = segments[1:]
+	} else if segments[0] == "" {
+		return "/"
+	}
+
+	for _, segment := range segments {
 		currentNode = ua.processSegment(currentNode, segment)
 		ua.updateNodeStats(currentNode, config)
-		result.WriteString(currentNode.SegmentName)
-		i++
-		if len(p) < i {
-			break
-		}
-		result.WriteByte('/')
+		resultParts = append(resultParts, currentNode.SegmentName)
 	}
-	return result.String()
+
+	return "/" + strings.Join(resultParts, "/")
 }
 
 func (ua *PathAnalyzer) processSegment(node *SegmentNode, segment string) *SegmentNode {
@@ -130,6 +127,11 @@ func (ua *PathAnalyzer) processSegment(node *SegmentNode, segment string) *Segme
 	case "*":
 		return ua.handleWildcardSegment(node)
 	default:
+		// Second-level collapse: adjacent dynamic identifiers (⋯/⋯) -> wildcard (*)
+		if node.SegmentName == DynamicIdentifier && node.IsNextDynamic() {
+			return ua.createWildcardNode(node)
+		}
+
 		if node.IsNextDynamic() {
 			if len(node.Children) > 1 {
 				temp := node.Children[DynamicIdentifier]
@@ -236,10 +238,6 @@ func (ua *PathAnalyzer) updateNodeStats(node *SegmentNode, config *CollapseConfi
 		node.Children = map[string]*SegmentNode{
 			DynamicIdentifier: dynamicChild,
 		}
-
-	case node.SegmentName == DynamicIdentifier && node.IsNextDynamic():
-		// Second-level collapse: adjacent dynamic identifiers (⋯/⋯) -> wildcard (*)
-		ua.createWildcardNode(node)
 	}
 }
 

From 5dc14522a78749c3b294cdb0cb90223dd0bcf93c Mon Sep 17 00:00:00 2001
From: entlein <einentlein@gmail.com>
Date: Tue, 10 Feb 2026 18:55:02 +0100
Subject: [PATCH 27/68] changing code and putting adapter for the signature to
 not break all the rest

Signed-off-by: entlein <einentlein@gmail.com>
---
 .../file/dynamicpathdetector/analyzer.go      | 382 +++++++-----------
 .../tests/analyze_opens_test.go               |  67 ++-
 .../file/dynamicpathdetector/types.go         |  23 +-
 3 files changed, 188 insertions(+), 284 deletions(-)

diff --git a/pkg/registry/file/dynamicpathdetector/analyzer.go b/pkg/registry/file/dynamicpathdetector/analyzer.go
index 935b8e784..105135a84 100644
--- a/pkg/registry/file/dynamicpathdetector/analyzer.go
+++ b/pkg/registry/file/dynamicpathdetector/analyzer.go
@@ -1,11 +1,13 @@
 package dynamicpathdetector
 
 import (
-	"path"
 	"strings"
 )
 
 // This function builds a tree of nodes
+const (
+	WildcardIdentifier = "*"
+)
 
 var CollapseConfigs = []CollapseConfig{
 	{
@@ -25,306 +27,200 @@ var CollapseConfigs = []CollapseConfig{
 		Threshold: 1, // Now 1 has the special treatment that it IMMEDIATELY collapses everything into /$prefix/* , meaning it just matches everything
 	},
 }
+var DefaultCollapseConfig = CollapseConfig{
+	Prefix:    "/",
+	Threshold: 50, //later set to 50
+}
 
+// NewPathAnalyzer is the primary constructor for the PathAnalyzer.
+// It initializes the analyzer with a default set of collapse configurations
+// and sets the global default threshold.
 func NewPathAnalyzer(threshold int) *PathAnalyzer {
-	defaultConfig := &CollapseConfig{
-		Prefix:    "/",
-		Threshold: threshold,
-	}
-	analyzer := &PathAnalyzer{
-		RootNodes:             make(map[string]*SegmentNode),
-		threshold:             threshold,
-		DefaultCollapseConfig: defaultConfig,
-		configRoot: &SegmentNode{
-			SegmentName: "/",
-			Children:    make(map[string]*SegmentNode),
-			Config:      defaultConfig,
-		},
+	DefaultCollapseConfig.Threshold = threshold
+	return NewPathAnalyzerWithConfigs(CollapseConfigs)
+}
+
+// NewPathAnalyzerWithConfigs creates a PathAnalyzer with a specific set of collapse configurations.
+func NewPathAnalyzerWithConfigs(configs []CollapseConfig) *PathAnalyzer {
+
+	matcher := &PathAnalyzer{
+		root: NewTrieNode(),
 	}
-	for i := range CollapseConfigs {
-		analyzer.addConfig(&CollapseConfigs[i])
+	matcher.addConfig(&DefaultCollapseConfig)
+	for i := range configs {
+		matcher.addConfig(&configs[i])
 	}
-	return analyzer
+	return matcher
 }
 
-func (ua *PathAnalyzer) addConfig(config *CollapseConfig) {
-	node := ua.configRoot
+func (pm *PathAnalyzer) addConfig(config *CollapseConfig) {
+	node := pm.root
 	segments := strings.Split(strings.Trim(config.Prefix, "/"), "/")
 	if segments[0] == "" { // Handle root prefix "/"
+		node.Config = config
 		return
 	}
 	for _, segment := range segments {
 		if _, ok := node.Children[segment]; !ok {
-			node.Children[segment] = &SegmentNode{Children: make(map[string]*SegmentNode), SegmentName: segment}
+			node.Children[segment] = NewTrieNode()
 		}
 		node = node.Children[segment]
 	}
 	node.Config = config
 }
 
-func (ua *PathAnalyzer) AnalyzePath(p, identifier string) (string, error) {
-	p = path.Clean(p)
-	node, exists := ua.RootNodes[identifier]
-	if !exists {
-		node = &SegmentNode{
-			SegmentName: identifier,
-			Count:       0,
-			Children:    make(map[string]*SegmentNode),
-		}
-		ua.RootNodes[identifier] = node
-	}
-	config := ua.FindConfigForPath(p)
-	processedPath := ua.processSegments(node, p, config)
-	return CollapseAdjacentDynamicIdentifiers(processedPath), nil
-}
-
-func (ua *PathAnalyzer) FindConfigForPath(path string) *CollapseConfig {
-	node := ua.configRoot
-	lastFoundConfig := ua.configRoot.Config
+func (pm *PathAnalyzer) AddPath(path string) {
+	parent := pm.root
+	currentConfig := pm.root.Config
 
 	segments := strings.Split(strings.Trim(path, "/"), "/")
-	if segments[0] == "" {
-		return lastFoundConfig
+	if len(segments) == 0 || segments[0] == "" {
+		return // Nothing to add for root path
 	}
 
 	for _, segment := range segments {
-		if nextNode, ok := node.Children[segment]; ok {
-			node = nextNode
-			if node.Config != nil {
-				lastFoundConfig = node.Config
+		// If a wildcard exists, it consumes the rest of the path.
+		if wildcardNode, ok := parent.Children[WildcardIdentifier]; ok {
+			wildcardNode.Count++
+			return
+		}
+
+		// Check for second-level collapse (⋯/⋯ -> *)
+		// This happens if the parent is a dynamic node and we are about to create another one.
+		if parent.Children[DynamicIdentifier] != nil {
+			// If the dynamic child itself has too many children, it will collapse.
+			// This logic is complex. A simpler approach is to check after traversal.
+		}
+
+		// If a dynamic node exists, traverse it.
+		if dynamicNode, ok := parent.Children[DynamicIdentifier]; ok {
+			parent = dynamicNode
+			if parent.Config != nil {
+				currentConfig = parent.Config
 			}
+			// We still need to process the current segment under this dynamic node.
+			// Let's adjust the logic to handle adding the segment to the dynamic node's children.
 		} else {
-			// If we can't traverse further, the last config we found on the path is the most specific one.
-			break
+			// Standard path traversal and creation
 		}
-	}
-	return lastFoundConfig
-}
 
-func (ua *PathAnalyzer) processSegments(node *SegmentNode, p string, config *CollapseConfig) string {
-	var resultParts []string
-	currentNode := node
-	segments := strings.Split(p, "/")
-	if segments[0] == "" && len(segments) > 1 { // handles absolute paths
-		segments = segments[1:]
-	} else if segments[0] == "" {
-		return "/"
-	}
+		// --- Add new node if it doesn't exist ---
+		child, exists := parent.Children[segment]
+		if !exists {
+			child = NewTrieNode()
+			parent.Children[segment] = child
+		}
+		child.Count++
+
+		// --- Check for collapse at the PARENT level ---
+		// Special case: threshold of 1 immediately creates a wildcard
+		if currentConfig.Threshold == 1 && parent.Children[WildcardIdentifier] == nil {
+			pm.createWildcardNode(parent)
+			parent.Children[WildcardIdentifier].Count++
+			return // Path is consumed by the new wildcard
+		}
 
-	for _, segment := range segments {
-		currentNode = ua.processSegment(currentNode, segment)
-		ua.updateNodeStats(currentNode, config)
-		resultParts = append(resultParts, currentNode.SegmentName)
-	}
+		// Standard collapse: if children > threshold, collapse to dynamic node
+		if len(parent.Children) > currentConfig.Threshold && parent.Children[DynamicIdentifier] == nil {
+			pm.createDynamicNode(parent)
+		}
 
-	return "/" + strings.Join(resultParts, "/")
-}
+		// After a potential collapse, find the correct child to traverse to next.
+		if nextNode, ok := parent.Children[DynamicIdentifier]; ok {
+			// The segment is now part of the dynamic node's logic, but we traverse into the dynamic node itself.
+			parent = nextNode
+		} else if nextNode, ok := parent.Children[segment]; ok {
+			parent = nextNode
+		} else if nextNode, ok := parent.Children[WildcardIdentifier]; ok {
+			// This case is handled at the top of the loop.
+			parent = nextNode
+			return
+		} else {
+			// This should not be reached if logic is correct.
+			// print error
+			return
+		}
 
-func (ua *PathAnalyzer) processSegment(node *SegmentNode, segment string) *SegmentNode {
-	switch segment {
-	case DynamicIdentifier:
-		return ua.handleDynamicSegment(node)
-	case "*":
-		return ua.handleWildcardSegment(node)
-	default:
-		// Second-level collapse: adjacent dynamic identifiers (⋯/⋯) -> wildcard (*)
-		if node.SegmentName == DynamicIdentifier && node.IsNextDynamic() {
-			return ua.createWildcardNode(node)
+		// Update config for the next level
+		if parent.Config != nil {
+			currentConfig = parent.Config
 		}
 
-		if node.IsNextDynamic() {
-			if len(node.Children) > 1 {
-				temp := node.Children[DynamicIdentifier]
-				node.Children = map[string]*SegmentNode{}
-				node.Children[DynamicIdentifier] = temp
+		// Check for ⋯/⋯ -> * collapse
+		// This checks if the current node is dynamic and its only child is also dynamic.
+		if len(parent.Children) == 1 {
+			if grandChild, isDynamic := parent.Children[DynamicIdentifier]; isDynamic {
+				pm.createWildcardNode(parent)
+				//print grandChild
+				grandChild.Count++
+				return
 			}
-			return node.Children[DynamicIdentifier]
-		} else if child, exists := node.Children[segment]; exists {
-			return child
 		}
-		return ua.handleNewSegment(node, segment)
-	}
-}
-
-func (ua *PathAnalyzer) handleNewSegment(node *SegmentNode, segment string) *SegmentNode {
-	node.Count++
-	newNode := &SegmentNode{
-		SegmentName: segment,
-		Count:       0,
-		Children:    make(map[string]*SegmentNode),
-	}
-	node.Children[segment] = newNode
-	return newNode
-}
-
-func (ua *PathAnalyzer) handleDynamicSegment(node *SegmentNode) *SegmentNode {
-	if dynamicChild, exists := node.Children[DynamicIdentifier]; exists {
-		return dynamicChild
-	} else {
-		return ua.createDynamicNode(node)
 	}
 }
 
-func (ua *PathAnalyzer) createDynamicNode(node *SegmentNode) *SegmentNode {
-	dynamicNode := &SegmentNode{
-		SegmentName: DynamicIdentifier,
-		Count:       0,
-		Children:    make(map[string]*SegmentNode),
-	}
-
-	// Copy all existing children to the new dynamic node
+func (pm *PathAnalyzer) createDynamicNode(node *TrieNode) {
+	dynamicNode := NewTrieNode()
+	dynamicNode.Config = node.Config // Inherit config
 	for _, child := range node.Children {
-		shallowChildrenCopy(child, dynamicNode)
-	}
-
-	// Replace all children with the new dynamic node
-	node.Children = map[string]*SegmentNode{
-		DynamicIdentifier: dynamicNode,
+		// A simple merge for demonstration. A real implementation might need deeper merging.
+		dynamicNode.Count += child.Count
 	}
-
-	return dynamicNode
+	node.Children = map[string]*TrieNode{DynamicIdentifier: dynamicNode}
 }
 
-func (ua *PathAnalyzer) handleWildcardSegment(node *SegmentNode) *SegmentNode {
-	if wildcardChild, exists := node.Children["*"]; exists {
-		return wildcardChild
-	} else {
-		return ua.createWildcardNode(node)
-	}
-}
-
-func (ua *PathAnalyzer) createWildcardNode(node *SegmentNode) *SegmentNode {
-	wildcardNode := &SegmentNode{
-		SegmentName: "*",
-		Count:       0, // for wildcards its not relevant how many counts it has, it collapes neighbors
-		Children:    make(map[string]*SegmentNode),
-	}
-
-	// This function is called when a ⋯/⋯ structure is detected.
-	// We copy the children of the second '⋯' (the grandchildren) to the new '*' node.
-	ua.copyGrandchildren(node, wildcardNode)
-
-	// Surgically replace the first dynamic node with the new wildcard node,
-	// leaving other children of the parent node intact.
-	delete(node.Children, DynamicIdentifier)
-	node.Children["*"] = wildcardNode
-
-	return wildcardNode
-}
-
-// copyGrandchildren finds the child and grandchild dynamic nodes and copies the grandchild's children to the destination node.
-func (ua *PathAnalyzer) copyGrandchildren(src, dst *SegmentNode) {
-	if child, exists := src.Children[DynamicIdentifier]; exists {
-		if grandchild, exists := child.Children[DynamicIdentifier]; exists {
-			shallowChildrenCopy(grandchild, dst)
-		}
+func (pm *PathAnalyzer) createWildcardNode(node *TrieNode) {
+	wildcardNode := NewTrieNode()
+	for _, child := range node.Children {
+		wildcardNode.Count += child.Count
 	}
+	node.Children = map[string]*TrieNode{WildcardIdentifier: wildcardNode}
 }
 
-func (ua *PathAnalyzer) updateNodeStats(node *SegmentNode, config *CollapseConfig) {
-	switch {
-	case node.Count > config.Threshold && !node.IsNextDynamic():
-		dynamicChild := &SegmentNode{
-			SegmentName: DynamicIdentifier,
-			Count:       0,
-			Children:    make(map[string]*SegmentNode),
-		}
-
-		// Copy all descendants
-		for _, child := range node.Children {
-			shallowChildrenCopy(child, dynamicChild)
-		}
-
-		node.Children = map[string]*SegmentNode{
-			DynamicIdentifier: dynamicChild,
-		}
+func (pm *PathAnalyzer) FindConfigForPath(path string) *CollapseConfig {
+	node := pm.root
+	var lastFoundConfig *CollapseConfig
+	if node.Config != nil {
+		lastFoundConfig = node.Config
 	}
-}
 
-func shallowChildrenCopy(src, dst *SegmentNode) {
-	for segmentName := range src.Children {
-		if _, ok := dst.Children[segmentName]; !ok {
-			dst.Children[segmentName] = src.Children[segmentName]
-		} else {
-			dst.Children[segmentName].Count += src.Children[segmentName].Count
-			shallowChildrenCopy(src.Children[segmentName], dst.Children[segmentName])
-		}
+	segments := strings.Split(strings.Trim(path, "/"), "/")
+	if segments[0] == "" {
+		return lastFoundConfig
 	}
-}
 
-// so in this masterful logic: we have 3 types of nodes:  the regular ,the ellipsis and the wildcard
-// if the path analyser is above the threshold it creates the ellipsis
-// if two ellipsis are adjacent it creates the asterix (and currently messes up the node tree)
-func CollapseAdjacentDynamicIdentifiers(p string) string {
-	segments := strings.Split(p, "/")
-	var result []string
-	inDynamicSequence := false
-
-	for i := 0; i < len(segments); i++ {
-		isDynamic := segments[i] == DynamicIdentifier
-
-		if isDynamic && !inDynamicSequence {
-			// Check if this starts a sequence of at least two dynamic identifiers ## TODO: @constanze check if we ever have two asterix adjacent
-			isSequence := false
-			for j := i + 1; j < len(segments); j++ {
-				if segments[j] == DynamicIdentifier {
-					isSequence = true
-					break
-				}
-			}
-
-			if isSequence {
-				inDynamicSequence = true
-				result = append(result, "*")
-			} else {
-				result = append(result, segments[i])
+	for _, segment := range segments {
+		if nextNode, ok := node.Children[segment]; ok {
+			node = nextNode
+			if node.Config != nil {
+				lastFoundConfig = node.Config
 			}
-		} else if isDynamic && inDynamicSequence {
-			// Continue sequence, do nothing as '*' is already added
-			continue
 		} else {
-			inDynamicSequence = false
-			result = append(result, segments[i])
+			break
 		}
 	}
-	return strings.Join(result, "/")
+	return lastFoundConfig
 }
 
-func CompareDynamic(dynamicPath, regularPath string) bool {
-	dynamicSegments := strings.Split(dynamicPath, "/")
-	regularSegments := strings.Split(regularPath, "/")
-
-	return compareSegments(dynamicSegments, regularSegments)
+func (pm *PathAnalyzer) GetStoredPaths() []string {
+	var storedPaths []string
+	pm.collectPaths(pm.root, "", &storedPaths)
+	return storedPaths
 }
 
-func compareSegments(dynamic, regular []string) bool {
-	if len(dynamic) == 0 {
-		return len(regular) == 0
-	}
-
-	if dynamic[0] == "*" {
-		if len(dynamic) == 1 {
-			return true
+// collectPaths is a recursive helper to traverse the tree and build path strings.
+func (pm *PathAnalyzer) collectPaths(node *TrieNode, currentPath string, paths *[]string) {
+	// If it's a leaf node, we've found a full path.
+	if len(node.Children) == 0 {
+		if currentPath != "" {
+			*paths = append(*paths, currentPath)
 		}
-		nextDynamic := dynamic[1]
-		for i := range regular {
-
-			match := nextDynamic == DynamicIdentifier || (i < len(regular) && regular[i] == nextDynamic)
-
-			if match && compareSegments(dynamic[1:], regular[i:]) {
-				return true
-			}
-		}
-		return false
-	}
-
-	if len(regular) == 0 {
-		return false
+		return
 	}
 
-	if dynamic[0] == DynamicIdentifier || dynamic[0] == regular[0] {
-		return compareSegments(dynamic[1:], regular[1:])
+	// Otherwise, continue traversing for each child.
+	for segment, child := range node.Children {
+		newPath := currentPath + "/" + segment
+		pm.collectPaths(child, newPath, paths)
 	}
-
-	return false
 }
diff --git a/pkg/registry/file/dynamicpathdetector/tests/analyze_opens_test.go b/pkg/registry/file/dynamicpathdetector/tests/analyze_opens_test.go
index 83c4f2c7c..1e6621fcd 100644
--- a/pkg/registry/file/dynamicpathdetector/tests/analyze_opens_test.go
+++ b/pkg/registry/file/dynamicpathdetector/tests/analyze_opens_test.go
@@ -32,34 +32,6 @@ func TestAnalyzeOpensWithThreshold(t *testing.T) {
 	assert.Equal(t, expected, result)
 }
 
-// func TestAnalyzeOpensWithThresholdAndExclusion(t *testing.T) {
-// 	analyzer := dynamicpathdetector.NewPathAnalyzer(100)
-
-// 	var input []types.OpenCalls
-// 	for i := 0; i < 101; i++ {
-// 		input = append(input, types.OpenCalls{
-// 			Path:  fmt.Sprintf("/home/user%d/file.txt", i),
-// 			Flags: []string{"READ"},
-// 		})
-// 	}
-
-// 	//interesting: @constanze: why should it preserve the 42?
-// 	expected := []types.OpenCalls{
-// 		{
-// 			Path:  "/home/user42/file.txt",
-// 			Flags: []string{"READ"},
-// 		},
-// 		{
-// 			Path:  "/home/\u22ef/file.txt",
-// 			Flags: []string{"READ"},
-// 		},
-// 	}
-
-// 	result, err := dynamicpathdetector.AnalyzeOpens(input, analyzer, mapset.NewSet[string]("/home/user42/file.txt"))
-// 	assert.NoError(t, err)
-// 	assert.Equal(t, expected, result)
-// }
-
 func TestAnalyzeOpensWithFlagMergingAndThreshold(t *testing.T) {
 	tests := []struct {
 		name     string
@@ -141,7 +113,7 @@ func TestAnalyzeOpensWithFlagMergingAndThreshold(t *testing.T) {
 }
 
 func TestAnalyzeOpensWithAsteriskAndEllipsis(t *testing.T) {
-	analyzer := dynamicpathdetector.NewPathAnalyzer(3) // Threshold of 3
+	analyzer := dynamicpathdetector.NewPathAnalyzer(3) // Threshold of 3 OLD BEHAVIOR
 
 	input := []types.OpenCalls{
 		// These should collapse into /home/…/file.txt
@@ -191,13 +163,13 @@ func TestAnalyzeOpensWithMultiCollapse(t *testing.T) {
 
 	input := []types.OpenCalls{
 		// These should collapse into /home/*/file.txt  and that may not be great, but lets first check if it actually does it
-		{Path: "/home/user1/txt/file.txt", Flags: []string{"READ"}},
-		{Path: "/home/user2/txt/file.txt", Flags: []string{"READ"}},
-		{Path: "/home/user3/txt/file.txt", Flags: []string{"READ"}},
-		{Path: "/home/user4/brr/file.txt", Flags: []string{"READ"}},
-		{Path: "/home/user1/brr/file.txt", Flags: []string{"READ"}},
-		{Path: "/home/user2/brr/file.txt", Flags: []string{"READ"}},
-		{Path: "/home/user3/brr/file.txt", Flags: []string{"READ"}},
+		{Path: "/var/run/txt/file.txt", Flags: []string{"READ"}},
+		{Path: "/var/run/txt/file.txt", Flags: []string{"READ"}},
+		{Path: "/var/run/txt/file.txt", Flags: []string{"READ"}},
+		{Path: "/var/run/brr/file.txt", Flags: []string{"READ"}},
+		{Path: "/var/run/brr/file.txt", Flags: []string{"READ"}},
+		{Path: "/var/run/brr/file.txt", Flags: []string{"READ"}},
+		{Path: "/var/run/brr/file.txt", Flags: []string{"READ"}},
 	}
 
 	expected := []types.OpenCalls{
@@ -212,7 +184,28 @@ func TestAnalyzeOpensWithMultiCollapse(t *testing.T) {
 
 func TestAnalyzeOpensWithDynamicConfigs(t *testing.T) {
 	// Default threshold is 10, used for paths like /tmp
-	analyzer := dynamicpathdetector.NewPathAnalyzer(10)
+	analyzer := dynamicpathdetector.NewPathAnalyzerWithConfigs([]dynamicpathdetector.CollapseConfig{
+		{
+			Prefix:    "/etc",
+			Threshold: 50,
+		},
+		{
+			Prefix:    "/opt",
+			Threshold: 5,
+		},
+		{
+			Prefix:    "/var/run",
+			Threshold: 3,
+		},
+		{
+			Prefix:    "/app",
+			Threshold: 1,
+		},
+		{
+			Prefix:    "/tmp",
+			Threshold: 10,
+		},
+	})
 
 	// The paths to be added, exercising different collapse configurations.
 	pathsToAdd := []string{
diff --git a/pkg/registry/file/dynamicpathdetector/types.go b/pkg/registry/file/dynamicpathdetector/types.go
index 258a37312..2bb26643c 100644
--- a/pkg/registry/file/dynamicpathdetector/types.go
+++ b/pkg/registry/file/dynamicpathdetector/types.go
@@ -15,10 +15,25 @@ type SegmentNode struct {
 }
 
 type PathAnalyzer struct {
-	RootNodes             map[string]*SegmentNode
-	threshold             int // Default threshold
-	DefaultCollapseConfig *CollapseConfig
-	configRoot            *SegmentNode // Trie for storing CollapseConfigs
+	root *TrieNode
+}
+
+//	type PathAnalyzer struct {
+//		RootNodes             map[string]*SegmentNode
+//		threshold             int // Default threshold
+//		DefaultCollapseConfig *CollapseConfig
+//		configRoot            *SegmentNode // Trie for storing CollapseConfigs
+//	}
+func NewTrieNode() *TrieNode {
+	return &TrieNode{
+		Children: make(map[string]*TrieNode),
+	}
+}
+
+type TrieNode struct {
+	Children map[string]*TrieNode
+	Config   *CollapseConfig // Configuration that applies from this node downwards
+	Count    int             // Number of paths passing through this node
 }
 
 func (sn *SegmentNode) IsNextDynamic() bool {

From 6ce7931510fb8cfeeace71db5f5041b5e29f2b2c Mon Sep 17 00:00:00 2001
From: entlein <einentlein@gmail.com>
Date: Tue, 10 Feb 2026 19:11:01 +0100
Subject: [PATCH 28/68] aligning the tests

Signed-off-by: entlein <einentlein@gmail.com>
---
 .../dynamicpathdetector/analyze_endpoints.go  |   2 +-
 .../file/dynamicpathdetector/analyzer.go      |  52 +++++++
 .../tests/coverage_test.go                    | 140 ++++--------------
 .../file/dynamicpathdetector/types.go         |   6 -
 4 files changed, 81 insertions(+), 119 deletions(-)

diff --git a/pkg/registry/file/dynamicpathdetector/analyze_endpoints.go b/pkg/registry/file/dynamicpathdetector/analyze_endpoints.go
index cba249120..0565169de 100644
--- a/pkg/registry/file/dynamicpathdetector/analyze_endpoints.go
+++ b/pkg/registry/file/dynamicpathdetector/analyze_endpoints.go
@@ -92,7 +92,7 @@ func AnalyzeURL(urlString string, analyzer *PathAnalyzer) (string, error) {
 	port = parsedURL.Port()
 
 	// If a wildcard port tree already exists, use it
-	if _, hasWildcard := analyzer.RootNodes[DynamicIdentifier]; hasWildcard {
+	if _, hasWildcard := analyzer.root.Children[DynamicIdentifier]; hasWildcard {
 		port = DynamicIdentifier
 	}
 
diff --git a/pkg/registry/file/dynamicpathdetector/analyzer.go b/pkg/registry/file/dynamicpathdetector/analyzer.go
index 105135a84..d1a5f0da5 100644
--- a/pkg/registry/file/dynamicpathdetector/analyzer.go
+++ b/pkg/registry/file/dynamicpathdetector/analyzer.go
@@ -224,3 +224,55 @@ func (pm *PathAnalyzer) collectPaths(node *TrieNode, currentPath string, paths *
 		pm.collectPaths(child, newPath, paths)
 	}
 }
+
+func (pm *PathAnalyzer) AnalyzePath(path string, identifier string) (string, error) {
+	// Clean the path
+	path = strings.Trim(path, "/")
+	if path == "" {
+		return "/", nil
+	}
+
+	segments := strings.Split(path, "/")
+	if len(segments) == 0 {
+		return "/", nil
+	}
+
+	// Traverse the trie to find the correct node
+	node := pm.root
+	var pathSegments []string
+
+	for _, segment := range segments {
+		if nextNode, ok := node.Children[WildcardIdentifier]; ok {
+			node = nextNode
+			pathSegments = append(pathSegments, WildcardIdentifier)
+			break // Wildcard consumes the rest
+		}
+
+		if nextNode, ok := node.Children[DynamicIdentifier]; ok {
+			node = nextNode
+			pathSegments = append(pathSegments, DynamicIdentifier)
+		} else if nextNode, ok := node.Children[segment]; ok {
+			node = nextNode
+			pathSegments = append(pathSegments, segment)
+		} else {
+			// Path not found, return original
+			pathSegments = append(pathSegments, segment)
+		}
+	}
+
+	finalPath := "/" + strings.Join(pathSegments, "/")
+	return CollapseAdjacentDynamicIdentifiers(finalPath), nil
+}
+
+// CollapseAdjacentDynamicIdentifiers replaces consecutive dynamic identifiers with a single wildcard.
+func CollapseAdjacentDynamicIdentifiers(path string) string {
+	// This pattern identifies two or more consecutive dynamic identifiers
+	pattern := DynamicIdentifier + "/" + DynamicIdentifier
+	wildcardPattern := WildcardIdentifier
+
+	// Keep replacing until no more consecutive dynamic identifiers are found
+	for strings.Contains(path, pattern) {
+		path = strings.Replace(path, pattern, wildcardPattern, -1)
+	}
+	return path
+}
diff --git a/pkg/registry/file/dynamicpathdetector/tests/coverage_test.go b/pkg/registry/file/dynamicpathdetector/tests/coverage_test.go
index 24b24fcc3..e080380e2 100644
--- a/pkg/registry/file/dynamicpathdetector/tests/coverage_test.go
+++ b/pkg/registry/file/dynamicpathdetector/tests/coverage_test.go
@@ -195,121 +195,37 @@ func TestDynamicInsertion(t *testing.T) {
 	assert.Equal(t, expected, result)
 }
 
-func TestCompareDynamic(t *testing.T) {
-	tests := []struct {
-		name        string
-		dynamicPath string
-		regularPath string
-		want        bool
-	}{
-		{
-			name:        "Equal paths",
-			dynamicPath: "/api/users/123",
-			regularPath: "/api/users/123",
-			want:        true,
-		},
-		{
-			name:        "Different paths",
-			dynamicPath: "/api/users/123",
-			regularPath: "/api/users/456",
-			want:        false,
-		},
-		{
-			name:        "Dynamic segment at the end",
-			dynamicPath: "/api/users/\u22ef",
-			regularPath: "/api/users/123",
-			want:        true,
-		},
-		{
-			name:        "Dynamic segment at the end",
-			dynamicPath: "/api/users/\u22ef",
-			regularPath: "/api/users/123/posts",
-			want:        false,
-		},
-		{
-			name:        "Dynamic segment at the end, no match",
-			dynamicPath: "/api/users/\u22ef",
-			regularPath: "/api/apps/123",
-			want:        false,
-		},
-		{
-			name:        "Dynamic segment in the middle",
-			dynamicPath: "/api/\u22ef/123",
-			regularPath: "/api/users/123",
-			want:        true,
-		},
-		{
-			name:        "Dynamic segment in the middle, no match",
-			dynamicPath: "/api/\u22ef/123",
-			regularPath: "/api/users/456",
-			want:        false,
-		},
-		{
-			name:        "2 dynamic segments",
-			dynamicPath: "/api/\u22ef/\u22ef",
-			regularPath: "/api/users/123",
-			want:        true,
-		},
-		{
-			name:        "2 dynamic segments, no match",
-			dynamicPath: "/api/\u22ef/\u22ef",
-			regularPath: "/papi/users/456",
-			want:        false,
-		},
-		{
-			name:        "2 other dynamic segments",
-			dynamicPath: "/\u22ef/users/\u22ef",
-			regularPath: "/api/users/123",
-			want:        true,
-		},
-		{
-			name:        "2 other dynamic segments, no match",
-			dynamicPath: "/\u22ef/users/\u22ef",
-			regularPath: "/api/apps/456",
-			want:        false,
-		},
-		{
-			name:        "Asterisk wildcard matches everything",
-			dynamicPath: "*",
-			regularPath: "/anything/goes/here",
-			want:        true,
-		},
-		{
-			name:        "Asterisk wildcard for multiple segments",
-			dynamicPath: "/api/*/123",
-			regularPath: "/api/users/some/other/segment/123",
-			want:        true,
-		},
-		{
-			name:        "Asterisk wildcard at the end",
-			dynamicPath: "/api/users/*",
-			regularPath: "/api/users/123/posts/456",
-			want:        true,
-		},
-		{
-			name:        "Asterisk wildcard no match",
-			dynamicPath: "/api/*/123",
-			regularPath: "/api/users/456",
-			want:        false,
-		},
+func TestDynamic(t *testing.T) {
+	analyzer := dynamicpathdetector.NewPathAnalyzer(100)
+	for i := 0; i < 101; i++ {
+		path := fmt.Sprintf("/api/users/%d", i)
+		_, err := analyzer.AnalyzePath(path, "api")
+		assert.NoError(t, err)
+	}
+	result, err := analyzer.AnalyzePath("/api/users/101", "api")
+	assert.NoError(t, err)
+	expected := "/api/users/\u22ef"
+	assert.Equal(t, expected, result)
+}
+
+func TestCollapseConfig(t *testing.T) {
+	analyzer := dynamicpathdetector.NewPathAnalyzerWithConfigs([]dynamicpathdetector.CollapseConfig{
 		{
-			name:        "Combination of asterisk and ellipsis",
-			dynamicPath: "/api/*/posts/\u22ef",
-			regularPath: "/api/users/123/posts/456",
-			want:        true,
+			Prefix:    "/api",
+			Threshold: 1,
 		},
 		{
-			name:        "Combination of asterisk and ellipsis no match",
-			dynamicPath: "/api/*/posts/\u22ef",
-			regularPath: "/api/users/123/posts/456/comments",
-			want:        false,
+			Prefix:    "/169.254.169.254", // todo test this as well
+			Threshold: 50,
 		},
+	})
+	for i := 0; i < 2; i++ {
+		path := fmt.Sprintf("/api/users/%d", i)
+		_, err := analyzer.AnalyzePath(path, "api")
+		assert.NoError(t, err)
 	}
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			if got := dynamicpathdetector.CompareDynamic(tt.dynamicPath, tt.regularPath); got != tt.want {
-				t.Errorf("CompareDynamic() = %v, want %v", got, tt.want)
-			}
-		})
-	}
+	result, err := analyzer.AnalyzePath("/api/users/101", "api")
+	assert.NoError(t, err)
+	expected := "/api/*"
+	assert.Equal(t, expected, result)
 }
diff --git a/pkg/registry/file/dynamicpathdetector/types.go b/pkg/registry/file/dynamicpathdetector/types.go
index 2bb26643c..f3fff8635 100644
--- a/pkg/registry/file/dynamicpathdetector/types.go
+++ b/pkg/registry/file/dynamicpathdetector/types.go
@@ -18,12 +18,6 @@ type PathAnalyzer struct {
 	root *TrieNode
 }
 
-//	type PathAnalyzer struct {
-//		RootNodes             map[string]*SegmentNode
-//		threshold             int // Default threshold
-//		DefaultCollapseConfig *CollapseConfig
-//		configRoot            *SegmentNode // Trie for storing CollapseConfigs
-//	}
 func NewTrieNode() *TrieNode {
 	return &TrieNode{
 		Children: make(map[string]*TrieNode),

From 3bf8c83f4dcb703d786d34904afbf7e031fa47ca Mon Sep 17 00:00:00 2001
From: entlein <einentlein@gmail.com>
Date: Tue, 10 Feb 2026 19:14:27 +0100
Subject: [PATCH 29/68] TODO write new benchmark test for the configs

Signed-off-by: entlein <einentlein@gmail.com>
---
 .../dynamicpathdetector/tests/benchmark_test.go  | 16 ++++++++--------
 1 file changed, 8 insertions(+), 8 deletions(-)

diff --git a/pkg/registry/file/dynamicpathdetector/tests/benchmark_test.go b/pkg/registry/file/dynamicpathdetector/tests/benchmark_test.go
index 4ca01af42..831aa3f51 100644
--- a/pkg/registry/file/dynamicpathdetector/tests/benchmark_test.go
+++ b/pkg/registry/file/dynamicpathdetector/tests/benchmark_test.go
@@ -72,14 +72,14 @@ func BenchmarkAnalyzeOpensVsDeflateStringer(b *testing.B) {
 	})
 }
 
-func BenchmarkCompareDynamic(b *testing.B) {
-	dynamicPath := "/api/\u22ef/\u22ef"
-	regularPath := "/api/users/123"
-	for i := 0; i < b.N; i++ {
-		_ = dynamicpathdetector.CompareDynamic(dynamicPath, regularPath)
-	}
-	b.ReportAllocs()
-}
+// func BenchmarkCompareDynamic(b *testing.B) {
+// 	dynamicPath := "/api/\u22ef/\u22ef"
+// 	regularPath := "/api/users/123"
+// 	for i := 0; i < b.N; i++ {
+// 		_ = dynamicpathdetector.CompareDynamic(dynamicPath, regularPath)
+// 	}
+// 	b.ReportAllocs()
+// }
 
 func generateMixedPaths(count int, fixedLength int) []string {
 	paths := make([]string, count)

From 710a7921294c222161870537e1e73c829f1dc44b Mon Sep 17 00:00:00 2001
From: entlein <einentlein@gmail.com>
Date: Tue, 10 Feb 2026 19:48:13 +0100
Subject: [PATCH 30/68] for endpoints the path collapse, collapsed too much

Signed-off-by: entlein <einentlein@gmail.com>
---
 pkg/registry/file/dynamicpathdetector/analyze_endpoints.go | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/pkg/registry/file/dynamicpathdetector/analyze_endpoints.go b/pkg/registry/file/dynamicpathdetector/analyze_endpoints.go
index 0565169de..57a092c1b 100644
--- a/pkg/registry/file/dynamicpathdetector/analyze_endpoints.go
+++ b/pkg/registry/file/dynamicpathdetector/analyze_endpoints.go
@@ -17,7 +17,8 @@ func AnalyzeEndpoints(endpoints *[]types.HTTPEndpoint, analyzer *PathAnalyzer) [
 
 	var newEndpoints []*types.HTTPEndpoint
 	for _, endpoint := range *endpoints {
-		_, _ = AnalyzeURL(endpoint.Endpoint, analyzer)
+		_, pathPart := splitEndpointPortAndPath(endpoint.Endpoint)
+		analyzer.AddPath(pathPart)
 	}
 
 	for _, endpoint := range *endpoints {

From f59b37a65989d81e3a8023fd476fb341e836c9f8 Mon Sep 17 00:00:00 2001
From: entlein <einentlein@gmail.com>
Date: Tue, 10 Feb 2026 21:05:55 +0100
Subject: [PATCH 31/68] for endpoints, we cant use the ellpisis for ports, we
 use 0

Signed-off-by: entlein <einentlein@gmail.com>
---
 .../dynamicpathdetector/analyze_endpoints.go  | 57 ++++++++-----------
 .../tests/analyze_endpoints_test.go           | 23 ++++++++
 2 files changed, 46 insertions(+), 34 deletions(-)

diff --git a/pkg/registry/file/dynamicpathdetector/analyze_endpoints.go b/pkg/registry/file/dynamicpathdetector/analyze_endpoints.go
index 57a092c1b..1d2ffb6f1 100644
--- a/pkg/registry/file/dynamicpathdetector/analyze_endpoints.go
+++ b/pkg/registry/file/dynamicpathdetector/analyze_endpoints.go
@@ -17,8 +17,7 @@ func AnalyzeEndpoints(endpoints *[]types.HTTPEndpoint, analyzer *PathAnalyzer) [
 
 	var newEndpoints []*types.HTTPEndpoint
 	for _, endpoint := range *endpoints {
-		_, pathPart := splitEndpointPortAndPath(endpoint.Endpoint)
-		analyzer.AddPath(pathPart)
+		_, _ = AnalyzeURL(endpoint.Endpoint, analyzer)
 	}
 
 	for _, endpoint := range *endpoints {
@@ -67,16 +66,6 @@ func ProcessEndpoint(endpoint *types.HTTPEndpoint, analyzer *PathAnalyzer, newEn
 }
 
 func AnalyzeURL(urlString string, analyzer *PathAnalyzer) (string, error) {
-	// Handle wildcard port in input (can't be parsed by url.Parse)
-	port, pathPart := splitEndpointPortAndPath(urlString)
-	if port == DynamicIdentifier {
-		analyzedPath, _ := analyzer.AnalyzePath(pathPart, DynamicIdentifier)
-		if analyzedPath == "/." {
-			analyzedPath = "/"
-		}
-		return ":" + DynamicIdentifier + analyzedPath, nil
-	}
-
 	if !strings.HasPrefix(urlString, "http://") && !strings.HasPrefix(urlString, "https://") {
 		urlString = "http://" + urlString
 	}
@@ -90,12 +79,7 @@ func AnalyzeURL(urlString string, analyzer *PathAnalyzer) (string, error) {
 		return "", err
 	}
 
-	port = parsedURL.Port()
-
-	// If a wildcard port tree already exists, use it
-	if _, hasWildcard := analyzer.root.Children[DynamicIdentifier]; hasWildcard {
-		port = DynamicIdentifier
-	}
+	port := parsedURL.Port()
 
 	path, _ := analyzer.AnalyzePath(parsedURL.Path, port)
 	if path == "/." {
@@ -113,27 +97,36 @@ func splitEndpointPortAndPath(endpoint string) (string, string) {
 	return s[:idx], s[idx:]
 }
 
+func getEndpointKey(endpoint *types.HTTPEndpoint) string {
+	port, pathPart := splitEndpointPortAndPath(endpoint.Endpoint)
+	return fmt.Sprintf(":%s%s|%s", port, pathPart, endpoint.Direction)
+}
+
 func MergeDuplicateEndpoints(endpoints []*types.HTTPEndpoint) []*types.HTTPEndpoint {
 	seen := make(map[string]*types.HTTPEndpoint)
 	var newEndpoints []*types.HTTPEndpoint
+
 	for _, endpoint := range endpoints {
-		key := getEndpointKey(endpoint)
+		var key, wildcardKey string
+		port, pathPart := splitEndpointPortAndPath(endpoint.Endpoint)
+		wildcardKey = fmt.Sprintf(":%s%s|%s", "0", pathPart, endpoint.Direction)
 
-		if existing, found := seen[key]; found {
+		//  Check if a wildcard version (:0) of this endpoint already exists.
+		if existing, found := seen[wildcardKey]; found {
+			if existing.Endpoint == endpoint.Endpoint {
+				continue
+			}
 			existing.Methods = MergeStrings(existing.Methods, endpoint.Methods)
 			mergeHeaders(existing, endpoint)
 			continue
 		}
 
-		// Check if a wildcard port variant already exists
-		port, pathPart := splitEndpointPortAndPath(endpoint.Endpoint)
-		if port != DynamicIdentifier {
-			wildcardKey := fmt.Sprintf(":%s%s|%s", DynamicIdentifier, pathPart, endpoint.Direction)
-			if existing, found := seen[wildcardKey]; found {
-				existing.Methods = MergeStrings(existing.Methods, endpoint.Methods)
-				mergeHeaders(existing, endpoint)
-				continue
-			}
+		// Check if an endpoint with the exact same port and path exists.
+		key = fmt.Sprintf(":%s%s|%s", port, pathPart, endpoint.Direction)
+		if existing, found := seen[key]; found {
+			existing.Methods = MergeStrings(existing.Methods, endpoint.Methods)
+			mergeHeaders(existing, endpoint)
+			continue
 		}
 
 		seen[key] = endpoint
@@ -143,12 +136,8 @@ func MergeDuplicateEndpoints(endpoints []*types.HTTPEndpoint) []*types.HTTPEndpo
 	return newEndpoints
 }
 
-func getEndpointKey(endpoint *types.HTTPEndpoint) string {
-	return fmt.Sprintf("%s|%s", endpoint.Endpoint, endpoint.Direction)
-}
-
 func mergeHeaders(existing, new *types.HTTPEndpoint) {
-	// TODO: Find a better way to unmashal the headers
+	// TODO: Find a better way to unmarshal the headers
 	existingHeaders, err := existing.GetHeaders()
 	if err != nil {
 		return
diff --git a/pkg/registry/file/dynamicpathdetector/tests/analyze_endpoints_test.go b/pkg/registry/file/dynamicpathdetector/tests/analyze_endpoints_test.go
index dd6382177..fa60b8d30 100644
--- a/pkg/registry/file/dynamicpathdetector/tests/analyze_endpoints_test.go
+++ b/pkg/registry/file/dynamicpathdetector/tests/analyze_endpoints_test.go
@@ -72,6 +72,29 @@ func TestAnalyzeEndpoints(t *testing.T) {
 				},
 			},
 		},
+		{
+			name: "Test with 0 port",
+			input: []types.HTTPEndpoint{
+				{
+					Endpoint: ":0/users/123/posts/\u22ef",
+					Methods:  []string{"GET"},
+				},
+				{
+					Endpoint: ":80/users/\u22ef/posts/101",
+					Methods:  []string{"POST"},
+				},
+				{
+					Endpoint: ":8770/users/blub/posts/101",
+					Methods:  []string{"POST"},
+				},
+			},
+			expected: []types.HTTPEndpoint{
+				{
+					Endpoint: ":0/users/\u22ef/posts/\u22ef",
+					Methods:  []string{"GET", "POST"},
+				},
+			},
+		},
 		{
 			name: "Test with different domains",
 			input: []types.HTTPEndpoint{

From f952518daf1b9e28f1330a50c997a9c8d83a7ddf Mon Sep 17 00:00:00 2001
From: entlein <einentlein@gmail.com>
Date: Tue, 10 Feb 2026 21:23:00 +0100
Subject: [PATCH 32/68] if the bug is in analyse_endpoint then this should undo
 it

Signed-off-by: entlein <einentlein@gmail.com>
---
 pkg/registry/file/dynamicpathdetector/analyze_endpoints.go | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/pkg/registry/file/dynamicpathdetector/analyze_endpoints.go b/pkg/registry/file/dynamicpathdetector/analyze_endpoints.go
index 1d2ffb6f1..777d65c77 100644
--- a/pkg/registry/file/dynamicpathdetector/analyze_endpoints.go
+++ b/pkg/registry/file/dynamicpathdetector/analyze_endpoints.go
@@ -110,7 +110,8 @@ func MergeDuplicateEndpoints(endpoints []*types.HTTPEndpoint) []*types.HTTPEndpo
 		var key, wildcardKey string
 		port, pathPart := splitEndpointPortAndPath(endpoint.Endpoint)
 		wildcardKey = fmt.Sprintf(":%s%s|%s", "0", pathPart, endpoint.Direction)
-
+		//debug only -- why are the METHODS collapsing
+		wildcardKey = fmt.Sprintf(":%s%s|%s", port, pathPart, endpoint.Direction)
 		//  Check if a wildcard version (:0) of this endpoint already exists.
 		if existing, found := seen[wildcardKey]; found {
 			if existing.Endpoint == endpoint.Endpoint {

From b075b75c6c561247c05edf4568ea263bd73fd85c Mon Sep 17 00:00:00 2001
From: entlein <einentlein@gmail.com>
Date: Tue, 10 Feb 2026 21:26:00 +0100
Subject: [PATCH 33/68] if the bug is in analyse_endpoint then this should undo
 it

Signed-off-by: entlein <einentlein@gmail.com>
---
 pkg/registry/file/dynamicpathdetector/analyze_endpoints.go    | 4 ++--
 .../file/dynamicpathdetector/tests/analyze_endpoints_test.go  | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkg/registry/file/dynamicpathdetector/analyze_endpoints.go b/pkg/registry/file/dynamicpathdetector/analyze_endpoints.go
index 777d65c77..6047c8225 100644
--- a/pkg/registry/file/dynamicpathdetector/analyze_endpoints.go
+++ b/pkg/registry/file/dynamicpathdetector/analyze_endpoints.go
@@ -110,8 +110,8 @@ func MergeDuplicateEndpoints(endpoints []*types.HTTPEndpoint) []*types.HTTPEndpo
 		var key, wildcardKey string
 		port, pathPart := splitEndpointPortAndPath(endpoint.Endpoint)
 		wildcardKey = fmt.Sprintf(":%s%s|%s", "0", pathPart, endpoint.Direction)
-		//debug only -- why are the METHODS collapsing
-		wildcardKey = fmt.Sprintf(":%s%s|%s", port, pathPart, endpoint.Direction)
+		//debug only -- why are the METHODS collapsing NOPE THIS DOESNT UNDO IT
+		//wildcardKey = fmt.Sprintf(":%s%s|%s", port, pathPart, endpoint.Direction)
 		//  Check if a wildcard version (:0) of this endpoint already exists.
 		if existing, found := seen[wildcardKey]; found {
 			if existing.Endpoint == endpoint.Endpoint {
diff --git a/pkg/registry/file/dynamicpathdetector/tests/analyze_endpoints_test.go b/pkg/registry/file/dynamicpathdetector/tests/analyze_endpoints_test.go
index fa60b8d30..fbe0859ca 100644
--- a/pkg/registry/file/dynamicpathdetector/tests/analyze_endpoints_test.go
+++ b/pkg/registry/file/dynamicpathdetector/tests/analyze_endpoints_test.go
@@ -38,7 +38,7 @@ func TestAnalyzeEndpoints(t *testing.T) {
 			name: "Test with multiple endpoints",
 			input: []types.HTTPEndpoint{
 				{
-					Endpoint: ":80/users/\u22ef",
+					Endpoint: ":80/users/123", //debug : is it the ellipsis character
 					Methods:  []string{"GET"},
 				},
 				{

From 9183bad3eb4fc47ff7653d354bbee35ce9a5aeed Mon Sep 17 00:00:00 2001
From: entlein <einentlein@gmail.com>
Date: Tue, 10 Feb 2026 21:26:21 +0100
Subject: [PATCH 34/68] if the bug is in analyse_endpoint then this should undo
 it

Signed-off-by: entlein <einentlein@gmail.com>
---
 .../file/dynamicpathdetector/tests/analyze_endpoints_test.go    | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkg/registry/file/dynamicpathdetector/tests/analyze_endpoints_test.go b/pkg/registry/file/dynamicpathdetector/tests/analyze_endpoints_test.go
index fbe0859ca..8e3d3fa64 100644
--- a/pkg/registry/file/dynamicpathdetector/tests/analyze_endpoints_test.go
+++ b/pkg/registry/file/dynamicpathdetector/tests/analyze_endpoints_test.go
@@ -48,7 +48,7 @@ func TestAnalyzeEndpoints(t *testing.T) {
 			},
 			expected: []types.HTTPEndpoint{
 				{
-					Endpoint: ":80/users/\u22ef",
+					Endpoint: ":80/users/123",
 					Methods:  []string{"GET", "POST"},
 				},
 			},

From 42eec3707245a75283762beb1342c751f0dd1b55 Mon Sep 17 00:00:00 2001
From: entlein <einentlein@gmail.com>
Date: Tue, 10 Feb 2026 21:42:15 +0100
Subject: [PATCH 35/68] it was the ellipsis char that is missing

Signed-off-by: entlein <einentlein@gmail.com>
---
 pkg/registry/file/dynamicpathdetector/analyzer.go            | 5 +++++
 .../file/dynamicpathdetector/tests/analyze_endpoints_test.go | 4 ++--
 2 files changed, 7 insertions(+), 2 deletions(-)

diff --git a/pkg/registry/file/dynamicpathdetector/analyzer.go b/pkg/registry/file/dynamicpathdetector/analyzer.go
index d1a5f0da5..ff1da01c3 100644
--- a/pkg/registry/file/dynamicpathdetector/analyzer.go
+++ b/pkg/registry/file/dynamicpathdetector/analyzer.go
@@ -242,6 +242,11 @@ func (pm *PathAnalyzer) AnalyzePath(path string, identifier string) (string, err
 	var pathSegments []string
 
 	for _, segment := range segments {
+		if segment == DynamicIdentifier {
+			pathSegments = append(pathSegments, DynamicIdentifier)
+			continue
+		}
+
 		if nextNode, ok := node.Children[WildcardIdentifier]; ok {
 			node = nextNode
 			pathSegments = append(pathSegments, WildcardIdentifier)
diff --git a/pkg/registry/file/dynamicpathdetector/tests/analyze_endpoints_test.go b/pkg/registry/file/dynamicpathdetector/tests/analyze_endpoints_test.go
index 8e3d3fa64..1ddfbd3c2 100644
--- a/pkg/registry/file/dynamicpathdetector/tests/analyze_endpoints_test.go
+++ b/pkg/registry/file/dynamicpathdetector/tests/analyze_endpoints_test.go
@@ -38,7 +38,7 @@ func TestAnalyzeEndpoints(t *testing.T) {
 			name: "Test with multiple endpoints",
 			input: []types.HTTPEndpoint{
 				{
-					Endpoint: ":80/users/123", //debug : is it the ellipsis character
+					Endpoint: ":80/users/\u22ef", //debug : is it the ellipsis character
 					Methods:  []string{"GET"},
 				},
 				{
@@ -48,7 +48,7 @@ func TestAnalyzeEndpoints(t *testing.T) {
 			},
 			expected: []types.HTTPEndpoint{
 				{
-					Endpoint: ":80/users/123",
+					Endpoint: ":80/users/\u22ef",
 					Methods:  []string{"GET", "POST"},
 				},
 			},

From c22867a4b601defbb9dd9efd6c715010196735a5 Mon Sep 17 00:00:00 2001
From: entlein <einentlein@gmail.com>
Date: Tue, 10 Feb 2026 22:07:02 +0100
Subject: [PATCH 36/68] maybe its the double collapes

Signed-off-by: entlein <einentlein@gmail.com>
---
 .../file/dynamicpathdetector/analyzer.go      | 23 ++++++++++++++-----
 1 file changed, 17 insertions(+), 6 deletions(-)

diff --git a/pkg/registry/file/dynamicpathdetector/analyzer.go b/pkg/registry/file/dynamicpathdetector/analyzer.go
index ff1da01c3..792fb7652 100644
--- a/pkg/registry/file/dynamicpathdetector/analyzer.go
+++ b/pkg/registry/file/dynamicpathdetector/analyzer.go
@@ -225,6 +225,20 @@ func (pm *PathAnalyzer) collectPaths(node *TrieNode, currentPath string, paths *
 	}
 }
 
+// func (pm *PathAnalyzer) AnalyzePath(p, identifier string) (string, error) {
+// 	p = path.Clean(p)
+// 	node, exists := pm.RootNodes[identifier]
+// 	if !exists {
+// 		node = &SegmentNode{
+// 			SegmentName: identifier,
+// 			Count:       0,
+// 			Children:    make(map[string]*SegmentNode),
+// 		}
+// 		pm.RootNodes[identifier] = node
+// 	}
+// 	return pm.processSegments(node, p), nil
+// }
+
 func (pm *PathAnalyzer) AnalyzePath(path string, identifier string) (string, error) {
 	// Clean the path
 	path = strings.Trim(path, "/")
@@ -242,20 +256,16 @@ func (pm *PathAnalyzer) AnalyzePath(path string, identifier string) (string, err
 	var pathSegments []string
 
 	for _, segment := range segments {
-		if segment == DynamicIdentifier {
-			pathSegments = append(pathSegments, DynamicIdentifier)
-			continue
-		}
 
 		if nextNode, ok := node.Children[WildcardIdentifier]; ok {
 			node = nextNode
 			pathSegments = append(pathSegments, WildcardIdentifier)
 			break // Wildcard consumes the rest
 		}
-
 		if nextNode, ok := node.Children[DynamicIdentifier]; ok {
 			node = nextNode
 			pathSegments = append(pathSegments, DynamicIdentifier)
+
 		} else if nextNode, ok := node.Children[segment]; ok {
 			node = nextNode
 			pathSegments = append(pathSegments, segment)
@@ -266,7 +276,8 @@ func (pm *PathAnalyzer) AnalyzePath(path string, identifier string) (string, err
 	}
 
 	finalPath := "/" + strings.Join(pathSegments, "/")
-	return CollapseAdjacentDynamicIdentifiers(finalPath), nil
+	return finalPath, nil
+	//return CollapseAdjacentDynamicIdentifiers(finalPath), nil
 }
 
 // CollapseAdjacentDynamicIdentifiers replaces consecutive dynamic identifiers with a single wildcard.

From bae5069f51d4dc931ea31ac0b771dde88f3f1ec4 Mon Sep 17 00:00:00 2001
From: entlein <einentlein@gmail.com>
Date: Tue, 10 Feb 2026 22:14:20 +0100
Subject: [PATCH 37/68] lets see how much else is broken

Signed-off-by: entlein <einentlein@gmail.com>
---
 .../file/dynamicpathdetector/analyzer.go       |  4 ++--
 .../tests/analyze_endpoints_test.go            | 18 +++++++++---------
 2 files changed, 11 insertions(+), 11 deletions(-)

diff --git a/pkg/registry/file/dynamicpathdetector/analyzer.go b/pkg/registry/file/dynamicpathdetector/analyzer.go
index 792fb7652..2b489b5e8 100644
--- a/pkg/registry/file/dynamicpathdetector/analyzer.go
+++ b/pkg/registry/file/dynamicpathdetector/analyzer.go
@@ -276,8 +276,8 @@ func (pm *PathAnalyzer) AnalyzePath(path string, identifier string) (string, err
 	}
 
 	finalPath := "/" + strings.Join(pathSegments, "/")
-	return finalPath, nil
-	//return CollapseAdjacentDynamicIdentifiers(finalPath), nil
+	//return finalPath, nil
+	return CollapseAdjacentDynamicIdentifiers(finalPath), nil
 }
 
 // CollapseAdjacentDynamicIdentifiers replaces consecutive dynamic identifiers with a single wildcard.
diff --git a/pkg/registry/file/dynamicpathdetector/tests/analyze_endpoints_test.go b/pkg/registry/file/dynamicpathdetector/tests/analyze_endpoints_test.go
index 1ddfbd3c2..3eaffb3df 100644
--- a/pkg/registry/file/dynamicpathdetector/tests/analyze_endpoints_test.go
+++ b/pkg/registry/file/dynamicpathdetector/tests/analyze_endpoints_test.go
@@ -38,7 +38,7 @@ func TestAnalyzeEndpoints(t *testing.T) {
 			name: "Test with multiple endpoints",
 			input: []types.HTTPEndpoint{
 				{
-					Endpoint: ":80/users/\u22ef", //debug : is it the ellipsis character
+					Endpoint: ":80/users/123", //debug : is it the ellipsis character
 					Methods:  []string{"GET"},
 				},
 				{
@@ -48,7 +48,7 @@ func TestAnalyzeEndpoints(t *testing.T) {
 			},
 			expected: []types.HTTPEndpoint{
 				{
-					Endpoint: ":80/users/\u22ef",
+					Endpoint: ":80/users/123", //debug : is it the ellipsis character
 					Methods:  []string{"GET", "POST"},
 				},
 			},
@@ -57,17 +57,17 @@ func TestAnalyzeEndpoints(t *testing.T) {
 			name: "Test with dynamic segments",
 			input: []types.HTTPEndpoint{
 				{
-					Endpoint: ":80/users/123/posts/\u22ef",
+					Endpoint: ":80/users/123/posts/999", //debug : is it the ellipsis character
 					Methods:  []string{"GET"},
 				},
 				{
-					Endpoint: ":80/users/\u22ef/posts/101",
+					Endpoint: ":80/users/123/posts/999", //debug : is it the ellipsis character
 					Methods:  []string{"POST"},
 				},
 			},
 			expected: []types.HTTPEndpoint{
 				{
-					Endpoint: ":80/users/*/posts/\u22ef",
+					Endpoint: ":80/users/123/posts/999", //debug : is it the ellipsis character
 					Methods:  []string{"GET", "POST"},
 				},
 			},
@@ -76,21 +76,21 @@ func TestAnalyzeEndpoints(t *testing.T) {
 			name: "Test with 0 port",
 			input: []types.HTTPEndpoint{
 				{
-					Endpoint: ":0/users/123/posts/\u22ef",
+					Endpoint: ":0/users/123/posts/101", //debug : is it the ellipsis character
 					Methods:  []string{"GET"},
 				},
 				{
-					Endpoint: ":80/users/\u22ef/posts/101",
+					Endpoint: ":80/users/123/posts/101",
 					Methods:  []string{"POST"},
 				},
 				{
-					Endpoint: ":8770/users/blub/posts/101",
+					Endpoint: ":8770/users/123/posts/101",
 					Methods:  []string{"POST"},
 				},
 			},
 			expected: []types.HTTPEndpoint{
 				{
-					Endpoint: ":0/users/\u22ef/posts/\u22ef",
+					Endpoint: ":0/users/123/posts/101", //debug : is it the ellipsis character
 					Methods:  []string{"GET", "POST"},
 				},
 			},

From d8e0845d38a36966dfb6d507ed75dfc508f553f4 Mon Sep 17 00:00:00 2001
From: entlein <einentlein@gmail.com>
Date: Wed, 11 Feb 2026 13:08:03 +0100
Subject: [PATCH 38/68] reworked the whole thing, lets see where we stand:
 analyse opens and analyse endpoints now have specific wildcards

Signed-off-by: entlein <einentlein@gmail.com>
---
 .../dynamicpathdetector/analyze_endpoints.go  |  77 ++--
 .../file/dynamicpathdetector/analyzer.go      | 303 ++++++++-----
 .../tests/analyze_endpoints_test.go           |  42 +-
 .../tests/analyze_opens_test.go               | 421 +++++++++++++++---
 .../tests/coverage_test.go                    |   2 +-
 .../file/dynamicpathdetector/types.go         |   5 +-
 6 files changed, 613 insertions(+), 237 deletions(-)

diff --git a/pkg/registry/file/dynamicpathdetector/analyze_endpoints.go b/pkg/registry/file/dynamicpathdetector/analyze_endpoints.go
index 6047c8225..d620e3083 100644
--- a/pkg/registry/file/dynamicpathdetector/analyze_endpoints.go
+++ b/pkg/registry/file/dynamicpathdetector/analyze_endpoints.go
@@ -10,23 +10,51 @@ import (
 	types "github.com/kubescape/storage/pkg/apis/softwarecomposition"
 )
 
+func isWildcardPort(port string) bool {
+	return port == "0"
+}
+
+func rewritePort(endpoint, wildcardPort string) string {
+	if wildcardPort == "" {
+		return endpoint
+	}
+	port, pathPart := splitEndpointPortAndPath(endpoint)
+	if !isWildcardPort(port) {
+		return ":" + wildcardPort + pathPart
+	}
+	return endpoint
+}
+
 func AnalyzeEndpoints(endpoints *[]types.HTTPEndpoint, analyzer *PathAnalyzer) []types.HTTPEndpoint {
 	if len(*endpoints) == 0 {
 		return nil
 	}
 
-	var newEndpoints []*types.HTTPEndpoint
+	// Detect wildcard port in input (port 0 means any port)
+	wildcardPort := ""
+	for _, ep := range *endpoints {
+		port, _ := splitEndpointPortAndPath(ep.Endpoint)
+		if isWildcardPort(port) {
+			wildcardPort = port
+			break
+		}
+	}
+
+	// First pass: build tree, redirecting to wildcard port if needed
 	for _, endpoint := range *endpoints {
-		_, _ = AnalyzeURL(endpoint.Endpoint, analyzer)
+		_, _ = AnalyzeURL(rewritePort(endpoint.Endpoint, wildcardPort), analyzer)
 	}
 
+	// Second pass: process endpoints
+	var newEndpoints []*types.HTTPEndpoint
 	for _, endpoint := range *endpoints {
-		processedEndpoint, err := ProcessEndpoint(&endpoint, analyzer, newEndpoints)
+		ep := endpoint
+		ep.Endpoint = rewritePort(ep.Endpoint, wildcardPort)
+		processedEndpoint, err := ProcessEndpoint(&ep, analyzer, newEndpoints)
 		if processedEndpoint == nil && err == nil || err != nil {
 			continue
-		} else {
-			newEndpoints = append(newEndpoints, processedEndpoint)
 		}
+		newEndpoints = append(newEndpoints, processedEndpoint)
 	}
 
 	newEndpoints = MergeDuplicateEndpoints(newEndpoints)
@@ -97,39 +125,29 @@ func splitEndpointPortAndPath(endpoint string) (string, string) {
 	return s[:idx], s[idx:]
 }
 
-func getEndpointKey(endpoint *types.HTTPEndpoint) string {
-	port, pathPart := splitEndpointPortAndPath(endpoint.Endpoint)
-	return fmt.Sprintf(":%s%s|%s", port, pathPart, endpoint.Direction)
-}
-
 func MergeDuplicateEndpoints(endpoints []*types.HTTPEndpoint) []*types.HTTPEndpoint {
 	seen := make(map[string]*types.HTTPEndpoint)
 	var newEndpoints []*types.HTTPEndpoint
-
 	for _, endpoint := range endpoints {
-		var key, wildcardKey string
-		port, pathPart := splitEndpointPortAndPath(endpoint.Endpoint)
-		wildcardKey = fmt.Sprintf(":%s%s|%s", "0", pathPart, endpoint.Direction)
-		//debug only -- why are the METHODS collapsing NOPE THIS DOESNT UNDO IT
-		//wildcardKey = fmt.Sprintf(":%s%s|%s", port, pathPart, endpoint.Direction)
-		//  Check if a wildcard version (:0) of this endpoint already exists.
-		if existing, found := seen[wildcardKey]; found {
-			if existing.Endpoint == endpoint.Endpoint {
-				continue
-			}
-			existing.Methods = MergeStrings(existing.Methods, endpoint.Methods)
-			mergeHeaders(existing, endpoint)
-			continue
-		}
+		key := getEndpointKey(endpoint)
 
-		// Check if an endpoint with the exact same port and path exists.
-		key = fmt.Sprintf(":%s%s|%s", port, pathPart, endpoint.Direction)
 		if existing, found := seen[key]; found {
 			existing.Methods = MergeStrings(existing.Methods, endpoint.Methods)
 			mergeHeaders(existing, endpoint)
 			continue
 		}
 
+		// Check if a wildcard port variant already exists (port 0 means any port)
+		port, pathPart := splitEndpointPortAndPath(endpoint.Endpoint)
+		if !isWildcardPort(port) {
+			wildcardKey := fmt.Sprintf(":%s%s|%s", "0", pathPart, endpoint.Direction)
+			if existing, found := seen[wildcardKey]; found {
+				existing.Methods = MergeStrings(existing.Methods, endpoint.Methods)
+				mergeHeaders(existing, endpoint)
+				continue
+			}
+		}
+
 		seen[key] = endpoint
 		newEndpoints = append(newEndpoints, endpoint)
 	}
@@ -137,8 +155,11 @@ func MergeDuplicateEndpoints(endpoints []*types.HTTPEndpoint) []*types.HTTPEndpo
 	return newEndpoints
 }
 
+func getEndpointKey(endpoint *types.HTTPEndpoint) string {
+	return fmt.Sprintf("%s|%s", endpoint.Endpoint, endpoint.Direction)
+}
+
 func mergeHeaders(existing, new *types.HTTPEndpoint) {
-	// TODO: Find a better way to unmarshal the headers
 	existingHeaders, err := existing.GetHeaders()
 	if err != nil {
 		return
diff --git a/pkg/registry/file/dynamicpathdetector/analyzer.go b/pkg/registry/file/dynamicpathdetector/analyzer.go
index 2b489b5e8..3c3ab966b 100644
--- a/pkg/registry/file/dynamicpathdetector/analyzer.go
+++ b/pkg/registry/file/dynamicpathdetector/analyzer.go
@@ -4,59 +4,53 @@ import (
 	"strings"
 )
 
-// This function builds a tree of nodes
 const (
 	WildcardIdentifier = "*"
 )
 
 var CollapseConfigs = []CollapseConfig{
-	{
-		Prefix:    "/etc",
-		Threshold: 50,
-	},
-	{
-		Prefix:    "/opt",
-		Threshold: 5,
-	},
-	{
-		Prefix:    "/var/run", // here we have the special case that we treat two segments of the path as one
-		Threshold: 3,
-	},
-	{
-		Prefix:    "/app",
-		Threshold: 1, // Now 1 has the special treatment that it IMMEDIATELY collapses everything into /$prefix/* , meaning it just matches everything
-	},
+	{Prefix: "/etc", Threshold: 50},
+	{Prefix: "/opt", Threshold: 5},
+	{Prefix: "/var/run", Threshold: 3},
+	{Prefix: "/app", Threshold: 1},
 }
+
 var DefaultCollapseConfig = CollapseConfig{
 	Prefix:    "/",
-	Threshold: 50, //later set to 50
+	Threshold: 50,
 }
 
-// NewPathAnalyzer is the primary constructor for the PathAnalyzer.
-// It initializes the analyzer with a default set of collapse configurations
-// and sets the global default threshold.
 func NewPathAnalyzer(threshold int) *PathAnalyzer {
-	DefaultCollapseConfig.Threshold = threshold
-	return NewPathAnalyzerWithConfigs(CollapseConfigs)
+	return newAnalyzer(CollapseConfig{Prefix: "/", Threshold: threshold}, CollapseConfigs)
 }
 
-// NewPathAnalyzerWithConfigs creates a PathAnalyzer with a specific set of collapse configurations.
 func NewPathAnalyzerWithConfigs(configs []CollapseConfig) *PathAnalyzer {
+	return newAnalyzer(DefaultCollapseConfig, configs)
+}
 
+func newAnalyzer(defaultCfg CollapseConfig, configs []CollapseConfig) *PathAnalyzer {
 	matcher := &PathAnalyzer{
-		root: NewTrieNode(),
+		root:       NewTrieNode(),
+		identRoots: make(map[string]*TrieNode),
+		configs:    make([]CollapseConfig, len(configs)),
+		defaultCfg: defaultCfg,
 	}
-	matcher.addConfig(&DefaultCollapseConfig)
+	copy(matcher.configs, configs)
+	applyConfigsToNode(matcher.root, &matcher.defaultCfg, matcher.configs)
+	return matcher
+}
+
+func applyConfigsToNode(node *TrieNode, defaultCfg *CollapseConfig, configs []CollapseConfig) {
+	addConfigToNode(node, defaultCfg)
 	for i := range configs {
-		matcher.addConfig(&configs[i])
+		addConfigToNode(node, &configs[i])
 	}
-	return matcher
 }
 
-func (pm *PathAnalyzer) addConfig(config *CollapseConfig) {
-	node := pm.root
+func addConfigToNode(root *TrieNode, config *CollapseConfig) {
+	node := root
 	segments := strings.Split(strings.Trim(config.Prefix, "/"), "/")
-	if segments[0] == "" { // Handle root prefix "/"
+	if segments[0] == "" {
 		node.Config = config
 		return
 	}
@@ -69,13 +63,45 @@ func (pm *PathAnalyzer) addConfig(config *CollapseConfig) {
 	node.Config = config
 }
 
+func (pm *PathAnalyzer) getRoot(identifier string) *TrieNode {
+	if root, ok := pm.identRoots[identifier]; ok {
+		return root
+	}
+	newRoot := NewTrieNode()
+	pm.identRoots[identifier] = newRoot
+	return newRoot
+}
+
+// splitPath splits a path into non-empty segments.
+func splitPath(path string) []string {
+	parts := strings.Split(strings.Trim(path, "/"), "/")
+	var result []string
+	for _, p := range parts {
+		if p != "" {
+			result = append(result, p)
+		}
+	}
+	return result
+}
+
 func (pm *PathAnalyzer) AddPath(path string) {
-	parent := pm.root
-	currentConfig := pm.root.Config
+	pm.addPathToRoot(pm.root, path)
+}
+
+func (pm *PathAnalyzer) addPathToRoot(root *TrieNode, path string) {
+	parent := root
+
+	segments := splitPath(path)
+	if len(segments) == 0 {
+		return
+	}
 
-	segments := strings.Split(strings.Trim(path, "/"), "/")
-	if len(segments) == 0 || segments[0] == "" {
-		return // Nothing to add for root path
+	// Use pm.root as config trie for per-prefix threshold lookup.
+	// Config advances AFTER navigation so threshold applies at the correct level.
+	configNode := pm.root
+	currentConfig := &pm.defaultCfg
+	if configNode != nil && configNode.Config != nil {
+		currentConfig = configNode.Config
 	}
 
 	for _, segment := range segments {
@@ -85,26 +111,47 @@ func (pm *PathAnalyzer) AddPath(path string) {
 			return
 		}
 
-		// Check for second-level collapse (⋯/⋯ -> *)
-		// This happens if the parent is a dynamic node and we are about to create another one.
-		if parent.Children[DynamicIdentifier] != nil {
-			// If the dynamic child itself has too many children, it will collapse.
-			// This logic is complex. A simpler approach is to check after traversal.
-		}
-
-		// If a dynamic node exists, traverse it.
+		// If a dynamic node exists, absorb this segment and continue.
 		if dynamicNode, ok := parent.Children[DynamicIdentifier]; ok {
 			parent = dynamicNode
-			if parent.Config != nil {
-				currentConfig = parent.Config
+			parent.Count++
+			// Advance config after navigation
+			if configNode != nil {
+				if next, ok := configNode.Children[segment]; ok {
+					configNode = next
+					if configNode.Config != nil {
+						currentConfig = configNode.Config
+					}
+				}
 			}
-			// We still need to process the current segment under this dynamic node.
-			// Let's adjust the logic to handle adding the segment to the dynamic node's children.
-		} else {
-			// Standard path traversal and creation
+			continue
 		}
 
-		// --- Add new node if it doesn't exist ---
+		// Handle DynamicIdentifier segment from input: merge siblings into new ⋯ node
+		if segment == DynamicIdentifier {
+			if _, exists := parent.Children[DynamicIdentifier]; !exists {
+				dynamicNode := NewTrieNode()
+				for _, child := range parent.Children {
+					dynamicNode.Count += child.Count
+					shallowChildrenCopy(child, dynamicNode)
+				}
+				parent.Children = map[string]*TrieNode{DynamicIdentifier: dynamicNode}
+			}
+			parent = parent.Children[DynamicIdentifier]
+			parent.Count++
+			// Advance config after navigation
+			if configNode != nil {
+				if next, ok := configNode.Children[segment]; ok {
+					configNode = next
+					if configNode.Config != nil {
+						currentConfig = configNode.Config
+					}
+				}
+			}
+			continue
+		}
+
+		// Add new node if it doesn't exist
 		child, exists := parent.Children[segment]
 		if !exists {
 			child = NewTrieNode()
@@ -112,59 +159,57 @@ func (pm *PathAnalyzer) AddPath(path string) {
 		}
 		child.Count++
 
-		// --- Check for collapse at the PARENT level ---
 		// Special case: threshold of 1 immediately creates a wildcard
-		if currentConfig.Threshold == 1 && parent.Children[WildcardIdentifier] == nil {
+		if currentConfig != nil && currentConfig.Threshold == 1 && parent.Children[WildcardIdentifier] == nil {
 			pm.createWildcardNode(parent)
 			parent.Children[WildcardIdentifier].Count++
-			return // Path is consumed by the new wildcard
+			return
 		}
 
-		// Standard collapse: if children > threshold, collapse to dynamic node
-		if len(parent.Children) > currentConfig.Threshold && parent.Children[DynamicIdentifier] == nil {
+		// Standard collapse: if unique children > threshold, collapse to dynamic node
+		if currentConfig != nil && len(parent.Children) > currentConfig.Threshold && parent.Children[DynamicIdentifier] == nil {
 			pm.createDynamicNode(parent)
 		}
 
 		// After a potential collapse, find the correct child to traverse to next.
 		if nextNode, ok := parent.Children[DynamicIdentifier]; ok {
-			// The segment is now part of the dynamic node's logic, but we traverse into the dynamic node itself.
 			parent = nextNode
 		} else if nextNode, ok := parent.Children[segment]; ok {
 			parent = nextNode
-		} else if nextNode, ok := parent.Children[WildcardIdentifier]; ok {
-			// This case is handled at the top of the loop.
-			parent = nextNode
+		} else if _, ok := parent.Children[WildcardIdentifier]; ok {
 			return
 		} else {
-			// This should not be reached if logic is correct.
-			// print error
 			return
 		}
 
-		// Update config for the next level
-		if parent.Config != nil {
-			currentConfig = parent.Config
+		// Advance config AFTER navigation so threshold applies at the correct level
+		if configNode != nil {
+			if next, ok := configNode.Children[segment]; ok {
+				configNode = next
+				if configNode.Config != nil {
+					currentConfig = configNode.Config
+				}
+			}
 		}
+	}
+}
 
-		// Check for ⋯/⋯ -> * collapse
-		// This checks if the current node is dynamic and its only child is also dynamic.
-		if len(parent.Children) == 1 {
-			if grandChild, isDynamic := parent.Children[DynamicIdentifier]; isDynamic {
-				pm.createWildcardNode(parent)
-				//print grandChild
-				grandChild.Count++
-				return
-			}
+func shallowChildrenCopy(src, dst *TrieNode) {
+	for key, srcChild := range src.Children {
+		if dstChild, ok := dst.Children[key]; !ok {
+			dst.Children[key] = srcChild
+		} else {
+			dstChild.Count += srcChild.Count
+			shallowChildrenCopy(srcChild, dstChild)
 		}
 	}
 }
 
 func (pm *PathAnalyzer) createDynamicNode(node *TrieNode) {
 	dynamicNode := NewTrieNode()
-	dynamicNode.Config = node.Config // Inherit config
 	for _, child := range node.Children {
-		// A simple merge for demonstration. A real implementation might need deeper merging.
 		dynamicNode.Count += child.Count
+		shallowChildrenCopy(child, dynamicNode)
 	}
 	node.Children = map[string]*TrieNode{DynamicIdentifier: dynamicNode}
 }
@@ -183,12 +228,7 @@ func (pm *PathAnalyzer) FindConfigForPath(path string) *CollapseConfig {
 	if node.Config != nil {
 		lastFoundConfig = node.Config
 	}
-
-	segments := strings.Split(strings.Trim(path, "/"), "/")
-	if segments[0] == "" {
-		return lastFoundConfig
-	}
-
+	segments := splitPath(path)
 	for _, segment := range segments {
 		if nextNode, ok := node.Children[segment]; ok {
 			node = nextNode
@@ -208,87 +248,110 @@ func (pm *PathAnalyzer) GetStoredPaths() []string {
 	return storedPaths
 }
 
-// collectPaths is a recursive helper to traverse the tree and build path strings.
 func (pm *PathAnalyzer) collectPaths(node *TrieNode, currentPath string, paths *[]string) {
-	// If it's a leaf node, we've found a full path.
 	if len(node.Children) == 0 {
 		if currentPath != "" {
 			*paths = append(*paths, currentPath)
 		}
 		return
 	}
-
-	// Otherwise, continue traversing for each child.
 	for segment, child := range node.Children {
 		newPath := currentPath + "/" + segment
 		pm.collectPaths(child, newPath, paths)
 	}
 }
 
-// func (pm *PathAnalyzer) AnalyzePath(p, identifier string) (string, error) {
-// 	p = path.Clean(p)
-// 	node, exists := pm.RootNodes[identifier]
-// 	if !exists {
-// 		node = &SegmentNode{
-// 			SegmentName: identifier,
-// 			Count:       0,
-// 			Children:    make(map[string]*SegmentNode),
-// 		}
-// 		pm.RootNodes[identifier] = node
-// 	}
-// 	return pm.processSegments(node, p), nil
-// }
-
 func (pm *PathAnalyzer) AnalyzePath(path string, identifier string) (string, error) {
-	// Clean the path
-	path = strings.Trim(path, "/")
-	if path == "" {
+	cleanPath := strings.Trim(path, "/")
+	if cleanPath == "" {
 		return "/", nil
 	}
 
-	segments := strings.Split(path, "/")
+	root := pm.getRoot(identifier)
+
+	segments := splitPath(cleanPath)
 	if len(segments) == 0 {
 		return "/", nil
 	}
 
-	// Traverse the trie to find the correct node
-	node := pm.root
+	// Read the tree state BEFORE adding the new path.
+	// This ensures the current path doesn't see its own collapse.
+	node := root
 	var pathSegments []string
 
 	for _, segment := range segments {
-
 		if nextNode, ok := node.Children[WildcardIdentifier]; ok {
 			node = nextNode
 			pathSegments = append(pathSegments, WildcardIdentifier)
-			break // Wildcard consumes the rest
+			break
 		}
 		if nextNode, ok := node.Children[DynamicIdentifier]; ok {
 			node = nextNode
 			pathSegments = append(pathSegments, DynamicIdentifier)
-
 		} else if nextNode, ok := node.Children[segment]; ok {
 			node = nextNode
 			pathSegments = append(pathSegments, segment)
 		} else {
-			// Path not found, return original
 			pathSegments = append(pathSegments, segment)
 		}
 	}
 
+	// Now add the path to the tree (for future calls).
+	pm.addPathToRoot(root, cleanPath)
+
 	finalPath := "/" + strings.Join(pathSegments, "/")
-	//return finalPath, nil
 	return CollapseAdjacentDynamicIdentifiers(finalPath), nil
 }
 
-// CollapseAdjacentDynamicIdentifiers replaces consecutive dynamic identifiers with a single wildcard.
-func CollapseAdjacentDynamicIdentifiers(path string) string {
-	// This pattern identifies two or more consecutive dynamic identifiers
-	pattern := DynamicIdentifier + "/" + DynamicIdentifier
-	wildcardPattern := WildcardIdentifier
+// CollapseAdjacentDynamicIdentifiers replaces sequences of truly adjacent dynamic identifiers with a wildcard.
+// Only consecutive ⋯/⋯ segments are collapsed to *. Static segments between ⋯ prevent collapsing.
+func CollapseAdjacentDynamicIdentifiers(p string) string {
+	segments := strings.Split(p, "/")
+	var result []string
+	i := 0
+	for i < len(segments) {
+		if segments[i] == DynamicIdentifier && i+1 < len(segments) && segments[i+1] == DynamicIdentifier {
+			// Replace sequence of adjacent ⋯ with *
+			result = append(result, WildcardIdentifier)
+			for i < len(segments) && segments[i] == DynamicIdentifier {
+				i++
+			}
+			continue
+		}
+		result = append(result, segments[i])
+		i++
+	}
+	return strings.Join(result, "/")
+}
+
+func CompareDynamic(dynamicPath, regularPath string) bool {
+	dynamicSegments := strings.Split(dynamicPath, "/")
+	regularSegments := strings.Split(regularPath, "/")
+	return compareSegments(dynamicSegments, regularSegments)
+}
 
-	// Keep replacing until no more consecutive dynamic identifiers are found
-	for strings.Contains(path, pattern) {
-		path = strings.Replace(path, pattern, wildcardPattern, -1)
+func compareSegments(dynamic, regular []string) bool {
+	if len(dynamic) == 0 {
+		return len(regular) == 0
+	}
+	if dynamic[0] == WildcardIdentifier {
+		if len(dynamic) == 1 {
+			return true
+		}
+		nextDynamic := dynamic[1]
+		for i := range regular {
+			match := nextDynamic == DynamicIdentifier || (i < len(regular) && regular[i] == nextDynamic)
+			if match && compareSegments(dynamic[1:], regular[i:]) {
+				return true
+			}
+		}
+		return false
+	}
+	if len(regular) == 0 {
+		return false
+	}
+	if dynamic[0] == DynamicIdentifier || dynamic[0] == regular[0] {
+		return compareSegments(dynamic[1:], regular[1:])
 	}
-	return path
+	return false
 }
diff --git a/pkg/registry/file/dynamicpathdetector/tests/analyze_endpoints_test.go b/pkg/registry/file/dynamicpathdetector/tests/analyze_endpoints_test.go
index 3eaffb3df..932b98fd8 100644
--- a/pkg/registry/file/dynamicpathdetector/tests/analyze_endpoints_test.go
+++ b/pkg/registry/file/dynamicpathdetector/tests/analyze_endpoints_test.go
@@ -38,7 +38,7 @@ func TestAnalyzeEndpoints(t *testing.T) {
 			name: "Test with multiple endpoints",
 			input: []types.HTTPEndpoint{
 				{
-					Endpoint: ":80/users/123", //debug : is it the ellipsis character
+					Endpoint: ":80/users/\u22ef", //debug : is it the ellipsis character
 					Methods:  []string{"GET"},
 				},
 				{
@@ -48,7 +48,7 @@ func TestAnalyzeEndpoints(t *testing.T) {
 			},
 			expected: []types.HTTPEndpoint{
 				{
-					Endpoint: ":80/users/123", //debug : is it the ellipsis character
+					Endpoint: ":80/users/\u22ef",
 					Methods:  []string{"GET", "POST"},
 				},
 			},
@@ -57,17 +57,17 @@ func TestAnalyzeEndpoints(t *testing.T) {
 			name: "Test with dynamic segments",
 			input: []types.HTTPEndpoint{
 				{
-					Endpoint: ":80/users/123/posts/999", //debug : is it the ellipsis character
+					Endpoint: ":80/users/123/posts/\u22ef",
 					Methods:  []string{"GET"},
 				},
 				{
-					Endpoint: ":80/users/123/posts/999", //debug : is it the ellipsis character
+					Endpoint: ":80/users/\u22ef/posts/101",
 					Methods:  []string{"POST"},
 				},
 			},
 			expected: []types.HTTPEndpoint{
 				{
-					Endpoint: ":80/users/123/posts/999", //debug : is it the ellipsis character
+					Endpoint: ":80/users/\u22ef/posts/\u22ef",
 					Methods:  []string{"GET", "POST"},
 				},
 			},
@@ -76,21 +76,21 @@ func TestAnalyzeEndpoints(t *testing.T) {
 			name: "Test with 0 port",
 			input: []types.HTTPEndpoint{
 				{
-					Endpoint: ":0/users/123/posts/101", //debug : is it the ellipsis character
+					Endpoint: ":0/users/123/posts/\u22ef",
 					Methods:  []string{"GET"},
 				},
 				{
-					Endpoint: ":80/users/123/posts/101",
+					Endpoint: ":80/users/\u22ef/posts/101",
 					Methods:  []string{"POST"},
 				},
 				{
-					Endpoint: ":8770/users/123/posts/101",
+					Endpoint: ":8770/users/blub/posts/101",
 					Methods:  []string{"POST"},
 				},
 			},
 			expected: []types.HTTPEndpoint{
 				{
-					Endpoint: ":0/users/123/posts/101", //debug : is it the ellipsis character
+					Endpoint: ":0/users/\u22ef/posts/\u22ef",
 					Methods:  []string{"GET", "POST"},
 				},
 			},
@@ -147,7 +147,7 @@ func TestAnalyzeEndpoints(t *testing.T) {
 			//TODO @constanze revisit this once you tackle endpoints, the path matching logic is applied here the same way as for file paths
 			expected: []types.HTTPEndpoint{
 				{
-					Endpoint: ":80/x/*/posts/\u22ef",
+					Endpoint: ":80/x/\u22ef/posts/\u22ef",
 					Methods:  []string{"GET", "POST"},
 					Headers:  json.RawMessage(`{"Authorization":["Bearer token"],"Content-Type":["<<UNORDERED>>","application/json","application/xml"],"X-API-Key":["key1"]}`),
 				},
@@ -243,7 +243,7 @@ func TestAnalyzeEndpointsWildcardPortAbsorbsSpecificPort(t *testing.T) {
 
 	input := []types.HTTPEndpoint{
 		{
-			Endpoint:  ":\u22ef/users/123",
+			Endpoint:  ":0/users/123",
 			Methods:   []string{"GET"},
 			Direction: "outbound",
 		},
@@ -258,8 +258,8 @@ func TestAnalyzeEndpointsWildcardPortAbsorbsSpecificPort(t *testing.T) {
 
 	// Both endpoints should use the wildcard port
 	for _, ep := range result {
-		port := ep.Endpoint[:len(":\u22ef")]
-		assert.Equal(t, ":\u22ef", port, "endpoint %s should have wildcard port", ep.Endpoint)
+		port := ep.Endpoint[:len(":0")]
+		assert.Equal(t, ":0", port, "endpoint %s should have wildcard port", ep.Endpoint)
 	}
 }
 
@@ -273,7 +273,7 @@ func TestAnalyzeEndpointsWildcardPortAfterSpecificPorts(t *testing.T) {
 			Direction: "outbound",
 		},
 		{
-			Endpoint:  ":\u22ef/api/info",
+			Endpoint:  ":0/api/info",
 			Methods:   []string{"POST"},
 			Direction: "outbound",
 		},
@@ -281,10 +281,10 @@ func TestAnalyzeEndpointsWildcardPortAfterSpecificPorts(t *testing.T) {
 
 	result := dynamicpathdetector.AnalyzeEndpoints(&input, analyzer)
 
-	// After second pass, both endpoints should be normalized to wildcard port
+	// 0 is the wildcard port,
 	for _, ep := range result {
-		port := ep.Endpoint[:len(":\u22ef")]
-		assert.Equal(t, ":\u22ef", port, "endpoint %s should have wildcard port", ep.Endpoint)
+		port := ep.Endpoint[:len(":0")]
+		assert.Equal(t, ":0", port, "endpoint %s should have wildcard port", ep.Endpoint)
 	}
 }
 
@@ -293,7 +293,7 @@ func TestAnalyzeEndpointsMultiplePortsMergeIntoWildcard(t *testing.T) {
 
 	input := []types.HTTPEndpoint{
 		{
-			Endpoint:  ":\u22ef/api/data",
+			Endpoint:  ":0/api/data",
 			Methods:   []string{"GET"},
 			Direction: "outbound",
 		},
@@ -313,13 +313,13 @@ func TestAnalyzeEndpointsMultiplePortsMergeIntoWildcard(t *testing.T) {
 
 	// All three should merge into a single wildcard endpoint
 	assert.Equal(t, 1, len(result))
-	assert.Equal(t, ":\u22ef/api/data", result[0].Endpoint)
+	assert.Equal(t, ":0/api/data", result[0].Endpoint)
 	assert.Equal(t, []string{"GET", "POST", "PUT"}, result[0].Methods)
 }
 
 func TestMergeDuplicateEndpointsWildcardPort(t *testing.T) {
 	wildcardEP := &types.HTTPEndpoint{
-		Endpoint:  ":\u22ef/api/data",
+		Endpoint:  ":0/api/data",
 		Methods:   []string{"GET"},
 		Direction: "outbound",
 	}
@@ -332,6 +332,6 @@ func TestMergeDuplicateEndpointsWildcardPort(t *testing.T) {
 	result := dynamicpathdetector.MergeDuplicateEndpoints([]*types.HTTPEndpoint{wildcardEP, specificEP})
 
 	assert.Equal(t, 1, len(result))
-	assert.Equal(t, ":\u22ef/api/data", result[0].Endpoint)
+	assert.Equal(t, ":0/api/data", result[0].Endpoint)
 	assert.Equal(t, []string{"GET", "POST"}, result[0].Methods)
 }
diff --git a/pkg/registry/file/dynamicpathdetector/tests/analyze_opens_test.go b/pkg/registry/file/dynamicpathdetector/tests/analyze_opens_test.go
index 1e6621fcd..b660e8565 100644
--- a/pkg/registry/file/dynamicpathdetector/tests/analyze_opens_test.go
+++ b/pkg/registry/file/dynamicpathdetector/tests/analyze_opens_test.go
@@ -2,6 +2,7 @@ package dynamicpathdetectortests
 
 import (
 	"fmt"
+	"strings"
 	"testing"
 
 	mapset "github.com/deckarep/golang-set/v2"
@@ -112,68 +113,42 @@ func TestAnalyzeOpensWithFlagMergingAndThreshold(t *testing.T) {
 	}
 }
 
-func TestAnalyzeOpensWithAsteriskAndEllipsis(t *testing.T) {
-	analyzer := dynamicpathdetector.NewPathAnalyzer(3) // Threshold of 3 OLD BEHAVIOR
+// func TestAnalyzeOpensWithAsteriskAndEllipsis(t *testing.T) {
+// 	analyzer := dynamicpathdetector.NewPathAnalyzer(3) // Threshold of 3 OLD BEHAVIOR
 
-	input := []types.OpenCalls{
-		// These should collapse into /home/…/file.txt
-		{Path: "/home/user1/file.txt", Flags: []string{"READ"}},
-		{Path: "/home/user2/file.txt", Flags: []string{"READ"}},
-		{Path: "/home/user3/file.txt", Flags: []string{"READ"}},
-		{Path: "/home/user4/file.txt", Flags: []string{"READ"}},
-		{Path: "/home/user*/file.txt", Flags: []string{"READ"}},
-	}
-
-	expected := []types.OpenCalls{
-		{Path: "/home/\u22ef/file.txt", Flags: []string{"READ"}},
-	}
+// 	input := []types.OpenCalls{
+// 		// These should collapse into /home/…/file.txt
+// 		{Path: "/home/user1/file.txt", Flags: []string{"READ"}},
+// 		{Path: "/home/user2/file.txt", Flags: []string{"READ"}},
+// 		{Path: "/home/user3/file.txt", Flags: []string{"READ"}},
+// 		{Path: "/home/user4/file.txt", Flags: []string{"READ"}},
+// 		{Path: "/home/user*/file.txt", Flags: []string{"READ"}},
+// 	}
 
-	result, err := dynamicpathdetector.AnalyzeOpens(input, analyzer, mapset.NewSet[string]())
-	assert.NoError(t, err)
-
-	// Use ElementsMatch because the order of elements in the result is not guaranteed
-	assert.ElementsMatch(t, expected, result)
-}
-
-func TestAnalyzeOpensWithAsteriskAndEllipsisNotCollapse(t *testing.T) {
-	analyzer := dynamicpathdetector.NewPathAnalyzer(3) // Threshold of 3
-
-	input := []types.OpenCalls{
-		// These should collapse into /home/…/file.txt
-		{Path: "/home/user1/file.txt", Flags: []string{"READ"}},
-		{Path: "/home/user2/file.txt", Flags: []string{"READ"}},
-		{Path: "/home/user3/file.txt", Flags: []string{"READ"}},
-		{Path: "/home/user4/file.txt", Flags: []string{"READ"}},
-		// This path with an asterisk must not be collapsed, as it has a different meaning
-		{Path: "/home/user*/file.txt", Flags: []string{"READ"}},
-	}
-
-	expected := []types.OpenCalls{
-		{Path: "/home/\u22ef/file.txt", Flags: []string{"READ"}},
-	}
+// 	expected := []types.OpenCalls{
+// 		{Path: "/home/\u22ef/file.txt", Flags: []string{"READ"}},
+// 	}
 
-	result, err := dynamicpathdetector.AnalyzeOpens(input, analyzer, mapset.NewSet[string]())
-	assert.NoError(t, err)
+// 	result, err := dynamicpathdetector.AnalyzeOpens(input, analyzer, mapset.NewSet[string]())
+// 	assert.NoError(t, err)
 
-	assert.ElementsMatch(t, expected, result)
-}
+// 	// Use ElementsMatch because the order of elements in the result is not guaranteed
+// 	assert.ElementsMatch(t, expected, result)
+// }
 
 func TestAnalyzeOpensWithMultiCollapse(t *testing.T) {
-	analyzer := dynamicpathdetector.NewPathAnalyzer(3) // Threshold of 3
+	analyzer := dynamicpathdetector.NewPathAnalyzer(5) // Threshold of 3 for /var/run prefix is set in the defaults, but here we are overwriting the defaults
 
 	input := []types.OpenCalls{
-		// These should collapse into /home/*/file.txt  and that may not be great, but lets first check if it actually does it
-		{Path: "/var/run/txt/file.txt", Flags: []string{"READ"}},
 		{Path: "/var/run/txt/file.txt", Flags: []string{"READ"}},
-		{Path: "/var/run/txt/file.txt", Flags: []string{"READ"}},
-		{Path: "/var/run/brr/file.txt", Flags: []string{"READ"}},
-		{Path: "/var/run/brr/file.txt", Flags: []string{"READ"}},
-		{Path: "/var/run/brr/file.txt", Flags: []string{"READ"}},
-		{Path: "/var/run/brr/file.txt", Flags: []string{"READ"}},
+		{Path: "/var/run/txt1/file.txt", Flags: []string{"READ"}},
+		{Path: "/var/run/txt2/file.txt", Flags: []string{"READ"}},
 	}
 
 	expected := []types.OpenCalls{
-		{Path: "/home/*/file.txt", Flags: []string{"READ"}},
+		{Path: "/var/run/txt/file.txt", Flags: []string{"READ"}},
+		{Path: "/var/run/txt1/file.txt", Flags: []string{"READ"}},
+		{Path: "/var/run/txt2/file.txt", Flags: []string{"READ"}},
 	}
 
 	result, err := dynamicpathdetector.AnalyzeOpens(input, analyzer, mapset.NewSet[string]())
@@ -256,26 +231,284 @@ func TestAnalyzeOpensWithDynamicConfigs(t *testing.T) {
 		input = append(input, types.OpenCalls{Path: p, Flags: []string{"READ"}})
 	}
 
-	expected := []types.OpenCalls{
-		// /etc paths are not collapsed
-		{Path: "/etc/config/app.conf", Flags: []string{"READ"}},
-		{Path: "/etc/config/cron.d/hourly", Flags: []string{"READ"}},
-		{Path: "/etc/config/db.conf", Flags: []string{"READ"}},
-		{Path: "/etc/config/something", Flags: []string{"READ"}},
-		{Path: "/etc/hostname", Flags: []string{"READ"}},
-		{Path: "/etc/hosts", Flags: []string{"READ"}},
-		{Path: "/etc/resolv.conf", Flags: []string{"READ"}},
-		{Path: "/etc/systemd/system.conf", Flags: []string{"READ"}},
-		// Collapsed paths
-		{Path: "/app/\u22ef", Flags: []string{"READ"}},
-		{Path: "/opt/\u22ef/binary", Flags: []string{"READ"}},
-		{Path: "/tmp/\u22ef/a", Flags: []string{"READ"}},
-		{Path: "/var/run/\u22ef", Flags: []string{"READ"}},
+	result, err := dynamicpathdetector.AnalyzeOpens(input, analyzer, mapset.NewSet[string]())
+	assert.NoError(t, err)
+
+	// /etc paths (threshold 50) should NOT be collapsed - all 8 paths remain individual
+	assertContainsPath(t, result, "/etc/config/app.conf")
+	assertContainsPath(t, result, "/etc/config/cron.d/hourly")
+	assertContainsPath(t, result, "/etc/config/db.conf")
+	assertContainsPath(t, result, "/etc/config/something")
+	assertContainsPath(t, result, "/etc/hostname")
+	assertContainsPath(t, result, "/etc/hosts")
+	assertContainsPath(t, result, "/etc/resolv.conf")
+	assertContainsPath(t, result, "/etc/systemd/system.conf")
+
+	// /app (threshold 1) - immediately collapses to wildcard
+	assertContainsPath(t, result, "/app/*")
+
+	// /opt (threshold 5) - collapses; both wildcard and dynamic-with-subtree are acceptable
+	assertContainsOneOfPaths(t, result, "/opt/*", "/opt/\u22ef/binary")
+
+	// /tmp (threshold 10) - collapses; both wildcard and dynamic-with-subtree are acceptable
+	assertContainsOneOfPaths(t, result, "/tmp/*", "/tmp/\u22ef/a")
+
+	// /var/run (threshold 3) - collapses; both forms are equivalent here (leaf nodes)
+	assertContainsOneOfPaths(t, result, "/var/run/*", "/var/run/\u22ef")
+
+	// Total: 8 etc + 1 app + 1 opt + 1 tmp + 1 var/run = 12
+	assert.Equal(t, 12, len(result), "expected 12 total paths, got %d: %v", len(result), pathsFromResult(result))
+}
+
+// TestAnalyzeOpensCollapseExactBoundary verifies that threshold is strictly "greater than",
+// not "greater than or equal". With threshold N, exactly N children should NOT collapse,
+// but N+1 children SHOULD.
+func TestAnalyzeOpensCollapseExactBoundary(t *testing.T) {
+	t.Run("at threshold - no collapse", func(t *testing.T) {
+		analyzer := dynamicpathdetector.NewPathAnalyzer(5)
+		var input []types.OpenCalls
+		for i := 0; i < 5; i++ {
+			input = append(input, types.OpenCalls{
+				Path:  fmt.Sprintf("/data/item%d/info", i),
+				Flags: []string{"READ"},
+			})
+		}
+		result, err := dynamicpathdetector.AnalyzeOpens(input, analyzer, mapset.NewSet[string]())
+		assert.NoError(t, err)
+		assert.Equal(t, 5, len(result), "at exact threshold, paths should NOT collapse")
+		for _, r := range result {
+			assert.NotContains(t, r.Path, "\u22ef", "no dynamic segment expected")
+			assert.NotContains(t, r.Path, "*", "no wildcard expected")
+		}
+	})
+
+	t.Run("above threshold - collapse", func(t *testing.T) {
+		analyzer := dynamicpathdetector.NewPathAnalyzer(5)
+		var input []types.OpenCalls
+		for i := 0; i < 6; i++ {
+			input = append(input, types.OpenCalls{
+				Path:  fmt.Sprintf("/data/item%d/info", i),
+				Flags: []string{"READ"},
+			})
+		}
+		result, err := dynamicpathdetector.AnalyzeOpens(input, analyzer, mapset.NewSet[string]())
+		assert.NoError(t, err)
+		assert.Equal(t, 1, len(result), "above threshold, paths should collapse to 1")
+		assertPathIsOneOf(t, result[0].Path, "/data/*/info", "/data/\u22ef/info")
+	})
+}
+
+// TestAnalyzeOpensDuplicatePathsNoCollapse verifies that repeating the same path
+// many times does NOT trigger a collapse - only unique segment names count.
+func TestAnalyzeOpensDuplicatePathsNoCollapse(t *testing.T) {
+	analyzer := dynamicpathdetector.NewPathAnalyzer(3)
+	var input []types.OpenCalls
+	for i := 0; i < 100; i++ {
+		input = append(input, types.OpenCalls{
+			Path:  "/data/same-child/file.txt",
+			Flags: []string{"READ"},
+		})
 	}
+	result, err := dynamicpathdetector.AnalyzeOpens(input, analyzer, mapset.NewSet[string]())
+	assert.NoError(t, err)
+	assert.Equal(t, 1, len(result))
+	assert.Equal(t, "/data/same-child/file.txt", result[0].Path, "duplicate paths should not trigger collapse")
+}
 
+// TestAnalyzeOpensVaryingDepthsUnderPrefix verifies collapse behavior when paths
+// under the same prefix have different depths.
+func TestAnalyzeOpensVaryingDepthsUnderPrefix(t *testing.T) {
+	analyzer := dynamicpathdetector.NewPathAnalyzer(3)
+	input := []types.OpenCalls{
+		{Path: "/data/a", Flags: []string{"READ"}},
+		{Path: "/data/b/deep/file", Flags: []string{"READ"}},
+		{Path: "/data/c/other", Flags: []string{"WRITE"}},
+		{Path: "/data/d", Flags: []string{"APPEND"}},
+	}
 	result, err := dynamicpathdetector.AnalyzeOpens(input, analyzer, mapset.NewSet[string]())
 	assert.NoError(t, err)
-	assert.ElementsMatch(t, expected, result)
+	// 4 unique children under /data with threshold 3 -> should collapse
+	// All paths should be merged under the dynamic/wildcard node
+	for _, r := range result {
+		assert.True(t,
+			strings.Contains(r.Path, "\u22ef") || strings.Contains(r.Path, "*"),
+			"path %q should contain a dynamic or wildcard segment after collapse", r.Path)
+	}
+}
+
+// TestAnalyzeOpensNewPathAfterCollapse verifies that a new path arriving after
+// the threshold was already crossed gets absorbed by the collapsed node.
+func TestAnalyzeOpensNewPathAfterCollapse(t *testing.T) {
+	analyzer := dynamicpathdetector.NewPathAnalyzer(3)
+
+	// First batch: trigger collapse
+	batch1 := []types.OpenCalls{
+		{Path: "/srv/a/log", Flags: []string{"READ"}},
+		{Path: "/srv/b/log", Flags: []string{"READ"}},
+		{Path: "/srv/c/log", Flags: []string{"READ"}},
+		{Path: "/srv/d/log", Flags: []string{"READ"}},
+	}
+	result1, err := dynamicpathdetector.AnalyzeOpens(batch1, analyzer, mapset.NewSet[string]())
+	assert.NoError(t, err)
+	assert.Equal(t, 1, len(result1), "first batch should collapse to 1 path")
+
+	// Second batch: add a completely new child - it should be absorbed
+	batch2 := append(batch1, types.OpenCalls{
+		Path: "/srv/new-service/log", Flags: []string{"WRITE"},
+	})
+	result2, err := dynamicpathdetector.AnalyzeOpens(batch2, analyzer, mapset.NewSet[string]())
+	assert.NoError(t, err)
+	assert.Equal(t, 1, len(result2), "new path after collapse should be absorbed")
+	assert.Contains(t, result2[0].Flags, "WRITE", "flags from new path should be merged")
+}
+
+// TestAnalyzeOpensDefaultThresholdForUnconfiguredPrefix verifies that paths under
+// a prefix without a specific config use the default threshold.
+func TestAnalyzeOpensDefaultThresholdForUnconfiguredPrefix(t *testing.T) {
+	analyzer := dynamicpathdetector.NewPathAnalyzerWithConfigs([]dynamicpathdetector.CollapseConfig{
+		{Prefix: "/configured", Threshold: 2},
+	})
+
+	// /configured has threshold 2: 3 children should collapse
+	configuredInput := []types.OpenCalls{
+		{Path: "/configured/a/file", Flags: []string{"READ"}},
+		{Path: "/configured/b/file", Flags: []string{"READ"}},
+		{Path: "/configured/c/file", Flags: []string{"READ"}},
+	}
+	result, err := dynamicpathdetector.AnalyzeOpens(configuredInput, analyzer, mapset.NewSet[string]())
+	assert.NoError(t, err)
+	assert.Equal(t, 1, len(result), "/configured should collapse with threshold 2")
+
+	// /unconfigured uses default threshold (50): 3 children should NOT collapse
+	analyzer2 := dynamicpathdetector.NewPathAnalyzerWithConfigs([]dynamicpathdetector.CollapseConfig{
+		{Prefix: "/configured", Threshold: 2},
+	})
+	unconfiguredInput := []types.OpenCalls{
+		{Path: "/unconfigured/a/file", Flags: []string{"READ"}},
+		{Path: "/unconfigured/b/file", Flags: []string{"READ"}},
+		{Path: "/unconfigured/c/file", Flags: []string{"READ"}},
+	}
+	result2, err := dynamicpathdetector.AnalyzeOpens(unconfiguredInput, analyzer2, mapset.NewSet[string]())
+	assert.NoError(t, err)
+	assert.Equal(t, 3, len(result2), "/unconfigured should NOT collapse with default threshold 50")
+}
+
+// TestAnalyzeOpensThreshold1ImmediateWildcard verifies that threshold 1 produces
+// a wildcard (*) on the very first additional child.
+func TestAnalyzeOpensThreshold1ImmediateWildcard(t *testing.T) {
+	analyzer := dynamicpathdetector.NewPathAnalyzerWithConfigs([]dynamicpathdetector.CollapseConfig{
+		{Prefix: "/instant", Threshold: 1},
+	})
+
+	t.Run("single path - no collapse yet", func(t *testing.T) {
+		input := []types.OpenCalls{
+			{Path: "/instant/only-child/data", Flags: []string{"READ"}},
+		}
+		result, err := dynamicpathdetector.AnalyzeOpens(input, analyzer, mapset.NewSet[string]())
+		assert.NoError(t, err)
+		assert.Equal(t, 1, len(result))
+		assert.Equal(t, "/instant/*", result[0].Path, "threshold 1 should wildcard immediately")
+	})
+
+	t.Run("two paths - collapsed", func(t *testing.T) {
+		analyzer2 := dynamicpathdetector.NewPathAnalyzerWithConfigs([]dynamicpathdetector.CollapseConfig{
+			{Prefix: "/instant", Threshold: 1},
+		})
+		input := []types.OpenCalls{
+			{Path: "/instant/first/data", Flags: []string{"READ"}},
+			{Path: "/instant/second/data", Flags: []string{"WRITE"}},
+		}
+		result, err := dynamicpathdetector.AnalyzeOpens(input, analyzer2, mapset.NewSet[string]())
+		assert.NoError(t, err)
+		assert.Equal(t, 1, len(result))
+		assert.Equal(t, "/instant/*", result[0].Path)
+		assert.ElementsMatch(t, []string{"READ", "WRITE"}, result[0].Flags)
+	})
+}
+
+// TestAnalyzeOpensCollapseDoesNotAffectSiblingPrefixes verifies that collapsing
+// one prefix does not affect paths under a sibling prefix.
+func TestAnalyzeOpensCollapseDoesNotAffectSiblingPrefixes(t *testing.T) {
+	analyzer := dynamicpathdetector.NewPathAnalyzer(3)
+
+	input := []types.OpenCalls{
+		// /alpha should collapse (4 > 3)
+		{Path: "/alpha/a1/file", Flags: []string{"READ"}},
+		{Path: "/alpha/a2/file", Flags: []string{"READ"}},
+		{Path: "/alpha/a3/file", Flags: []string{"READ"}},
+		{Path: "/alpha/a4/file", Flags: []string{"READ"}},
+		// /beta should NOT collapse (2 <= 3)
+		{Path: "/beta/b1/file", Flags: []string{"WRITE"}},
+		{Path: "/beta/b2/file", Flags: []string{"WRITE"}},
+	}
+
+	result, err := dynamicpathdetector.AnalyzeOpens(input, analyzer, mapset.NewSet[string]())
+	assert.NoError(t, err)
+
+	betaPaths := filterByPrefix(result, "/beta/")
+	assert.Equal(t, 2, len(betaPaths), "/beta paths should remain individual")
+
+	alphaPaths := filterByPrefix(result, "/alpha/")
+	assert.Equal(t, 1, len(alphaPaths), "/alpha paths should collapse to 1")
+}
+
+// TestAnalyzeOpensFlagMergingAfterCollapse verifies that flags from all paths
+// that collapse into the same dynamic node are properly merged and deduplicated.
+func TestAnalyzeOpensFlagMergingAfterCollapse(t *testing.T) {
+	analyzer := dynamicpathdetector.NewPathAnalyzer(3)
+	input := []types.OpenCalls{
+		{Path: "/logs/service1/app.log", Flags: []string{"READ", "WRITE"}},
+		{Path: "/logs/service2/app.log", Flags: []string{"WRITE", "APPEND"}},
+		{Path: "/logs/service3/app.log", Flags: []string{"READ"}},
+		{Path: "/logs/service4/app.log", Flags: []string{"APPEND", "READ"}},
+	}
+	result, err := dynamicpathdetector.AnalyzeOpens(input, analyzer, mapset.NewSet[string]())
+	assert.NoError(t, err)
+	assert.Equal(t, 1, len(result))
+	assert.ElementsMatch(t, []string{"APPEND", "READ", "WRITE"}, result[0].Flags, "flags should be merged and deduplicated")
+	assert.True(t, areStringSlicesUnique(result[0].Flags), "flags must be unique")
+}
+
+// TestAnalyzeOpensMultipleLevelsOfCollapse verifies behavior when both parent and
+// grandchild segments independently exceed their thresholds.
+func TestAnalyzeOpensMultipleLevelsOfCollapse(t *testing.T) {
+	analyzer := dynamicpathdetector.NewPathAnalyzer(3)
+
+	var input []types.OpenCalls
+	// 4 unique children under /multi, each with 4 unique grandchildren
+	for i := 0; i < 4; i++ {
+		for j := 0; j < 4; j++ {
+			input = append(input, types.OpenCalls{
+				Path:  fmt.Sprintf("/multi/level%d/sub%d/file", i, j),
+				Flags: []string{"READ"},
+			})
+		}
+	}
+
+	result, err := dynamicpathdetector.AnalyzeOpens(input, analyzer, mapset.NewSet[string]())
+	assert.NoError(t, err)
+	// Both /multi children and the grandchildren should collapse
+	assert.Equal(t, 1, len(result), "double collapse should yield a single path")
+	// The path should contain wildcard or dynamic segments
+	assert.True(t,
+		strings.Contains(result[0].Path, "\u22ef") || strings.Contains(result[0].Path, "*"),
+		"result %q should contain dynamic or wildcard segments", result[0].Path)
+}
+
+// TestAnalyzeOpensExistingDynamicSegmentInInput verifies that input paths
+// already containing ⋯ are handled correctly and merge with new paths.
+func TestAnalyzeOpensExistingDynamicSegmentInInput(t *testing.T) {
+	analyzer := dynamicpathdetector.NewPathAnalyzer(100)
+	input := []types.OpenCalls{
+		{Path: "/data/\u22ef/config", Flags: []string{"READ"}},
+		{Path: "/data/specific/config", Flags: []string{"WRITE"}},
+	}
+	result, err := dynamicpathdetector.AnalyzeOpens(input, analyzer, mapset.NewSet[string]())
+	assert.NoError(t, err)
+	// The specific path should be absorbed by the existing dynamic segment
+	assert.Equal(t, 1, len(result))
+	assert.Equal(t, "/data/\u22ef/config", result[0].Path)
+	assert.ElementsMatch(t, []string{"READ", "WRITE"}, result[0].Flags)
 }
 
 // Helper function to check if a slice of strings contains only unique elements
@@ -289,3 +522,59 @@ func areStringSlicesUnique(slice []string) bool {
 	}
 	return true
 }
+
+// assertContainsPath checks that at least one result has the given path.
+func assertContainsPath(t *testing.T, result []types.OpenCalls, path string) {
+	t.Helper()
+	for _, r := range result {
+		if r.Path == path {
+			return
+		}
+	}
+	assert.Fail(t, fmt.Sprintf("result does not contain path %q, got: %v", path, pathsFromResult(result)))
+}
+
+// assertContainsOneOfPaths checks that at least one result matches any of the given paths.
+// Used when both the dynamic (⋯) and wildcard (*) forms are acceptable.
+func assertContainsOneOfPaths(t *testing.T, result []types.OpenCalls, alternatives ...string) {
+	t.Helper()
+	for _, r := range result {
+		for _, alt := range alternatives {
+			if r.Path == alt {
+				return
+			}
+		}
+	}
+	assert.Fail(t, fmt.Sprintf("result does not contain any of %v, got: %v", alternatives, pathsFromResult(result)))
+}
+
+// assertPathIsOneOf checks that the given path matches one of the alternatives.
+func assertPathIsOneOf(t *testing.T, actual string, alternatives ...string) {
+	t.Helper()
+	for _, alt := range alternatives {
+		if actual == alt {
+			return
+		}
+	}
+	assert.Fail(t, fmt.Sprintf("path %q does not match any of %v", actual, alternatives))
+}
+
+// filterByPrefix returns all OpenCalls whose path starts with the given prefix.
+func filterByPrefix(result []types.OpenCalls, prefix string) []types.OpenCalls {
+	var filtered []types.OpenCalls
+	for _, r := range result {
+		if strings.HasPrefix(r.Path, prefix) {
+			filtered = append(filtered, r)
+		}
+	}
+	return filtered
+}
+
+// pathsFromResult extracts just the paths for readable error messages.
+func pathsFromResult(result []types.OpenCalls) []string {
+	paths := make([]string, len(result))
+	for i, r := range result {
+		paths[i] = r.Path
+	}
+	return paths
+}
diff --git a/pkg/registry/file/dynamicpathdetector/tests/coverage_test.go b/pkg/registry/file/dynamicpathdetector/tests/coverage_test.go
index e080380e2..28791f2b1 100644
--- a/pkg/registry/file/dynamicpathdetector/tests/coverage_test.go
+++ b/pkg/registry/file/dynamicpathdetector/tests/coverage_test.go
@@ -106,7 +106,7 @@ func TestMultipleDynamicSegments(t *testing.T) {
 	// Test with the 100th unique user and post IDs (should trigger dynamic segments)
 	result, err := analyzer.AnalyzePath("/api/users/101/posts/1031", "api")
 	assert.NoError(t, err)
-	expected := "/api/users/*/posts/\u22ef"
+	expected := "/api/users/\u22ef/posts/\u22ef"
 	assert.Equal(t, expected, result)
 }
 
diff --git a/pkg/registry/file/dynamicpathdetector/types.go b/pkg/registry/file/dynamicpathdetector/types.go
index f3fff8635..774171f6f 100644
--- a/pkg/registry/file/dynamicpathdetector/types.go
+++ b/pkg/registry/file/dynamicpathdetector/types.go
@@ -15,7 +15,10 @@ type SegmentNode struct {
 }
 
 type PathAnalyzer struct {
-	root *TrieNode
+	root       *TrieNode
+	identRoots map[string]*TrieNode
+	configs    []CollapseConfig
+	defaultCfg CollapseConfig
 }
 
 func NewTrieNode() *TrieNode {

From ede9e481f96c49f72b3a8fea18b4acf1e80a1f9b Mon Sep 17 00:00:00 2001
From: entlein <einentlein@gmail.com>
Date: Wed, 11 Feb 2026 23:23:23 +0100
Subject: [PATCH 39/68] need a more aggressive default for testing

Signed-off-by: entlein <einentlein@gmail.com>
---
 .../file/dynamicpathdetector/analyzer.go      |  2 +-
 .../tests/analyze_opens_test.go               | 43 +++++++++----------
 2 files changed, 22 insertions(+), 23 deletions(-)

diff --git a/pkg/registry/file/dynamicpathdetector/analyzer.go b/pkg/registry/file/dynamicpathdetector/analyzer.go
index 3c3ab966b..d7783f31f 100644
--- a/pkg/registry/file/dynamicpathdetector/analyzer.go
+++ b/pkg/registry/file/dynamicpathdetector/analyzer.go
@@ -17,7 +17,7 @@ var CollapseConfigs = []CollapseConfig{
 
 var DefaultCollapseConfig = CollapseConfig{
 	Prefix:    "/",
-	Threshold: 50,
+	Threshold: 5,
 }
 
 func NewPathAnalyzer(threshold int) *PathAnalyzer {
diff --git a/pkg/registry/file/dynamicpathdetector/tests/analyze_opens_test.go b/pkg/registry/file/dynamicpathdetector/tests/analyze_opens_test.go
index b660e8565..2c4ef09b9 100644
--- a/pkg/registry/file/dynamicpathdetector/tests/analyze_opens_test.go
+++ b/pkg/registry/file/dynamicpathdetector/tests/analyze_opens_test.go
@@ -113,28 +113,27 @@ func TestAnalyzeOpensWithFlagMergingAndThreshold(t *testing.T) {
 	}
 }
 
-// func TestAnalyzeOpensWithAsteriskAndEllipsis(t *testing.T) {
-// 	analyzer := dynamicpathdetector.NewPathAnalyzer(3) // Threshold of 3 OLD BEHAVIOR
-
-// 	input := []types.OpenCalls{
-// 		// These should collapse into /home/…/file.txt
-// 		{Path: "/home/user1/file.txt", Flags: []string{"READ"}},
-// 		{Path: "/home/user2/file.txt", Flags: []string{"READ"}},
-// 		{Path: "/home/user3/file.txt", Flags: []string{"READ"}},
-// 		{Path: "/home/user4/file.txt", Flags: []string{"READ"}},
-// 		{Path: "/home/user*/file.txt", Flags: []string{"READ"}},
-// 	}
-
-// 	expected := []types.OpenCalls{
-// 		{Path: "/home/\u22ef/file.txt", Flags: []string{"READ"}},
-// 	}
-
-// 	result, err := dynamicpathdetector.AnalyzeOpens(input, analyzer, mapset.NewSet[string]())
-// 	assert.NoError(t, err)
-
-// 	// Use ElementsMatch because the order of elements in the result is not guaranteed
-// 	assert.ElementsMatch(t, expected, result)
-// }
+func TestAnalyzeOpensWithAsteriskAndEllipsis(t *testing.T) {
+	analyzer := dynamicpathdetector.NewPathAnalyzer(3) // Threshold of 3 OLD BEHAVIOR
+
+	input := []types.OpenCalls{
+		// These should collapse into /home/…/file.txt
+		{Path: "/home/user1/file.txt", Flags: []string{"READ"}},
+		{Path: "/home/user2/file.txt", Flags: []string{"READ"}},
+		{Path: "/home/\u22ef/file.txt", Flags: []string{"READ"}},
+		{Path: "/home/user4/file.txt", Flags: []string{"READ"}},
+	}
+
+	expected := []types.OpenCalls{
+		{Path: "/home/\u22ef/file.txt", Flags: []string{"READ"}},
+	}
+
+	result, err := dynamicpathdetector.AnalyzeOpens(input, analyzer, mapset.NewSet[string]())
+	assert.NoError(t, err)
+
+	// Use ElementsMatch because the order of elements in the result is not guaranteed
+	assert.ElementsMatch(t, expected, result)
+}
 
 func TestAnalyzeOpensWithMultiCollapse(t *testing.T) {
 	analyzer := dynamicpathdetector.NewPathAnalyzer(5) // Threshold of 3 for /var/run prefix is set in the defaults, but here we are overwriting the defaults

From 303e41103030aba8d3646c887211dd633344090d Mon Sep 17 00:00:00 2001
From: entlein <einentlein@gmail.com>
Date: Thu, 12 Feb 2026 11:53:13 +0100
Subject: [PATCH 40/68] is it really this sbom thingy?

Signed-off-by: entlein <einentlein@gmail.com>
---
 .../file/applicationprofile_processor.go      |   4 +-
 .../file/applicationprofile_processor_test.go | 178 ++++++++++++++++++
 .../file/dynamicpathdetector/analyze_opens.go |  13 +-
 .../file/dynamicpathdetector/analyzer.go      |   3 +
 .../tests/analyze_opens_test.go               |  31 +++
 5 files changed, 216 insertions(+), 13 deletions(-)

diff --git a/pkg/registry/file/applicationprofile_processor.go b/pkg/registry/file/applicationprofile_processor.go
index 09d6b7d87..c68d8510f 100644
--- a/pkg/registry/file/applicationprofile_processor.go
+++ b/pkg/registry/file/applicationprofile_processor.go
@@ -18,8 +18,8 @@ import (
 )
 
 const (
-	OpenDynamicThreshold     = 50
-	EndpointDynamicThreshold = 100
+	OpenDynamicThreshold     = 5 //todo @constanze : this is currently in contradiction with the actual analyzer
+	EndpointDynamicThreshold = 5 // modified for testing
 )
 
 type ApplicationProfileProcessor struct {
diff --git a/pkg/registry/file/applicationprofile_processor_test.go b/pkg/registry/file/applicationprofile_processor_test.go
index e727d20b6..069f9f76b 100644
--- a/pkg/registry/file/applicationprofile_processor_test.go
+++ b/pkg/registry/file/applicationprofile_processor_test.go
@@ -4,8 +4,10 @@ import (
 	"context"
 	"fmt"
 	"slices"
+	"strings"
 	"testing"
 
+	mapset "github.com/deckarep/golang-set/v2"
 	"github.com/kubescape/k8s-interface/instanceidhandler/v1/helpers"
 	"github.com/kubescape/storage/pkg/apis/softwarecomposition"
 	"github.com/kubescape/storage/pkg/apis/softwarecomposition/consts"
@@ -247,3 +249,179 @@ func TestDeflateRulePolicies(t *testing.T) {
 		})
 	}
 }
+
+// generateSOOpens creates N unique .so OpenCalls under /usr/lib/x86_64-linux-gnu/
+func generateSOOpens(n int) []softwarecomposition.OpenCalls {
+	opens := make([]softwarecomposition.OpenCalls, n)
+	for i := 0; i < n; i++ {
+		opens[i] = softwarecomposition.OpenCalls{
+			Path:  fmt.Sprintf("/usr/lib/x86_64-linux-gnu/lib%d.so.%d", i, i%5),
+			Flags: []string{"O_RDONLY", "O_CLOEXEC"},
+		}
+	}
+	return opens
+}
+
+func TestDeflateApplicationProfileContainer_CollapsesManyOpens(t *testing.T) {
+	opens := generateSOOpens(100)
+
+	container := softwarecomposition.ApplicationProfileContainer{
+		Name:  "test-container",
+		Opens: opens,
+	}
+
+	result := deflateApplicationProfileContainer(container, nil)
+
+	assert.Less(t, len(result.Opens), 100,
+		"100 .so files should be collapsed, got %d opens", len(result.Opens))
+
+	// Verify collapsed paths contain dynamic or wildcard segments
+	for _, open := range result.Opens {
+		if strings.HasPrefix(open.Path, "/usr/lib/x86_64-linux-gnu/") {
+			assert.True(t,
+				strings.Contains(open.Path, "\u22ef") || strings.Contains(open.Path, "*"),
+				"path %q should contain a dynamic or wildcard segment", open.Path)
+		}
+	}
+
+	// Flags should be preserved and merged
+	for _, open := range result.Opens {
+		assert.NotEmpty(t, open.Flags, "flags should be preserved after collapse")
+	}
+}
+
+// Todo use the OpenDynamicThreshold in the test here not hardcoded integers
+func TestDeflateApplicationProfileContainer_CollapsesWithSbomSet(t *testing.T) {
+	opens := generateSOOpens(100)
+
+	// Build sbomSet containing ALL the .so paths (realistic scenario)
+	sbomSet := mapset.NewSet[string]()
+	for _, open := range opens {
+		sbomSet.Add(open.Path)
+	}
+
+	container := softwarecomposition.ApplicationProfileContainer{
+		Name:  "test-container",
+		Opens: opens,
+	}
+
+	result := deflateApplicationProfileContainer(container, sbomSet)
+
+	// Even though all paths are in SBOM, they should still be collapsed
+	assert.Less(t, len(result.Opens), 100,
+		"SBOM paths should be collapsed too, got %d opens", len(result.Opens))
+}
+
+// Todo use the OpenDynamicThreshold in the test here not hardcoded integers
+func TestDeflateApplicationProfileContainer_MixedPathsCollapse(t *testing.T) {
+	var opens []softwarecomposition.OpenCalls
+
+	for i := 0; i < 60; i++ {
+		opens = append(opens, softwarecomposition.OpenCalls{
+			Path:  fmt.Sprintf("/usr/lib/lib%d.so", i),
+			Flags: []string{"O_RDONLY"},
+		})
+	}
+
+	for i := 0; i < 55; i++ {
+		opens = append(opens, softwarecomposition.OpenCalls{
+			Path:  fmt.Sprintf("/etc/conf%d.cfg", i),
+			Flags: []string{"O_RDONLY"},
+		})
+	}
+
+	opens = append(opens,
+		softwarecomposition.OpenCalls{Path: "/tmp/file1.txt", Flags: []string{"O_RDWR"}},
+		softwarecomposition.OpenCalls{Path: "/tmp/file2.txt", Flags: []string{"O_RDWR"}},
+	)
+
+	container := softwarecomposition.ApplicationProfileContainer{
+		Name:  "test-container",
+		Opens: opens,
+	}
+
+	result := deflateApplicationProfileContainer(container, nil)
+
+	// Count paths by prefix
+	var usrLibPaths, etcPaths, tmpPaths int
+	for _, open := range result.Opens {
+		switch {
+		case strings.HasPrefix(open.Path, "/usr/lib/"):
+			usrLibPaths++
+		case strings.HasPrefix(open.Path, "/etc/"):
+			etcPaths++
+		case strings.HasPrefix(open.Path, "/tmp/"):
+			tmpPaths++
+		}
+	}
+
+	assert.LessOrEqual(t, usrLibPaths, 1, "/usr/lib/ paths should collapse to 1, got %d", usrLibPaths)
+	assert.LessOrEqual(t, etcPaths, 1, "/etc/ paths should collapse to 1, got %d", etcPaths)
+	assert.Equal(t, 2, tmpPaths, "/tmp/ paths should remain individual (below threshold)")
+}
+
+// TestDeflateApplicationProfileContainer_NilSbomNoError verifies that nil sbomSet
+// with a small number of opens (below threshold) works without error.
+func TestDeflateApplicationProfileContainer_NilSbomNoError(t *testing.T) {
+	container := softwarecomposition.ApplicationProfileContainer{
+		Name: "test-container",
+		Opens: []softwarecomposition.OpenCalls{
+			{Path: "/etc/hosts", Flags: []string{"O_RDONLY"}},
+			{Path: "/etc/resolv.conf", Flags: []string{"O_RDONLY"}},
+			{Path: "/usr/lib/libc.so.6", Flags: []string{"O_RDONLY", "O_CLOEXEC"}},
+		},
+	}
+
+	result := deflateApplicationProfileContainer(container, nil)
+
+	// All 3 paths should remain (below any threshold)
+	assert.Equal(t, 3, len(result.Opens), "paths below threshold should not collapse")
+	// Paths should be sorted
+	for i := 1; i < len(result.Opens); i++ {
+		assert.True(t, result.Opens[i-1].Path <= result.Opens[i].Path,
+			"opens should be sorted, got %q before %q", result.Opens[i-1].Path, result.Opens[i].Path)
+	}
+}
+
+// TestDeflateApplicationProfileContainer_PreSaveEndToEnd verifies the full
+// PreSave flow with an ApplicationProfile containing many opens that should collapse.
+func TestDeflateApplicationProfileContainer_PreSaveEndToEnd(t *testing.T) {
+	opens := generateSOOpens(100)
+
+	profile := &softwarecomposition.ApplicationProfile{
+		ObjectMeta: v1.ObjectMeta{
+			Annotations: map[string]string{},
+		},
+		Spec: softwarecomposition.ApplicationProfileSpec{
+			Containers: []softwarecomposition.ApplicationProfileContainer{
+				{
+					Name:  "main",
+					Opens: opens,
+				},
+			},
+		},
+	}
+
+	processor := NewApplicationProfileProcessor(config.Config{
+		DefaultNamespace:          "kubescape",
+		MaxApplicationProfileSize: 100000,
+	})
+
+	err := processor.PreSave(context.TODO(), profile)
+	assert.NoError(t, err)
+
+	// Todo use the OpenDynamicThreshold in the test here not hardcoded integers
+	resultOpens := profile.Spec.Containers[0].Opens
+	assert.Less(t, len(resultOpens), 100,
+		"PreSave should collapse 100 .so files, got %d opens", len(resultOpens))
+
+	// The collapsed path should contain dynamic or wildcard segments
+	hasCollapsed := false
+	for _, open := range resultOpens {
+		if strings.Contains(open.Path, "\u22ef") || strings.Contains(open.Path, "*") {
+			hasCollapsed = true
+			break
+		}
+	}
+	assert.True(t, hasCollapsed, "at least one path should contain a dynamic/wildcard segment after PreSave")
+}
diff --git a/pkg/registry/file/dynamicpathdetector/analyze_opens.go b/pkg/registry/file/dynamicpathdetector/analyze_opens.go
index 554325e31..8750adff5 100644
--- a/pkg/registry/file/dynamicpathdetector/analyze_opens.go
+++ b/pkg/registry/file/dynamicpathdetector/analyze_opens.go
@@ -1,7 +1,6 @@
 package dynamicpathdetector
 
 import (
-	"errors"
 	"maps"
 	"slices"
 	"strings"
@@ -15,22 +14,14 @@ func AnalyzeOpens(opens []types.OpenCalls, analyzer *PathAnalyzer, sbomSet mapse
 		return nil, nil
 	}
 
-	if sbomSet == nil {
-		return nil, errors.New("sbomSet is nil")
-	}
-
+	// First pass: build trie from all paths
 	dynamicOpens := make(map[string]types.OpenCalls)
 	for _, open := range opens {
 		_, _ = AnalyzeOpen(open.Path, analyzer)
 	}
 
+	// Second pass: read collapsed paths and merge
 	for i := range opens {
-		// sbomSet files have to be always present in the dynamicOpens
-		if sbomSet.ContainsOne(opens[i].Path) {
-			dynamicOpens[opens[i].Path] = opens[i]
-			continue
-		}
-
 		result, err := AnalyzeOpen(opens[i].Path, analyzer)
 		if err != nil {
 			continue
diff --git a/pkg/registry/file/dynamicpathdetector/analyzer.go b/pkg/registry/file/dynamicpathdetector/analyzer.go
index d7783f31f..14a7f80a3 100644
--- a/pkg/registry/file/dynamicpathdetector/analyzer.go
+++ b/pkg/registry/file/dynamicpathdetector/analyzer.go
@@ -4,10 +4,12 @@ import (
 	"strings"
 )
 
+// TODO define the two Wildcards in the same place
 const (
 	WildcardIdentifier = "*"
 )
 
+// TODO move this to whereever we define those Configs, write tests that they are consistent
 var CollapseConfigs = []CollapseConfig{
 	{Prefix: "/etc", Threshold: 50},
 	{Prefix: "/opt", Threshold: 5},
@@ -15,6 +17,7 @@ var CollapseConfigs = []CollapseConfig{
 	{Prefix: "/app", Threshold: 1},
 }
 
+// TODO replace the Threshold Integer with the struct everywhere in codebase and tests
 var DefaultCollapseConfig = CollapseConfig{
 	Prefix:    "/",
 	Threshold: 5,
diff --git a/pkg/registry/file/dynamicpathdetector/tests/analyze_opens_test.go b/pkg/registry/file/dynamicpathdetector/tests/analyze_opens_test.go
index 2c4ef09b9..79aafb0cb 100644
--- a/pkg/registry/file/dynamicpathdetector/tests/analyze_opens_test.go
+++ b/pkg/registry/file/dynamicpathdetector/tests/analyze_opens_test.go
@@ -510,6 +510,37 @@ func TestAnalyzeOpensExistingDynamicSegmentInInput(t *testing.T) {
 	assert.ElementsMatch(t, []string{"READ", "WRITE"}, result[0].Flags)
 }
 
+// TestAnalyzeOpens_NilSbomSetNoError verifies that passing a nil sbomSet
+// does not return an error (previously it did).
+func TestAnalyzeOpens_NilSbomSetNoError(t *testing.T) {
+	analyzer := dynamicpathdetector.NewPathAnalyzer(3)
+	input := []types.OpenCalls{
+		{Path: "/usr/lib/libfoo.so", Flags: []string{"READ"}},
+		{Path: "/usr/lib/libbar.so", Flags: []string{"READ"}},
+	}
+	result, err := dynamicpathdetector.AnalyzeOpens(input, analyzer, nil)
+	assert.NoError(t, err, "nil sbomSet should not cause an error")
+	assert.Equal(t, 2, len(result), "paths below threshold should remain individual")
+}
+
+// TestAnalyzeOpens_NilSbomSetWithCollapse verifies that collapse works
+// correctly even when sbomSet is nil.
+func TestAnalyzeOpens_NilSbomSetWithCollapse(t *testing.T) {
+	analyzer := dynamicpathdetector.NewPathAnalyzer(3)
+	input := []types.OpenCalls{
+		{Path: "/usr/lib/liba.so", Flags: []string{"READ"}},
+		{Path: "/usr/lib/libb.so", Flags: []string{"READ"}},
+		{Path: "/usr/lib/libc.so", Flags: []string{"WRITE"}},
+		{Path: "/usr/lib/libd.so", Flags: []string{"APPEND"}},
+	}
+	result, err := dynamicpathdetector.AnalyzeOpens(input, analyzer, nil)
+	assert.NoError(t, err)
+	assert.Equal(t, 1, len(result), "4 children > threshold 3, should collapse")
+	assert.True(t,
+		strings.Contains(result[0].Path, "\u22ef") || strings.Contains(result[0].Path, "*"),
+		"collapsed path should contain dynamic or wildcard segment, got %q", result[0].Path)
+}
+
 // Helper function to check if a slice of strings contains only unique elements
 func areStringSlicesUnique(slice []string) bool {
 	seen := make(map[string]struct{})

From 97b0a0753f45f2a0903f7aea9415d8849de996fc Mon Sep 17 00:00:00 2001
From: entlein <einentlein@gmail.com>
Date: Thu, 12 Feb 2026 17:11:27 +0100
Subject: [PATCH 41/68] need to add a git tag

Signed-off-by: entlein <einentlein@gmail.com>
---
 .github/workflows/build.yaml | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/.github/workflows/build.yaml b/.github/workflows/build.yaml
index 82ffc26bc..a0d044b3e 100644
--- a/.github/workflows/build.yaml
+++ b/.github/workflows/build.yaml
@@ -19,7 +19,20 @@ on:
             required: false
             default: false
 jobs:
+  tag-for-go-module:
+    name: Create Git tag so Go modules can resolve this version
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    steps:
+      - uses: actions/checkout@v4
+      - name: Create git tag matching IMAGE_TAG
+        run: |
+          git tag -f "go/${{ inputs.IMAGE_TAG }}"
+          git push origin "go/${{ inputs.IMAGE_TAG }}" --force
+
   publish-image:
+    needs: tag-for-go-module
     permissions:
       id-token: write
       packages: write

From 1389b985ae8f800de071d1092c9cb00297f1da4f Mon Sep 17 00:00:00 2001
From: entlein <einentlein@gmail.com>
Date: Thu, 12 Feb 2026 16:26:35 +0000
Subject: [PATCH 42/68] ci: auto-trigger node-agent build after storage push

Add push trigger on test/localtestbuild branch. After building the
storage image, the workflow now triggers node-agent's build.yaml
with the same IMAGE_TAG via CROSS_REPO_PAT secret.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---
 .github/workflows/build.yaml | 62 +++++++++++++++++++++++++++++++-----
 1 file changed, 54 insertions(+), 8 deletions(-)

diff --git a/.github/workflows/build.yaml b/.github/workflows/build.yaml
index a0d044b3e..490fb1864 100644
--- a/.github/workflows/build.yaml
+++ b/.github/workflows/build.yaml
@@ -18,8 +18,37 @@ on:
             type: boolean
             required: false
             default: false
+    push:
+      branches:
+        - test/localtestbuild
+
 jobs:
+  prepare:
+    name: Resolve build parameters
+    runs-on: ubuntu-latest
+    outputs:
+      image_tag: ${{ steps.params.outputs.image_tag }}
+      client: ${{ steps.params.outputs.client }}
+      platforms: ${{ steps.params.outputs.platforms }}
+      cosign: ${{ steps.params.outputs.cosign }}
+    steps:
+      - id: params
+        run: |
+          if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
+            echo "image_tag=${{ inputs.IMAGE_TAG }}" >> "$GITHUB_OUTPUT"
+            echo "client=${{ inputs.CLIENT }}" >> "$GITHUB_OUTPUT"
+            echo "platforms=${{ inputs.PLATFORMS }}" >> "$GITHUB_OUTPUT"
+            echo "cosign=${{ inputs.CO_SIGN }}" >> "$GITHUB_OUTPUT"
+          else
+            # Push trigger: derive tag from short commit SHA
+            echo "image_tag=dev-${GITHUB_SHA::7}" >> "$GITHUB_OUTPUT"
+            echo "client=test" >> "$GITHUB_OUTPUT"
+            echo "platforms=false" >> "$GITHUB_OUTPUT"
+            echo "cosign=false" >> "$GITHUB_OUTPUT"
+          fi
+
   tag-for-go-module:
+    needs: prepare
     name: Create Git tag so Go modules can resolve this version
     runs-on: ubuntu-latest
     permissions:
@@ -28,20 +57,37 @@ jobs:
       - uses: actions/checkout@v4
       - name: Create git tag matching IMAGE_TAG
         run: |
-          git tag -f "go/${{ inputs.IMAGE_TAG }}"
-          git push origin "go/${{ inputs.IMAGE_TAG }}" --force
+          git tag -f "go/${{ needs.prepare.outputs.image_tag }}"
+          git push origin "go/${{ needs.prepare.outputs.image_tag }}" --force
 
   publish-image:
-    needs: tag-for-go-module
+    needs: [prepare, tag-for-go-module]
     permissions:
       id-token: write
       packages: write
       contents: read
     uses: ./.github/workflows/publish-image.yaml
     with:
-      client: ${{ inputs.CLIENT }}
+      client: ${{ needs.prepare.outputs.client }}
       image_name: "ghcr.io/${{ github.repository_owner }}/storage"
-      image_tag: ${{ inputs.IMAGE_TAG }}
-      support_platforms: ${{ inputs.PLATFORMS }}
-      cosign: ${{ inputs.CO_SIGN }}
-    secrets: inherit
\ No newline at end of file
+      image_tag: ${{ needs.prepare.outputs.image_tag }}
+      support_platforms: ${{ needs.prepare.outputs.platforms == 'true' }}
+      cosign: ${{ needs.prepare.outputs.cosign == 'true' }}
+    secrets: inherit
+
+  trigger-node-agent:
+    needs: [prepare, publish-image]
+    name: Trigger node-agent rebuild with matching tag
+    runs-on: ubuntu-latest
+    steps:
+      - name: Trigger node-agent build
+        env:
+          GH_TOKEN: ${{ secrets.CROSS_REPO_PAT }}
+        run: |
+          IMAGE_TAG="${{ needs.prepare.outputs.image_tag }}"
+          echo "Triggering node-agent build with IMAGE_TAG=${IMAGE_TAG} STORAGE_REF=${IMAGE_TAG}"
+          gh workflow run build.yaml \
+            --repo "${{ github.repository_owner }}/node-agent" \
+            --ref test/localtestbuild \
+            -f IMAGE_TAG="${IMAGE_TAG}" \
+            -f STORAGE_REF="${IMAGE_TAG}"

From ef26bee09329047d8ada4699e82c37a6b8989a11 Mon Sep 17 00:00:00 2001
From: entlein <einentlein@gmail.com>
Date: Thu, 12 Feb 2026 20:09:35 +0100
Subject: [PATCH 43/68] cleaning up some

Signed-off-by: entlein <einentlein@gmail.com>
---
 .../file/applicationprofile_processor.go      |  10 +-
 .../file/applicationprofile_processor_test.go |  44 +-
 .../file/containerprofile_processor.go        |   4 +-
 .../file/dynamicpathdetector/analyzer.go      |  21 +-
 .../tests/analyze_endpoints_test.go           |  33 +-
 .../tests/analyze_opens_test.go               | 384 +++++++++---------
 .../tests/benchmark_test.go                   |   6 +-
 .../tests/coverage_test.go                    |  80 ++--
 .../file/dynamicpathdetector/types.go         |  47 ++-
 9 files changed, 345 insertions(+), 284 deletions(-)

diff --git a/pkg/registry/file/applicationprofile_processor.go b/pkg/registry/file/applicationprofile_processor.go
index c68d8510f..3c75df152 100644
--- a/pkg/registry/file/applicationprofile_processor.go
+++ b/pkg/registry/file/applicationprofile_processor.go
@@ -17,10 +17,8 @@ import (
 	"k8s.io/apimachinery/pkg/runtime"
 )
 
-const (
-	OpenDynamicThreshold     = 5 //todo @constanze : this is currently in contradiction with the actual analyzer
-	EndpointDynamicThreshold = 5 // modified for testing
-)
+// Thresholds are defined in dynamicpathdetector.OpenDynamicThreshold and
+// dynamicpathdetector.EndpointDynamicThreshold (single source of truth).
 
 type ApplicationProfileProcessor struct {
 	defaultNamespace          string
@@ -109,12 +107,12 @@ func (a *ApplicationProfileProcessor) SetStorage(containerProfileStorage Contain
 }
 
 func deflateApplicationProfileContainer(container softwarecomposition.ApplicationProfileContainer, sbomSet mapset.Set[string]) softwarecomposition.ApplicationProfileContainer {
-	opens, err := dynamicpathdetector.AnalyzeOpens(container.Opens, dynamicpathdetector.NewPathAnalyzer(OpenDynamicThreshold), sbomSet)
+	opens, err := dynamicpathdetector.AnalyzeOpens(container.Opens, dynamicpathdetector.NewPathAnalyzer(dynamicpathdetector.OpenDynamicThreshold), sbomSet)
 	if err != nil {
 		logger.L().Debug("falling back to DeflateStringer for opens", loggerhelpers.Error(err))
 		opens = DeflateStringer(container.Opens)
 	}
-	endpoints := dynamicpathdetector.AnalyzeEndpoints(&container.Endpoints, dynamicpathdetector.NewPathAnalyzer(EndpointDynamicThreshold))
+	endpoints := dynamicpathdetector.AnalyzeEndpoints(&container.Endpoints, dynamicpathdetector.NewPathAnalyzer(dynamicpathdetector.EndpointDynamicThreshold))
 	identifiedCallStacks := callstack.UnifyIdentifiedCallStacks(container.IdentifiedCallStacks)
 
 	return softwarecomposition.ApplicationProfileContainer{
diff --git a/pkg/registry/file/applicationprofile_processor_test.go b/pkg/registry/file/applicationprofile_processor_test.go
index 069f9f76b..f097b2c21 100644
--- a/pkg/registry/file/applicationprofile_processor_test.go
+++ b/pkg/registry/file/applicationprofile_processor_test.go
@@ -12,11 +12,24 @@ import (
 	"github.com/kubescape/storage/pkg/apis/softwarecomposition"
 	"github.com/kubescape/storage/pkg/apis/softwarecomposition/consts"
 	"github.com/kubescape/storage/pkg/config"
+	"github.com/kubescape/storage/pkg/registry/file/dynamicpathdetector"
 	"github.com/stretchr/testify/assert"
 	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/runtime"
 )
 
+// configThreshold returns the collapse threshold for the given path prefix
+// from dynamicpathdetector.DefaultCollapseConfigs. Falls back to
+// dynamicpathdetector.DefaultCollapseConfig.Threshold for unconfigured prefixes.
+func configThreshold(prefix string) int {
+	for _, cfg := range dynamicpathdetector.DefaultCollapseConfigs {
+		if cfg.Prefix == prefix {
+			return cfg.Threshold
+		}
+	}
+	return dynamicpathdetector.DefaultCollapseConfig.Threshold
+}
+
 var ap = softwarecomposition.ApplicationProfile{
 	ObjectMeta: v1.ObjectMeta{
 		Annotations: map[string]string{},
@@ -263,7 +276,9 @@ func generateSOOpens(n int) []softwarecomposition.OpenCalls {
 }
 
 func TestDeflateApplicationProfileContainer_CollapsesManyOpens(t *testing.T) {
-	opens := generateSOOpens(100)
+	// Generate enough opens to exceed the threshold for /usr/lib (uses default config)
+	numOpens := configThreshold("/usr/lib") + 1
+	opens := generateSOOpens(numOpens)
 
 	container := softwarecomposition.ApplicationProfileContainer{
 		Name:  "test-container",
@@ -272,8 +287,8 @@ func TestDeflateApplicationProfileContainer_CollapsesManyOpens(t *testing.T) {
 
 	result := deflateApplicationProfileContainer(container, nil)
 
-	assert.Less(t, len(result.Opens), 100,
-		"100 .so files should be collapsed, got %d opens", len(result.Opens))
+	assert.Less(t, len(result.Opens), numOpens,
+		"%d .so files should be collapsed, got %d opens", numOpens, len(result.Opens))
 
 	// Verify collapsed paths contain dynamic or wildcard segments
 	for _, open := range result.Opens {
@@ -290,9 +305,9 @@ func TestDeflateApplicationProfileContainer_CollapsesManyOpens(t *testing.T) {
 	}
 }
 
-// Todo use the OpenDynamicThreshold in the test here not hardcoded integers
 func TestDeflateApplicationProfileContainer_CollapsesWithSbomSet(t *testing.T) {
-	opens := generateSOOpens(100)
+	numOpens := configThreshold("/usr/lib") + 1
+	opens := generateSOOpens(numOpens)
 
 	// Build sbomSet containing ALL the .so paths (realistic scenario)
 	sbomSet := mapset.NewSet[string]()
@@ -308,22 +323,25 @@ func TestDeflateApplicationProfileContainer_CollapsesWithSbomSet(t *testing.T) {
 	result := deflateApplicationProfileContainer(container, sbomSet)
 
 	// Even though all paths are in SBOM, they should still be collapsed
-	assert.Less(t, len(result.Opens), 100,
+	assert.Less(t, len(result.Opens), numOpens,
 		"SBOM paths should be collapsed too, got %d opens", len(result.Opens))
 }
 
-// Todo use the OpenDynamicThreshold in the test here not hardcoded integers
 func TestDeflateApplicationProfileContainer_MixedPathsCollapse(t *testing.T) {
 	var opens []softwarecomposition.OpenCalls
 
-	for i := 0; i < 60; i++ {
+	// /usr/lib uses the default threshold (no specific prefix config)
+	usrLibThreshold := configThreshold("/usr/lib")
+	for i := 0; i < usrLibThreshold+1; i++ {
 		opens = append(opens, softwarecomposition.OpenCalls{
 			Path:  fmt.Sprintf("/usr/lib/lib%d.so", i),
 			Flags: []string{"O_RDONLY"},
 		})
 	}
 
-	for i := 0; i < 55; i++ {
+	// /etc has its own threshold in DefaultCollapseConfigs
+	etcThreshold := configThreshold("/etc")
+	for i := 0; i < etcThreshold+1; i++ {
 		opens = append(opens, softwarecomposition.OpenCalls{
 			Path:  fmt.Sprintf("/etc/conf%d.cfg", i),
 			Flags: []string{"O_RDONLY"},
@@ -386,7 +404,8 @@ func TestDeflateApplicationProfileContainer_NilSbomNoError(t *testing.T) {
 // TestDeflateApplicationProfileContainer_PreSaveEndToEnd verifies the full
 // PreSave flow with an ApplicationProfile containing many opens that should collapse.
 func TestDeflateApplicationProfileContainer_PreSaveEndToEnd(t *testing.T) {
-	opens := generateSOOpens(100)
+	numOpens := configThreshold("/usr/lib") + 1
+	opens := generateSOOpens(numOpens)
 
 	profile := &softwarecomposition.ApplicationProfile{
 		ObjectMeta: v1.ObjectMeta{
@@ -410,10 +429,9 @@ func TestDeflateApplicationProfileContainer_PreSaveEndToEnd(t *testing.T) {
 	err := processor.PreSave(context.TODO(), profile)
 	assert.NoError(t, err)
 
-	// Todo use the OpenDynamicThreshold in the test here not hardcoded integers
 	resultOpens := profile.Spec.Containers[0].Opens
-	assert.Less(t, len(resultOpens), 100,
-		"PreSave should collapse 100 .so files, got %d opens", len(resultOpens))
+	assert.Less(t, len(resultOpens), numOpens,
+		"PreSave should collapse %d .so files, got %d opens", numOpens, len(resultOpens))
 
 	// The collapsed path should contain dynamic or wildcard segments
 	hasCollapsed := false
diff --git a/pkg/registry/file/containerprofile_processor.go b/pkg/registry/file/containerprofile_processor.go
index 9560a40d2..904fc89d9 100644
--- a/pkg/registry/file/containerprofile_processor.go
+++ b/pkg/registry/file/containerprofile_processor.go
@@ -701,12 +701,12 @@ func (a *ContainerProfileProcessor) getAggregatedData(ctx context.Context, key s
 }
 
 func DeflateContainerProfileSpec(container softwarecomposition.ContainerProfileSpec, sbomSet mapset.Set[string]) softwarecomposition.ContainerProfileSpec {
-	opens, err := dynamicpathdetector.AnalyzeOpens(container.Opens, dynamicpathdetector.NewPathAnalyzer(OpenDynamicThreshold), sbomSet)
+	opens, err := dynamicpathdetector.AnalyzeOpens(container.Opens, dynamicpathdetector.NewPathAnalyzer(dynamicpathdetector.OpenDynamicThreshold), sbomSet)
 	if err != nil {
 		logger.L().Debug("ContainerProfileProcessor.deflateContainerProfileSpec - falling back to DeflateStringer for opens", loggerhelpers.Error(err))
 		opens = DeflateStringer(container.Opens)
 	}
-	endpoints := dynamicpathdetector.AnalyzeEndpoints(&container.Endpoints, dynamicpathdetector.NewPathAnalyzer(EndpointDynamicThreshold))
+	endpoints := dynamicpathdetector.AnalyzeEndpoints(&container.Endpoints, dynamicpathdetector.NewPathAnalyzer(dynamicpathdetector.EndpointDynamicThreshold))
 	identifiedCallStacks := callstack.UnifyIdentifiedCallStacks(container.IdentifiedCallStacks)
 
 	return softwarecomposition.ContainerProfileSpec{
diff --git a/pkg/registry/file/dynamicpathdetector/analyzer.go b/pkg/registry/file/dynamicpathdetector/analyzer.go
index 14a7f80a3..744060427 100644
--- a/pkg/registry/file/dynamicpathdetector/analyzer.go
+++ b/pkg/registry/file/dynamicpathdetector/analyzer.go
@@ -4,27 +4,8 @@ import (
 	"strings"
 )
 
-// TODO define the two Wildcards in the same place
-const (
-	WildcardIdentifier = "*"
-)
-
-// TODO move this to whereever we define those Configs, write tests that they are consistent
-var CollapseConfigs = []CollapseConfig{
-	{Prefix: "/etc", Threshold: 50},
-	{Prefix: "/opt", Threshold: 5},
-	{Prefix: "/var/run", Threshold: 3},
-	{Prefix: "/app", Threshold: 1},
-}
-
-// TODO replace the Threshold Integer with the struct everywhere in codebase and tests
-var DefaultCollapseConfig = CollapseConfig{
-	Prefix:    "/",
-	Threshold: 5,
-}
-
 func NewPathAnalyzer(threshold int) *PathAnalyzer {
-	return newAnalyzer(CollapseConfig{Prefix: "/", Threshold: threshold}, CollapseConfigs)
+	return newAnalyzer(CollapseConfig{Prefix: "/", Threshold: threshold}, DefaultCollapseConfigs)
 }
 
 func NewPathAnalyzerWithConfigs(configs []CollapseConfig) *PathAnalyzer {
diff --git a/pkg/registry/file/dynamicpathdetector/tests/analyze_endpoints_test.go b/pkg/registry/file/dynamicpathdetector/tests/analyze_endpoints_test.go
index 932b98fd8..817c5f52c 100644
--- a/pkg/registry/file/dynamicpathdetector/tests/analyze_endpoints_test.go
+++ b/pkg/registry/file/dynamicpathdetector/tests/analyze_endpoints_test.go
@@ -12,7 +12,7 @@ import (
 )
 
 func TestAnalyzeEndpoints(t *testing.T) {
-	analyzer := dynamicpathdetector.NewPathAnalyzer(100)
+	analyzer := dynamicpathdetector.NewPathAnalyzer(dynamicpathdetector.EndpointDynamicThreshold)
 
 	tests := []struct {
 		name     string
@@ -38,7 +38,7 @@ func TestAnalyzeEndpoints(t *testing.T) {
 			name: "Test with multiple endpoints",
 			input: []types.HTTPEndpoint{
 				{
-					Endpoint: ":80/users/\u22ef", //debug : is it the ellipsis character
+					Endpoint: ":80/users/\u22ef",
 					Methods:  []string{"GET"},
 				},
 				{
@@ -144,7 +144,6 @@ func TestAnalyzeEndpoints(t *testing.T) {
 					Headers:  json.RawMessage(`{"Content-Type": ["application/xml"], "Authorization": ["Bearer token"]}`),
 				},
 			},
-			//TODO @constanze revisit this once you tackle endpoints, the path matching logic is applied here the same way as for file paths
 			expected: []types.HTTPEndpoint{
 				{
 					Endpoint: ":80/x/\u22ef/posts/\u22ef",
@@ -169,10 +168,11 @@ func TestAnalyzeEndpoints(t *testing.T) {
 }
 
 func TestAnalyzeEndpointsWithThreshold(t *testing.T) {
-	analyzer := dynamicpathdetector.NewPathAnalyzer(100)
+	threshold := dynamicpathdetector.EndpointDynamicThreshold
+	analyzer := dynamicpathdetector.NewPathAnalyzer(threshold)
 
 	var input []types.HTTPEndpoint
-	for i := 0; i < 101; i++ {
+	for i := 0; i < threshold+1; i++ {
 		input = append(input, types.HTTPEndpoint{
 			Endpoint: fmt.Sprintf(":80/users/%d", i),
 			Methods:  []string{"GET"},
@@ -191,10 +191,11 @@ func TestAnalyzeEndpointsWithThreshold(t *testing.T) {
 }
 
 func TestAnalyzeEndpointsWithExactThreshold(t *testing.T) {
-	analyzer := dynamicpathdetector.NewPathAnalyzer(100)
+	threshold := dynamicpathdetector.EndpointDynamicThreshold
+	analyzer := dynamicpathdetector.NewPathAnalyzer(threshold)
 
 	var input []types.HTTPEndpoint
-	for i := 0; i < 100; i++ {
+	for i := 0; i < threshold; i++ {
 		input = append(input, types.HTTPEndpoint{
 			Endpoint: fmt.Sprintf(":80/users/%d", i),
 			Methods:  []string{"GET"},
@@ -203,18 +204,17 @@ func TestAnalyzeEndpointsWithExactThreshold(t *testing.T) {
 
 	result := dynamicpathdetector.AnalyzeEndpoints(&input, analyzer)
 
-	// Check that all 100 endpoints are still individual
-	assert.Equal(t, 100, len(result))
+	// At exact threshold: all endpoints should remain individual
+	assert.Equal(t, threshold, len(result))
 
 	// Now add one more endpoint to trigger the dynamic behavior
 	input = append(input, types.HTTPEndpoint{
-		Endpoint: ":80/users/100",
+		Endpoint: fmt.Sprintf(":80/users/%d", threshold),
 		Methods:  []string{"GET"},
 	})
 
 	result = dynamicpathdetector.AnalyzeEndpoints(&input, analyzer)
 
-	// Check that all endpoints are now merged into one dynamic endpoint
 	expected := []types.HTTPEndpoint{
 		{
 			Endpoint: ":80/users/\u22ef",
@@ -225,7 +225,7 @@ func TestAnalyzeEndpointsWithExactThreshold(t *testing.T) {
 }
 
 func TestAnalyzeEndpointsWithInvalidURL(t *testing.T) {
-	analyzer := dynamicpathdetector.NewPathAnalyzer(100)
+	analyzer := dynamicpathdetector.NewPathAnalyzer(dynamicpathdetector.EndpointDynamicThreshold)
 
 	input := []types.HTTPEndpoint{
 		{
@@ -239,7 +239,7 @@ func TestAnalyzeEndpointsWithInvalidURL(t *testing.T) {
 }
 
 func TestAnalyzeEndpointsWildcardPortAbsorbsSpecificPort(t *testing.T) {
-	analyzer := dynamicpathdetector.NewPathAnalyzer(100)
+	analyzer := dynamicpathdetector.NewPathAnalyzer(dynamicpathdetector.EndpointDynamicThreshold)
 
 	input := []types.HTTPEndpoint{
 		{
@@ -256,7 +256,6 @@ func TestAnalyzeEndpointsWildcardPortAbsorbsSpecificPort(t *testing.T) {
 
 	result := dynamicpathdetector.AnalyzeEndpoints(&input, analyzer)
 
-	// Both endpoints should use the wildcard port
 	for _, ep := range result {
 		port := ep.Endpoint[:len(":0")]
 		assert.Equal(t, ":0", port, "endpoint %s should have wildcard port", ep.Endpoint)
@@ -264,7 +263,7 @@ func TestAnalyzeEndpointsWildcardPortAbsorbsSpecificPort(t *testing.T) {
 }
 
 func TestAnalyzeEndpointsWildcardPortAfterSpecificPorts(t *testing.T) {
-	analyzer := dynamicpathdetector.NewPathAnalyzer(100)
+	analyzer := dynamicpathdetector.NewPathAnalyzer(dynamicpathdetector.EndpointDynamicThreshold)
 
 	input := []types.HTTPEndpoint{
 		{
@@ -281,7 +280,6 @@ func TestAnalyzeEndpointsWildcardPortAfterSpecificPorts(t *testing.T) {
 
 	result := dynamicpathdetector.AnalyzeEndpoints(&input, analyzer)
 
-	// 0 is the wildcard port,
 	for _, ep := range result {
 		port := ep.Endpoint[:len(":0")]
 		assert.Equal(t, ":0", port, "endpoint %s should have wildcard port", ep.Endpoint)
@@ -289,7 +287,7 @@ func TestAnalyzeEndpointsWildcardPortAfterSpecificPorts(t *testing.T) {
 }
 
 func TestAnalyzeEndpointsMultiplePortsMergeIntoWildcard(t *testing.T) {
-	analyzer := dynamicpathdetector.NewPathAnalyzer(100)
+	analyzer := dynamicpathdetector.NewPathAnalyzer(dynamicpathdetector.EndpointDynamicThreshold)
 
 	input := []types.HTTPEndpoint{
 		{
@@ -311,7 +309,6 @@ func TestAnalyzeEndpointsMultiplePortsMergeIntoWildcard(t *testing.T) {
 
 	result := dynamicpathdetector.AnalyzeEndpoints(&input, analyzer)
 
-	// All three should merge into a single wildcard endpoint
 	assert.Equal(t, 1, len(result))
 	assert.Equal(t, ":0/api/data", result[0].Endpoint)
 	assert.Equal(t, []string{"GET", "POST", "PUT"}, result[0].Methods)
diff --git a/pkg/registry/file/dynamicpathdetector/tests/analyze_opens_test.go b/pkg/registry/file/dynamicpathdetector/tests/analyze_opens_test.go
index 79aafb0cb..b6f174587 100644
--- a/pkg/registry/file/dynamicpathdetector/tests/analyze_opens_test.go
+++ b/pkg/registry/file/dynamicpathdetector/tests/analyze_opens_test.go
@@ -2,6 +2,7 @@ package dynamicpathdetectortests
 
 import (
 	"fmt"
+	"sort"
 	"strings"
 	"testing"
 
@@ -12,10 +13,11 @@ import (
 )
 
 func TestAnalyzeOpensWithThreshold(t *testing.T) {
-	analyzer := dynamicpathdetector.NewPathAnalyzer(100)
+	threshold := dynamicpathdetector.OpenDynamicThreshold
+	analyzer := dynamicpathdetector.NewPathAnalyzer(threshold)
 
 	var input []types.OpenCalls
-	for i := 0; i < 101; i++ {
+	for i := 0; i < threshold+1; i++ {
 		input = append(input, types.OpenCalls{
 			Path: fmt.Sprintf("/home/user%d/file.txt", i),
 		})
@@ -34,21 +36,19 @@ func TestAnalyzeOpensWithThreshold(t *testing.T) {
 }
 
 func TestAnalyzeOpensWithFlagMergingAndThreshold(t *testing.T) {
+	// Use /var/run threshold (3) — low enough that hand-written subtests work
+	threshold := configThreshold("/var/run")
+
 	tests := []struct {
 		name     string
 		input    []types.OpenCalls
 		expected []types.OpenCalls
 	}{
 		{
-			name: "Merge flags for paths exceeding threshold",
-			input: []types.OpenCalls{
-				{Path: "/home/user1/file.txt", Flags: []string{"READ"}},
-				{Path: "/home/user2/file.txt", Flags: []string{"WRITE"}},
-				{Path: "/home/user3/file.txt", Flags: []string{"APPEND"}},
-				{Path: "/home/user4/file.txt", Flags: []string{"READ", "WRITE"}},
-			},
+			name:  "Merge flags for paths exceeding threshold",
+			input: generateOpenCallsWithFlags("/home", "file.txt", threshold+1),
 			expected: []types.OpenCalls{
-				{Path: "/home/\u22ef/file.txt", Flags: []string{"APPEND", "READ", "WRITE"}},
+				{Path: "/home/\u22ef/file.txt", Flags: flagsForN(threshold + 1)},
 			},
 		},
 		{
@@ -64,42 +64,33 @@ func TestAnalyzeOpensWithFlagMergingAndThreshold(t *testing.T) {
 		},
 		{
 			name: "Partial merging for some paths exceeding threshold",
-			input: []types.OpenCalls{
-				{Path: "/home/user1/common.txt", Flags: []string{"READ"}},
-				{Path: "/home/user2/common.txt", Flags: []string{"WRITE"}},
-				{Path: "/home/user3/common.txt", Flags: []string{"APPEND"}},
-				{Path: "/home/user4/common.txt", Flags: []string{"READ", "WRITE"}},
-				{Path: "/var/log/app1.log", Flags: []string{"READ"}},
-				{Path: "/var/log/app2.log", Flags: []string{"WRITE"}},
-			},
+			input: append(
+				generateOpenCallsWithFlags("/home", "common.txt", threshold+1),
+				types.OpenCalls{Path: "/var/log/app1.log", Flags: []string{"READ"}},
+				types.OpenCalls{Path: "/var/log/app2.log", Flags: []string{"WRITE"}},
+			),
 			expected: []types.OpenCalls{
-				{Path: "/home/\u22ef/common.txt", Flags: []string{"APPEND", "READ", "WRITE"}},
+				{Path: "/home/\u22ef/common.txt", Flags: flagsForN(threshold + 1)},
 				{Path: "/var/log/app1.log", Flags: []string{"READ"}},
 				{Path: "/var/log/app2.log", Flags: []string{"WRITE"}},
 			},
 		},
 		{
 			name: "Multiple dynamic segments",
-			input: []types.OpenCalls{
-				{Path: "/home/user1/file1.txt", Flags: []string{"READ"}},
-				{Path: "/home/user2/file1.txt", Flags: []string{"WRITE"}},
-				{Path: "/home/user3/file1.txt", Flags: []string{"APPEND"}},
-				{Path: "/home/user4/file1.txt", Flags: []string{"READ", "WRITE"}},
-				{Path: "/home/user1/file2.txt", Flags: []string{"READ"}},
-				{Path: "/home/user2/file2.txt", Flags: []string{"WRITE"}},
-				{Path: "/home/user3/file2.txt", Flags: []string{"APPEND"}},
-				{Path: "/home/user4/file2.txt", Flags: []string{"READ", "WRITE"}},
-			},
+			input: append(
+				generateOpenCallsWithFlags("/home", "file1.txt", threshold+1),
+				generateOpenCallsWithFlags("/home", "file2.txt", threshold+1)...,
+			),
 			expected: []types.OpenCalls{
-				{Path: "/home/\u22ef/file1.txt", Flags: []string{"APPEND", "READ", "WRITE"}},
-				{Path: "/home/\u22ef/file2.txt", Flags: []string{"APPEND", "READ", "WRITE"}},
+				{Path: "/home/\u22ef/file1.txt", Flags: flagsForN(threshold + 1)},
+				{Path: "/home/\u22ef/file2.txt", Flags: flagsForN(threshold + 1)},
 			},
 		},
 	}
 
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
-			analyzer := dynamicpathdetector.NewPathAnalyzer(3)
+			analyzer := dynamicpathdetector.NewPathAnalyzer(threshold)
 			result, err := dynamicpathdetector.AnalyzeOpens(tt.input, analyzer, mapset.NewSet[string]())
 			assert.NoError(t, err)
 
@@ -114,15 +105,20 @@ func TestAnalyzeOpensWithFlagMergingAndThreshold(t *testing.T) {
 }
 
 func TestAnalyzeOpensWithAsteriskAndEllipsis(t *testing.T) {
-	analyzer := dynamicpathdetector.NewPathAnalyzer(3) // Threshold of 3 OLD BEHAVIOR
+	threshold := configThreshold("/var/run")
+	analyzer := dynamicpathdetector.NewPathAnalyzer(threshold)
 
-	input := []types.OpenCalls{
-		// These should collapse into /home/…/file.txt
-		{Path: "/home/user1/file.txt", Flags: []string{"READ"}},
-		{Path: "/home/user2/file.txt", Flags: []string{"READ"}},
-		{Path: "/home/\u22ef/file.txt", Flags: []string{"READ"}},
-		{Path: "/home/user4/file.txt", Flags: []string{"READ"}},
+	// Generate threshold paths + one ⋯ path to trigger collapse
+	var input []types.OpenCalls
+	for i := 0; i < threshold; i++ {
+		input = append(input, types.OpenCalls{
+			Path: fmt.Sprintf("/home/user%d/file.txt", i), Flags: []string{"READ"},
+		})
 	}
+	input = append(input,
+		types.OpenCalls{Path: "/home/\u22ef/file.txt", Flags: []string{"READ"}},
+		types.OpenCalls{Path: fmt.Sprintf("/home/user%d/file.txt", threshold), Flags: []string{"READ"}},
+	)
 
 	expected := []types.OpenCalls{
 		{Path: "/home/\u22ef/file.txt", Flags: []string{"READ"}},
@@ -131,13 +127,17 @@ func TestAnalyzeOpensWithAsteriskAndEllipsis(t *testing.T) {
 	result, err := dynamicpathdetector.AnalyzeOpens(input, analyzer, mapset.NewSet[string]())
 	assert.NoError(t, err)
 
-	// Use ElementsMatch because the order of elements in the result is not guaranteed
 	assert.ElementsMatch(t, expected, result)
 }
 
 func TestAnalyzeOpensWithMultiCollapse(t *testing.T) {
-	analyzer := dynamicpathdetector.NewPathAnalyzer(5) // Threshold of 3 for /var/run prefix is set in the defaults, but here we are overwriting the defaults
+	// Use a threshold higher than the /var/run config (3) so /var/run paths do NOT collapse
+	threshold := dynamicpathdetector.DefaultCollapseConfig.Threshold
+	analyzer := dynamicpathdetector.NewPathAnalyzer(threshold)
 
+	// Only 3 paths under /var/run — the per-prefix threshold for /var/run is 3,
+	// but NewPathAnalyzer overrides the default to 'threshold', so /var/run inherits its own config (3).
+	// 3 children <= threshold 3, so these should NOT collapse.
 	input := []types.OpenCalls{
 		{Path: "/var/run/txt/file.txt", Flags: []string{"READ"}},
 		{Path: "/var/run/txt1/file.txt", Flags: []string{"READ"}},
@@ -157,72 +157,53 @@ func TestAnalyzeOpensWithMultiCollapse(t *testing.T) {
 }
 
 func TestAnalyzeOpensWithDynamicConfigs(t *testing.T) {
-	// Default threshold is 10, used for paths like /tmp
+	etcThreshold := configThreshold("/etc")
+	optThreshold := configThreshold("/opt")
+	varRunThreshold := configThreshold("/var/run")
+	appThreshold := configThreshold("/app")
+	tmpThreshold := 10 // custom for this test
+
 	analyzer := dynamicpathdetector.NewPathAnalyzerWithConfigs([]dynamicpathdetector.CollapseConfig{
-		{
-			Prefix:    "/etc",
-			Threshold: 50,
-		},
-		{
-			Prefix:    "/opt",
-			Threshold: 5,
-		},
-		{
-			Prefix:    "/var/run",
-			Threshold: 3,
-		},
-		{
-			Prefix:    "/app",
-			Threshold: 1,
-		},
-		{
-			Prefix:    "/tmp",
-			Threshold: 10,
-		},
+		{Prefix: "/etc", Threshold: etcThreshold},
+		{Prefix: "/opt", Threshold: optThreshold},
+		{Prefix: "/var/run", Threshold: varRunThreshold},
+		{Prefix: "/app", Threshold: appThreshold},
+		{Prefix: "/tmp", Threshold: tmpThreshold},
 	})
 
-	// The paths to be added, exercising different collapse configurations.
-	pathsToAdd := []string{
-		// /etc paths (Threshold: 50) - should not collapse
-		"/etc/config/app.conf",
-		"/etc/config/db.conf",
+	var pathsToAdd []string
+
+	// /etc paths (high threshold) - should not collapse
+	for i := 0; i < 8; i++ {
+		pathsToAdd = append(pathsToAdd, fmt.Sprintf("/etc/config/item%d", i))
+	}
+	pathsToAdd = append(pathsToAdd,
 		"/etc/hosts",
 		"/etc/resolv.conf",
-		"/etc/config/cron.d/hourly",
-		"/etc/systemd/system.conf",
 		"/etc/hostname",
-		"/etc/config/something",
-
-		// /opt paths (Threshold: 5) - should collapse at /opt level
-		"/opt/app1/binary",
-		"/opt/app2/binary",
-		"/opt/app3/binary",
-		"/opt/app4/binary",
-		"/opt/app5/binary",
-		"/opt/app6/binary", // 6th child of /opt, triggers collapse
-
-		// /var/run paths (Threshold: 3) - should collapse at /var/run level
-		"/var/run/pid1.pid",
-		"/var/run/pid2.pid",
-		"/var/run/pid3.pid",
-		"/var/run/pid4.pid", // 4th child of /var/run, triggers collapse
-
-		// /app paths (Threshold: 1) - should immediately collapse
+		"/etc/systemd/system.conf",
+	)
+	// Total /etc: 12, well below etcThreshold (50)
+
+	// /opt paths — exceed optThreshold to trigger collapse
+	for i := 0; i < optThreshold+1; i++ {
+		pathsToAdd = append(pathsToAdd, fmt.Sprintf("/opt/app%d/binary", i))
+	}
+
+	// /var/run paths — exceed varRunThreshold to trigger collapse
+	for i := 0; i < varRunThreshold+1; i++ {
+		pathsToAdd = append(pathsToAdd, fmt.Sprintf("/var/run/pid%d.pid", i))
+	}
+
+	// /app paths — appThreshold is 1, so second child triggers wildcard
+	pathsToAdd = append(pathsToAdd,
 		"/app/some/deep/path",
-		"/app/another/path", // 2nd child of /app, triggers collapse
-
-		// /tmp paths (Default Threshold: 10) - should collapse at /tmp level
-		"/tmp/user1/a",
-		"/tmp/user2/a",
-		"/tmp/user3/a",
-		"/tmp/user4/a",
-		"/tmp/user5/a",
-		"/tmp/user6/a",
-		"/tmp/user7/a",
-		"/tmp/user8/a",
-		"/tmp/user9/a",
-		"/tmp/user10/a",
-		"/tmp/user11/a", // 11th child of /tmp, triggers collapse
+		"/app/another/path",
+	)
+
+	// /tmp paths — exceed tmpThreshold to trigger collapse
+	for i := 0; i < tmpThreshold+1; i++ {
+		pathsToAdd = append(pathsToAdd, fmt.Sprintf("/tmp/user%d/a", i))
 	}
 
 	var input []types.OpenCalls
@@ -233,40 +214,36 @@ func TestAnalyzeOpensWithDynamicConfigs(t *testing.T) {
 	result, err := dynamicpathdetector.AnalyzeOpens(input, analyzer, mapset.NewSet[string]())
 	assert.NoError(t, err)
 
-	// /etc paths (threshold 50) should NOT be collapsed - all 8 paths remain individual
-	assertContainsPath(t, result, "/etc/config/app.conf")
-	assertContainsPath(t, result, "/etc/config/cron.d/hourly")
-	assertContainsPath(t, result, "/etc/config/db.conf")
-	assertContainsPath(t, result, "/etc/config/something")
-	assertContainsPath(t, result, "/etc/hostname")
-	assertContainsPath(t, result, "/etc/hosts")
-	assertContainsPath(t, result, "/etc/resolv.conf")
-	assertContainsPath(t, result, "/etc/systemd/system.conf")
+	// /etc paths (threshold 50) should NOT be collapsed
+	etcPaths := filterByPrefix(result, "/etc/")
+	assert.Equal(t, 12, len(etcPaths), "/etc paths should remain individual (below threshold %d)", etcThreshold)
 
 	// /app (threshold 1) - immediately collapses to wildcard
 	assertContainsPath(t, result, "/app/*")
 
-	// /opt (threshold 5) - collapses; both wildcard and dynamic-with-subtree are acceptable
+	// /opt — collapses; both wildcard and dynamic-with-subtree are acceptable
 	assertContainsOneOfPaths(t, result, "/opt/*", "/opt/\u22ef/binary")
 
-	// /tmp (threshold 10) - collapses; both wildcard and dynamic-with-subtree are acceptable
+	// /tmp — collapses
 	assertContainsOneOfPaths(t, result, "/tmp/*", "/tmp/\u22ef/a")
 
-	// /var/run (threshold 3) - collapses; both forms are equivalent here (leaf nodes)
+	// /var/run — collapses
 	assertContainsOneOfPaths(t, result, "/var/run/*", "/var/run/\u22ef")
 
-	// Total: 8 etc + 1 app + 1 opt + 1 tmp + 1 var/run = 12
-	assert.Equal(t, 12, len(result), "expected 12 total paths, got %d: %v", len(result), pathsFromResult(result))
+	// Total: 12 etc + 1 app + 1 opt + 1 tmp + 1 var/run = 16
+	assert.Equal(t, 16, len(result), "expected 16 total paths, got %d: %v", len(result), pathsFromResult(result))
 }
 
 // TestAnalyzeOpensCollapseExactBoundary verifies that threshold is strictly "greater than",
 // not "greater than or equal". With threshold N, exactly N children should NOT collapse,
 // but N+1 children SHOULD.
 func TestAnalyzeOpensCollapseExactBoundary(t *testing.T) {
+	threshold := dynamicpathdetector.DefaultCollapseConfig.Threshold
+
 	t.Run("at threshold - no collapse", func(t *testing.T) {
-		analyzer := dynamicpathdetector.NewPathAnalyzer(5)
+		analyzer := dynamicpathdetector.NewPathAnalyzer(threshold)
 		var input []types.OpenCalls
-		for i := 0; i < 5; i++ {
+		for i := 0; i < threshold; i++ {
 			input = append(input, types.OpenCalls{
 				Path:  fmt.Sprintf("/data/item%d/info", i),
 				Flags: []string{"READ"},
@@ -274,7 +251,7 @@ func TestAnalyzeOpensCollapseExactBoundary(t *testing.T) {
 		}
 		result, err := dynamicpathdetector.AnalyzeOpens(input, analyzer, mapset.NewSet[string]())
 		assert.NoError(t, err)
-		assert.Equal(t, 5, len(result), "at exact threshold, paths should NOT collapse")
+		assert.Equal(t, threshold, len(result), "at exact threshold, paths should NOT collapse")
 		for _, r := range result {
 			assert.NotContains(t, r.Path, "\u22ef", "no dynamic segment expected")
 			assert.NotContains(t, r.Path, "*", "no wildcard expected")
@@ -282,9 +259,9 @@ func TestAnalyzeOpensCollapseExactBoundary(t *testing.T) {
 	})
 
 	t.Run("above threshold - collapse", func(t *testing.T) {
-		analyzer := dynamicpathdetector.NewPathAnalyzer(5)
+		analyzer := dynamicpathdetector.NewPathAnalyzer(threshold)
 		var input []types.OpenCalls
-		for i := 0; i < 6; i++ {
+		for i := 0; i < threshold+1; i++ {
 			input = append(input, types.OpenCalls{
 				Path:  fmt.Sprintf("/data/item%d/info", i),
 				Flags: []string{"READ"},
@@ -300,9 +277,11 @@ func TestAnalyzeOpensCollapseExactBoundary(t *testing.T) {
 // TestAnalyzeOpensDuplicatePathsNoCollapse verifies that repeating the same path
 // many times does NOT trigger a collapse - only unique segment names count.
 func TestAnalyzeOpensDuplicatePathsNoCollapse(t *testing.T) {
-	analyzer := dynamicpathdetector.NewPathAnalyzer(3)
+	threshold := configThreshold("/var/run")
+	analyzer := dynamicpathdetector.NewPathAnalyzer(threshold)
 	var input []types.OpenCalls
-	for i := 0; i < 100; i++ {
+	// Repeat the same path many times — should NOT trigger collapse
+	for i := 0; i < threshold*10; i++ {
 		input = append(input, types.OpenCalls{
 			Path:  "/data/same-child/file.txt",
 			Flags: []string{"READ"},
@@ -317,17 +296,19 @@ func TestAnalyzeOpensDuplicatePathsNoCollapse(t *testing.T) {
 // TestAnalyzeOpensVaryingDepthsUnderPrefix verifies collapse behavior when paths
 // under the same prefix have different depths.
 func TestAnalyzeOpensVaryingDepthsUnderPrefix(t *testing.T) {
-	analyzer := dynamicpathdetector.NewPathAnalyzer(3)
-	input := []types.OpenCalls{
-		{Path: "/data/a", Flags: []string{"READ"}},
-		{Path: "/data/b/deep/file", Flags: []string{"READ"}},
-		{Path: "/data/c/other", Flags: []string{"WRITE"}},
-		{Path: "/data/d", Flags: []string{"APPEND"}},
+	threshold := configThreshold("/var/run")
+	analyzer := dynamicpathdetector.NewPathAnalyzer(threshold)
+
+	// Generate threshold+1 unique children under /data to trigger collapse
+	var input []types.OpenCalls
+	for i := 0; i < threshold+1; i++ {
+		input = append(input, types.OpenCalls{
+			Path:  fmt.Sprintf("/data/%c/deep/file", 'a'+rune(i)),
+			Flags: []string{"READ"},
+		})
 	}
 	result, err := dynamicpathdetector.AnalyzeOpens(input, analyzer, mapset.NewSet[string]())
 	assert.NoError(t, err)
-	// 4 unique children under /data with threshold 3 -> should collapse
-	// All paths should be merged under the dynamic/wildcard node
 	for _, r := range result {
 		assert.True(t,
 			strings.Contains(r.Path, "\u22ef") || strings.Contains(r.Path, "*"),
@@ -338,20 +319,21 @@ func TestAnalyzeOpensVaryingDepthsUnderPrefix(t *testing.T) {
 // TestAnalyzeOpensNewPathAfterCollapse verifies that a new path arriving after
 // the threshold was already crossed gets absorbed by the collapsed node.
 func TestAnalyzeOpensNewPathAfterCollapse(t *testing.T) {
-	analyzer := dynamicpathdetector.NewPathAnalyzer(3)
-
-	// First batch: trigger collapse
-	batch1 := []types.OpenCalls{
-		{Path: "/srv/a/log", Flags: []string{"READ"}},
-		{Path: "/srv/b/log", Flags: []string{"READ"}},
-		{Path: "/srv/c/log", Flags: []string{"READ"}},
-		{Path: "/srv/d/log", Flags: []string{"READ"}},
+	threshold := configThreshold("/var/run")
+	analyzer := dynamicpathdetector.NewPathAnalyzer(threshold)
+
+	// First batch: trigger collapse with threshold+1 children
+	var batch1 []types.OpenCalls
+	for i := 0; i < threshold+1; i++ {
+		batch1 = append(batch1, types.OpenCalls{
+			Path: fmt.Sprintf("/srv/%c/log", 'a'+rune(i)), Flags: []string{"READ"},
+		})
 	}
 	result1, err := dynamicpathdetector.AnalyzeOpens(batch1, analyzer, mapset.NewSet[string]())
 	assert.NoError(t, err)
 	assert.Equal(t, 1, len(result1), "first batch should collapse to 1 path")
 
-	// Second batch: add a completely new child - it should be absorbed
+	// Second batch: add a completely new child — it should be absorbed
 	batch2 := append(batch1, types.OpenCalls{
 		Path: "/srv/new-service/log", Flags: []string{"WRITE"},
 	})
@@ -378,7 +360,8 @@ func TestAnalyzeOpensDefaultThresholdForUnconfiguredPrefix(t *testing.T) {
 	assert.NoError(t, err)
 	assert.Equal(t, 1, len(result), "/configured should collapse with threshold 2")
 
-	// /unconfigured uses default threshold (50): 3 children should NOT collapse
+	// /unconfigured uses default threshold: 3 children should NOT collapse
+	defaultThreshold := dynamicpathdetector.DefaultCollapseConfig.Threshold
 	analyzer2 := dynamicpathdetector.NewPathAnalyzerWithConfigs([]dynamicpathdetector.CollapseConfig{
 		{Prefix: "/configured", Threshold: 2},
 	})
@@ -389,14 +372,16 @@ func TestAnalyzeOpensDefaultThresholdForUnconfiguredPrefix(t *testing.T) {
 	}
 	result2, err := dynamicpathdetector.AnalyzeOpens(unconfiguredInput, analyzer2, mapset.NewSet[string]())
 	assert.NoError(t, err)
-	assert.Equal(t, 3, len(result2), "/unconfigured should NOT collapse with default threshold 50")
+	assert.Equal(t, 3, len(result2),
+		"/unconfigured should NOT collapse with default threshold %d", defaultThreshold)
 }
 
 // TestAnalyzeOpensThreshold1ImmediateWildcard verifies that threshold 1 produces
 // a wildcard (*) on the very first additional child.
 func TestAnalyzeOpensThreshold1ImmediateWildcard(t *testing.T) {
+	appThreshold := configThreshold("/app") // threshold 1
 	analyzer := dynamicpathdetector.NewPathAnalyzerWithConfigs([]dynamicpathdetector.CollapseConfig{
-		{Prefix: "/instant", Threshold: 1},
+		{Prefix: "/instant", Threshold: appThreshold},
 	})
 
 	t.Run("single path - no collapse yet", func(t *testing.T) {
@@ -411,7 +396,7 @@ func TestAnalyzeOpensThreshold1ImmediateWildcard(t *testing.T) {
 
 	t.Run("two paths - collapsed", func(t *testing.T) {
 		analyzer2 := dynamicpathdetector.NewPathAnalyzerWithConfigs([]dynamicpathdetector.CollapseConfig{
-			{Prefix: "/instant", Threshold: 1},
+			{Prefix: "/instant", Threshold: appThreshold},
 		})
 		input := []types.OpenCalls{
 			{Path: "/instant/first/data", Flags: []string{"READ"}},
@@ -428,18 +413,21 @@ func TestAnalyzeOpensThreshold1ImmediateWildcard(t *testing.T) {
 // TestAnalyzeOpensCollapseDoesNotAffectSiblingPrefixes verifies that collapsing
 // one prefix does not affect paths under a sibling prefix.
 func TestAnalyzeOpensCollapseDoesNotAffectSiblingPrefixes(t *testing.T) {
-	analyzer := dynamicpathdetector.NewPathAnalyzer(3)
+	threshold := configThreshold("/var/run")
+	analyzer := dynamicpathdetector.NewPathAnalyzer(threshold)
 
-	input := []types.OpenCalls{
-		// /alpha should collapse (4 > 3)
-		{Path: "/alpha/a1/file", Flags: []string{"READ"}},
-		{Path: "/alpha/a2/file", Flags: []string{"READ"}},
-		{Path: "/alpha/a3/file", Flags: []string{"READ"}},
-		{Path: "/alpha/a4/file", Flags: []string{"READ"}},
-		// /beta should NOT collapse (2 <= 3)
-		{Path: "/beta/b1/file", Flags: []string{"WRITE"}},
-		{Path: "/beta/b2/file", Flags: []string{"WRITE"}},
+	// /alpha: threshold+1 children → should collapse
+	var input []types.OpenCalls
+	for i := 0; i < threshold+1; i++ {
+		input = append(input, types.OpenCalls{
+			Path: fmt.Sprintf("/alpha/a%d/file", i), Flags: []string{"READ"},
+		})
 	}
+	// /beta: 2 children → should NOT collapse (2 <= threshold)
+	input = append(input,
+		types.OpenCalls{Path: "/beta/b1/file", Flags: []string{"WRITE"}},
+		types.OpenCalls{Path: "/beta/b2/file", Flags: []string{"WRITE"}},
+	)
 
 	result, err := dynamicpathdetector.AnalyzeOpens(input, analyzer, mapset.NewSet[string]())
 	assert.NoError(t, err)
@@ -454,12 +442,17 @@ func TestAnalyzeOpensCollapseDoesNotAffectSiblingPrefixes(t *testing.T) {
 // TestAnalyzeOpensFlagMergingAfterCollapse verifies that flags from all paths
 // that collapse into the same dynamic node are properly merged and deduplicated.
 func TestAnalyzeOpensFlagMergingAfterCollapse(t *testing.T) {
-	analyzer := dynamicpathdetector.NewPathAnalyzer(3)
-	input := []types.OpenCalls{
-		{Path: "/logs/service1/app.log", Flags: []string{"READ", "WRITE"}},
-		{Path: "/logs/service2/app.log", Flags: []string{"WRITE", "APPEND"}},
-		{Path: "/logs/service3/app.log", Flags: []string{"READ"}},
-		{Path: "/logs/service4/app.log", Flags: []string{"APPEND", "READ"}},
+	threshold := configThreshold("/var/run")
+	analyzer := dynamicpathdetector.NewPathAnalyzer(threshold)
+
+	// Generate threshold+1 children to trigger collapse, with varied flags
+	var input []types.OpenCalls
+	flags := [][]string{{"READ", "WRITE"}, {"WRITE", "APPEND"}, {"READ"}, {"APPEND", "READ"}}
+	for i := 0; i < threshold+1; i++ {
+		input = append(input, types.OpenCalls{
+			Path:  fmt.Sprintf("/logs/service%d/app.log", i),
+			Flags: flags[i%len(flags)],
+		})
 	}
 	result, err := dynamicpathdetector.AnalyzeOpens(input, analyzer, mapset.NewSet[string]())
 	assert.NoError(t, err)
@@ -471,12 +464,13 @@ func TestAnalyzeOpensFlagMergingAfterCollapse(t *testing.T) {
 // TestAnalyzeOpensMultipleLevelsOfCollapse verifies behavior when both parent and
 // grandchild segments independently exceed their thresholds.
 func TestAnalyzeOpensMultipleLevelsOfCollapse(t *testing.T) {
-	analyzer := dynamicpathdetector.NewPathAnalyzer(3)
+	threshold := configThreshold("/var/run")
+	analyzer := dynamicpathdetector.NewPathAnalyzer(threshold)
 
 	var input []types.OpenCalls
-	// 4 unique children under /multi, each with 4 unique grandchildren
-	for i := 0; i < 4; i++ {
-		for j := 0; j < 4; j++ {
+	// threshold+1 unique children under /multi, each with threshold+1 unique grandchildren
+	for i := 0; i < threshold+1; i++ {
+		for j := 0; j < threshold+1; j++ {
 			input = append(input, types.OpenCalls{
 				Path:  fmt.Sprintf("/multi/level%d/sub%d/file", i, j),
 				Flags: []string{"READ"},
@@ -486,9 +480,7 @@ func TestAnalyzeOpensMultipleLevelsOfCollapse(t *testing.T) {
 
 	result, err := dynamicpathdetector.AnalyzeOpens(input, analyzer, mapset.NewSet[string]())
 	assert.NoError(t, err)
-	// Both /multi children and the grandchildren should collapse
 	assert.Equal(t, 1, len(result), "double collapse should yield a single path")
-	// The path should contain wildcard or dynamic segments
 	assert.True(t,
 		strings.Contains(result[0].Path, "\u22ef") || strings.Contains(result[0].Path, "*"),
 		"result %q should contain dynamic or wildcard segments", result[0].Path)
@@ -497,23 +489,25 @@ func TestAnalyzeOpensMultipleLevelsOfCollapse(t *testing.T) {
 // TestAnalyzeOpensExistingDynamicSegmentInInput verifies that input paths
 // already containing ⋯ are handled correctly and merge with new paths.
 func TestAnalyzeOpensExistingDynamicSegmentInInput(t *testing.T) {
-	analyzer := dynamicpathdetector.NewPathAnalyzer(100)
+	// Use a high threshold so that the two paths alone don't trigger collapse —
+	// instead, the existing ⋯ segment absorbs the specific path.
+	analyzer := dynamicpathdetector.NewPathAnalyzer(dynamicpathdetector.OpenDynamicThreshold)
 	input := []types.OpenCalls{
 		{Path: "/data/\u22ef/config", Flags: []string{"READ"}},
 		{Path: "/data/specific/config", Flags: []string{"WRITE"}},
 	}
 	result, err := dynamicpathdetector.AnalyzeOpens(input, analyzer, mapset.NewSet[string]())
 	assert.NoError(t, err)
-	// The specific path should be absorbed by the existing dynamic segment
 	assert.Equal(t, 1, len(result))
 	assert.Equal(t, "/data/\u22ef/config", result[0].Path)
 	assert.ElementsMatch(t, []string{"READ", "WRITE"}, result[0].Flags)
 }
 
 // TestAnalyzeOpens_NilSbomSetNoError verifies that passing a nil sbomSet
-// does not return an error (previously it did).
+// does not return an error.
 func TestAnalyzeOpens_NilSbomSetNoError(t *testing.T) {
-	analyzer := dynamicpathdetector.NewPathAnalyzer(3)
+	threshold := configThreshold("/var/run")
+	analyzer := dynamicpathdetector.NewPathAnalyzer(threshold)
 	input := []types.OpenCalls{
 		{Path: "/usr/lib/libfoo.so", Flags: []string{"READ"}},
 		{Path: "/usr/lib/libbar.so", Flags: []string{"READ"}},
@@ -526,22 +520,54 @@ func TestAnalyzeOpens_NilSbomSetNoError(t *testing.T) {
 // TestAnalyzeOpens_NilSbomSetWithCollapse verifies that collapse works
 // correctly even when sbomSet is nil.
 func TestAnalyzeOpens_NilSbomSetWithCollapse(t *testing.T) {
-	analyzer := dynamicpathdetector.NewPathAnalyzer(3)
-	input := []types.OpenCalls{
-		{Path: "/usr/lib/liba.so", Flags: []string{"READ"}},
-		{Path: "/usr/lib/libb.so", Flags: []string{"READ"}},
-		{Path: "/usr/lib/libc.so", Flags: []string{"WRITE"}},
-		{Path: "/usr/lib/libd.so", Flags: []string{"APPEND"}},
+	threshold := configThreshold("/var/run")
+	analyzer := dynamicpathdetector.NewPathAnalyzer(threshold)
+
+	var input []types.OpenCalls
+	for i := 0; i < threshold+1; i++ {
+		input = append(input, types.OpenCalls{
+			Path:  fmt.Sprintf("/usr/lib/lib%c.so", 'a'+rune(i)),
+			Flags: []string{"READ"},
+		})
 	}
 	result, err := dynamicpathdetector.AnalyzeOpens(input, analyzer, nil)
 	assert.NoError(t, err)
-	assert.Equal(t, 1, len(result), "4 children > threshold 3, should collapse")
+	assert.Equal(t, 1, len(result), "%d children > threshold %d, should collapse", threshold+1, threshold)
 	assert.True(t,
 		strings.Contains(result[0].Path, "\u22ef") || strings.Contains(result[0].Path, "*"),
 		"collapsed path should contain dynamic or wildcard segment, got %q", result[0].Path)
 }
 
-// Helper function to check if a slice of strings contains only unique elements
+// --- Helpers ---
+
+// generateOpenCallsWithFlags creates N OpenCalls under prefix/userN/filename with rotating flags.
+func generateOpenCallsWithFlags(prefix, filename string, n int) []types.OpenCalls {
+	allFlags := []string{"READ", "WRITE", "APPEND"}
+	var result []types.OpenCalls
+	for i := 0; i < n; i++ {
+		result = append(result, types.OpenCalls{
+			Path:  fmt.Sprintf("%s/user%d/%s", prefix, i, filename),
+			Flags: []string{allFlags[i%len(allFlags)]},
+		})
+	}
+	return result
+}
+
+// flagsForN returns the sorted, unique flags that generateOpenCallsWithFlags would produce for N items.
+func flagsForN(n int) []string {
+	allFlags := []string{"READ", "WRITE", "APPEND"}
+	seen := map[string]bool{}
+	for i := 0; i < n; i++ {
+		seen[allFlags[i%len(allFlags)]] = true
+	}
+	var result []string
+	for f := range seen {
+		result = append(result, f)
+	}
+	sort.Strings(result)
+	return result
+}
+
 func areStringSlicesUnique(slice []string) bool {
 	seen := make(map[string]struct{})
 	for _, s := range slice {
@@ -553,7 +579,6 @@ func areStringSlicesUnique(slice []string) bool {
 	return true
 }
 
-// assertContainsPath checks that at least one result has the given path.
 func assertContainsPath(t *testing.T, result []types.OpenCalls, path string) {
 	t.Helper()
 	for _, r := range result {
@@ -564,8 +589,6 @@ func assertContainsPath(t *testing.T, result []types.OpenCalls, path string) {
 	assert.Fail(t, fmt.Sprintf("result does not contain path %q, got: %v", path, pathsFromResult(result)))
 }
 
-// assertContainsOneOfPaths checks that at least one result matches any of the given paths.
-// Used when both the dynamic (⋯) and wildcard (*) forms are acceptable.
 func assertContainsOneOfPaths(t *testing.T, result []types.OpenCalls, alternatives ...string) {
 	t.Helper()
 	for _, r := range result {
@@ -578,7 +601,6 @@ func assertContainsOneOfPaths(t *testing.T, result []types.OpenCalls, alternativ
 	assert.Fail(t, fmt.Sprintf("result does not contain any of %v, got: %v", alternatives, pathsFromResult(result)))
 }
 
-// assertPathIsOneOf checks that the given path matches one of the alternatives.
 func assertPathIsOneOf(t *testing.T, actual string, alternatives ...string) {
 	t.Helper()
 	for _, alt := range alternatives {
@@ -589,7 +611,6 @@ func assertPathIsOneOf(t *testing.T, actual string, alternatives ...string) {
 	assert.Fail(t, fmt.Sprintf("path %q does not match any of %v", actual, alternatives))
 }
 
-// filterByPrefix returns all OpenCalls whose path starts with the given prefix.
 func filterByPrefix(result []types.OpenCalls, prefix string) []types.OpenCalls {
 	var filtered []types.OpenCalls
 	for _, r := range result {
@@ -600,7 +621,6 @@ func filterByPrefix(result []types.OpenCalls, prefix string) []types.OpenCalls {
 	return filtered
 }
 
-// pathsFromResult extracts just the paths for readable error messages.
 func pathsFromResult(result []types.OpenCalls) []string {
 	paths := make([]string, len(result))
 	for i, r := range result {
diff --git a/pkg/registry/file/dynamicpathdetector/tests/benchmark_test.go b/pkg/registry/file/dynamicpathdetector/tests/benchmark_test.go
index 831aa3f51..bc06b6458 100644
--- a/pkg/registry/file/dynamicpathdetector/tests/benchmark_test.go
+++ b/pkg/registry/file/dynamicpathdetector/tests/benchmark_test.go
@@ -13,7 +13,7 @@ import (
 )
 
 func BenchmarkAnalyzePath(b *testing.B) {
-	analyzer := dynamicpathdetector.NewPathAnalyzer(100)
+	analyzer := dynamicpathdetector.NewPathAnalyzer(dynamicpathdetector.OpenDynamicThreshold)
 	paths := generateMixedPaths(10000, 0) // 0 means use default mixed lengths
 
 	identifier := "test"
@@ -33,7 +33,7 @@ func BenchmarkAnalyzePathWithDifferentLengths(b *testing.B) {
 
 	for _, length := range pathLengths {
 		b.Run(fmt.Sprintf("PathLength-%d", length), func(b *testing.B) {
-			analyzer := dynamicpathdetector.NewPathAnalyzer(100)
+			analyzer := dynamicpathdetector.NewPathAnalyzer(dynamicpathdetector.OpenDynamicThreshold)
 			paths := generateMixedPaths(10000, length)
 			identifier := "test"
 
@@ -52,7 +52,7 @@ func BenchmarkAnalyzePathWithDifferentLengths(b *testing.B) {
 
 func BenchmarkAnalyzeOpensVsDeflateStringer(b *testing.B) {
 	paths := pathsToOpens(generateMixedPaths(10000, 0))
-	analyzer := dynamicpathdetector.NewPathAnalyzer(100)
+	analyzer := dynamicpathdetector.NewPathAnalyzer(dynamicpathdetector.OpenDynamicThreshold)
 
 	b.Run("AnalyzeOpens", func(b *testing.B) {
 		b.ResetTimer()
diff --git a/pkg/registry/file/dynamicpathdetector/tests/coverage_test.go b/pkg/registry/file/dynamicpathdetector/tests/coverage_test.go
index 28791f2b1..517e3522f 100644
--- a/pkg/registry/file/dynamicpathdetector/tests/coverage_test.go
+++ b/pkg/registry/file/dynamicpathdetector/tests/coverage_test.go
@@ -8,15 +8,26 @@ import (
 	"github.com/stretchr/testify/assert"
 )
 
+// configThreshold returns the collapse threshold for the given path prefix
+// from DefaultCollapseConfigs. Falls back to DefaultCollapseConfig.Threshold.
+func configThreshold(prefix string) int {
+	for _, cfg := range dynamicpathdetector.DefaultCollapseConfigs {
+		if cfg.Prefix == prefix {
+			return cfg.Threshold
+		}
+	}
+	return dynamicpathdetector.DefaultCollapseConfig.Threshold
+}
+
 func TestNewPathAnalyzer(t *testing.T) {
-	analyzer := dynamicpathdetector.NewPathAnalyzer(100)
+	analyzer := dynamicpathdetector.NewPathAnalyzer(dynamicpathdetector.OpenDynamicThreshold)
 	if analyzer == nil {
 		t.Error("NewPathAnalyzer() returned nil")
 	}
 }
 
 func TestAnalyzePath(t *testing.T) {
-	analyzer := dynamicpathdetector.NewPathAnalyzer(100)
+	analyzer := dynamicpathdetector.NewPathAnalyzer(dynamicpathdetector.OpenDynamicThreshold)
 
 	testCases := []struct {
 		name       string
@@ -69,16 +80,16 @@ func TestCollapseAdjacentDynamicIdentifiers(t *testing.T) {
 }
 
 func TestDynamicSegments(t *testing.T) {
-	analyzer := dynamicpathdetector.NewPathAnalyzer(100)
+	threshold := dynamicpathdetector.OpenDynamicThreshold
+	analyzer := dynamicpathdetector.NewPathAnalyzer(threshold)
 
-	// Create 99 different paths under the 'users' segment
-	for i := 0; i < 101; i++ {
+	for i := 0; i < threshold+1; i++ {
 		path := fmt.Sprintf("/api/users/%d", i)
 		_, err := analyzer.AnalyzePath(path, "api")
 		assert.NoError(t, err)
 	}
 
-	result, err := analyzer.AnalyzePath("/api/users/101", "api")
+	result, err := analyzer.AnalyzePath(fmt.Sprintf("/api/users/%d", threshold+1), "api")
 	if err != nil {
 		t.Errorf("AnalyzePath() returned an error: %v", err)
 	}
@@ -86,16 +97,16 @@ func TestDynamicSegments(t *testing.T) {
 	assert.Equal(t, expected, result)
 
 	// Test with one of the original IDs to ensure it's also marked as dynamic
-	result, err = analyzer.AnalyzePath("/api/users/50", "api")
+	result, err = analyzer.AnalyzePath("/api/users/0", "api")
 	assert.NoError(t, err)
 	assert.Equal(t, expected, result)
 }
 
 func TestMultipleDynamicSegments(t *testing.T) {
-	analyzer := dynamicpathdetector.NewPathAnalyzer(100)
+	threshold := dynamicpathdetector.OpenDynamicThreshold
+	analyzer := dynamicpathdetector.NewPathAnalyzer(threshold)
 
-	// Create 99 different paths for both 'users' and 'posts' segments
-	for i := 0; i < 110; i++ {
+	for i := 0; i < threshold+10; i++ {
 		path := fmt.Sprintf("/api/users/%d/posts/%d", i, i)
 		_, err := analyzer.AnalyzePath(path, "api")
 		if err != nil {
@@ -103,18 +114,17 @@ func TestMultipleDynamicSegments(t *testing.T) {
 		}
 	}
 
-	// Test with the 100th unique user and post IDs (should trigger dynamic segments)
-	result, err := analyzer.AnalyzePath("/api/users/101/posts/1031", "api")
+	result, err := analyzer.AnalyzePath(fmt.Sprintf("/api/users/%d/posts/%d", threshold+11, threshold+11), "api")
 	assert.NoError(t, err)
 	expected := "/api/users/\u22ef/posts/\u22ef"
 	assert.Equal(t, expected, result)
 }
 
 func TestMixedStaticAndDynamicSegments(t *testing.T) {
-	analyzer := dynamicpathdetector.NewPathAnalyzer(100)
+	threshold := dynamicpathdetector.OpenDynamicThreshold
+	analyzer := dynamicpathdetector.NewPathAnalyzer(threshold)
 
-	// Create 99 different paths for 'users' but keep 'posts' static
-	for i := 0; i < 101; i++ {
+	for i := 0; i < threshold+1; i++ {
 		path := fmt.Sprintf("/api/users/%d/posts", i)
 		_, err := analyzer.AnalyzePath(path, "api")
 		if err != nil {
@@ -122,42 +132,40 @@ func TestMixedStaticAndDynamicSegments(t *testing.T) {
 		}
 	}
 
-	// Test with the 100th unique user ID but same 'posts' segment (should trigger dynamic segment for users)
-	result, err := analyzer.AnalyzePath("/api/users/99/posts", "api")
+	result, err := analyzer.AnalyzePath("/api/users/0/posts", "api")
 	assert.NoError(t, err)
 	expected := "/api/users/\u22ef/posts"
 	assert.Equal(t, expected, result)
 }
 
 func TestDifferentRootIdentifiers(t *testing.T) {
-	analyzer := dynamicpathdetector.NewPathAnalyzer(100)
+	analyzer := dynamicpathdetector.NewPathAnalyzer(dynamicpathdetector.OpenDynamicThreshold)
 
-	// Analyze paths with different root identifiers
 	result1, _ := analyzer.AnalyzePath("/api/users/123", "api")
 	result2, _ := analyzer.AnalyzePath("/api/products/456", "store")
 
 	assert.Equal(t, "/api/users/123", result1)
-
 	assert.Equal(t, "/api/products/456", result2)
 }
 
 func TestDynamicThreshold(t *testing.T) {
-	analyzer := dynamicpathdetector.NewPathAnalyzer(100)
+	threshold := dynamicpathdetector.OpenDynamicThreshold
+	analyzer := dynamicpathdetector.NewPathAnalyzer(threshold)
 
-	for i := 0; i < 101; i++ {
+	for i := 0; i < threshold+1; i++ {
 		path := fmt.Sprintf("/api/users/%d", i)
 		result, _ := analyzer.AnalyzePath(path, "api")
 		if result != fmt.Sprintf("/api/users/%d", i) {
-			t.Errorf("Path became dynamic before reaching 99 different paths")
+			t.Errorf("Path became dynamic before reaching %d different paths", threshold)
 		}
 	}
 
-	result, _ := analyzer.AnalyzePath("/api/users/991", "api")
+	result, _ := analyzer.AnalyzePath(fmt.Sprintf("/api/users/%d", threshold+2), "api")
 	assert.Equal(t, "/api/users/\u22ef", result)
 }
 
 func TestEdgeCases(t *testing.T) {
-	analyzer := dynamicpathdetector.NewPathAnalyzer(100)
+	analyzer := dynamicpathdetector.NewPathAnalyzer(dynamicpathdetector.OpenDynamicThreshold)
 
 	testCases := []struct {
 		name       string
@@ -180,15 +188,13 @@ func TestEdgeCases(t *testing.T) {
 }
 
 func TestDynamicInsertion(t *testing.T) {
-	analyzer := dynamicpathdetector.NewPathAnalyzer(100)
+	analyzer := dynamicpathdetector.NewPathAnalyzer(dynamicpathdetector.OpenDynamicThreshold)
 
-	// Insert a new path with a different identifier
 	result, err := analyzer.AnalyzePath("/api/users/\u22ef", "api")
 	assert.NoError(t, err)
 	expected := "/api/users/\u22ef"
 	assert.Equal(t, expected, result)
 
-	// Insert a new path with the same identifier
 	result, err = analyzer.AnalyzePath("/api/users/102", "api")
 	assert.NoError(t, err)
 	expected = "/api/users/\u22ef"
@@ -196,35 +202,37 @@ func TestDynamicInsertion(t *testing.T) {
 }
 
 func TestDynamic(t *testing.T) {
-	analyzer := dynamicpathdetector.NewPathAnalyzer(100)
-	for i := 0; i < 101; i++ {
+	threshold := dynamicpathdetector.OpenDynamicThreshold
+	analyzer := dynamicpathdetector.NewPathAnalyzer(threshold)
+	for i := 0; i < threshold+1; i++ {
 		path := fmt.Sprintf("/api/users/%d", i)
 		_, err := analyzer.AnalyzePath(path, "api")
 		assert.NoError(t, err)
 	}
-	result, err := analyzer.AnalyzePath("/api/users/101", "api")
+	result, err := analyzer.AnalyzePath(fmt.Sprintf("/api/users/%d", threshold+1), "api")
 	assert.NoError(t, err)
 	expected := "/api/users/\u22ef"
 	assert.Equal(t, expected, result)
 }
 
 func TestCollapseConfig(t *testing.T) {
+	appThreshold := configThreshold("/app")
 	analyzer := dynamicpathdetector.NewPathAnalyzerWithConfigs([]dynamicpathdetector.CollapseConfig{
 		{
 			Prefix:    "/api",
-			Threshold: 1,
+			Threshold: appThreshold,
 		},
 		{
-			Prefix:    "/169.254.169.254", // todo test this as well
-			Threshold: 50,
+			Prefix:    "/169.254.169.254",
+			Threshold: configThreshold("/etc"),
 		},
 	})
-	for i := 0; i < 2; i++ {
+	for i := 0; i < appThreshold+1; i++ {
 		path := fmt.Sprintf("/api/users/%d", i)
 		_, err := analyzer.AnalyzePath(path, "api")
 		assert.NoError(t, err)
 	}
-	result, err := analyzer.AnalyzePath("/api/users/101", "api")
+	result, err := analyzer.AnalyzePath(fmt.Sprintf("/api/users/%d", appThreshold+1), "api")
 	assert.NoError(t, err)
 	expected := "/api/*"
 	assert.Equal(t, expected, result)
diff --git a/pkg/registry/file/dynamicpathdetector/types.go b/pkg/registry/file/dynamicpathdetector/types.go
index 774171f6f..40f0f4c9a 100644
--- a/pkg/registry/file/dynamicpathdetector/types.go
+++ b/pkg/registry/file/dynamicpathdetector/types.go
@@ -1,17 +1,56 @@
 package dynamicpathdetector
 
-const DynamicIdentifier string = "\u22ef"
+// --- Identifier constants ---
+// DynamicIdentifier matches exactly one path segment (like a single-segment wildcard).
+// WildcardIdentifier matches zero or more path segments (like a glob **).
+const (
+	DynamicIdentifier  = "\u22ef" // U+22EF: ⋯
+	WildcardIdentifier = "*"
+)
 
+// --- Collapse configuration ---
+
+// CollapseConfig controls the threshold at which children of a trie node
+// (under the given path Prefix) are collapsed into a dynamic or wildcard node.
 type CollapseConfig struct {
 	Prefix    string
 	Threshold int
 }
 
+// DefaultCollapseConfigs defines per-prefix thresholds for path collapsing.
+// Paths under these prefixes are collapsed when the number of unique children
+// exceeds the threshold.
+var DefaultCollapseConfigs = []CollapseConfig{
+	{Prefix: "/etc", Threshold: 50},
+	{Prefix: "/opt", Threshold: 5},
+	{Prefix: "/var/run", Threshold: 3},
+	{Prefix: "/app", Threshold: 1},
+}
+
+// DefaultCollapseConfig is the fallback used for paths that don't match any
+// prefix in DefaultCollapseConfigs.
+var DefaultCollapseConfig = CollapseConfig{
+	Prefix:    "/",
+	Threshold: 5,
+}
+
+// --- Default thresholds for processors ---
+
+// OpenDynamicThreshold is the default collapse threshold used when analyzing
+// file-open paths in ApplicationProfile and ContainerProfile processors.
+const OpenDynamicThreshold = 5
+
+// EndpointDynamicThreshold is the default collapse threshold used when
+// analyzing HTTP endpoint paths.
+const EndpointDynamicThreshold = 5
+
+// --- Types ---
+
 type SegmentNode struct {
 	SegmentName string
 	Count       int
 	Children    map[string]*SegmentNode
-	Config      *CollapseConfig // Configuration that applies from this node downwards
+	Config      *CollapseConfig
 }
 
 type PathAnalyzer struct {
@@ -29,8 +68,8 @@ func NewTrieNode() *TrieNode {
 
 type TrieNode struct {
 	Children map[string]*TrieNode
-	Config   *CollapseConfig // Configuration that applies from this node downwards
-	Count    int             // Number of paths passing through this node
+	Config   *CollapseConfig
+	Count    int
 }
 
 func (sn *SegmentNode) IsNextDynamic() bool {

From 9578a947a3107aa7743e44e8aa67f578bce9aa3b Mon Sep 17 00:00:00 2001
From: Duck <70207455+entlein@users.noreply.github.com>
Date: Sat, 14 Feb 2026 10:30:23 +0100
Subject: [PATCH 44/68] Skip user-managed resources during cleanup

Add check to skip user-managed resources in cleanup.

Signed-off-by: Duck <70207455+entlein@users.noreply.github.com>
---
 pkg/registry/file/cleanup.go | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/pkg/registry/file/cleanup.go b/pkg/registry/file/cleanup.go
index 7a98286b7..1dc714bc2 100644
--- a/pkg/registry/file/cleanup.go
+++ b/pkg/registry/file/cleanup.go
@@ -185,6 +185,11 @@ func (h *ResourcesCleanupHandler) cleanupNamespace(ctx context.Context, ns strin
 				return nil
 			}
 
+			// Skip user-managed resources (e.g., user-defined profiles)
+			if metadata.Labels[helpersv1.ManagedByMetadataKey] == helpersv1.ManagedByUserValue {
+				return nil
+			}
+
 			// either run single handler, or perform OR operation on multiple handlers
 			var toDelete bool
 			if len(handlers) == 1 {

From 37d0d564bafb9ba909f65466930ea4d89b08c4b2 Mon Sep 17 00:00:00 2001
From: tanzee <einentlein@gmail.com>
Date: Sat, 14 Feb 2026 13:04:01 +0100
Subject: [PATCH 45/68] asymptotic behavior for backwards compatitbility

---
 .gitignore                                    | 14 ++++++++++-
 .../file/dynamicpathdetector/analyzer.go      | 24 +++++++++++--------
 .../tests/analyze_opens_test.go               |  9 ++++---
 .../file/dynamicpathdetector/types.go         | 13 +++++-----
 4 files changed, 38 insertions(+), 22 deletions(-)

diff --git a/.gitignore b/.gitignore
index 49f87ff70..731bee96c 100644
--- a/.gitignore
+++ b/.gitignore
@@ -3,4 +3,16 @@ vendor/*
 artifacts/simple-image/storage-apiserver
 artifacts/simple-image/kube-sample-apiserver
 logs-*/*
-tmp/*
\ No newline at end of file
+tmp/*
+
+# Integration test artifacts
+tests/integration-test-suite/junit-*.xml
+tests/integration-test-suite/log-*.txt
+tests/integration-test-suite/integration-test-suite.test
+
+# TODO: Fix upstream - these test files import containerwatcher/v1 which was
+# renamed to containerprofilemanager/v1 in node-agent. Until the upstream
+# integration test suite is updated, local builds require patching these imports.
+tests/integration-test-suite/case_*_test.go
+tests/integration-test-suite/go.mod
+tests/integration-test-suite/go.sum
\ No newline at end of file
diff --git a/pkg/registry/file/dynamicpathdetector/analyzer.go b/pkg/registry/file/dynamicpathdetector/analyzer.go
index 744060427..7a18c01ea 100644
--- a/pkg/registry/file/dynamicpathdetector/analyzer.go
+++ b/pkg/registry/file/dynamicpathdetector/analyzer.go
@@ -5,19 +5,20 @@ import (
 )
 
 func NewPathAnalyzer(threshold int) *PathAnalyzer {
-	return newAnalyzer(CollapseConfig{Prefix: "/", Threshold: threshold}, DefaultCollapseConfigs)
+	return newAnalyzer(CollapseConfig{Prefix: "/", Threshold: threshold}, nil, false)
 }
 
 func NewPathAnalyzerWithConfigs(configs []CollapseConfig) *PathAnalyzer {
-	return newAnalyzer(DefaultCollapseConfig, configs)
+	return newAnalyzer(DefaultCollapseConfig, configs, true)
 }
 
-func newAnalyzer(defaultCfg CollapseConfig, configs []CollapseConfig) *PathAnalyzer {
+func newAnalyzer(defaultCfg CollapseConfig, configs []CollapseConfig, collapseAdjacent bool) *PathAnalyzer {
 	matcher := &PathAnalyzer{
-		root:       NewTrieNode(),
-		identRoots: make(map[string]*TrieNode),
-		configs:    make([]CollapseConfig, len(configs)),
-		defaultCfg: defaultCfg,
+		root:             NewTrieNode(),
+		identRoots:       make(map[string]*TrieNode),
+		configs:          make([]CollapseConfig, len(configs)),
+		defaultCfg:       defaultCfg,
+		collapseAdjacent: collapseAdjacent,
 	}
 	copy(matcher.configs, configs)
 	applyConfigsToNode(matcher.root, &matcher.defaultCfg, matcher.configs)
@@ -143,8 +144,8 @@ func (pm *PathAnalyzer) addPathToRoot(root *TrieNode, path string) {
 		}
 		child.Count++
 
-		// Special case: threshold of 1 immediately creates a wildcard
-		if currentConfig != nil && currentConfig.Threshold == 1 && parent.Children[WildcardIdentifier] == nil {
+		// Special case: threshold of 1 immediately creates a wildcard (only with collapseAdjacent)
+		if pm.collapseAdjacent && currentConfig != nil && currentConfig.Threshold == 1 && parent.Children[WildcardIdentifier] == nil {
 			pm.createWildcardNode(parent)
 			parent.Children[WildcardIdentifier].Count++
 			return
@@ -284,7 +285,10 @@ func (pm *PathAnalyzer) AnalyzePath(path string, identifier string) (string, err
 	pm.addPathToRoot(root, cleanPath)
 
 	finalPath := "/" + strings.Join(pathSegments, "/")
-	return CollapseAdjacentDynamicIdentifiers(finalPath), nil
+	if pm.collapseAdjacent {
+		return CollapseAdjacentDynamicIdentifiers(finalPath), nil
+	}
+	return finalPath, nil
 }
 
 // CollapseAdjacentDynamicIdentifiers replaces sequences of truly adjacent dynamic identifiers with a wildcard.
diff --git a/pkg/registry/file/dynamicpathdetector/tests/analyze_opens_test.go b/pkg/registry/file/dynamicpathdetector/tests/analyze_opens_test.go
index b6f174587..fe2ff16ea 100644
--- a/pkg/registry/file/dynamicpathdetector/tests/analyze_opens_test.go
+++ b/pkg/registry/file/dynamicpathdetector/tests/analyze_opens_test.go
@@ -131,13 +131,12 @@ func TestAnalyzeOpensWithAsteriskAndEllipsis(t *testing.T) {
 }
 
 func TestAnalyzeOpensWithMultiCollapse(t *testing.T) {
-	// Use a threshold higher than the /var/run config (3) so /var/run paths do NOT collapse
+	// NewPathAnalyzer uses a uniform threshold (no per-prefix configs).
 	threshold := dynamicpathdetector.DefaultCollapseConfig.Threshold
 	analyzer := dynamicpathdetector.NewPathAnalyzer(threshold)
 
-	// Only 3 paths under /var/run — the per-prefix threshold for /var/run is 3,
-	// but NewPathAnalyzer overrides the default to 'threshold', so /var/run inherits its own config (3).
-	// 3 children <= threshold 3, so these should NOT collapse.
+	// Only 3 paths under /var/run — uniform threshold is 5, so 3 children <= 5.
+	// These should NOT collapse.
 	input := []types.OpenCalls{
 		{Path: "/var/run/txt/file.txt", Flags: []string{"READ"}},
 		{Path: "/var/run/txt1/file.txt", Flags: []string{"READ"}},
@@ -270,7 +269,7 @@ func TestAnalyzeOpensCollapseExactBoundary(t *testing.T) {
 		result, err := dynamicpathdetector.AnalyzeOpens(input, analyzer, mapset.NewSet[string]())
 		assert.NoError(t, err)
 		assert.Equal(t, 1, len(result), "above threshold, paths should collapse to 1")
-		assertPathIsOneOf(t, result[0].Path, "/data/*/info", "/data/\u22ef/info")
+		assert.Equal(t, "/data/\u22ef/info", result[0].Path, "NewPathAnalyzer should only produce \u22ef, never *")
 	})
 }
 
diff --git a/pkg/registry/file/dynamicpathdetector/types.go b/pkg/registry/file/dynamicpathdetector/types.go
index 40f0f4c9a..145d5ca00 100644
--- a/pkg/registry/file/dynamicpathdetector/types.go
+++ b/pkg/registry/file/dynamicpathdetector/types.go
@@ -38,11 +38,11 @@ var DefaultCollapseConfig = CollapseConfig{
 
 // OpenDynamicThreshold is the default collapse threshold used when analyzing
 // file-open paths in ApplicationProfile and ContainerProfile processors.
-const OpenDynamicThreshold = 5
+const OpenDynamicThreshold = 50
 
 // EndpointDynamicThreshold is the default collapse threshold used when
 // analyzing HTTP endpoint paths.
-const EndpointDynamicThreshold = 5
+const EndpointDynamicThreshold = 100
 
 // --- Types ---
 
@@ -54,10 +54,11 @@ type SegmentNode struct {
 }
 
 type PathAnalyzer struct {
-	root       *TrieNode
-	identRoots map[string]*TrieNode
-	configs    []CollapseConfig
-	defaultCfg CollapseConfig
+	root             *TrieNode
+	identRoots       map[string]*TrieNode
+	configs          []CollapseConfig
+	defaultCfg       CollapseConfig
+	collapseAdjacent bool
 }
 
 func NewTrieNode() *TrieNode {

From 6aac5331f142b09a749140d1c9e8ea19861a6c00 Mon Sep 17 00:00:00 2001
From: tanzee <einentlein@gmail.com>
Date: Sat, 14 Feb 2026 13:14:56 +0100
Subject: [PATCH 46/68] tests must use variables not hardcoded thresholds

---
 .../file/applicationprofile_processor_test.go | 30 ++++++++-----------
 1 file changed, 12 insertions(+), 18 deletions(-)

diff --git a/pkg/registry/file/applicationprofile_processor_test.go b/pkg/registry/file/applicationprofile_processor_test.go
index f097b2c21..5f508d984 100644
--- a/pkg/registry/file/applicationprofile_processor_test.go
+++ b/pkg/registry/file/applicationprofile_processor_test.go
@@ -18,16 +18,10 @@ import (
 	"k8s.io/apimachinery/pkg/runtime"
 )
 
-// configThreshold returns the collapse threshold for the given path prefix
-// from dynamicpathdetector.DefaultCollapseConfigs. Falls back to
-// dynamicpathdetector.DefaultCollapseConfig.Threshold for unconfigured prefixes.
-func configThreshold(prefix string) int {
-	for _, cfg := range dynamicpathdetector.DefaultCollapseConfigs {
-		if cfg.Prefix == prefix {
-			return cfg.Threshold
-		}
-	}
-	return dynamicpathdetector.DefaultCollapseConfig.Threshold
+// openThreshold returns the collapse threshold used by deflateApplicationProfileContainer
+// for file-open paths. NewPathAnalyzer uses a uniform threshold (OpenDynamicThreshold).
+func openThreshold() int {
+	return dynamicpathdetector.OpenDynamicThreshold
 }
 
 var ap = softwarecomposition.ApplicationProfile{
@@ -276,8 +270,8 @@ func generateSOOpens(n int) []softwarecomposition.OpenCalls {
 }
 
 func TestDeflateApplicationProfileContainer_CollapsesManyOpens(t *testing.T) {
-	// Generate enough opens to exceed the threshold for /usr/lib (uses default config)
-	numOpens := configThreshold("/usr/lib") + 1
+	// Generate enough opens to exceed the uniform threshold used by NewPathAnalyzer
+	numOpens := openThreshold() + 1
 	opens := generateSOOpens(numOpens)
 
 	container := softwarecomposition.ApplicationProfileContainer{
@@ -306,7 +300,7 @@ func TestDeflateApplicationProfileContainer_CollapsesManyOpens(t *testing.T) {
 }
 
 func TestDeflateApplicationProfileContainer_CollapsesWithSbomSet(t *testing.T) {
-	numOpens := configThreshold("/usr/lib") + 1
+	numOpens := openThreshold() + 1
 	opens := generateSOOpens(numOpens)
 
 	// Build sbomSet containing ALL the .so paths (realistic scenario)
@@ -330,8 +324,8 @@ func TestDeflateApplicationProfileContainer_CollapsesWithSbomSet(t *testing.T) {
 func TestDeflateApplicationProfileContainer_MixedPathsCollapse(t *testing.T) {
 	var opens []softwarecomposition.OpenCalls
 
-	// /usr/lib uses the default threshold (no specific prefix config)
-	usrLibThreshold := configThreshold("/usr/lib")
+	// /usr/lib uses the uniform threshold from NewPathAnalyzer(OpenDynamicThreshold)
+	usrLibThreshold := openThreshold()
 	for i := 0; i < usrLibThreshold+1; i++ {
 		opens = append(opens, softwarecomposition.OpenCalls{
 			Path:  fmt.Sprintf("/usr/lib/lib%d.so", i),
@@ -339,8 +333,8 @@ func TestDeflateApplicationProfileContainer_MixedPathsCollapse(t *testing.T) {
 		})
 	}
 
-	// /etc has its own threshold in DefaultCollapseConfigs
-	etcThreshold := configThreshold("/etc")
+	// /etc also uses the same uniform threshold
+	etcThreshold := openThreshold()
 	for i := 0; i < etcThreshold+1; i++ {
 		opens = append(opens, softwarecomposition.OpenCalls{
 			Path:  fmt.Sprintf("/etc/conf%d.cfg", i),
@@ -404,7 +398,7 @@ func TestDeflateApplicationProfileContainer_NilSbomNoError(t *testing.T) {
 // TestDeflateApplicationProfileContainer_PreSaveEndToEnd verifies the full
 // PreSave flow with an ApplicationProfile containing many opens that should collapse.
 func TestDeflateApplicationProfileContainer_PreSaveEndToEnd(t *testing.T) {
-	numOpens := configThreshold("/usr/lib") + 1
+	numOpens := openThreshold() + 1
 	opens := generateSOOpens(numOpens)
 
 	profile := &softwarecomposition.ApplicationProfile{

From 0bfa1f75ac277ba4fd6f02d74fa65bb44dd20217 Mon Sep 17 00:00:00 2001
From: entlein <einentlein@gmail.com>
Date: Sat, 14 Feb 2026 14:28:51 +0100
Subject: [PATCH 47/68] align the constants

Signed-off-by: entlein <einentlein@gmail.com>
---
 .../file/dynamicpathdetector/types.go         | 20 ++++++-------------
 1 file changed, 6 insertions(+), 14 deletions(-)

diff --git a/pkg/registry/file/dynamicpathdetector/types.go b/pkg/registry/file/dynamicpathdetector/types.go
index 145d5ca00..0d187ad9f 100644
--- a/pkg/registry/file/dynamicpathdetector/types.go
+++ b/pkg/registry/file/dynamicpathdetector/types.go
@@ -21,29 +21,21 @@ type CollapseConfig struct {
 // Paths under these prefixes are collapsed when the number of unique children
 // exceeds the threshold.
 var DefaultCollapseConfigs = []CollapseConfig{
-	{Prefix: "/etc", Threshold: 50},
+	{Prefix: "/etc", Threshold: 100},
+	{Prefix: "/etc/apache2", Threshold: 5}, //this is mostly for our webapp standard test
 	{Prefix: "/opt", Threshold: 5},
 	{Prefix: "/var/run", Threshold: 3},
 	{Prefix: "/app", Threshold: 1},
 }
 
-// DefaultCollapseConfig is the fallback used for paths that don't match any
-// prefix in DefaultCollapseConfigs.
+const OpenDynamicThreshold = 50
+const EndpointDynamicThreshold = 100
+
 var DefaultCollapseConfig = CollapseConfig{
 	Prefix:    "/",
-	Threshold: 5,
+	Threshold: OpenDynamicThreshold,
 }
 
-// --- Default thresholds for processors ---
-
-// OpenDynamicThreshold is the default collapse threshold used when analyzing
-// file-open paths in ApplicationProfile and ContainerProfile processors.
-const OpenDynamicThreshold = 50
-
-// EndpointDynamicThreshold is the default collapse threshold used when
-// analyzing HTTP endpoint paths.
-const EndpointDynamicThreshold = 100
-
 // --- Types ---
 
 type SegmentNode struct {

From fbe8f8190ba9670c476cc7fd483b4956949a1e30 Mon Sep 17 00:00:00 2001
From: tanzee <einentlein@gmail.com>
Date: Sat, 14 Feb 2026 16:54:48 +0100
Subject: [PATCH 48/68] exec events collapisble, try 1

---
 pkg/apis/softwarecomposition/types.go         |  11 +-
 pkg/apis/softwarecomposition/v1beta1/types.go |   7 +-
 .../v1beta1/zz_generated.conversion.go        |   2 +
 .../softwarecomposition/v1beta1/execcalls.go  |  15 +-
 pkg/generated/openapi/zz_generated.openapi.go |   6 +
 .../file/applicationprofile_processor.go      |   3 +-
 .../file/applicationprofile_processor_test.go |   2 +-
 .../file/containerprofile_processor.go        |   3 +-
 .../file/dynamicpathdetector/analyze_execs.go |  45 +++++
 .../file/dynamicpathdetector/arg_analyzer.go  |  84 +++++++++
 .../tests/analyze_execs_test.go               | 174 ++++++++++++++++++
 .../file/dynamicpathdetector/types.go         |   1 +
 12 files changed, 341 insertions(+), 12 deletions(-)
 create mode 100644 pkg/registry/file/dynamicpathdetector/analyze_execs.go
 create mode 100644 pkg/registry/file/dynamicpathdetector/arg_analyzer.go
 create mode 100644 pkg/registry/file/dynamicpathdetector/tests/analyze_execs_test.go

diff --git a/pkg/apis/softwarecomposition/types.go b/pkg/apis/softwarecomposition/types.go
index 1453e6f0c..c84e947ec 100644
--- a/pkg/apis/softwarecomposition/types.go
+++ b/pkg/apis/softwarecomposition/types.go
@@ -250,9 +250,10 @@ type RulePolicy struct {
 }
 
 type ExecCalls struct {
-	Path string
-	Args []string
-	Envs []string
+	Path       string
+	Args       []string
+	Envs       []string
+	ParentPath string
 }
 
 const sep = "␟"
@@ -269,6 +270,10 @@ func (e ExecCalls) String() string {
 		s.WriteString(sep)
 		s.WriteString(env)
 	}
+	if e.ParentPath != "" {
+		s.WriteString(sep)
+		s.WriteString(e.ParentPath)
+	}
 	return s.String()
 }
 
diff --git a/pkg/apis/softwarecomposition/v1beta1/types.go b/pkg/apis/softwarecomposition/v1beta1/types.go
index 36d4cff63..d27d19ad3 100644
--- a/pkg/apis/softwarecomposition/v1beta1/types.go
+++ b/pkg/apis/softwarecomposition/v1beta1/types.go
@@ -226,9 +226,10 @@ type ApplicationProfileContainer struct {
 }
 
 type ExecCalls struct {
-	Path string   `json:"path,omitempty" protobuf:"bytes,1,opt,name=path"`
-	Args []string `json:"args,omitempty" protobuf:"bytes,2,opt,name=args"`
-	Envs []string `json:"envs,omitempty" protobuf:"bytes,3,opt,name=envs"`
+	Path       string   `json:"path,omitempty" protobuf:"bytes,1,opt,name=path"`
+	Args       []string `json:"args,omitempty" protobuf:"bytes,2,opt,name=args"`
+	Envs       []string `json:"envs,omitempty" protobuf:"bytes,3,opt,name=envs"`
+	ParentPath string   `json:"parentPath,omitempty" protobuf:"bytes,4,opt,name=parentPath"`
 }
 
 type OpenCalls struct {
diff --git a/pkg/apis/softwarecomposition/v1beta1/zz_generated.conversion.go b/pkg/apis/softwarecomposition/v1beta1/zz_generated.conversion.go
index 03d068836..25726d255 100644
--- a/pkg/apis/softwarecomposition/v1beta1/zz_generated.conversion.go
+++ b/pkg/apis/softwarecomposition/v1beta1/zz_generated.conversion.go
@@ -2468,6 +2468,7 @@ func autoConvert_v1beta1_ExecCalls_To_softwarecomposition_ExecCalls(in *ExecCall
 	out.Path = in.Path
 	out.Args = *(*[]string)(unsafe.Pointer(&in.Args))
 	out.Envs = *(*[]string)(unsafe.Pointer(&in.Envs))
+	out.ParentPath = in.ParentPath
 	return nil
 }
 
@@ -2480,6 +2481,7 @@ func autoConvert_softwarecomposition_ExecCalls_To_v1beta1_ExecCalls(in *software
 	out.Path = in.Path
 	out.Args = *(*[]string)(unsafe.Pointer(&in.Args))
 	out.Envs = *(*[]string)(unsafe.Pointer(&in.Envs))
+	out.ParentPath = in.ParentPath
 	return nil
 }
 
diff --git a/pkg/generated/applyconfiguration/softwarecomposition/v1beta1/execcalls.go b/pkg/generated/applyconfiguration/softwarecomposition/v1beta1/execcalls.go
index 4bbbec724..f3be9de76 100644
--- a/pkg/generated/applyconfiguration/softwarecomposition/v1beta1/execcalls.go
+++ b/pkg/generated/applyconfiguration/softwarecomposition/v1beta1/execcalls.go
@@ -21,9 +21,10 @@ package v1beta1
 // ExecCallsApplyConfiguration represents a declarative configuration of the ExecCalls type for use
 // with apply.
 type ExecCallsApplyConfiguration struct {
-	Path *string  `json:"path,omitempty"`
-	Args []string `json:"args,omitempty"`
-	Envs []string `json:"envs,omitempty"`
+	Path       *string  `json:"path,omitempty"`
+	Args       []string `json:"args,omitempty"`
+	Envs       []string `json:"envs,omitempty"`
+	ParentPath *string  `json:"parentPath,omitempty"`
 }
 
 // ExecCallsApplyConfiguration constructs a declarative configuration of the ExecCalls type for use with
@@ -59,3 +60,11 @@ func (b *ExecCallsApplyConfiguration) WithEnvs(values ...string) *ExecCallsApply
 	}
 	return b
 }
+
+// WithParentPath sets the ParentPath field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the ParentPath field is set to the value of the last call.
+func (b *ExecCallsApplyConfiguration) WithParentPath(value string) *ExecCallsApplyConfiguration {
+	b.ParentPath = &value
+	return b
+}
diff --git a/pkg/generated/openapi/zz_generated.openapi.go b/pkg/generated/openapi/zz_generated.openapi.go
index ac2a4fa9f..98b948652 100644
--- a/pkg/generated/openapi/zz_generated.openapi.go
+++ b/pkg/generated/openapi/zz_generated.openapi.go
@@ -1702,6 +1702,12 @@ func schema_pkg_apis_softwarecomposition_v1beta1_ExecCalls(ref common.ReferenceC
 							},
 						},
 					},
+					"parentPath": {
+						SchemaProps: spec.SchemaProps{
+							Type:   []string{"string"},
+							Format: "",
+						},
+					},
 				},
 			},
 		},
diff --git a/pkg/registry/file/applicationprofile_processor.go b/pkg/registry/file/applicationprofile_processor.go
index 3c75df152..3af75cd85 100644
--- a/pkg/registry/file/applicationprofile_processor.go
+++ b/pkg/registry/file/applicationprofile_processor.go
@@ -112,13 +112,14 @@ func deflateApplicationProfileContainer(container softwarecomposition.Applicatio
 		logger.L().Debug("falling back to DeflateStringer for opens", loggerhelpers.Error(err))
 		opens = DeflateStringer(container.Opens)
 	}
+	execs := dynamicpathdetector.AnalyzeExecs(container.Execs, dynamicpathdetector.ExecArgDynamicThreshold)
 	endpoints := dynamicpathdetector.AnalyzeEndpoints(&container.Endpoints, dynamicpathdetector.NewPathAnalyzer(dynamicpathdetector.EndpointDynamicThreshold))
 	identifiedCallStacks := callstack.UnifyIdentifiedCallStacks(container.IdentifiedCallStacks)
 
 	return softwarecomposition.ApplicationProfileContainer{
 		Name:                 container.Name,
 		Capabilities:         DeflateSortString(container.Capabilities),
-		Execs:                DeflateStringer(container.Execs),
+		Execs:                execs,
 		Opens:                opens,
 		Syscalls:             DeflateSortString(container.Syscalls),
 		SeccompProfile:       container.SeccompProfile,
diff --git a/pkg/registry/file/applicationprofile_processor_test.go b/pkg/registry/file/applicationprofile_processor_test.go
index 5f508d984..ca919cf8c 100644
--- a/pkg/registry/file/applicationprofile_processor_test.go
+++ b/pkg/registry/file/applicationprofile_processor_test.go
@@ -118,8 +118,8 @@ func TestApplicationProfileProcessor_PreSave(t *testing.T) {
 						{
 							Name: "container1",
 							Execs: []softwarecomposition.ExecCalls{
-								{Path: "/usr/bin/ls", Args: []string{"-l", "/tmp"}},
 								{Path: "/usr/bin/ls", Args: []string{"-l", "/home"}},
+								{Path: "/usr/bin/ls", Args: []string{"-l", "/tmp"}},
 							},
 						},
 						{
diff --git a/pkg/registry/file/containerprofile_processor.go b/pkg/registry/file/containerprofile_processor.go
index 904fc89d9..54fc82141 100644
--- a/pkg/registry/file/containerprofile_processor.go
+++ b/pkg/registry/file/containerprofile_processor.go
@@ -706,13 +706,14 @@ func DeflateContainerProfileSpec(container softwarecomposition.ContainerProfileS
 		logger.L().Debug("ContainerProfileProcessor.deflateContainerProfileSpec - falling back to DeflateStringer for opens", loggerhelpers.Error(err))
 		opens = DeflateStringer(container.Opens)
 	}
+	execs := dynamicpathdetector.AnalyzeExecs(container.Execs, dynamicpathdetector.ExecArgDynamicThreshold)
 	endpoints := dynamicpathdetector.AnalyzeEndpoints(&container.Endpoints, dynamicpathdetector.NewPathAnalyzer(dynamicpathdetector.EndpointDynamicThreshold))
 	identifiedCallStacks := callstack.UnifyIdentifiedCallStacks(container.IdentifiedCallStacks)
 
 	return softwarecomposition.ContainerProfileSpec{
 		Architectures:        DeflateSortString(container.Architectures),
 		Capabilities:         DeflateSortString(container.Capabilities),
-		Execs:                DeflateStringer(container.Execs),
+		Execs:                execs,
 		Opens:                opens,
 		Syscalls:             DeflateSortString(container.Syscalls),
 		SeccompProfile:       container.SeccompProfile,
diff --git a/pkg/registry/file/dynamicpathdetector/analyze_execs.go b/pkg/registry/file/dynamicpathdetector/analyze_execs.go
new file mode 100644
index 000000000..6d6d89008
--- /dev/null
+++ b/pkg/registry/file/dynamicpathdetector/analyze_execs.go
@@ -0,0 +1,45 @@
+package dynamicpathdetector
+
+import (
+	"maps"
+	"slices"
+	"strings"
+
+	types "github.com/kubescape/storage/pkg/apis/softwarecomposition"
+)
+
+// AnalyzeExecs collapses exec argument vectors using a trie-based approach.
+// Argument positions with more than threshold unique values are replaced with DynamicIdentifier (⋯).
+// Results are deduplicated by their collapsed string representation and sorted.
+func AnalyzeExecs(execs []types.ExecCalls, threshold int) []types.ExecCalls {
+	if execs == nil {
+		return nil
+	}
+
+	analyzer := NewArgAnalyzer(threshold)
+
+	// First pass: build trie from all arg vectors, grouped by exec Path
+	for _, exec := range execs {
+		analyzer.AddArgs(exec.Args, exec.Path)
+	}
+
+	// Second pass: read collapsed arg vectors, dedup by collapsed string
+	dedupMap := make(map[string]types.ExecCalls)
+	for _, exec := range execs {
+		collapsed := analyzer.AnalyzeArgs(exec.Args, exec.Path)
+		collapsedExec := types.ExecCalls{
+			Path:       exec.Path,
+			Args:       collapsed,
+			Envs:       exec.Envs,
+			ParentPath: exec.ParentPath,
+		}
+		key := collapsedExec.String()
+		if _, ok := dedupMap[key]; !ok {
+			dedupMap[key] = collapsedExec
+		}
+	}
+
+	return slices.SortedFunc(maps.Values(dedupMap), func(a, b types.ExecCalls) int {
+		return strings.Compare(a.String(), b.String())
+	})
+}
diff --git a/pkg/registry/file/dynamicpathdetector/arg_analyzer.go b/pkg/registry/file/dynamicpathdetector/arg_analyzer.go
new file mode 100644
index 000000000..daf45e91d
--- /dev/null
+++ b/pkg/registry/file/dynamicpathdetector/arg_analyzer.go
@@ -0,0 +1,84 @@
+package dynamicpathdetector
+
+// ArgAnalyzer is a trie-based analyzer for exec argument vectors.
+// Each exec binary (Path) gets its own trie root. Each argument position
+// is a trie level. When unique values at a position exceed the threshold,
+// that position collapses to DynamicIdentifier (⋯).
+type ArgAnalyzer struct {
+	roots     map[string]*ArgNode
+	threshold int
+}
+
+type ArgNode struct {
+	Children map[string]*ArgNode
+}
+
+func NewArgAnalyzer(threshold int) *ArgAnalyzer {
+	return &ArgAnalyzer{
+		roots:     make(map[string]*ArgNode),
+		threshold: threshold,
+	}
+}
+
+// AddArgs inserts an argument vector into the trie for the given exec path.
+func (a *ArgAnalyzer) AddArgs(args []string, execPath string) {
+	if len(args) == 0 {
+		return
+	}
+	root, ok := a.roots[execPath]
+	if !ok {
+		root = &ArgNode{Children: make(map[string]*ArgNode)}
+		a.roots[execPath] = root
+	}
+	node := root
+	for _, arg := range args {
+		if node.Children == nil {
+			node.Children = make(map[string]*ArgNode)
+		}
+		child, ok := node.Children[arg]
+		if !ok {
+			child = &ArgNode{Children: make(map[string]*ArgNode)}
+			node.Children[arg] = child
+		}
+		node = child
+	}
+}
+
+// AnalyzeArgs returns the collapsed argument vector for the given exec path.
+// Positions where unique values exceed the threshold are replaced with DynamicIdentifier.
+func (a *ArgAnalyzer) AnalyzeArgs(args []string, execPath string) []string {
+	if len(args) == 0 {
+		return args
+	}
+	root, ok := a.roots[execPath]
+	if !ok {
+		return args
+	}
+	result := make([]string, len(args))
+	node := root
+	for i, arg := range args {
+		if node == nil || node.Children == nil {
+			result[i] = arg
+			continue
+		}
+		if len(node.Children) > a.threshold {
+			result[i] = DynamicIdentifier
+			// Follow the dynamic path if it exists, otherwise try the exact child
+			if dynChild, ok := node.Children[DynamicIdentifier]; ok {
+				node = dynChild
+			} else if child, ok := node.Children[arg]; ok {
+				node = child
+			} else {
+				node = nil
+			}
+		} else {
+			result[i] = arg
+			if child, ok := node.Children[arg]; ok {
+				node = child
+			} else {
+				node = nil
+			}
+		}
+	}
+	return result
+}
diff --git a/pkg/registry/file/dynamicpathdetector/tests/analyze_execs_test.go b/pkg/registry/file/dynamicpathdetector/tests/analyze_execs_test.go
new file mode 100644
index 000000000..754134106
--- /dev/null
+++ b/pkg/registry/file/dynamicpathdetector/tests/analyze_execs_test.go
@@ -0,0 +1,174 @@
+package dynamicpathdetectortests
+
+import (
+	"fmt"
+	"testing"
+
+	types "github.com/kubescape/storage/pkg/apis/softwarecomposition"
+	"github.com/kubescape/storage/pkg/registry/file/dynamicpathdetector"
+	"github.com/stretchr/testify/assert"
+)
+
+func TestAnalyzeExecsNoCollapse(t *testing.T) {
+	threshold := 10
+	input := []types.ExecCalls{
+		{Path: "/usr/bin/curl", Args: []string{"http://example.com"}},
+		{Path: "/usr/bin/curl", Args: []string{"http://example.org"}},
+		{Path: "/usr/bin/curl", Args: []string{"http://example.com"}}, // duplicate
+	}
+
+	result := dynamicpathdetector.AnalyzeExecs(input, threshold)
+
+	// Should dedup but not collapse (only 2 unique values < threshold)
+	assert.Len(t, result, 2)
+}
+
+func TestAnalyzeExecsArgPositionCollapse(t *testing.T) {
+	threshold := 10
+	var input []types.ExecCalls
+	for i := 0; i < threshold+1; i++ {
+		input = append(input, types.ExecCalls{
+			Path: "/usr/bin/curl",
+			Args: []string{fmt.Sprintf("http://service%d/api", i)},
+		})
+	}
+
+	result := dynamicpathdetector.AnalyzeExecs(input, threshold)
+
+	assert.Len(t, result, 1)
+	assert.Equal(t, "/usr/bin/curl", result[0].Path)
+	assert.Equal(t, []string{dynamicpathdetector.DynamicIdentifier}, result[0].Args)
+}
+
+func TestAnalyzeExecsDifferentBinariesIsolated(t *testing.T) {
+	threshold := 10
+	var input []types.ExecCalls
+
+	// 11 unique curl URLs → should collapse
+	for i := 0; i < threshold+1; i++ {
+		input = append(input, types.ExecCalls{
+			Path: "/usr/bin/curl",
+			Args: []string{fmt.Sprintf("http://service%d", i)},
+		})
+	}
+
+	// Only 2 unique grep patterns → should NOT collapse
+	input = append(input,
+		types.ExecCalls{Path: "/bin/grep", Args: []string{"pattern1"}},
+		types.ExecCalls{Path: "/bin/grep", Args: []string{"pattern2"}},
+	)
+
+	result := dynamicpathdetector.AnalyzeExecs(input, threshold)
+
+	curlResults := filterByPath(result, "/usr/bin/curl")
+	grepResults := filterByPath(result, "/bin/grep")
+
+	assert.Len(t, curlResults, 1)
+	assert.Equal(t, []string{dynamicpathdetector.DynamicIdentifier}, curlResults[0].Args)
+
+	assert.Len(t, grepResults, 2)
+}
+
+func TestAnalyzeExecsPreservesStaticArgs(t *testing.T) {
+	threshold := 10
+	var input []types.ExecCalls
+
+	// curl -s <dynamic URL> — only the URL varies
+	for i := 0; i < threshold+1; i++ {
+		input = append(input, types.ExecCalls{
+			Path: "/usr/bin/curl",
+			Args: []string{"-s", fmt.Sprintf("http://service%d/api", i)},
+		})
+	}
+
+	result := dynamicpathdetector.AnalyzeExecs(input, threshold)
+
+	assert.Len(t, result, 1)
+	assert.Equal(t, "/usr/bin/curl", result[0].Path)
+	assert.Equal(t, []string{"-s", dynamicpathdetector.DynamicIdentifier}, result[0].Args)
+}
+
+func TestAnalyzeExecsVariableLengthArgs(t *testing.T) {
+	threshold := 10
+	var input []types.ExecCalls
+
+	// Some have 1 arg, some have 2
+	for i := 0; i < threshold+1; i++ {
+		args := []string{fmt.Sprintf("http://service%d", i)}
+		if i%2 == 0 {
+			args = append(args, "--verbose")
+		}
+		input = append(input, types.ExecCalls{
+			Path: "/usr/bin/curl",
+			Args: args,
+		})
+	}
+
+	result := dynamicpathdetector.AnalyzeExecs(input, threshold)
+
+	// First arg position should collapse; results may vary by length
+	for _, r := range result {
+		assert.Equal(t, dynamicpathdetector.DynamicIdentifier, r.Args[0])
+	}
+}
+
+func TestAnalyzeExecsEmptyArgs(t *testing.T) {
+	input := []types.ExecCalls{
+		{Path: "/usr/bin/ls", Args: []string{}},
+		{Path: "/usr/bin/ls"},
+	}
+
+	result := dynamicpathdetector.AnalyzeExecs(input, 10)
+
+	// Both have no args — should dedup to a small set
+	assert.NotEmpty(t, result)
+	for _, r := range result {
+		assert.Equal(t, "/usr/bin/ls", r.Path)
+	}
+}
+
+func TestAnalyzeExecsNilInput(t *testing.T) {
+	result := dynamicpathdetector.AnalyzeExecs(nil, 10)
+	assert.Nil(t, result)
+}
+
+func TestAnalyzeExecsThreshold1(t *testing.T) {
+	input := []types.ExecCalls{
+		{Path: "/usr/bin/echo", Args: []string{"hello"}},
+		{Path: "/usr/bin/echo", Args: []string{"world"}},
+	}
+
+	result := dynamicpathdetector.AnalyzeExecs(input, 1)
+
+	// Threshold 1: any position with >1 unique value collapses
+	assert.Len(t, result, 1)
+	assert.Equal(t, []string{dynamicpathdetector.DynamicIdentifier}, result[0].Args)
+}
+
+func TestAnalyzeExecsParentPathPreserved(t *testing.T) {
+	threshold := 10
+	var input []types.ExecCalls
+	for i := 0; i < threshold+1; i++ {
+		input = append(input, types.ExecCalls{
+			Path:       "/usr/bin/curl",
+			Args:       []string{fmt.Sprintf("http://service%d", i)},
+			ParentPath: "/bin/bash",
+		})
+	}
+
+	result := dynamicpathdetector.AnalyzeExecs(input, threshold)
+
+	assert.Len(t, result, 1)
+	assert.Equal(t, "/bin/bash", result[0].ParentPath)
+	assert.Equal(t, []string{dynamicpathdetector.DynamicIdentifier}, result[0].Args)
+}
+
+func filterByPath(execs []types.ExecCalls, path string) []types.ExecCalls {
+	var filtered []types.ExecCalls
+	for _, e := range execs {
+		if e.Path == path {
+			filtered = append(filtered, e)
+		}
+	}
+	return filtered
+}
diff --git a/pkg/registry/file/dynamicpathdetector/types.go b/pkg/registry/file/dynamicpathdetector/types.go
index 0d187ad9f..9fbb0832f 100644
--- a/pkg/registry/file/dynamicpathdetector/types.go
+++ b/pkg/registry/file/dynamicpathdetector/types.go
@@ -30,6 +30,7 @@ var DefaultCollapseConfigs = []CollapseConfig{
 
 const OpenDynamicThreshold = 50
 const EndpointDynamicThreshold = 100
+const ExecArgDynamicThreshold = 10
 
 var DefaultCollapseConfig = CollapseConfig{
 	Prefix:    "/",

From a3a8365de94bc76afa0c1948428e55c83c8be88b Mon Sep 17 00:00:00 2001
From: tanzee <einentlein@gmail.com>
Date: Sun, 15 Feb 2026 13:50:44 +0100
Subject: [PATCH 49/68] deduplication fix

---
 .../file/applicationprofile_processor.go      |   2 +-
 .../file/containerprofile_processor.go        |   2 +-
 .../file/dynamicpathdetector/analyze_execs.go |  34 ++-
 .../tests/analyze_execs_test.go               | 245 ++++++++++++------
 4 files changed, 193 insertions(+), 90 deletions(-)

diff --git a/pkg/registry/file/applicationprofile_processor.go b/pkg/registry/file/applicationprofile_processor.go
index 3af75cd85..46a57cd5e 100644
--- a/pkg/registry/file/applicationprofile_processor.go
+++ b/pkg/registry/file/applicationprofile_processor.go
@@ -112,7 +112,7 @@ func deflateApplicationProfileContainer(container softwarecomposition.Applicatio
 		logger.L().Debug("falling back to DeflateStringer for opens", loggerhelpers.Error(err))
 		opens = DeflateStringer(container.Opens)
 	}
-	execs := dynamicpathdetector.AnalyzeExecs(container.Execs, dynamicpathdetector.ExecArgDynamicThreshold)
+	execs := dynamicpathdetector.CollapseExecArgs(dynamicpathdetector.DeduplicateExecs(container.Execs), dynamicpathdetector.ExecArgDynamicThreshold)
 	endpoints := dynamicpathdetector.AnalyzeEndpoints(&container.Endpoints, dynamicpathdetector.NewPathAnalyzer(dynamicpathdetector.EndpointDynamicThreshold))
 	identifiedCallStacks := callstack.UnifyIdentifiedCallStacks(container.IdentifiedCallStacks)
 
diff --git a/pkg/registry/file/containerprofile_processor.go b/pkg/registry/file/containerprofile_processor.go
index 54fc82141..b51b28a02 100644
--- a/pkg/registry/file/containerprofile_processor.go
+++ b/pkg/registry/file/containerprofile_processor.go
@@ -706,7 +706,7 @@ func DeflateContainerProfileSpec(container softwarecomposition.ContainerProfileS
 		logger.L().Debug("ContainerProfileProcessor.deflateContainerProfileSpec - falling back to DeflateStringer for opens", loggerhelpers.Error(err))
 		opens = DeflateStringer(container.Opens)
 	}
-	execs := dynamicpathdetector.AnalyzeExecs(container.Execs, dynamicpathdetector.ExecArgDynamicThreshold)
+	execs := dynamicpathdetector.CollapseExecArgs(dynamicpathdetector.DeduplicateExecs(container.Execs), dynamicpathdetector.ExecArgDynamicThreshold)
 	endpoints := dynamicpathdetector.AnalyzeEndpoints(&container.Endpoints, dynamicpathdetector.NewPathAnalyzer(dynamicpathdetector.EndpointDynamicThreshold))
 	identifiedCallStacks := callstack.UnifyIdentifiedCallStacks(container.IdentifiedCallStacks)
 
diff --git a/pkg/registry/file/dynamicpathdetector/analyze_execs.go b/pkg/registry/file/dynamicpathdetector/analyze_execs.go
index 6d6d89008..a6fd76902 100644
--- a/pkg/registry/file/dynamicpathdetector/analyze_execs.go
+++ b/pkg/registry/file/dynamicpathdetector/analyze_execs.go
@@ -5,25 +5,47 @@ import (
 	"slices"
 	"strings"
 
+	mapset "github.com/deckarep/golang-set/v2"
 	types "github.com/kubescape/storage/pkg/apis/softwarecomposition"
 )
 
-// AnalyzeExecs collapses exec argument vectors using a trie-based approach.
-// Argument positions with more than threshold unique values are replaced with DynamicIdentifier (⋯).
-// Results are deduplicated by their collapsed string representation and sorted.
-func AnalyzeExecs(execs []types.ExecCalls, threshold int) []types.ExecCalls {
+// DeduplicateExecs removes exact-duplicate ExecCalls based on their
+// string representation (Path + Args + Envs + ParentPath).
+func DeduplicateExecs(execs []types.ExecCalls) []types.ExecCalls {
+	if execs == nil {
+		return nil
+	}
+	out := make([]types.ExecCalls, 0, len(execs))
+	seen := mapset.NewThreadUnsafeSet[string]()
+	for _, e := range execs {
+		key := e.String()
+		if seen.Contains(key) {
+			continue
+		}
+		seen.Add(key)
+		out = append(out, e)
+	}
+	return out
+}
+
+// CollapseExecArgs collapses argument positions that show high variability
+// across execs sharing the same binary Path. Positions with more than
+// threshold unique values are replaced with DynamicIdentifier (⋯).
+// Since collapsing can turn previously-distinct entries into duplicates,
+// a second dedup pass is applied to the result.
+func CollapseExecArgs(execs []types.ExecCalls, threshold int) []types.ExecCalls {
 	if execs == nil {
 		return nil
 	}
 
 	analyzer := NewArgAnalyzer(threshold)
 
-	// First pass: build trie from all arg vectors, grouped by exec Path
+	// Build trie from all arg vectors, grouped by exec Path
 	for _, exec := range execs {
 		analyzer.AddArgs(exec.Args, exec.Path)
 	}
 
-	// Second pass: read collapsed arg vectors, dedup by collapsed string
+	// Apply collapsing and dedup the result
 	dedupMap := make(map[string]types.ExecCalls)
 	for _, exec := range execs {
 		collapsed := analyzer.AnalyzeArgs(exec.Args, exec.Path)
diff --git a/pkg/registry/file/dynamicpathdetector/tests/analyze_execs_test.go b/pkg/registry/file/dynamicpathdetector/tests/analyze_execs_test.go
index 754134106..e1ad54143 100644
--- a/pkg/registry/file/dynamicpathdetector/tests/analyze_execs_test.go
+++ b/pkg/registry/file/dynamicpathdetector/tests/analyze_execs_test.go
@@ -9,160 +9,241 @@ import (
 	"github.com/stretchr/testify/assert"
 )
 
-func TestAnalyzeExecsNoCollapse(t *testing.T) {
-	threshold := 10
+const threshold = dynamicpathdetector.ExecArgDynamicThreshold
+
+// ---------------------------------------------------------------------------
+// DeduplicateExecs — exact-duplicate removal, no collapsing
+// ---------------------------------------------------------------------------
+
+func TestDeduplicateExecsRemovesDuplicates(t *testing.T) {
 	input := []types.ExecCalls{
 		{Path: "/usr/bin/curl", Args: []string{"http://example.com"}},
+		{Path: "/usr/bin/curl", Args: []string{"http://example.com"}}, // exact dup
 		{Path: "/usr/bin/curl", Args: []string{"http://example.org"}},
-		{Path: "/usr/bin/curl", Args: []string{"http://example.com"}}, // duplicate
 	}
 
-	result := dynamicpathdetector.AnalyzeExecs(input, threshold)
+	result := dynamicpathdetector.DeduplicateExecs(input)
 
-	// Should dedup but not collapse (only 2 unique values < threshold)
 	assert.Len(t, result, 2)
+	assert.Equal(t, []string{"http://example.com"}, result[0].Args)
+	assert.Equal(t, []string{"http://example.org"}, result[1].Args)
 }
 
-func TestAnalyzeExecsArgPositionCollapse(t *testing.T) {
-	threshold := 10
-	var input []types.ExecCalls
-	for i := 0; i < threshold+1; i++ {
-		input = append(input, types.ExecCalls{
-			Path: "/usr/bin/curl",
-			Args: []string{fmt.Sprintf("http://service%d/api", i)},
-		})
+func TestDeduplicateExecsPreservesOrder(t *testing.T) {
+	input := []types.ExecCalls{
+		{Path: "/bin/mkdir", Args: []string{"-p", "/var/log"}},
+		{Path: "/bin/rm", Args: []string{"-f", "/tmp/lock"}},
+		{Path: "/bin/mkdir", Args: []string{"-p", "/var/log"}}, // exact dup
 	}
 
-	result := dynamicpathdetector.AnalyzeExecs(input, threshold)
+	result := dynamicpathdetector.DeduplicateExecs(input)
 
-	assert.Len(t, result, 1)
-	assert.Equal(t, "/usr/bin/curl", result[0].Path)
-	assert.Equal(t, []string{dynamicpathdetector.DynamicIdentifier}, result[0].Args)
+	assert.Len(t, result, 2)
+	assert.Equal(t, "/bin/mkdir", result[0].Path)
+	assert.Equal(t, "/bin/rm", result[1].Path)
 }
 
-func TestAnalyzeExecsDifferentBinariesIsolated(t *testing.T) {
-	threshold := 10
-	var input []types.ExecCalls
+func TestDeduplicateExecsNil(t *testing.T) {
+	assert.Nil(t, dynamicpathdetector.DeduplicateExecs(nil))
+}
 
-	// 11 unique curl URLs → should collapse
-	for i := 0; i < threshold+1; i++ {
-		input = append(input, types.ExecCalls{
-			Path: "/usr/bin/curl",
-			Args: []string{fmt.Sprintf("http://service%d", i)},
-		})
+func TestDeduplicateExecsDistinguishesByParentPath(t *testing.T) {
+	input := []types.ExecCalls{
+		{Path: "/usr/bin/ls", Args: []string{"-l"}, ParentPath: "/bin/bash"},
+		{Path: "/usr/bin/ls", Args: []string{"-l"}, ParentPath: "/bin/sh"},
 	}
 
-	// Only 2 unique grep patterns → should NOT collapse
-	input = append(input,
-		types.ExecCalls{Path: "/bin/grep", Args: []string{"pattern1"}},
-		types.ExecCalls{Path: "/bin/grep", Args: []string{"pattern2"}},
-	)
+	result := dynamicpathdetector.DeduplicateExecs(input)
 
-	result := dynamicpathdetector.AnalyzeExecs(input, threshold)
+	// Same Path+Args but different ParentPath → not duplicates
+	assert.Len(t, result, 2)
+}
+
+// ---------------------------------------------------------------------------
+// CollapseExecArgs — argument-vector collapsing on already-deduped input
+// ---------------------------------------------------------------------------
+
+func TestCollapseExecArgsApacheStartup(t *testing.T) {
+	// Already-deduped execs from a real Apache container.
+	// 3 variants for mkdir and 3 for dirname — exceeds ExecArgDynamicThreshold.
+	deduped := []types.ExecCalls{
+		{Path: "/bin/mkdir", Args: []string{"/bin/mkdir", "-p", "/var/lock/apache2"}},
+		{Path: "/bin/mkdir", Args: []string{"/bin/mkdir", "-p", "/var/log/apache2"}},
+		{Path: "/bin/mkdir", Args: []string{"/bin/mkdir", "-p", "/var/run/apache2"}},
+		{Path: "/bin/rm", Args: []string{"/bin/rm", "-f", "/var/run/apache2/apache2.pid"}},
+		{Path: "/usr/bin/dirname", Args: []string{"/usr/bin/dirname", "/var/lock/apache2"}},
+		{Path: "/usr/bin/dirname", Args: []string{"/usr/bin/dirname", "/var/log/apache2"}},
+		{Path: "/usr/bin/dirname", Args: []string{"/usr/bin/dirname", "/var/run/apache2"}},
+	}
 
-	curlResults := filterByPath(result, "/usr/bin/curl")
-	grepResults := filterByPath(result, "/bin/grep")
+	result := dynamicpathdetector.CollapseExecArgs(deduped, 3)
 
-	assert.Len(t, curlResults, 1)
-	assert.Equal(t, []string{dynamicpathdetector.DynamicIdentifier}, curlResults[0].Args)
+	// 7 entries → 3 after collapsing:
+	//   /bin/mkdir       [/bin/mkdir, -p, ⋯]
+	//   /bin/rm          [/bin/rm, -f, /var/run/apache2/apache2.pid]  (only 1, unchanged)
+	//   /usr/bin/dirname [/usr/bin/dirname, ⋯]
+	assert.Len(t, result, 3, "got: %v", result)
 
-	assert.Len(t, grepResults, 2)
-}
+	mkdirResults := filterByPath(result, "/bin/mkdir")
+	assert.Len(t, mkdirResults, 1)
+	assert.Equal(t, []string{"/bin/mkdir", "-p", dynamicpathdetector.DynamicIdentifier}, mkdirResults[0].Args)
 
-func TestAnalyzeExecsPreservesStaticArgs(t *testing.T) {
-	threshold := 10
-	var input []types.ExecCalls
+	rmResults := filterByPath(result, "/bin/rm")
+	assert.Len(t, rmResults, 1)
+	assert.Equal(t, []string{"/bin/rm", "-f", "/var/run/apache2/apache2.pid"}, rmResults[0].Args)
 
-	// curl -s <dynamic URL> — only the URL varies
+	dirnameResults := filterByPath(result, "/usr/bin/dirname")
+	assert.Len(t, dirnameResults, 1)
+	assert.Equal(t, []string{"/usr/bin/dirname", dynamicpathdetector.DynamicIdentifier}, dirnameResults[0].Args)
+}
+
+func TestCollapseExecArgsPreservesStaticPositions(t *testing.T) {
+	// curl -s <varying URL> — only the URL position varies
+	var deduped []types.ExecCalls
 	for i := 0; i < threshold+1; i++ {
-		input = append(input, types.ExecCalls{
+		deduped = append(deduped, types.ExecCalls{
 			Path: "/usr/bin/curl",
 			Args: []string{"-s", fmt.Sprintf("http://service%d/api", i)},
 		})
 	}
 
-	result := dynamicpathdetector.AnalyzeExecs(input, threshold)
+	result := dynamicpathdetector.CollapseExecArgs(deduped, threshold)
 
 	assert.Len(t, result, 1)
-	assert.Equal(t, "/usr/bin/curl", result[0].Path)
 	assert.Equal(t, []string{"-s", dynamicpathdetector.DynamicIdentifier}, result[0].Args)
 }
 
-func TestAnalyzeExecsVariableLengthArgs(t *testing.T) {
-	threshold := 10
-	var input []types.ExecCalls
+func TestCollapseExecArgsBelowThresholdNoCollapse(t *testing.T) {
+	// Generate exactly threshold entries — at threshold means not exceeded, no collapse
+	var deduped []types.ExecCalls
+	for i := 0; i < threshold; i++ {
+		deduped = append(deduped, types.ExecCalls{
+			Path: "/bin/mkdir",
+			Args: []string{"/bin/mkdir", "-p", fmt.Sprintf("/var/dir%d", i)},
+		})
+	}
+
+	result := dynamicpathdetector.CollapseExecArgs(deduped, threshold)
+	assert.Len(t, result, threshold, "at threshold, nothing should collapse")
+}
 
-	// Some have 1 arg, some have 2
+func TestCollapseExecArgsDifferentBinariesIsolated(t *testing.T) {
+	var deduped []types.ExecCalls
+
+	// threshold+1 unique curl URLs → should collapse
 	for i := 0; i < threshold+1; i++ {
-		args := []string{fmt.Sprintf("http://service%d", i)}
-		if i%2 == 0 {
-			args = append(args, "--verbose")
-		}
-		input = append(input, types.ExecCalls{
+		deduped = append(deduped, types.ExecCalls{
 			Path: "/usr/bin/curl",
-			Args: args,
+			Args: []string{fmt.Sprintf("http://service%d", i)},
 		})
 	}
 
-	result := dynamicpathdetector.AnalyzeExecs(input, threshold)
+	// Only 1 grep pattern → should NOT collapse (well below threshold)
+	deduped = append(deduped,
+		types.ExecCalls{Path: "/bin/grep", Args: []string{"pattern1"}},
+	)
 
-	// First arg position should collapse; results may vary by length
-	for _, r := range result {
-		assert.Equal(t, dynamicpathdetector.DynamicIdentifier, r.Args[0])
-	}
+	result := dynamicpathdetector.CollapseExecArgs(deduped, threshold)
+
+	assert.Len(t, filterByPath(result, "/usr/bin/curl"), 1)
+	assert.Equal(t, []string{dynamicpathdetector.DynamicIdentifier}, filterByPath(result, "/usr/bin/curl")[0].Args)
+	assert.Len(t, filterByPath(result, "/bin/grep"), 1)
 }
 
-func TestAnalyzeExecsEmptyArgs(t *testing.T) {
-	input := []types.ExecCalls{
+func TestCollapseExecArgsEmptyArgs(t *testing.T) {
+	deduped := []types.ExecCalls{
 		{Path: "/usr/bin/ls", Args: []string{}},
 		{Path: "/usr/bin/ls"},
 	}
 
-	result := dynamicpathdetector.AnalyzeExecs(input, 10)
+	result := dynamicpathdetector.CollapseExecArgs(deduped, threshold)
 
-	// Both have no args — should dedup to a small set
 	assert.NotEmpty(t, result)
 	for _, r := range result {
 		assert.Equal(t, "/usr/bin/ls", r.Path)
 	}
 }
 
-func TestAnalyzeExecsNilInput(t *testing.T) {
-	result := dynamicpathdetector.AnalyzeExecs(nil, 10)
-	assert.Nil(t, result)
+func TestCollapseExecArgsNil(t *testing.T) {
+	assert.Nil(t, dynamicpathdetector.CollapseExecArgs(nil, threshold))
 }
 
-func TestAnalyzeExecsThreshold1(t *testing.T) {
-	input := []types.ExecCalls{
-		{Path: "/usr/bin/echo", Args: []string{"hello"}},
-		{Path: "/usr/bin/echo", Args: []string{"world"}},
+func TestCollapseExecArgsParentPathPreserved(t *testing.T) {
+	var deduped []types.ExecCalls
+	for i := 0; i < threshold+1; i++ {
+		deduped = append(deduped, types.ExecCalls{
+			Path:       "/usr/bin/curl",
+			Args:       []string{fmt.Sprintf("http://service%d", i)},
+			ParentPath: "/bin/bash",
+		})
 	}
 
-	result := dynamicpathdetector.AnalyzeExecs(input, 1)
+	result := dynamicpathdetector.CollapseExecArgs(deduped, threshold)
 
-	// Threshold 1: any position with >1 unique value collapses
 	assert.Len(t, result, 1)
+	assert.Equal(t, "/bin/bash", result[0].ParentPath)
 	assert.Equal(t, []string{dynamicpathdetector.DynamicIdentifier}, result[0].Args)
 }
 
-func TestAnalyzeExecsParentPathPreserved(t *testing.T) {
-	threshold := 10
+// ---------------------------------------------------------------------------
+// Pipeline — DeduplicateExecs then CollapseExecArgs (as used in processors)
+// ---------------------------------------------------------------------------
+
+func TestPipelineApacheStartupWithDuplicates(t *testing.T) {
+	// Raw input with exact duplicates mixed in
+	input := []types.ExecCalls{
+		{Path: "/bin/mkdir", Args: []string{"/bin/mkdir", "-p", "/var/lock/apache2"}},
+		{Path: "/bin/mkdir", Args: []string{"/bin/mkdir", "-p", "/var/log/apache2"}},
+		{Path: "/bin/mkdir", Args: []string{"/bin/mkdir", "-p", "/var/lock/apache2"}}, // exact dup
+		{Path: "/bin/mkdir", Args: []string{"/bin/mkdir", "-p", "/var/run/apache2"}},
+		{Path: "/bin/mkdir", Args: []string{"/bin/mkdir", "-p", "/var/log/apache2"}},  // exact dup
+		{Path: "/usr/bin/dirname", Args: []string{"/usr/bin/dirname", "/var/lock/apache2"}},
+		{Path: "/usr/bin/dirname", Args: []string{"/usr/bin/dirname", "/var/log/apache2"}},
+		{Path: "/usr/bin/dirname", Args: []string{"/usr/bin/dirname", "/var/run/apache2"}},
+		{Path: "/usr/bin/dirname", Args: []string{"/usr/bin/dirname", "/var/lock/apache2"}}, // exact dup
+	}
+
+	// Step 1: dedup removes 3 exact duplicates → 6 unique entries
+	deduped := dynamicpathdetector.DeduplicateExecs(input)
+	assert.Len(t, deduped, 6)
+
+	// Step 2: collapse merges mkdir variants and dirname variants → 2
+	result := dynamicpathdetector.CollapseExecArgs(deduped, 2)
+	assert.Len(t, result, 2)
+
+	mkdirResults := filterByPath(result, "/bin/mkdir")
+	assert.Len(t, mkdirResults, 1)
+	assert.Equal(t, []string{"/bin/mkdir", "-p", dynamicpathdetector.DynamicIdentifier}, mkdirResults[0].Args)
+
+	dirnameResults := filterByPath(result, "/usr/bin/dirname")
+	assert.Len(t, dirnameResults, 1)
+	assert.Equal(t, []string{"/usr/bin/dirname", dynamicpathdetector.DynamicIdentifier}, dirnameResults[0].Args)
+}
+
+func TestPipelineVariableLengthArgs(t *testing.T) {
 	var input []types.ExecCalls
+
 	for i := 0; i < threshold+1; i++ {
+		args := []string{fmt.Sprintf("http://service%d", i)}
+		if i%2 == 0 {
+			args = append(args, "--verbose")
+		}
 		input = append(input, types.ExecCalls{
-			Path:       "/usr/bin/curl",
-			Args:       []string{fmt.Sprintf("http://service%d", i)},
-			ParentPath: "/bin/bash",
+			Path: "/usr/bin/curl",
+			Args: args,
 		})
 	}
 
-	result := dynamicpathdetector.AnalyzeExecs(input, threshold)
+	deduped := dynamicpathdetector.DeduplicateExecs(input)
+	result := dynamicpathdetector.CollapseExecArgs(deduped, threshold)
 
-	assert.Len(t, result, 1)
-	assert.Equal(t, "/bin/bash", result[0].ParentPath)
-	assert.Equal(t, []string{dynamicpathdetector.DynamicIdentifier}, result[0].Args)
+	for _, r := range result {
+		assert.Equal(t, dynamicpathdetector.DynamicIdentifier, r.Args[0])
+	}
 }
 
+// ---------------------------------------------------------------------------
+
 func filterByPath(execs []types.ExecCalls, path string) []types.ExecCalls {
 	var filtered []types.ExecCalls
 	for _, e := range execs {

From 02f86153e35696e57c5b56fb9ffd8d8ffab27923 Mon Sep 17 00:00:00 2001
From: tanzee <einentlein@gmail.com>
Date: Sun, 15 Feb 2026 14:47:11 +0100
Subject: [PATCH 50/68] test itself was wrong

---
 .../file/dynamicpathdetector/tests/analyze_execs_test.go        | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkg/registry/file/dynamicpathdetector/tests/analyze_execs_test.go b/pkg/registry/file/dynamicpathdetector/tests/analyze_execs_test.go
index e1ad54143..941a17305 100644
--- a/pkg/registry/file/dynamicpathdetector/tests/analyze_execs_test.go
+++ b/pkg/registry/file/dynamicpathdetector/tests/analyze_execs_test.go
@@ -76,7 +76,7 @@ func TestCollapseExecArgsApacheStartup(t *testing.T) {
 		{Path: "/usr/bin/dirname", Args: []string{"/usr/bin/dirname", "/var/run/apache2"}},
 	}
 
-	result := dynamicpathdetector.CollapseExecArgs(deduped, 3)
+	result := dynamicpathdetector.CollapseExecArgs(deduped, 2)
 
 	// 7 entries → 3 after collapsing:
 	//   /bin/mkdir       [/bin/mkdir, -p, ⋯]

From 1f833c4022a97e458cace50b16d99002e1a8f6fb Mon Sep 17 00:00:00 2001
From: tanzee <einentlein@gmail.com>
Date: Sun, 15 Feb 2026 16:29:25 +0100
Subject: [PATCH 51/68] more tests

---
 .../file/applicationprofile_processor_test.go | 162 ++++++++++++++++++
 1 file changed, 162 insertions(+)

diff --git a/pkg/registry/file/applicationprofile_processor_test.go b/pkg/registry/file/applicationprofile_processor_test.go
index ca919cf8c..ffa1904cb 100644
--- a/pkg/registry/file/applicationprofile_processor_test.go
+++ b/pkg/registry/file/applicationprofile_processor_test.go
@@ -257,6 +257,168 @@ func TestDeflateRulePolicies(t *testing.T) {
 	}
 }
 
+// ---------------------------------------------------------------------------
+// Exec dedup + collapse through the actual deflateApplicationProfileContainer
+// ---------------------------------------------------------------------------
+
+// TestDeflateApplicationProfileContainer_ExecDedup verifies that exact-duplicate
+// execs are removed by the deflate pipeline.
+func TestDeflateApplicationProfileContainer_ExecDedup(t *testing.T) {
+	container := softwarecomposition.ApplicationProfileContainer{
+		Name: "test",
+		Execs: []softwarecomposition.ExecCalls{
+			{Path: "/usr/bin/ls", Args: []string{"-l", "/tmp"}},
+			{Path: "/usr/bin/ls", Args: []string{"-l", "/tmp"}}, // exact dup
+			{Path: "/usr/bin/ls", Args: []string{"-l", "/tmp"}}, // exact dup
+			{Path: "/usr/bin/ls", Args: []string{"-l", "/home"}},
+		},
+	}
+
+	result := deflateApplicationProfileContainer(container, nil)
+
+	assert.Len(t, result.Execs, 2, "exact duplicates should be removed, got %v", result.Execs)
+}
+
+// TestDeflateApplicationProfileContainer_ExecCollapseApache uses the exact exec
+// data from a real Apache container ApplicationProfile. The pipeline must:
+//  1. Deduplicate exact duplicates
+//  2. Collapse varying arg positions to ⋯
+func TestDeflateApplicationProfileContainer_ExecCollapseApache(t *testing.T) {
+	container := softwarecomposition.ApplicationProfileContainer{
+		Name: "apache",
+		Execs: []softwarecomposition.ExecCalls{
+			// mkdir called with 3 different dirs (+ duplicates of each)
+			{Path: "/bin/mkdir", Args: []string{"/bin/mkdir", "-p", "/var/lock/apache2"}},
+			{Path: "/bin/mkdir", Args: []string{"/bin/mkdir", "-p", "/var/lock/apache2"}},
+			{Path: "/bin/mkdir", Args: []string{"/bin/mkdir", "-p", "/var/log/apache2"}},
+			{Path: "/bin/mkdir", Args: []string{"/bin/mkdir", "-p", "/var/log/apache2"}},
+			{Path: "/bin/mkdir", Args: []string{"/bin/mkdir", "-p", "/var/run/apache2"}},
+			{Path: "/bin/mkdir", Args: []string{"/bin/mkdir", "-p", "/var/run/apache2"}},
+			// rm called once
+			{Path: "/bin/rm", Args: []string{"/bin/rm", "-f", "/var/run/apache2/apache2.pid"}},
+			{Path: "/bin/rm", Args: []string{"/bin/rm", "-f", "/var/run/apache2/apache2.pid"}},
+			// dirname called with 3 different dirs (+ duplicates)
+			{Path: "/usr/bin/dirname", Args: []string{"/usr/bin/dirname", "/var/lock/apache2"}},
+			{Path: "/usr/bin/dirname", Args: []string{"/usr/bin/dirname", "/var/lock/apache2"}},
+			{Path: "/usr/bin/dirname", Args: []string{"/usr/bin/dirname", "/var/log/apache2"}},
+			{Path: "/usr/bin/dirname", Args: []string{"/usr/bin/dirname", "/var/log/apache2"}},
+			{Path: "/usr/bin/dirname", Args: []string{"/usr/bin/dirname", "/var/run/apache2"}},
+		},
+	}
+
+	result := deflateApplicationProfileContainer(container, nil)
+
+	// After dedup: 7 unique. After collapse (threshold=10, 3 variants per binary):
+	// With threshold=10 and only 3 variants, collapsing does NOT kick in.
+	// This test documents the current behavior at ExecArgDynamicThreshold.
+	t.Logf("ExecArgDynamicThreshold=%d", dynamicpathdetector.ExecArgDynamicThreshold)
+	t.Logf("result execs (%d):", len(result.Execs))
+	for _, e := range result.Execs {
+		t.Logf("  path=%s args=%v", e.Path, e.Args)
+	}
+
+	// Duplicates must always be removed regardless of threshold
+	assert.Less(t, len(result.Execs), len(container.Execs),
+		"duplicates were not removed")
+
+	// After dedup we expect 7 unique entries
+	// (3 mkdir + 1 rm + 3 dirname)
+	// Whether they further collapse depends on the threshold
+	if dynamicpathdetector.ExecArgDynamicThreshold < 3 {
+		// Collapsing kicks in: 3 variants > threshold
+		assert.Len(t, result.Execs, 3,
+			"with threshold < 3, mkdir/dirname variants should collapse")
+
+		for _, e := range result.Execs {
+			if e.Path == "/bin/mkdir" {
+				assert.Equal(t, []string{"/bin/mkdir", "-p", dynamicpathdetector.DynamicIdentifier}, e.Args)
+			}
+			if e.Path == "/usr/bin/dirname" {
+				assert.Equal(t, []string{"/usr/bin/dirname", dynamicpathdetector.DynamicIdentifier}, e.Args)
+			}
+			if e.Path == "/bin/rm" {
+				assert.Equal(t, []string{"/bin/rm", "-f", "/var/run/apache2/apache2.pid"}, e.Args)
+			}
+		}
+	} else {
+		// Threshold too high for 3 variants — only dedup, no collapse
+		assert.Len(t, result.Execs, 7,
+			"with threshold >= 3, 3 variants should not collapse (only dedup)")
+	}
+}
+
+// TestDeflateApplicationProfileContainer_ExecCollapseHighVariability generates
+// enough exec variants to exceed ExecArgDynamicThreshold and verifies collapsing.
+func TestDeflateApplicationProfileContainer_ExecCollapseHighVariability(t *testing.T) {
+	n := dynamicpathdetector.ExecArgDynamicThreshold + 1
+	var execs []softwarecomposition.ExecCalls
+	for i := 0; i < n; i++ {
+		execs = append(execs, softwarecomposition.ExecCalls{
+			Path: "/usr/bin/curl",
+			Args: []string{"-s", fmt.Sprintf("http://service%d/api", i)},
+		})
+	}
+	// Add duplicates
+	execs = append(execs, execs[0], execs[1], execs[2])
+
+	container := softwarecomposition.ApplicationProfileContainer{
+		Name:  "curl-heavy",
+		Execs: execs,
+	}
+
+	result := deflateApplicationProfileContainer(container, nil)
+
+	// All entries share path=/usr/bin/curl, static arg "-s", varying URL
+	assert.Len(t, result.Execs, 1,
+		"all curl variants should collapse to one entry, got %v", result.Execs)
+	assert.Equal(t, "/usr/bin/curl", result.Execs[0].Path)
+	assert.Equal(t, []string{"-s", dynamicpathdetector.DynamicIdentifier}, result.Execs[0].Args,
+		"static -s preserved, dynamic URL collapsed")
+}
+
+// TestDeflateApplicationProfileContainer_PreSaveExecEndToEnd runs the full
+// PreSave path with exec data to verify dedup+collapse in the real pipeline.
+func TestDeflateApplicationProfileContainer_PreSaveExecEndToEnd(t *testing.T) {
+	n := dynamicpathdetector.ExecArgDynamicThreshold + 1
+	var execs []softwarecomposition.ExecCalls
+	for i := 0; i < n; i++ {
+		// Each exec appears twice (exact dup)
+		exec := softwarecomposition.ExecCalls{
+			Path: "/usr/bin/wget",
+			Args: []string{"/usr/bin/wget", "-q", fmt.Sprintf("http://backend%d:8080/health", i)},
+		}
+		execs = append(execs, exec, exec)
+	}
+
+	profile := &softwarecomposition.ApplicationProfile{
+		ObjectMeta: v1.ObjectMeta{Annotations: map[string]string{}},
+		Spec: softwarecomposition.ApplicationProfileSpec{
+			Containers: []softwarecomposition.ApplicationProfileContainer{
+				{Name: "sidecar", Execs: execs},
+			},
+		},
+	}
+
+	processor := NewApplicationProfileProcessor(config.Config{
+		DefaultNamespace:          "kubescape",
+		MaxApplicationProfileSize: 100000,
+	})
+
+	err := processor.PreSave(context.TODO(), profile)
+	assert.NoError(t, err)
+
+	resultExecs := profile.Spec.Containers[0].Execs
+	t.Logf("input: %d execs, output: %d execs", len(execs), len(resultExecs))
+	for _, e := range resultExecs {
+		t.Logf("  path=%s args=%v", e.Path, e.Args)
+	}
+
+	assert.Len(t, resultExecs, 1,
+		"all wget variants should dedup+collapse to 1 entry")
+	assert.Equal(t, "/usr/bin/wget", resultExecs[0].Path)
+	assert.Equal(t, []string{"/usr/bin/wget", "-q", dynamicpathdetector.DynamicIdentifier}, resultExecs[0].Args)
+}
+
 // generateSOOpens creates N unique .so OpenCalls under /usr/lib/x86_64-linux-gnu/
 func generateSOOpens(n int) []softwarecomposition.OpenCalls {
 	opens := make([]softwarecomposition.OpenCalls, n)

From 452831681342f1d447417281c2fffe26c7aa1446 Mon Sep 17 00:00:00 2001
From: entlein <einentlein@gmail.com>
Date: Wed, 11 Feb 2026 23:23:23 +0100
Subject: [PATCH 52/68] need a more aggressive default for testing

Signed-off-by: entlein <einentlein@gmail.com>
---
 .../file/dynamicpathdetector/analyzer.go      |  2 +-
 .../tests/analyze_opens_test.go               | 43 +++++++++----------
 2 files changed, 22 insertions(+), 23 deletions(-)

diff --git a/pkg/registry/file/dynamicpathdetector/analyzer.go b/pkg/registry/file/dynamicpathdetector/analyzer.go
index 3c3ab966b..d7783f31f 100644
--- a/pkg/registry/file/dynamicpathdetector/analyzer.go
+++ b/pkg/registry/file/dynamicpathdetector/analyzer.go
@@ -17,7 +17,7 @@ var CollapseConfigs = []CollapseConfig{
 
 var DefaultCollapseConfig = CollapseConfig{
 	Prefix:    "/",
-	Threshold: 50,
+	Threshold: 5,
 }
 
 func NewPathAnalyzer(threshold int) *PathAnalyzer {
diff --git a/pkg/registry/file/dynamicpathdetector/tests/analyze_opens_test.go b/pkg/registry/file/dynamicpathdetector/tests/analyze_opens_test.go
index b660e8565..2c4ef09b9 100644
--- a/pkg/registry/file/dynamicpathdetector/tests/analyze_opens_test.go
+++ b/pkg/registry/file/dynamicpathdetector/tests/analyze_opens_test.go
@@ -113,28 +113,27 @@ func TestAnalyzeOpensWithFlagMergingAndThreshold(t *testing.T) {
 	}
 }
 
-// func TestAnalyzeOpensWithAsteriskAndEllipsis(t *testing.T) {
-// 	analyzer := dynamicpathdetector.NewPathAnalyzer(3) // Threshold of 3 OLD BEHAVIOR
-
-// 	input := []types.OpenCalls{
-// 		// These should collapse into /home/…/file.txt
-// 		{Path: "/home/user1/file.txt", Flags: []string{"READ"}},
-// 		{Path: "/home/user2/file.txt", Flags: []string{"READ"}},
-// 		{Path: "/home/user3/file.txt", Flags: []string{"READ"}},
-// 		{Path: "/home/user4/file.txt", Flags: []string{"READ"}},
-// 		{Path: "/home/user*/file.txt", Flags: []string{"READ"}},
-// 	}
-
-// 	expected := []types.OpenCalls{
-// 		{Path: "/home/\u22ef/file.txt", Flags: []string{"READ"}},
-// 	}
-
-// 	result, err := dynamicpathdetector.AnalyzeOpens(input, analyzer, mapset.NewSet[string]())
-// 	assert.NoError(t, err)
-
-// 	// Use ElementsMatch because the order of elements in the result is not guaranteed
-// 	assert.ElementsMatch(t, expected, result)
-// }
+func TestAnalyzeOpensWithAsteriskAndEllipsis(t *testing.T) {
+	analyzer := dynamicpathdetector.NewPathAnalyzer(3) // Threshold of 3 OLD BEHAVIOR
+
+	input := []types.OpenCalls{
+		// These should collapse into /home/…/file.txt
+		{Path: "/home/user1/file.txt", Flags: []string{"READ"}},
+		{Path: "/home/user2/file.txt", Flags: []string{"READ"}},
+		{Path: "/home/\u22ef/file.txt", Flags: []string{"READ"}},
+		{Path: "/home/user4/file.txt", Flags: []string{"READ"}},
+	}
+
+	expected := []types.OpenCalls{
+		{Path: "/home/\u22ef/file.txt", Flags: []string{"READ"}},
+	}
+
+	result, err := dynamicpathdetector.AnalyzeOpens(input, analyzer, mapset.NewSet[string]())
+	assert.NoError(t, err)
+
+	// Use ElementsMatch because the order of elements in the result is not guaranteed
+	assert.ElementsMatch(t, expected, result)
+}
 
 func TestAnalyzeOpensWithMultiCollapse(t *testing.T) {
 	analyzer := dynamicpathdetector.NewPathAnalyzer(5) // Threshold of 3 for /var/run prefix is set in the defaults, but here we are overwriting the defaults

From 8decd0ff77f68d458f2fe43532d4c30635c7bc11 Mon Sep 17 00:00:00 2001
From: entlein <einentlein@gmail.com>
Date: Thu, 12 Feb 2026 11:53:13 +0100
Subject: [PATCH 53/68] is it really this sbom thingy?

Signed-off-by: entlein <einentlein@gmail.com>
---
 .../file/applicationprofile_processor.go      |   4 +-
 .../file/applicationprofile_processor_test.go | 178 ++++++++++++++++++
 .../file/dynamicpathdetector/analyze_opens.go |  13 +-
 .../file/dynamicpathdetector/analyzer.go      |   3 +
 .../tests/analyze_opens_test.go               |  31 +++
 5 files changed, 216 insertions(+), 13 deletions(-)

diff --git a/pkg/registry/file/applicationprofile_processor.go b/pkg/registry/file/applicationprofile_processor.go
index 09d6b7d87..c68d8510f 100644
--- a/pkg/registry/file/applicationprofile_processor.go
+++ b/pkg/registry/file/applicationprofile_processor.go
@@ -18,8 +18,8 @@ import (
 )
 
 const (
-	OpenDynamicThreshold     = 50
-	EndpointDynamicThreshold = 100
+	OpenDynamicThreshold     = 5 //todo @constanze : this is currently in contradiction with the actual analyzer
+	EndpointDynamicThreshold = 5 // modified for testing
 )
 
 type ApplicationProfileProcessor struct {
diff --git a/pkg/registry/file/applicationprofile_processor_test.go b/pkg/registry/file/applicationprofile_processor_test.go
index e727d20b6..069f9f76b 100644
--- a/pkg/registry/file/applicationprofile_processor_test.go
+++ b/pkg/registry/file/applicationprofile_processor_test.go
@@ -4,8 +4,10 @@ import (
 	"context"
 	"fmt"
 	"slices"
+	"strings"
 	"testing"
 
+	mapset "github.com/deckarep/golang-set/v2"
 	"github.com/kubescape/k8s-interface/instanceidhandler/v1/helpers"
 	"github.com/kubescape/storage/pkg/apis/softwarecomposition"
 	"github.com/kubescape/storage/pkg/apis/softwarecomposition/consts"
@@ -247,3 +249,179 @@ func TestDeflateRulePolicies(t *testing.T) {
 		})
 	}
 }
+
+// generateSOOpens creates N unique .so OpenCalls under /usr/lib/x86_64-linux-gnu/
+func generateSOOpens(n int) []softwarecomposition.OpenCalls {
+	opens := make([]softwarecomposition.OpenCalls, n)
+	for i := 0; i < n; i++ {
+		opens[i] = softwarecomposition.OpenCalls{
+			Path:  fmt.Sprintf("/usr/lib/x86_64-linux-gnu/lib%d.so.%d", i, i%5),
+			Flags: []string{"O_RDONLY", "O_CLOEXEC"},
+		}
+	}
+	return opens
+}
+
+func TestDeflateApplicationProfileContainer_CollapsesManyOpens(t *testing.T) {
+	opens := generateSOOpens(100)
+
+	container := softwarecomposition.ApplicationProfileContainer{
+		Name:  "test-container",
+		Opens: opens,
+	}
+
+	result := deflateApplicationProfileContainer(container, nil)
+
+	assert.Less(t, len(result.Opens), 100,
+		"100 .so files should be collapsed, got %d opens", len(result.Opens))
+
+	// Verify collapsed paths contain dynamic or wildcard segments
+	for _, open := range result.Opens {
+		if strings.HasPrefix(open.Path, "/usr/lib/x86_64-linux-gnu/") {
+			assert.True(t,
+				strings.Contains(open.Path, "\u22ef") || strings.Contains(open.Path, "*"),
+				"path %q should contain a dynamic or wildcard segment", open.Path)
+		}
+	}
+
+	// Flags should be preserved and merged
+	for _, open := range result.Opens {
+		assert.NotEmpty(t, open.Flags, "flags should be preserved after collapse")
+	}
+}
+
+// Todo use the OpenDynamicThreshold in the test here not hardcoded integers
+func TestDeflateApplicationProfileContainer_CollapsesWithSbomSet(t *testing.T) {
+	opens := generateSOOpens(100)
+
+	// Build sbomSet containing ALL the .so paths (realistic scenario)
+	sbomSet := mapset.NewSet[string]()
+	for _, open := range opens {
+		sbomSet.Add(open.Path)
+	}
+
+	container := softwarecomposition.ApplicationProfileContainer{
+		Name:  "test-container",
+		Opens: opens,
+	}
+
+	result := deflateApplicationProfileContainer(container, sbomSet)
+
+	// Even though all paths are in SBOM, they should still be collapsed
+	assert.Less(t, len(result.Opens), 100,
+		"SBOM paths should be collapsed too, got %d opens", len(result.Opens))
+}
+
+// Todo use the OpenDynamicThreshold in the test here not hardcoded integers
+func TestDeflateApplicationProfileContainer_MixedPathsCollapse(t *testing.T) {
+	var opens []softwarecomposition.OpenCalls
+
+	for i := 0; i < 60; i++ {
+		opens = append(opens, softwarecomposition.OpenCalls{
+			Path:  fmt.Sprintf("/usr/lib/lib%d.so", i),
+			Flags: []string{"O_RDONLY"},
+		})
+	}
+
+	for i := 0; i < 55; i++ {
+		opens = append(opens, softwarecomposition.OpenCalls{
+			Path:  fmt.Sprintf("/etc/conf%d.cfg", i),
+			Flags: []string{"O_RDONLY"},
+		})
+	}
+
+	opens = append(opens,
+		softwarecomposition.OpenCalls{Path: "/tmp/file1.txt", Flags: []string{"O_RDWR"}},
+		softwarecomposition.OpenCalls{Path: "/tmp/file2.txt", Flags: []string{"O_RDWR"}},
+	)
+
+	container := softwarecomposition.ApplicationProfileContainer{
+		Name:  "test-container",
+		Opens: opens,
+	}
+
+	result := deflateApplicationProfileContainer(container, nil)
+
+	// Count paths by prefix
+	var usrLibPaths, etcPaths, tmpPaths int
+	for _, open := range result.Opens {
+		switch {
+		case strings.HasPrefix(open.Path, "/usr/lib/"):
+			usrLibPaths++
+		case strings.HasPrefix(open.Path, "/etc/"):
+			etcPaths++
+		case strings.HasPrefix(open.Path, "/tmp/"):
+			tmpPaths++
+		}
+	}
+
+	assert.LessOrEqual(t, usrLibPaths, 1, "/usr/lib/ paths should collapse to 1, got %d", usrLibPaths)
+	assert.LessOrEqual(t, etcPaths, 1, "/etc/ paths should collapse to 1, got %d", etcPaths)
+	assert.Equal(t, 2, tmpPaths, "/tmp/ paths should remain individual (below threshold)")
+}
+
+// TestDeflateApplicationProfileContainer_NilSbomNoError verifies that nil sbomSet
+// with a small number of opens (below threshold) works without error.
+func TestDeflateApplicationProfileContainer_NilSbomNoError(t *testing.T) {
+	container := softwarecomposition.ApplicationProfileContainer{
+		Name: "test-container",
+		Opens: []softwarecomposition.OpenCalls{
+			{Path: "/etc/hosts", Flags: []string{"O_RDONLY"}},
+			{Path: "/etc/resolv.conf", Flags: []string{"O_RDONLY"}},
+			{Path: "/usr/lib/libc.so.6", Flags: []string{"O_RDONLY", "O_CLOEXEC"}},
+		},
+	}
+
+	result := deflateApplicationProfileContainer(container, nil)
+
+	// All 3 paths should remain (below any threshold)
+	assert.Equal(t, 3, len(result.Opens), "paths below threshold should not collapse")
+	// Paths should be sorted
+	for i := 1; i < len(result.Opens); i++ {
+		assert.True(t, result.Opens[i-1].Path <= result.Opens[i].Path,
+			"opens should be sorted, got %q before %q", result.Opens[i-1].Path, result.Opens[i].Path)
+	}
+}
+
+// TestDeflateApplicationProfileContainer_PreSaveEndToEnd verifies the full
+// PreSave flow with an ApplicationProfile containing many opens that should collapse.
+func TestDeflateApplicationProfileContainer_PreSaveEndToEnd(t *testing.T) {
+	opens := generateSOOpens(100)
+
+	profile := &softwarecomposition.ApplicationProfile{
+		ObjectMeta: v1.ObjectMeta{
+			Annotations: map[string]string{},
+		},
+		Spec: softwarecomposition.ApplicationProfileSpec{
+			Containers: []softwarecomposition.ApplicationProfileContainer{
+				{
+					Name:  "main",
+					Opens: opens,
+				},
+			},
+		},
+	}
+
+	processor := NewApplicationProfileProcessor(config.Config{
+		DefaultNamespace:          "kubescape",
+		MaxApplicationProfileSize: 100000,
+	})
+
+	err := processor.PreSave(context.TODO(), profile)
+	assert.NoError(t, err)
+
+	// Todo use the OpenDynamicThreshold in the test here not hardcoded integers
+	resultOpens := profile.Spec.Containers[0].Opens
+	assert.Less(t, len(resultOpens), 100,
+		"PreSave should collapse 100 .so files, got %d opens", len(resultOpens))
+
+	// The collapsed path should contain dynamic or wildcard segments
+	hasCollapsed := false
+	for _, open := range resultOpens {
+		if strings.Contains(open.Path, "\u22ef") || strings.Contains(open.Path, "*") {
+			hasCollapsed = true
+			break
+		}
+	}
+	assert.True(t, hasCollapsed, "at least one path should contain a dynamic/wildcard segment after PreSave")
+}
diff --git a/pkg/registry/file/dynamicpathdetector/analyze_opens.go b/pkg/registry/file/dynamicpathdetector/analyze_opens.go
index 554325e31..8750adff5 100644
--- a/pkg/registry/file/dynamicpathdetector/analyze_opens.go
+++ b/pkg/registry/file/dynamicpathdetector/analyze_opens.go
@@ -1,7 +1,6 @@
 package dynamicpathdetector
 
 import (
-	"errors"
 	"maps"
 	"slices"
 	"strings"
@@ -15,22 +14,14 @@ func AnalyzeOpens(opens []types.OpenCalls, analyzer *PathAnalyzer, sbomSet mapse
 		return nil, nil
 	}
 
-	if sbomSet == nil {
-		return nil, errors.New("sbomSet is nil")
-	}
-
+	// First pass: build trie from all paths
 	dynamicOpens := make(map[string]types.OpenCalls)
 	for _, open := range opens {
 		_, _ = AnalyzeOpen(open.Path, analyzer)
 	}
 
+	// Second pass: read collapsed paths and merge
 	for i := range opens {
-		// sbomSet files have to be always present in the dynamicOpens
-		if sbomSet.ContainsOne(opens[i].Path) {
-			dynamicOpens[opens[i].Path] = opens[i]
-			continue
-		}
-
 		result, err := AnalyzeOpen(opens[i].Path, analyzer)
 		if err != nil {
 			continue
diff --git a/pkg/registry/file/dynamicpathdetector/analyzer.go b/pkg/registry/file/dynamicpathdetector/analyzer.go
index d7783f31f..14a7f80a3 100644
--- a/pkg/registry/file/dynamicpathdetector/analyzer.go
+++ b/pkg/registry/file/dynamicpathdetector/analyzer.go
@@ -4,10 +4,12 @@ import (
 	"strings"
 )
 
+// TODO define the two Wildcards in the same place
 const (
 	WildcardIdentifier = "*"
 )
 
+// TODO move this to whereever we define those Configs, write tests that they are consistent
 var CollapseConfigs = []CollapseConfig{
 	{Prefix: "/etc", Threshold: 50},
 	{Prefix: "/opt", Threshold: 5},
@@ -15,6 +17,7 @@ var CollapseConfigs = []CollapseConfig{
 	{Prefix: "/app", Threshold: 1},
 }
 
+// TODO replace the Threshold Integer with the struct everywhere in codebase and tests
 var DefaultCollapseConfig = CollapseConfig{
 	Prefix:    "/",
 	Threshold: 5,
diff --git a/pkg/registry/file/dynamicpathdetector/tests/analyze_opens_test.go b/pkg/registry/file/dynamicpathdetector/tests/analyze_opens_test.go
index 2c4ef09b9..79aafb0cb 100644
--- a/pkg/registry/file/dynamicpathdetector/tests/analyze_opens_test.go
+++ b/pkg/registry/file/dynamicpathdetector/tests/analyze_opens_test.go
@@ -510,6 +510,37 @@ func TestAnalyzeOpensExistingDynamicSegmentInInput(t *testing.T) {
 	assert.ElementsMatch(t, []string{"READ", "WRITE"}, result[0].Flags)
 }
 
+// TestAnalyzeOpens_NilSbomSetNoError verifies that passing a nil sbomSet
+// does not return an error (previously it did).
+func TestAnalyzeOpens_NilSbomSetNoError(t *testing.T) {
+	analyzer := dynamicpathdetector.NewPathAnalyzer(3)
+	input := []types.OpenCalls{
+		{Path: "/usr/lib/libfoo.so", Flags: []string{"READ"}},
+		{Path: "/usr/lib/libbar.so", Flags: []string{"READ"}},
+	}
+	result, err := dynamicpathdetector.AnalyzeOpens(input, analyzer, nil)
+	assert.NoError(t, err, "nil sbomSet should not cause an error")
+	assert.Equal(t, 2, len(result), "paths below threshold should remain individual")
+}
+
+// TestAnalyzeOpens_NilSbomSetWithCollapse verifies that collapse works
+// correctly even when sbomSet is nil.
+func TestAnalyzeOpens_NilSbomSetWithCollapse(t *testing.T) {
+	analyzer := dynamicpathdetector.NewPathAnalyzer(3)
+	input := []types.OpenCalls{
+		{Path: "/usr/lib/liba.so", Flags: []string{"READ"}},
+		{Path: "/usr/lib/libb.so", Flags: []string{"READ"}},
+		{Path: "/usr/lib/libc.so", Flags: []string{"WRITE"}},
+		{Path: "/usr/lib/libd.so", Flags: []string{"APPEND"}},
+	}
+	result, err := dynamicpathdetector.AnalyzeOpens(input, analyzer, nil)
+	assert.NoError(t, err)
+	assert.Equal(t, 1, len(result), "4 children > threshold 3, should collapse")
+	assert.True(t,
+		strings.Contains(result[0].Path, "\u22ef") || strings.Contains(result[0].Path, "*"),
+		"collapsed path should contain dynamic or wildcard segment, got %q", result[0].Path)
+}
+
 // Helper function to check if a slice of strings contains only unique elements
 func areStringSlicesUnique(slice []string) bool {
 	seen := make(map[string]struct{})

From 0920396619f5e91b4e80eeb49514904901675341 Mon Sep 17 00:00:00 2001
From: entlein <einentlein@gmail.com>
Date: Thu, 12 Feb 2026 17:11:27 +0100
Subject: [PATCH 54/68] need to add a git tag

Signed-off-by: entlein <einentlein@gmail.com>
---
 .github/workflows/build.yaml | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/.github/workflows/build.yaml b/.github/workflows/build.yaml
index 82ffc26bc..a0d044b3e 100644
--- a/.github/workflows/build.yaml
+++ b/.github/workflows/build.yaml
@@ -19,7 +19,20 @@ on:
             required: false
             default: false
 jobs:
+  tag-for-go-module:
+    name: Create Git tag so Go modules can resolve this version
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    steps:
+      - uses: actions/checkout@v4
+      - name: Create git tag matching IMAGE_TAG
+        run: |
+          git tag -f "go/${{ inputs.IMAGE_TAG }}"
+          git push origin "go/${{ inputs.IMAGE_TAG }}" --force
+
   publish-image:
+    needs: tag-for-go-module
     permissions:
       id-token: write
       packages: write

From 354916c5b3820eb6a625ff96f32467075232f504 Mon Sep 17 00:00:00 2001
From: entlein <einentlein@gmail.com>
Date: Thu, 12 Feb 2026 16:26:35 +0000
Subject: [PATCH 55/68] ci: auto-trigger node-agent build after storage push

Add push trigger on test/localtestbuild branch. After building the
storage image, the workflow now triggers node-agent's build.yaml
with the same IMAGE_TAG via CROSS_REPO_PAT secret.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---
 .github/workflows/build.yaml | 62 +++++++++++++++++++++++++++++++-----
 1 file changed, 54 insertions(+), 8 deletions(-)

diff --git a/.github/workflows/build.yaml b/.github/workflows/build.yaml
index a0d044b3e..490fb1864 100644
--- a/.github/workflows/build.yaml
+++ b/.github/workflows/build.yaml
@@ -18,8 +18,37 @@ on:
             type: boolean
             required: false
             default: false
+    push:
+      branches:
+        - test/localtestbuild
+
 jobs:
+  prepare:
+    name: Resolve build parameters
+    runs-on: ubuntu-latest
+    outputs:
+      image_tag: ${{ steps.params.outputs.image_tag }}
+      client: ${{ steps.params.outputs.client }}
+      platforms: ${{ steps.params.outputs.platforms }}
+      cosign: ${{ steps.params.outputs.cosign }}
+    steps:
+      - id: params
+        run: |
+          if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
+            echo "image_tag=${{ inputs.IMAGE_TAG }}" >> "$GITHUB_OUTPUT"
+            echo "client=${{ inputs.CLIENT }}" >> "$GITHUB_OUTPUT"
+            echo "platforms=${{ inputs.PLATFORMS }}" >> "$GITHUB_OUTPUT"
+            echo "cosign=${{ inputs.CO_SIGN }}" >> "$GITHUB_OUTPUT"
+          else
+            # Push trigger: derive tag from short commit SHA
+            echo "image_tag=dev-${GITHUB_SHA::7}" >> "$GITHUB_OUTPUT"
+            echo "client=test" >> "$GITHUB_OUTPUT"
+            echo "platforms=false" >> "$GITHUB_OUTPUT"
+            echo "cosign=false" >> "$GITHUB_OUTPUT"
+          fi
+
   tag-for-go-module:
+    needs: prepare
     name: Create Git tag so Go modules can resolve this version
     runs-on: ubuntu-latest
     permissions:
@@ -28,20 +57,37 @@ jobs:
       - uses: actions/checkout@v4
       - name: Create git tag matching IMAGE_TAG
         run: |
-          git tag -f "go/${{ inputs.IMAGE_TAG }}"
-          git push origin "go/${{ inputs.IMAGE_TAG }}" --force
+          git tag -f "go/${{ needs.prepare.outputs.image_tag }}"
+          git push origin "go/${{ needs.prepare.outputs.image_tag }}" --force
 
   publish-image:
-    needs: tag-for-go-module
+    needs: [prepare, tag-for-go-module]
     permissions:
       id-token: write
       packages: write
       contents: read
     uses: ./.github/workflows/publish-image.yaml
     with:
-      client: ${{ inputs.CLIENT }}
+      client: ${{ needs.prepare.outputs.client }}
       image_name: "ghcr.io/${{ github.repository_owner }}/storage"
-      image_tag: ${{ inputs.IMAGE_TAG }}
-      support_platforms: ${{ inputs.PLATFORMS }}
-      cosign: ${{ inputs.CO_SIGN }}
-    secrets: inherit
\ No newline at end of file
+      image_tag: ${{ needs.prepare.outputs.image_tag }}
+      support_platforms: ${{ needs.prepare.outputs.platforms == 'true' }}
+      cosign: ${{ needs.prepare.outputs.cosign == 'true' }}
+    secrets: inherit
+
+  trigger-node-agent:
+    needs: [prepare, publish-image]
+    name: Trigger node-agent rebuild with matching tag
+    runs-on: ubuntu-latest
+    steps:
+      - name: Trigger node-agent build
+        env:
+          GH_TOKEN: ${{ secrets.CROSS_REPO_PAT }}
+        run: |
+          IMAGE_TAG="${{ needs.prepare.outputs.image_tag }}"
+          echo "Triggering node-agent build with IMAGE_TAG=${IMAGE_TAG} STORAGE_REF=${IMAGE_TAG}"
+          gh workflow run build.yaml \
+            --repo "${{ github.repository_owner }}/node-agent" \
+            --ref test/localtestbuild \
+            -f IMAGE_TAG="${IMAGE_TAG}" \
+            -f STORAGE_REF="${IMAGE_TAG}"

From 94f92f937ce79f929fe35d57f05dae1b9152f5c1 Mon Sep 17 00:00:00 2001
From: entlein <einentlein@gmail.com>
Date: Thu, 12 Feb 2026 20:09:35 +0100
Subject: [PATCH 56/68] cleaning up some

Signed-off-by: entlein <einentlein@gmail.com>
---
 .../file/applicationprofile_processor.go      |  10 +-
 .../file/applicationprofile_processor_test.go |  44 +-
 .../file/containerprofile_processor.go        |   4 +-
 .../file/dynamicpathdetector/analyzer.go      |  21 +-
 .../tests/analyze_endpoints_test.go           |  33 +-
 .../tests/analyze_opens_test.go               | 384 +++++++++---------
 .../tests/benchmark_test.go                   |   6 +-
 .../tests/coverage_test.go                    |  80 ++--
 .../file/dynamicpathdetector/types.go         |  47 ++-
 9 files changed, 345 insertions(+), 284 deletions(-)

diff --git a/pkg/registry/file/applicationprofile_processor.go b/pkg/registry/file/applicationprofile_processor.go
index c68d8510f..3c75df152 100644
--- a/pkg/registry/file/applicationprofile_processor.go
+++ b/pkg/registry/file/applicationprofile_processor.go
@@ -17,10 +17,8 @@ import (
 	"k8s.io/apimachinery/pkg/runtime"
 )
 
-const (
-	OpenDynamicThreshold     = 5 //todo @constanze : this is currently in contradiction with the actual analyzer
-	EndpointDynamicThreshold = 5 // modified for testing
-)
+// Thresholds are defined in dynamicpathdetector.OpenDynamicThreshold and
+// dynamicpathdetector.EndpointDynamicThreshold (single source of truth).
 
 type ApplicationProfileProcessor struct {
 	defaultNamespace          string
@@ -109,12 +107,12 @@ func (a *ApplicationProfileProcessor) SetStorage(containerProfileStorage Contain
 }
 
 func deflateApplicationProfileContainer(container softwarecomposition.ApplicationProfileContainer, sbomSet mapset.Set[string]) softwarecomposition.ApplicationProfileContainer {
-	opens, err := dynamicpathdetector.AnalyzeOpens(container.Opens, dynamicpathdetector.NewPathAnalyzer(OpenDynamicThreshold), sbomSet)
+	opens, err := dynamicpathdetector.AnalyzeOpens(container.Opens, dynamicpathdetector.NewPathAnalyzer(dynamicpathdetector.OpenDynamicThreshold), sbomSet)
 	if err != nil {
 		logger.L().Debug("falling back to DeflateStringer for opens", loggerhelpers.Error(err))
 		opens = DeflateStringer(container.Opens)
 	}
-	endpoints := dynamicpathdetector.AnalyzeEndpoints(&container.Endpoints, dynamicpathdetector.NewPathAnalyzer(EndpointDynamicThreshold))
+	endpoints := dynamicpathdetector.AnalyzeEndpoints(&container.Endpoints, dynamicpathdetector.NewPathAnalyzer(dynamicpathdetector.EndpointDynamicThreshold))
 	identifiedCallStacks := callstack.UnifyIdentifiedCallStacks(container.IdentifiedCallStacks)
 
 	return softwarecomposition.ApplicationProfileContainer{
diff --git a/pkg/registry/file/applicationprofile_processor_test.go b/pkg/registry/file/applicationprofile_processor_test.go
index 069f9f76b..f097b2c21 100644
--- a/pkg/registry/file/applicationprofile_processor_test.go
+++ b/pkg/registry/file/applicationprofile_processor_test.go
@@ -12,11 +12,24 @@ import (
 	"github.com/kubescape/storage/pkg/apis/softwarecomposition"
 	"github.com/kubescape/storage/pkg/apis/softwarecomposition/consts"
 	"github.com/kubescape/storage/pkg/config"
+	"github.com/kubescape/storage/pkg/registry/file/dynamicpathdetector"
 	"github.com/stretchr/testify/assert"
 	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/runtime"
 )
 
+// configThreshold returns the collapse threshold for the given path prefix
+// from dynamicpathdetector.DefaultCollapseConfigs. Falls back to
+// dynamicpathdetector.DefaultCollapseConfig.Threshold for unconfigured prefixes.
+func configThreshold(prefix string) int {
+	for _, cfg := range dynamicpathdetector.DefaultCollapseConfigs {
+		if cfg.Prefix == prefix {
+			return cfg.Threshold
+		}
+	}
+	return dynamicpathdetector.DefaultCollapseConfig.Threshold
+}
+
 var ap = softwarecomposition.ApplicationProfile{
 	ObjectMeta: v1.ObjectMeta{
 		Annotations: map[string]string{},
@@ -263,7 +276,9 @@ func generateSOOpens(n int) []softwarecomposition.OpenCalls {
 }
 
 func TestDeflateApplicationProfileContainer_CollapsesManyOpens(t *testing.T) {
-	opens := generateSOOpens(100)
+	// Generate enough opens to exceed the threshold for /usr/lib (uses default config)
+	numOpens := configThreshold("/usr/lib") + 1
+	opens := generateSOOpens(numOpens)
 
 	container := softwarecomposition.ApplicationProfileContainer{
 		Name:  "test-container",
@@ -272,8 +287,8 @@ func TestDeflateApplicationProfileContainer_CollapsesManyOpens(t *testing.T) {
 
 	result := deflateApplicationProfileContainer(container, nil)
 
-	assert.Less(t, len(result.Opens), 100,
-		"100 .so files should be collapsed, got %d opens", len(result.Opens))
+	assert.Less(t, len(result.Opens), numOpens,
+		"%d .so files should be collapsed, got %d opens", numOpens, len(result.Opens))
 
 	// Verify collapsed paths contain dynamic or wildcard segments
 	for _, open := range result.Opens {
@@ -290,9 +305,9 @@ func TestDeflateApplicationProfileContainer_CollapsesManyOpens(t *testing.T) {
 	}
 }
 
-// Todo use the OpenDynamicThreshold in the test here not hardcoded integers
 func TestDeflateApplicationProfileContainer_CollapsesWithSbomSet(t *testing.T) {
-	opens := generateSOOpens(100)
+	numOpens := configThreshold("/usr/lib") + 1
+	opens := generateSOOpens(numOpens)
 
 	// Build sbomSet containing ALL the .so paths (realistic scenario)
 	sbomSet := mapset.NewSet[string]()
@@ -308,22 +323,25 @@ func TestDeflateApplicationProfileContainer_CollapsesWithSbomSet(t *testing.T) {
 	result := deflateApplicationProfileContainer(container, sbomSet)
 
 	// Even though all paths are in SBOM, they should still be collapsed
-	assert.Less(t, len(result.Opens), 100,
+	assert.Less(t, len(result.Opens), numOpens,
 		"SBOM paths should be collapsed too, got %d opens", len(result.Opens))
 }
 
-// Todo use the OpenDynamicThreshold in the test here not hardcoded integers
 func TestDeflateApplicationProfileContainer_MixedPathsCollapse(t *testing.T) {
 	var opens []softwarecomposition.OpenCalls
 
-	for i := 0; i < 60; i++ {
+	// /usr/lib uses the default threshold (no specific prefix config)
+	usrLibThreshold := configThreshold("/usr/lib")
+	for i := 0; i < usrLibThreshold+1; i++ {
 		opens = append(opens, softwarecomposition.OpenCalls{
 			Path:  fmt.Sprintf("/usr/lib/lib%d.so", i),
 			Flags: []string{"O_RDONLY"},
 		})
 	}
 
-	for i := 0; i < 55; i++ {
+	// /etc has its own threshold in DefaultCollapseConfigs
+	etcThreshold := configThreshold("/etc")
+	for i := 0; i < etcThreshold+1; i++ {
 		opens = append(opens, softwarecomposition.OpenCalls{
 			Path:  fmt.Sprintf("/etc/conf%d.cfg", i),
 			Flags: []string{"O_RDONLY"},
@@ -386,7 +404,8 @@ func TestDeflateApplicationProfileContainer_NilSbomNoError(t *testing.T) {
 // TestDeflateApplicationProfileContainer_PreSaveEndToEnd verifies the full
 // PreSave flow with an ApplicationProfile containing many opens that should collapse.
 func TestDeflateApplicationProfileContainer_PreSaveEndToEnd(t *testing.T) {
-	opens := generateSOOpens(100)
+	numOpens := configThreshold("/usr/lib") + 1
+	opens := generateSOOpens(numOpens)
 
 	profile := &softwarecomposition.ApplicationProfile{
 		ObjectMeta: v1.ObjectMeta{
@@ -410,10 +429,9 @@ func TestDeflateApplicationProfileContainer_PreSaveEndToEnd(t *testing.T) {
 	err := processor.PreSave(context.TODO(), profile)
 	assert.NoError(t, err)
 
-	// Todo use the OpenDynamicThreshold in the test here not hardcoded integers
 	resultOpens := profile.Spec.Containers[0].Opens
-	assert.Less(t, len(resultOpens), 100,
-		"PreSave should collapse 100 .so files, got %d opens", len(resultOpens))
+	assert.Less(t, len(resultOpens), numOpens,
+		"PreSave should collapse %d .so files, got %d opens", numOpens, len(resultOpens))
 
 	// The collapsed path should contain dynamic or wildcard segments
 	hasCollapsed := false
diff --git a/pkg/registry/file/containerprofile_processor.go b/pkg/registry/file/containerprofile_processor.go
index 9560a40d2..904fc89d9 100644
--- a/pkg/registry/file/containerprofile_processor.go
+++ b/pkg/registry/file/containerprofile_processor.go
@@ -701,12 +701,12 @@ func (a *ContainerProfileProcessor) getAggregatedData(ctx context.Context, key s
 }
 
 func DeflateContainerProfileSpec(container softwarecomposition.ContainerProfileSpec, sbomSet mapset.Set[string]) softwarecomposition.ContainerProfileSpec {
-	opens, err := dynamicpathdetector.AnalyzeOpens(container.Opens, dynamicpathdetector.NewPathAnalyzer(OpenDynamicThreshold), sbomSet)
+	opens, err := dynamicpathdetector.AnalyzeOpens(container.Opens, dynamicpathdetector.NewPathAnalyzer(dynamicpathdetector.OpenDynamicThreshold), sbomSet)
 	if err != nil {
 		logger.L().Debug("ContainerProfileProcessor.deflateContainerProfileSpec - falling back to DeflateStringer for opens", loggerhelpers.Error(err))
 		opens = DeflateStringer(container.Opens)
 	}
-	endpoints := dynamicpathdetector.AnalyzeEndpoints(&container.Endpoints, dynamicpathdetector.NewPathAnalyzer(EndpointDynamicThreshold))
+	endpoints := dynamicpathdetector.AnalyzeEndpoints(&container.Endpoints, dynamicpathdetector.NewPathAnalyzer(dynamicpathdetector.EndpointDynamicThreshold))
 	identifiedCallStacks := callstack.UnifyIdentifiedCallStacks(container.IdentifiedCallStacks)
 
 	return softwarecomposition.ContainerProfileSpec{
diff --git a/pkg/registry/file/dynamicpathdetector/analyzer.go b/pkg/registry/file/dynamicpathdetector/analyzer.go
index 14a7f80a3..744060427 100644
--- a/pkg/registry/file/dynamicpathdetector/analyzer.go
+++ b/pkg/registry/file/dynamicpathdetector/analyzer.go
@@ -4,27 +4,8 @@ import (
 	"strings"
 )
 
-// TODO define the two Wildcards in the same place
-const (
-	WildcardIdentifier = "*"
-)
-
-// TODO move this to whereever we define those Configs, write tests that they are consistent
-var CollapseConfigs = []CollapseConfig{
-	{Prefix: "/etc", Threshold: 50},
-	{Prefix: "/opt", Threshold: 5},
-	{Prefix: "/var/run", Threshold: 3},
-	{Prefix: "/app", Threshold: 1},
-}
-
-// TODO replace the Threshold Integer with the struct everywhere in codebase and tests
-var DefaultCollapseConfig = CollapseConfig{
-	Prefix:    "/",
-	Threshold: 5,
-}
-
 func NewPathAnalyzer(threshold int) *PathAnalyzer {
-	return newAnalyzer(CollapseConfig{Prefix: "/", Threshold: threshold}, CollapseConfigs)
+	return newAnalyzer(CollapseConfig{Prefix: "/", Threshold: threshold}, DefaultCollapseConfigs)
 }
 
 func NewPathAnalyzerWithConfigs(configs []CollapseConfig) *PathAnalyzer {
diff --git a/pkg/registry/file/dynamicpathdetector/tests/analyze_endpoints_test.go b/pkg/registry/file/dynamicpathdetector/tests/analyze_endpoints_test.go
index 932b98fd8..817c5f52c 100644
--- a/pkg/registry/file/dynamicpathdetector/tests/analyze_endpoints_test.go
+++ b/pkg/registry/file/dynamicpathdetector/tests/analyze_endpoints_test.go
@@ -12,7 +12,7 @@ import (
 )
 
 func TestAnalyzeEndpoints(t *testing.T) {
-	analyzer := dynamicpathdetector.NewPathAnalyzer(100)
+	analyzer := dynamicpathdetector.NewPathAnalyzer(dynamicpathdetector.EndpointDynamicThreshold)
 
 	tests := []struct {
 		name     string
@@ -38,7 +38,7 @@ func TestAnalyzeEndpoints(t *testing.T) {
 			name: "Test with multiple endpoints",
 			input: []types.HTTPEndpoint{
 				{
-					Endpoint: ":80/users/\u22ef", //debug : is it the ellipsis character
+					Endpoint: ":80/users/\u22ef",
 					Methods:  []string{"GET"},
 				},
 				{
@@ -144,7 +144,6 @@ func TestAnalyzeEndpoints(t *testing.T) {
 					Headers:  json.RawMessage(`{"Content-Type": ["application/xml"], "Authorization": ["Bearer token"]}`),
 				},
 			},
-			//TODO @constanze revisit this once you tackle endpoints, the path matching logic is applied here the same way as for file paths
 			expected: []types.HTTPEndpoint{
 				{
 					Endpoint: ":80/x/\u22ef/posts/\u22ef",
@@ -169,10 +168,11 @@ func TestAnalyzeEndpoints(t *testing.T) {
 }
 
 func TestAnalyzeEndpointsWithThreshold(t *testing.T) {
-	analyzer := dynamicpathdetector.NewPathAnalyzer(100)
+	threshold := dynamicpathdetector.EndpointDynamicThreshold
+	analyzer := dynamicpathdetector.NewPathAnalyzer(threshold)
 
 	var input []types.HTTPEndpoint
-	for i := 0; i < 101; i++ {
+	for i := 0; i < threshold+1; i++ {
 		input = append(input, types.HTTPEndpoint{
 			Endpoint: fmt.Sprintf(":80/users/%d", i),
 			Methods:  []string{"GET"},
@@ -191,10 +191,11 @@ func TestAnalyzeEndpointsWithThreshold(t *testing.T) {
 }
 
 func TestAnalyzeEndpointsWithExactThreshold(t *testing.T) {
-	analyzer := dynamicpathdetector.NewPathAnalyzer(100)
+	threshold := dynamicpathdetector.EndpointDynamicThreshold
+	analyzer := dynamicpathdetector.NewPathAnalyzer(threshold)
 
 	var input []types.HTTPEndpoint
-	for i := 0; i < 100; i++ {
+	for i := 0; i < threshold; i++ {
 		input = append(input, types.HTTPEndpoint{
 			Endpoint: fmt.Sprintf(":80/users/%d", i),
 			Methods:  []string{"GET"},
@@ -203,18 +204,17 @@ func TestAnalyzeEndpointsWithExactThreshold(t *testing.T) {
 
 	result := dynamicpathdetector.AnalyzeEndpoints(&input, analyzer)
 
-	// Check that all 100 endpoints are still individual
-	assert.Equal(t, 100, len(result))
+	// At exact threshold: all endpoints should remain individual
+	assert.Equal(t, threshold, len(result))
 
 	// Now add one more endpoint to trigger the dynamic behavior
 	input = append(input, types.HTTPEndpoint{
-		Endpoint: ":80/users/100",
+		Endpoint: fmt.Sprintf(":80/users/%d", threshold),
 		Methods:  []string{"GET"},
 	})
 
 	result = dynamicpathdetector.AnalyzeEndpoints(&input, analyzer)
 
-	// Check that all endpoints are now merged into one dynamic endpoint
 	expected := []types.HTTPEndpoint{
 		{
 			Endpoint: ":80/users/\u22ef",
@@ -225,7 +225,7 @@ func TestAnalyzeEndpointsWithExactThreshold(t *testing.T) {
 }
 
 func TestAnalyzeEndpointsWithInvalidURL(t *testing.T) {
-	analyzer := dynamicpathdetector.NewPathAnalyzer(100)
+	analyzer := dynamicpathdetector.NewPathAnalyzer(dynamicpathdetector.EndpointDynamicThreshold)
 
 	input := []types.HTTPEndpoint{
 		{
@@ -239,7 +239,7 @@ func TestAnalyzeEndpointsWithInvalidURL(t *testing.T) {
 }
 
 func TestAnalyzeEndpointsWildcardPortAbsorbsSpecificPort(t *testing.T) {
-	analyzer := dynamicpathdetector.NewPathAnalyzer(100)
+	analyzer := dynamicpathdetector.NewPathAnalyzer(dynamicpathdetector.EndpointDynamicThreshold)
 
 	input := []types.HTTPEndpoint{
 		{
@@ -256,7 +256,6 @@ func TestAnalyzeEndpointsWildcardPortAbsorbsSpecificPort(t *testing.T) {
 
 	result := dynamicpathdetector.AnalyzeEndpoints(&input, analyzer)
 
-	// Both endpoints should use the wildcard port
 	for _, ep := range result {
 		port := ep.Endpoint[:len(":0")]
 		assert.Equal(t, ":0", port, "endpoint %s should have wildcard port", ep.Endpoint)
@@ -264,7 +263,7 @@ func TestAnalyzeEndpointsWildcardPortAbsorbsSpecificPort(t *testing.T) {
 }
 
 func TestAnalyzeEndpointsWildcardPortAfterSpecificPorts(t *testing.T) {
-	analyzer := dynamicpathdetector.NewPathAnalyzer(100)
+	analyzer := dynamicpathdetector.NewPathAnalyzer(dynamicpathdetector.EndpointDynamicThreshold)
 
 	input := []types.HTTPEndpoint{
 		{
@@ -281,7 +280,6 @@ func TestAnalyzeEndpointsWildcardPortAfterSpecificPorts(t *testing.T) {
 
 	result := dynamicpathdetector.AnalyzeEndpoints(&input, analyzer)
 
-	// 0 is the wildcard port,
 	for _, ep := range result {
 		port := ep.Endpoint[:len(":0")]
 		assert.Equal(t, ":0", port, "endpoint %s should have wildcard port", ep.Endpoint)
@@ -289,7 +287,7 @@ func TestAnalyzeEndpointsWildcardPortAfterSpecificPorts(t *testing.T) {
 }
 
 func TestAnalyzeEndpointsMultiplePortsMergeIntoWildcard(t *testing.T) {
-	analyzer := dynamicpathdetector.NewPathAnalyzer(100)
+	analyzer := dynamicpathdetector.NewPathAnalyzer(dynamicpathdetector.EndpointDynamicThreshold)
 
 	input := []types.HTTPEndpoint{
 		{
@@ -311,7 +309,6 @@ func TestAnalyzeEndpointsMultiplePortsMergeIntoWildcard(t *testing.T) {
 
 	result := dynamicpathdetector.AnalyzeEndpoints(&input, analyzer)
 
-	// All three should merge into a single wildcard endpoint
 	assert.Equal(t, 1, len(result))
 	assert.Equal(t, ":0/api/data", result[0].Endpoint)
 	assert.Equal(t, []string{"GET", "POST", "PUT"}, result[0].Methods)
diff --git a/pkg/registry/file/dynamicpathdetector/tests/analyze_opens_test.go b/pkg/registry/file/dynamicpathdetector/tests/analyze_opens_test.go
index 79aafb0cb..b6f174587 100644
--- a/pkg/registry/file/dynamicpathdetector/tests/analyze_opens_test.go
+++ b/pkg/registry/file/dynamicpathdetector/tests/analyze_opens_test.go
@@ -2,6 +2,7 @@ package dynamicpathdetectortests
 
 import (
 	"fmt"
+	"sort"
 	"strings"
 	"testing"
 
@@ -12,10 +13,11 @@ import (
 )
 
 func TestAnalyzeOpensWithThreshold(t *testing.T) {
-	analyzer := dynamicpathdetector.NewPathAnalyzer(100)
+	threshold := dynamicpathdetector.OpenDynamicThreshold
+	analyzer := dynamicpathdetector.NewPathAnalyzer(threshold)
 
 	var input []types.OpenCalls
-	for i := 0; i < 101; i++ {
+	for i := 0; i < threshold+1; i++ {
 		input = append(input, types.OpenCalls{
 			Path: fmt.Sprintf("/home/user%d/file.txt", i),
 		})
@@ -34,21 +36,19 @@ func TestAnalyzeOpensWithThreshold(t *testing.T) {
 }
 
 func TestAnalyzeOpensWithFlagMergingAndThreshold(t *testing.T) {
+	// Use /var/run threshold (3) — low enough that hand-written subtests work
+	threshold := configThreshold("/var/run")
+
 	tests := []struct {
 		name     string
 		input    []types.OpenCalls
 		expected []types.OpenCalls
 	}{
 		{
-			name: "Merge flags for paths exceeding threshold",
-			input: []types.OpenCalls{
-				{Path: "/home/user1/file.txt", Flags: []string{"READ"}},
-				{Path: "/home/user2/file.txt", Flags: []string{"WRITE"}},
-				{Path: "/home/user3/file.txt", Flags: []string{"APPEND"}},
-				{Path: "/home/user4/file.txt", Flags: []string{"READ", "WRITE"}},
-			},
+			name:  "Merge flags for paths exceeding threshold",
+			input: generateOpenCallsWithFlags("/home", "file.txt", threshold+1),
 			expected: []types.OpenCalls{
-				{Path: "/home/\u22ef/file.txt", Flags: []string{"APPEND", "READ", "WRITE"}},
+				{Path: "/home/\u22ef/file.txt", Flags: flagsForN(threshold + 1)},
 			},
 		},
 		{
@@ -64,42 +64,33 @@ func TestAnalyzeOpensWithFlagMergingAndThreshold(t *testing.T) {
 		},
 		{
 			name: "Partial merging for some paths exceeding threshold",
-			input: []types.OpenCalls{
-				{Path: "/home/user1/common.txt", Flags: []string{"READ"}},
-				{Path: "/home/user2/common.txt", Flags: []string{"WRITE"}},
-				{Path: "/home/user3/common.txt", Flags: []string{"APPEND"}},
-				{Path: "/home/user4/common.txt", Flags: []string{"READ", "WRITE"}},
-				{Path: "/var/log/app1.log", Flags: []string{"READ"}},
-				{Path: "/var/log/app2.log", Flags: []string{"WRITE"}},
-			},
+			input: append(
+				generateOpenCallsWithFlags("/home", "common.txt", threshold+1),
+				types.OpenCalls{Path: "/var/log/app1.log", Flags: []string{"READ"}},
+				types.OpenCalls{Path: "/var/log/app2.log", Flags: []string{"WRITE"}},
+			),
 			expected: []types.OpenCalls{
-				{Path: "/home/\u22ef/common.txt", Flags: []string{"APPEND", "READ", "WRITE"}},
+				{Path: "/home/\u22ef/common.txt", Flags: flagsForN(threshold + 1)},
 				{Path: "/var/log/app1.log", Flags: []string{"READ"}},
 				{Path: "/var/log/app2.log", Flags: []string{"WRITE"}},
 			},
 		},
 		{
 			name: "Multiple dynamic segments",
-			input: []types.OpenCalls{
-				{Path: "/home/user1/file1.txt", Flags: []string{"READ"}},
-				{Path: "/home/user2/file1.txt", Flags: []string{"WRITE"}},
-				{Path: "/home/user3/file1.txt", Flags: []string{"APPEND"}},
-				{Path: "/home/user4/file1.txt", Flags: []string{"READ", "WRITE"}},
-				{Path: "/home/user1/file2.txt", Flags: []string{"READ"}},
-				{Path: "/home/user2/file2.txt", Flags: []string{"WRITE"}},
-				{Path: "/home/user3/file2.txt", Flags: []string{"APPEND"}},
-				{Path: "/home/user4/file2.txt", Flags: []string{"READ", "WRITE"}},
-			},
+			input: append(
+				generateOpenCallsWithFlags("/home", "file1.txt", threshold+1),
+				generateOpenCallsWithFlags("/home", "file2.txt", threshold+1)...,
+			),
 			expected: []types.OpenCalls{
-				{Path: "/home/\u22ef/file1.txt", Flags: []string{"APPEND", "READ", "WRITE"}},
-				{Path: "/home/\u22ef/file2.txt", Flags: []string{"APPEND", "READ", "WRITE"}},
+				{Path: "/home/\u22ef/file1.txt", Flags: flagsForN(threshold + 1)},
+				{Path: "/home/\u22ef/file2.txt", Flags: flagsForN(threshold + 1)},
 			},
 		},
 	}
 
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
-			analyzer := dynamicpathdetector.NewPathAnalyzer(3)
+			analyzer := dynamicpathdetector.NewPathAnalyzer(threshold)
 			result, err := dynamicpathdetector.AnalyzeOpens(tt.input, analyzer, mapset.NewSet[string]())
 			assert.NoError(t, err)
 
@@ -114,15 +105,20 @@ func TestAnalyzeOpensWithFlagMergingAndThreshold(t *testing.T) {
 }
 
 func TestAnalyzeOpensWithAsteriskAndEllipsis(t *testing.T) {
-	analyzer := dynamicpathdetector.NewPathAnalyzer(3) // Threshold of 3 OLD BEHAVIOR
+	threshold := configThreshold("/var/run")
+	analyzer := dynamicpathdetector.NewPathAnalyzer(threshold)
 
-	input := []types.OpenCalls{
-		// These should collapse into /home/…/file.txt
-		{Path: "/home/user1/file.txt", Flags: []string{"READ"}},
-		{Path: "/home/user2/file.txt", Flags: []string{"READ"}},
-		{Path: "/home/\u22ef/file.txt", Flags: []string{"READ"}},
-		{Path: "/home/user4/file.txt", Flags: []string{"READ"}},
+	// Generate threshold paths + one ⋯ path to trigger collapse
+	var input []types.OpenCalls
+	for i := 0; i < threshold; i++ {
+		input = append(input, types.OpenCalls{
+			Path: fmt.Sprintf("/home/user%d/file.txt", i), Flags: []string{"READ"},
+		})
 	}
+	input = append(input,
+		types.OpenCalls{Path: "/home/\u22ef/file.txt", Flags: []string{"READ"}},
+		types.OpenCalls{Path: fmt.Sprintf("/home/user%d/file.txt", threshold), Flags: []string{"READ"}},
+	)
 
 	expected := []types.OpenCalls{
 		{Path: "/home/\u22ef/file.txt", Flags: []string{"READ"}},
@@ -131,13 +127,17 @@ func TestAnalyzeOpensWithAsteriskAndEllipsis(t *testing.T) {
 	result, err := dynamicpathdetector.AnalyzeOpens(input, analyzer, mapset.NewSet[string]())
 	assert.NoError(t, err)
 
-	// Use ElementsMatch because the order of elements in the result is not guaranteed
 	assert.ElementsMatch(t, expected, result)
 }
 
 func TestAnalyzeOpensWithMultiCollapse(t *testing.T) {
-	analyzer := dynamicpathdetector.NewPathAnalyzer(5) // Threshold of 3 for /var/run prefix is set in the defaults, but here we are overwriting the defaults
+	// Use a threshold higher than the /var/run config (3) so /var/run paths do NOT collapse
+	threshold := dynamicpathdetector.DefaultCollapseConfig.Threshold
+	analyzer := dynamicpathdetector.NewPathAnalyzer(threshold)
 
+	// Only 3 paths under /var/run — the per-prefix threshold for /var/run is 3,
+	// but NewPathAnalyzer overrides the default to 'threshold', so /var/run inherits its own config (3).
+	// 3 children <= threshold 3, so these should NOT collapse.
 	input := []types.OpenCalls{
 		{Path: "/var/run/txt/file.txt", Flags: []string{"READ"}},
 		{Path: "/var/run/txt1/file.txt", Flags: []string{"READ"}},
@@ -157,72 +157,53 @@ func TestAnalyzeOpensWithMultiCollapse(t *testing.T) {
 }
 
 func TestAnalyzeOpensWithDynamicConfigs(t *testing.T) {
-	// Default threshold is 10, used for paths like /tmp
+	etcThreshold := configThreshold("/etc")
+	optThreshold := configThreshold("/opt")
+	varRunThreshold := configThreshold("/var/run")
+	appThreshold := configThreshold("/app")
+	tmpThreshold := 10 // custom for this test
+
 	analyzer := dynamicpathdetector.NewPathAnalyzerWithConfigs([]dynamicpathdetector.CollapseConfig{
-		{
-			Prefix:    "/etc",
-			Threshold: 50,
-		},
-		{
-			Prefix:    "/opt",
-			Threshold: 5,
-		},
-		{
-			Prefix:    "/var/run",
-			Threshold: 3,
-		},
-		{
-			Prefix:    "/app",
-			Threshold: 1,
-		},
-		{
-			Prefix:    "/tmp",
-			Threshold: 10,
-		},
+		{Prefix: "/etc", Threshold: etcThreshold},
+		{Prefix: "/opt", Threshold: optThreshold},
+		{Prefix: "/var/run", Threshold: varRunThreshold},
+		{Prefix: "/app", Threshold: appThreshold},
+		{Prefix: "/tmp", Threshold: tmpThreshold},
 	})
 
-	// The paths to be added, exercising different collapse configurations.
-	pathsToAdd := []string{
-		// /etc paths (Threshold: 50) - should not collapse
-		"/etc/config/app.conf",
-		"/etc/config/db.conf",
+	var pathsToAdd []string
+
+	// /etc paths (high threshold) - should not collapse
+	for i := 0; i < 8; i++ {
+		pathsToAdd = append(pathsToAdd, fmt.Sprintf("/etc/config/item%d", i))
+	}
+	pathsToAdd = append(pathsToAdd,
 		"/etc/hosts",
 		"/etc/resolv.conf",
-		"/etc/config/cron.d/hourly",
-		"/etc/systemd/system.conf",
 		"/etc/hostname",
-		"/etc/config/something",
-
-		// /opt paths (Threshold: 5) - should collapse at /opt level
-		"/opt/app1/binary",
-		"/opt/app2/binary",
-		"/opt/app3/binary",
-		"/opt/app4/binary",
-		"/opt/app5/binary",
-		"/opt/app6/binary", // 6th child of /opt, triggers collapse
-
-		// /var/run paths (Threshold: 3) - should collapse at /var/run level
-		"/var/run/pid1.pid",
-		"/var/run/pid2.pid",
-		"/var/run/pid3.pid",
-		"/var/run/pid4.pid", // 4th child of /var/run, triggers collapse
-
-		// /app paths (Threshold: 1) - should immediately collapse
+		"/etc/systemd/system.conf",
+	)
+	// Total /etc: 12, well below etcThreshold (50)
+
+	// /opt paths — exceed optThreshold to trigger collapse
+	for i := 0; i < optThreshold+1; i++ {
+		pathsToAdd = append(pathsToAdd, fmt.Sprintf("/opt/app%d/binary", i))
+	}
+
+	// /var/run paths — exceed varRunThreshold to trigger collapse
+	for i := 0; i < varRunThreshold+1; i++ {
+		pathsToAdd = append(pathsToAdd, fmt.Sprintf("/var/run/pid%d.pid", i))
+	}
+
+	// /app paths — appThreshold is 1, so second child triggers wildcard
+	pathsToAdd = append(pathsToAdd,
 		"/app/some/deep/path",
-		"/app/another/path", // 2nd child of /app, triggers collapse
-
-		// /tmp paths (Default Threshold: 10) - should collapse at /tmp level
-		"/tmp/user1/a",
-		"/tmp/user2/a",
-		"/tmp/user3/a",
-		"/tmp/user4/a",
-		"/tmp/user5/a",
-		"/tmp/user6/a",
-		"/tmp/user7/a",
-		"/tmp/user8/a",
-		"/tmp/user9/a",
-		"/tmp/user10/a",
-		"/tmp/user11/a", // 11th child of /tmp, triggers collapse
+		"/app/another/path",
+	)
+
+	// /tmp paths — exceed tmpThreshold to trigger collapse
+	for i := 0; i < tmpThreshold+1; i++ {
+		pathsToAdd = append(pathsToAdd, fmt.Sprintf("/tmp/user%d/a", i))
 	}
 
 	var input []types.OpenCalls
@@ -233,40 +214,36 @@ func TestAnalyzeOpensWithDynamicConfigs(t *testing.T) {
 	result, err := dynamicpathdetector.AnalyzeOpens(input, analyzer, mapset.NewSet[string]())
 	assert.NoError(t, err)
 
-	// /etc paths (threshold 50) should NOT be collapsed - all 8 paths remain individual
-	assertContainsPath(t, result, "/etc/config/app.conf")
-	assertContainsPath(t, result, "/etc/config/cron.d/hourly")
-	assertContainsPath(t, result, "/etc/config/db.conf")
-	assertContainsPath(t, result, "/etc/config/something")
-	assertContainsPath(t, result, "/etc/hostname")
-	assertContainsPath(t, result, "/etc/hosts")
-	assertContainsPath(t, result, "/etc/resolv.conf")
-	assertContainsPath(t, result, "/etc/systemd/system.conf")
+	// /etc paths (threshold 50) should NOT be collapsed
+	etcPaths := filterByPrefix(result, "/etc/")
+	assert.Equal(t, 12, len(etcPaths), "/etc paths should remain individual (below threshold %d)", etcThreshold)
 
 	// /app (threshold 1) - immediately collapses to wildcard
 	assertContainsPath(t, result, "/app/*")
 
-	// /opt (threshold 5) - collapses; both wildcard and dynamic-with-subtree are acceptable
+	// /opt — collapses; both wildcard and dynamic-with-subtree are acceptable
 	assertContainsOneOfPaths(t, result, "/opt/*", "/opt/\u22ef/binary")
 
-	// /tmp (threshold 10) - collapses; both wildcard and dynamic-with-subtree are acceptable
+	// /tmp — collapses
 	assertContainsOneOfPaths(t, result, "/tmp/*", "/tmp/\u22ef/a")
 
-	// /var/run (threshold 3) - collapses; both forms are equivalent here (leaf nodes)
+	// /var/run — collapses
 	assertContainsOneOfPaths(t, result, "/var/run/*", "/var/run/\u22ef")
 
-	// Total: 8 etc + 1 app + 1 opt + 1 tmp + 1 var/run = 12
-	assert.Equal(t, 12, len(result), "expected 12 total paths, got %d: %v", len(result), pathsFromResult(result))
+	// Total: 12 etc + 1 app + 1 opt + 1 tmp + 1 var/run = 16
+	assert.Equal(t, 16, len(result), "expected 16 total paths, got %d: %v", len(result), pathsFromResult(result))
 }
 
 // TestAnalyzeOpensCollapseExactBoundary verifies that threshold is strictly "greater than",
 // not "greater than or equal". With threshold N, exactly N children should NOT collapse,
 // but N+1 children SHOULD.
 func TestAnalyzeOpensCollapseExactBoundary(t *testing.T) {
+	threshold := dynamicpathdetector.DefaultCollapseConfig.Threshold
+
 	t.Run("at threshold - no collapse", func(t *testing.T) {
-		analyzer := dynamicpathdetector.NewPathAnalyzer(5)
+		analyzer := dynamicpathdetector.NewPathAnalyzer(threshold)
 		var input []types.OpenCalls
-		for i := 0; i < 5; i++ {
+		for i := 0; i < threshold; i++ {
 			input = append(input, types.OpenCalls{
 				Path:  fmt.Sprintf("/data/item%d/info", i),
 				Flags: []string{"READ"},
@@ -274,7 +251,7 @@ func TestAnalyzeOpensCollapseExactBoundary(t *testing.T) {
 		}
 		result, err := dynamicpathdetector.AnalyzeOpens(input, analyzer, mapset.NewSet[string]())
 		assert.NoError(t, err)
-		assert.Equal(t, 5, len(result), "at exact threshold, paths should NOT collapse")
+		assert.Equal(t, threshold, len(result), "at exact threshold, paths should NOT collapse")
 		for _, r := range result {
 			assert.NotContains(t, r.Path, "\u22ef", "no dynamic segment expected")
 			assert.NotContains(t, r.Path, "*", "no wildcard expected")
@@ -282,9 +259,9 @@ func TestAnalyzeOpensCollapseExactBoundary(t *testing.T) {
 	})
 
 	t.Run("above threshold - collapse", func(t *testing.T) {
-		analyzer := dynamicpathdetector.NewPathAnalyzer(5)
+		analyzer := dynamicpathdetector.NewPathAnalyzer(threshold)
 		var input []types.OpenCalls
-		for i := 0; i < 6; i++ {
+		for i := 0; i < threshold+1; i++ {
 			input = append(input, types.OpenCalls{
 				Path:  fmt.Sprintf("/data/item%d/info", i),
 				Flags: []string{"READ"},
@@ -300,9 +277,11 @@ func TestAnalyzeOpensCollapseExactBoundary(t *testing.T) {
 // TestAnalyzeOpensDuplicatePathsNoCollapse verifies that repeating the same path
 // many times does NOT trigger a collapse - only unique segment names count.
 func TestAnalyzeOpensDuplicatePathsNoCollapse(t *testing.T) {
-	analyzer := dynamicpathdetector.NewPathAnalyzer(3)
+	threshold := configThreshold("/var/run")
+	analyzer := dynamicpathdetector.NewPathAnalyzer(threshold)
 	var input []types.OpenCalls
-	for i := 0; i < 100; i++ {
+	// Repeat the same path many times — should NOT trigger collapse
+	for i := 0; i < threshold*10; i++ {
 		input = append(input, types.OpenCalls{
 			Path:  "/data/same-child/file.txt",
 			Flags: []string{"READ"},
@@ -317,17 +296,19 @@ func TestAnalyzeOpensDuplicatePathsNoCollapse(t *testing.T) {
 // TestAnalyzeOpensVaryingDepthsUnderPrefix verifies collapse behavior when paths
 // under the same prefix have different depths.
 func TestAnalyzeOpensVaryingDepthsUnderPrefix(t *testing.T) {
-	analyzer := dynamicpathdetector.NewPathAnalyzer(3)
-	input := []types.OpenCalls{
-		{Path: "/data/a", Flags: []string{"READ"}},
-		{Path: "/data/b/deep/file", Flags: []string{"READ"}},
-		{Path: "/data/c/other", Flags: []string{"WRITE"}},
-		{Path: "/data/d", Flags: []string{"APPEND"}},
+	threshold := configThreshold("/var/run")
+	analyzer := dynamicpathdetector.NewPathAnalyzer(threshold)
+
+	// Generate threshold+1 unique children under /data to trigger collapse
+	var input []types.OpenCalls
+	for i := 0; i < threshold+1; i++ {
+		input = append(input, types.OpenCalls{
+			Path:  fmt.Sprintf("/data/%c/deep/file", 'a'+rune(i)),
+			Flags: []string{"READ"},
+		})
 	}
 	result, err := dynamicpathdetector.AnalyzeOpens(input, analyzer, mapset.NewSet[string]())
 	assert.NoError(t, err)
-	// 4 unique children under /data with threshold 3 -> should collapse
-	// All paths should be merged under the dynamic/wildcard node
 	for _, r := range result {
 		assert.True(t,
 			strings.Contains(r.Path, "\u22ef") || strings.Contains(r.Path, "*"),
@@ -338,20 +319,21 @@ func TestAnalyzeOpensVaryingDepthsUnderPrefix(t *testing.T) {
 // TestAnalyzeOpensNewPathAfterCollapse verifies that a new path arriving after
 // the threshold was already crossed gets absorbed by the collapsed node.
 func TestAnalyzeOpensNewPathAfterCollapse(t *testing.T) {
-	analyzer := dynamicpathdetector.NewPathAnalyzer(3)
-
-	// First batch: trigger collapse
-	batch1 := []types.OpenCalls{
-		{Path: "/srv/a/log", Flags: []string{"READ"}},
-		{Path: "/srv/b/log", Flags: []string{"READ"}},
-		{Path: "/srv/c/log", Flags: []string{"READ"}},
-		{Path: "/srv/d/log", Flags: []string{"READ"}},
+	threshold := configThreshold("/var/run")
+	analyzer := dynamicpathdetector.NewPathAnalyzer(threshold)
+
+	// First batch: trigger collapse with threshold+1 children
+	var batch1 []types.OpenCalls
+	for i := 0; i < threshold+1; i++ {
+		batch1 = append(batch1, types.OpenCalls{
+			Path: fmt.Sprintf("/srv/%c/log", 'a'+rune(i)), Flags: []string{"READ"},
+		})
 	}
 	result1, err := dynamicpathdetector.AnalyzeOpens(batch1, analyzer, mapset.NewSet[string]())
 	assert.NoError(t, err)
 	assert.Equal(t, 1, len(result1), "first batch should collapse to 1 path")
 
-	// Second batch: add a completely new child - it should be absorbed
+	// Second batch: add a completely new child — it should be absorbed
 	batch2 := append(batch1, types.OpenCalls{
 		Path: "/srv/new-service/log", Flags: []string{"WRITE"},
 	})
@@ -378,7 +360,8 @@ func TestAnalyzeOpensDefaultThresholdForUnconfiguredPrefix(t *testing.T) {
 	assert.NoError(t, err)
 	assert.Equal(t, 1, len(result), "/configured should collapse with threshold 2")
 
-	// /unconfigured uses default threshold (50): 3 children should NOT collapse
+	// /unconfigured uses default threshold: 3 children should NOT collapse
+	defaultThreshold := dynamicpathdetector.DefaultCollapseConfig.Threshold
 	analyzer2 := dynamicpathdetector.NewPathAnalyzerWithConfigs([]dynamicpathdetector.CollapseConfig{
 		{Prefix: "/configured", Threshold: 2},
 	})
@@ -389,14 +372,16 @@ func TestAnalyzeOpensDefaultThresholdForUnconfiguredPrefix(t *testing.T) {
 	}
 	result2, err := dynamicpathdetector.AnalyzeOpens(unconfiguredInput, analyzer2, mapset.NewSet[string]())
 	assert.NoError(t, err)
-	assert.Equal(t, 3, len(result2), "/unconfigured should NOT collapse with default threshold 50")
+	assert.Equal(t, 3, len(result2),
+		"/unconfigured should NOT collapse with default threshold %d", defaultThreshold)
 }
 
 // TestAnalyzeOpensThreshold1ImmediateWildcard verifies that threshold 1 produces
 // a wildcard (*) on the very first additional child.
 func TestAnalyzeOpensThreshold1ImmediateWildcard(t *testing.T) {
+	appThreshold := configThreshold("/app") // threshold 1
 	analyzer := dynamicpathdetector.NewPathAnalyzerWithConfigs([]dynamicpathdetector.CollapseConfig{
-		{Prefix: "/instant", Threshold: 1},
+		{Prefix: "/instant", Threshold: appThreshold},
 	})
 
 	t.Run("single path - no collapse yet", func(t *testing.T) {
@@ -411,7 +396,7 @@ func TestAnalyzeOpensThreshold1ImmediateWildcard(t *testing.T) {
 
 	t.Run("two paths - collapsed", func(t *testing.T) {
 		analyzer2 := dynamicpathdetector.NewPathAnalyzerWithConfigs([]dynamicpathdetector.CollapseConfig{
-			{Prefix: "/instant", Threshold: 1},
+			{Prefix: "/instant", Threshold: appThreshold},
 		})
 		input := []types.OpenCalls{
 			{Path: "/instant/first/data", Flags: []string{"READ"}},
@@ -428,18 +413,21 @@ func TestAnalyzeOpensThreshold1ImmediateWildcard(t *testing.T) {
 // TestAnalyzeOpensCollapseDoesNotAffectSiblingPrefixes verifies that collapsing
 // one prefix does not affect paths under a sibling prefix.
 func TestAnalyzeOpensCollapseDoesNotAffectSiblingPrefixes(t *testing.T) {
-	analyzer := dynamicpathdetector.NewPathAnalyzer(3)
+	threshold := configThreshold("/var/run")
+	analyzer := dynamicpathdetector.NewPathAnalyzer(threshold)
 
-	input := []types.OpenCalls{
-		// /alpha should collapse (4 > 3)
-		{Path: "/alpha/a1/file", Flags: []string{"READ"}},
-		{Path: "/alpha/a2/file", Flags: []string{"READ"}},
-		{Path: "/alpha/a3/file", Flags: []string{"READ"}},
-		{Path: "/alpha/a4/file", Flags: []string{"READ"}},
-		// /beta should NOT collapse (2 <= 3)
-		{Path: "/beta/b1/file", Flags: []string{"WRITE"}},
-		{Path: "/beta/b2/file", Flags: []string{"WRITE"}},
+	// /alpha: threshold+1 children → should collapse
+	var input []types.OpenCalls
+	for i := 0; i < threshold+1; i++ {
+		input = append(input, types.OpenCalls{
+			Path: fmt.Sprintf("/alpha/a%d/file", i), Flags: []string{"READ"},
+		})
 	}
+	// /beta: 2 children → should NOT collapse (2 <= threshold)
+	input = append(input,
+		types.OpenCalls{Path: "/beta/b1/file", Flags: []string{"WRITE"}},
+		types.OpenCalls{Path: "/beta/b2/file", Flags: []string{"WRITE"}},
+	)
 
 	result, err := dynamicpathdetector.AnalyzeOpens(input, analyzer, mapset.NewSet[string]())
 	assert.NoError(t, err)
@@ -454,12 +442,17 @@ func TestAnalyzeOpensCollapseDoesNotAffectSiblingPrefixes(t *testing.T) {
 // TestAnalyzeOpensFlagMergingAfterCollapse verifies that flags from all paths
 // that collapse into the same dynamic node are properly merged and deduplicated.
 func TestAnalyzeOpensFlagMergingAfterCollapse(t *testing.T) {
-	analyzer := dynamicpathdetector.NewPathAnalyzer(3)
-	input := []types.OpenCalls{
-		{Path: "/logs/service1/app.log", Flags: []string{"READ", "WRITE"}},
-		{Path: "/logs/service2/app.log", Flags: []string{"WRITE", "APPEND"}},
-		{Path: "/logs/service3/app.log", Flags: []string{"READ"}},
-		{Path: "/logs/service4/app.log", Flags: []string{"APPEND", "READ"}},
+	threshold := configThreshold("/var/run")
+	analyzer := dynamicpathdetector.NewPathAnalyzer(threshold)
+
+	// Generate threshold+1 children to trigger collapse, with varied flags
+	var input []types.OpenCalls
+	flags := [][]string{{"READ", "WRITE"}, {"WRITE", "APPEND"}, {"READ"}, {"APPEND", "READ"}}
+	for i := 0; i < threshold+1; i++ {
+		input = append(input, types.OpenCalls{
+			Path:  fmt.Sprintf("/logs/service%d/app.log", i),
+			Flags: flags[i%len(flags)],
+		})
 	}
 	result, err := dynamicpathdetector.AnalyzeOpens(input, analyzer, mapset.NewSet[string]())
 	assert.NoError(t, err)
@@ -471,12 +464,13 @@ func TestAnalyzeOpensFlagMergingAfterCollapse(t *testing.T) {
 // TestAnalyzeOpensMultipleLevelsOfCollapse verifies behavior when both parent and
 // grandchild segments independently exceed their thresholds.
 func TestAnalyzeOpensMultipleLevelsOfCollapse(t *testing.T) {
-	analyzer := dynamicpathdetector.NewPathAnalyzer(3)
+	threshold := configThreshold("/var/run")
+	analyzer := dynamicpathdetector.NewPathAnalyzer(threshold)
 
 	var input []types.OpenCalls
-	// 4 unique children under /multi, each with 4 unique grandchildren
-	for i := 0; i < 4; i++ {
-		for j := 0; j < 4; j++ {
+	// threshold+1 unique children under /multi, each with threshold+1 unique grandchildren
+	for i := 0; i < threshold+1; i++ {
+		for j := 0; j < threshold+1; j++ {
 			input = append(input, types.OpenCalls{
 				Path:  fmt.Sprintf("/multi/level%d/sub%d/file", i, j),
 				Flags: []string{"READ"},
@@ -486,9 +480,7 @@ func TestAnalyzeOpensMultipleLevelsOfCollapse(t *testing.T) {
 
 	result, err := dynamicpathdetector.AnalyzeOpens(input, analyzer, mapset.NewSet[string]())
 	assert.NoError(t, err)
-	// Both /multi children and the grandchildren should collapse
 	assert.Equal(t, 1, len(result), "double collapse should yield a single path")
-	// The path should contain wildcard or dynamic segments
 	assert.True(t,
 		strings.Contains(result[0].Path, "\u22ef") || strings.Contains(result[0].Path, "*"),
 		"result %q should contain dynamic or wildcard segments", result[0].Path)
@@ -497,23 +489,25 @@ func TestAnalyzeOpensMultipleLevelsOfCollapse(t *testing.T) {
 // TestAnalyzeOpensExistingDynamicSegmentInInput verifies that input paths
 // already containing ⋯ are handled correctly and merge with new paths.
 func TestAnalyzeOpensExistingDynamicSegmentInInput(t *testing.T) {
-	analyzer := dynamicpathdetector.NewPathAnalyzer(100)
+	// Use a high threshold so that the two paths alone don't trigger collapse —
+	// instead, the existing ⋯ segment absorbs the specific path.
+	analyzer := dynamicpathdetector.NewPathAnalyzer(dynamicpathdetector.OpenDynamicThreshold)
 	input := []types.OpenCalls{
 		{Path: "/data/\u22ef/config", Flags: []string{"READ"}},
 		{Path: "/data/specific/config", Flags: []string{"WRITE"}},
 	}
 	result, err := dynamicpathdetector.AnalyzeOpens(input, analyzer, mapset.NewSet[string]())
 	assert.NoError(t, err)
-	// The specific path should be absorbed by the existing dynamic segment
 	assert.Equal(t, 1, len(result))
 	assert.Equal(t, "/data/\u22ef/config", result[0].Path)
 	assert.ElementsMatch(t, []string{"READ", "WRITE"}, result[0].Flags)
 }
 
 // TestAnalyzeOpens_NilSbomSetNoError verifies that passing a nil sbomSet
-// does not return an error (previously it did).
+// does not return an error.
 func TestAnalyzeOpens_NilSbomSetNoError(t *testing.T) {
-	analyzer := dynamicpathdetector.NewPathAnalyzer(3)
+	threshold := configThreshold("/var/run")
+	analyzer := dynamicpathdetector.NewPathAnalyzer(threshold)
 	input := []types.OpenCalls{
 		{Path: "/usr/lib/libfoo.so", Flags: []string{"READ"}},
 		{Path: "/usr/lib/libbar.so", Flags: []string{"READ"}},
@@ -526,22 +520,54 @@ func TestAnalyzeOpens_NilSbomSetNoError(t *testing.T) {
 // TestAnalyzeOpens_NilSbomSetWithCollapse verifies that collapse works
 // correctly even when sbomSet is nil.
 func TestAnalyzeOpens_NilSbomSetWithCollapse(t *testing.T) {
-	analyzer := dynamicpathdetector.NewPathAnalyzer(3)
-	input := []types.OpenCalls{
-		{Path: "/usr/lib/liba.so", Flags: []string{"READ"}},
-		{Path: "/usr/lib/libb.so", Flags: []string{"READ"}},
-		{Path: "/usr/lib/libc.so", Flags: []string{"WRITE"}},
-		{Path: "/usr/lib/libd.so", Flags: []string{"APPEND"}},
+	threshold := configThreshold("/var/run")
+	analyzer := dynamicpathdetector.NewPathAnalyzer(threshold)
+
+	var input []types.OpenCalls
+	for i := 0; i < threshold+1; i++ {
+		input = append(input, types.OpenCalls{
+			Path:  fmt.Sprintf("/usr/lib/lib%c.so", 'a'+rune(i)),
+			Flags: []string{"READ"},
+		})
 	}
 	result, err := dynamicpathdetector.AnalyzeOpens(input, analyzer, nil)
 	assert.NoError(t, err)
-	assert.Equal(t, 1, len(result), "4 children > threshold 3, should collapse")
+	assert.Equal(t, 1, len(result), "%d children > threshold %d, should collapse", threshold+1, threshold)
 	assert.True(t,
 		strings.Contains(result[0].Path, "\u22ef") || strings.Contains(result[0].Path, "*"),
 		"collapsed path should contain dynamic or wildcard segment, got %q", result[0].Path)
 }
 
-// Helper function to check if a slice of strings contains only unique elements
+// --- Helpers ---
+
+// generateOpenCallsWithFlags creates N OpenCalls under prefix/userN/filename with rotating flags.
+func generateOpenCallsWithFlags(prefix, filename string, n int) []types.OpenCalls {
+	allFlags := []string{"READ", "WRITE", "APPEND"}
+	var result []types.OpenCalls
+	for i := 0; i < n; i++ {
+		result = append(result, types.OpenCalls{
+			Path:  fmt.Sprintf("%s/user%d/%s", prefix, i, filename),
+			Flags: []string{allFlags[i%len(allFlags)]},
+		})
+	}
+	return result
+}
+
+// flagsForN returns the sorted, unique flags that generateOpenCallsWithFlags would produce for N items.
+func flagsForN(n int) []string {
+	allFlags := []string{"READ", "WRITE", "APPEND"}
+	seen := map[string]bool{}
+	for i := 0; i < n; i++ {
+		seen[allFlags[i%len(allFlags)]] = true
+	}
+	var result []string
+	for f := range seen {
+		result = append(result, f)
+	}
+	sort.Strings(result)
+	return result
+}
+
 func areStringSlicesUnique(slice []string) bool {
 	seen := make(map[string]struct{})
 	for _, s := range slice {
@@ -553,7 +579,6 @@ func areStringSlicesUnique(slice []string) bool {
 	return true
 }
 
-// assertContainsPath checks that at least one result has the given path.
 func assertContainsPath(t *testing.T, result []types.OpenCalls, path string) {
 	t.Helper()
 	for _, r := range result {
@@ -564,8 +589,6 @@ func assertContainsPath(t *testing.T, result []types.OpenCalls, path string) {
 	assert.Fail(t, fmt.Sprintf("result does not contain path %q, got: %v", path, pathsFromResult(result)))
 }
 
-// assertContainsOneOfPaths checks that at least one result matches any of the given paths.
-// Used when both the dynamic (⋯) and wildcard (*) forms are acceptable.
 func assertContainsOneOfPaths(t *testing.T, result []types.OpenCalls, alternatives ...string) {
 	t.Helper()
 	for _, r := range result {
@@ -578,7 +601,6 @@ func assertContainsOneOfPaths(t *testing.T, result []types.OpenCalls, alternativ
 	assert.Fail(t, fmt.Sprintf("result does not contain any of %v, got: %v", alternatives, pathsFromResult(result)))
 }
 
-// assertPathIsOneOf checks that the given path matches one of the alternatives.
 func assertPathIsOneOf(t *testing.T, actual string, alternatives ...string) {
 	t.Helper()
 	for _, alt := range alternatives {
@@ -589,7 +611,6 @@ func assertPathIsOneOf(t *testing.T, actual string, alternatives ...string) {
 	assert.Fail(t, fmt.Sprintf("path %q does not match any of %v", actual, alternatives))
 }
 
-// filterByPrefix returns all OpenCalls whose path starts with the given prefix.
 func filterByPrefix(result []types.OpenCalls, prefix string) []types.OpenCalls {
 	var filtered []types.OpenCalls
 	for _, r := range result {
@@ -600,7 +621,6 @@ func filterByPrefix(result []types.OpenCalls, prefix string) []types.OpenCalls {
 	return filtered
 }
 
-// pathsFromResult extracts just the paths for readable error messages.
 func pathsFromResult(result []types.OpenCalls) []string {
 	paths := make([]string, len(result))
 	for i, r := range result {
diff --git a/pkg/registry/file/dynamicpathdetector/tests/benchmark_test.go b/pkg/registry/file/dynamicpathdetector/tests/benchmark_test.go
index 831aa3f51..bc06b6458 100644
--- a/pkg/registry/file/dynamicpathdetector/tests/benchmark_test.go
+++ b/pkg/registry/file/dynamicpathdetector/tests/benchmark_test.go
@@ -13,7 +13,7 @@ import (
 )
 
 func BenchmarkAnalyzePath(b *testing.B) {
-	analyzer := dynamicpathdetector.NewPathAnalyzer(100)
+	analyzer := dynamicpathdetector.NewPathAnalyzer(dynamicpathdetector.OpenDynamicThreshold)
 	paths := generateMixedPaths(10000, 0) // 0 means use default mixed lengths
 
 	identifier := "test"
@@ -33,7 +33,7 @@ func BenchmarkAnalyzePathWithDifferentLengths(b *testing.B) {
 
 	for _, length := range pathLengths {
 		b.Run(fmt.Sprintf("PathLength-%d", length), func(b *testing.B) {
-			analyzer := dynamicpathdetector.NewPathAnalyzer(100)
+			analyzer := dynamicpathdetector.NewPathAnalyzer(dynamicpathdetector.OpenDynamicThreshold)
 			paths := generateMixedPaths(10000, length)
 			identifier := "test"
 
@@ -52,7 +52,7 @@ func BenchmarkAnalyzePathWithDifferentLengths(b *testing.B) {
 
 func BenchmarkAnalyzeOpensVsDeflateStringer(b *testing.B) {
 	paths := pathsToOpens(generateMixedPaths(10000, 0))
-	analyzer := dynamicpathdetector.NewPathAnalyzer(100)
+	analyzer := dynamicpathdetector.NewPathAnalyzer(dynamicpathdetector.OpenDynamicThreshold)
 
 	b.Run("AnalyzeOpens", func(b *testing.B) {
 		b.ResetTimer()
diff --git a/pkg/registry/file/dynamicpathdetector/tests/coverage_test.go b/pkg/registry/file/dynamicpathdetector/tests/coverage_test.go
index 28791f2b1..517e3522f 100644
--- a/pkg/registry/file/dynamicpathdetector/tests/coverage_test.go
+++ b/pkg/registry/file/dynamicpathdetector/tests/coverage_test.go
@@ -8,15 +8,26 @@ import (
 	"github.com/stretchr/testify/assert"
 )
 
+// configThreshold returns the collapse threshold for the given path prefix
+// from DefaultCollapseConfigs. Falls back to DefaultCollapseConfig.Threshold.
+func configThreshold(prefix string) int {
+	for _, cfg := range dynamicpathdetector.DefaultCollapseConfigs {
+		if cfg.Prefix == prefix {
+			return cfg.Threshold
+		}
+	}
+	return dynamicpathdetector.DefaultCollapseConfig.Threshold
+}
+
 func TestNewPathAnalyzer(t *testing.T) {
-	analyzer := dynamicpathdetector.NewPathAnalyzer(100)
+	analyzer := dynamicpathdetector.NewPathAnalyzer(dynamicpathdetector.OpenDynamicThreshold)
 	if analyzer == nil {
 		t.Error("NewPathAnalyzer() returned nil")
 	}
 }
 
 func TestAnalyzePath(t *testing.T) {
-	analyzer := dynamicpathdetector.NewPathAnalyzer(100)
+	analyzer := dynamicpathdetector.NewPathAnalyzer(dynamicpathdetector.OpenDynamicThreshold)
 
 	testCases := []struct {
 		name       string
@@ -69,16 +80,16 @@ func TestCollapseAdjacentDynamicIdentifiers(t *testing.T) {
 }
 
 func TestDynamicSegments(t *testing.T) {
-	analyzer := dynamicpathdetector.NewPathAnalyzer(100)
+	threshold := dynamicpathdetector.OpenDynamicThreshold
+	analyzer := dynamicpathdetector.NewPathAnalyzer(threshold)
 
-	// Create 99 different paths under the 'users' segment
-	for i := 0; i < 101; i++ {
+	for i := 0; i < threshold+1; i++ {
 		path := fmt.Sprintf("/api/users/%d", i)
 		_, err := analyzer.AnalyzePath(path, "api")
 		assert.NoError(t, err)
 	}
 
-	result, err := analyzer.AnalyzePath("/api/users/101", "api")
+	result, err := analyzer.AnalyzePath(fmt.Sprintf("/api/users/%d", threshold+1), "api")
 	if err != nil {
 		t.Errorf("AnalyzePath() returned an error: %v", err)
 	}
@@ -86,16 +97,16 @@ func TestDynamicSegments(t *testing.T) {
 	assert.Equal(t, expected, result)
 
 	// Test with one of the original IDs to ensure it's also marked as dynamic
-	result, err = analyzer.AnalyzePath("/api/users/50", "api")
+	result, err = analyzer.AnalyzePath("/api/users/0", "api")
 	assert.NoError(t, err)
 	assert.Equal(t, expected, result)
 }
 
 func TestMultipleDynamicSegments(t *testing.T) {
-	analyzer := dynamicpathdetector.NewPathAnalyzer(100)
+	threshold := dynamicpathdetector.OpenDynamicThreshold
+	analyzer := dynamicpathdetector.NewPathAnalyzer(threshold)
 
-	// Create 99 different paths for both 'users' and 'posts' segments
-	for i := 0; i < 110; i++ {
+	for i := 0; i < threshold+10; i++ {
 		path := fmt.Sprintf("/api/users/%d/posts/%d", i, i)
 		_, err := analyzer.AnalyzePath(path, "api")
 		if err != nil {
@@ -103,18 +114,17 @@ func TestMultipleDynamicSegments(t *testing.T) {
 		}
 	}
 
-	// Test with the 100th unique user and post IDs (should trigger dynamic segments)
-	result, err := analyzer.AnalyzePath("/api/users/101/posts/1031", "api")
+	result, err := analyzer.AnalyzePath(fmt.Sprintf("/api/users/%d/posts/%d", threshold+11, threshold+11), "api")
 	assert.NoError(t, err)
 	expected := "/api/users/\u22ef/posts/\u22ef"
 	assert.Equal(t, expected, result)
 }
 
 func TestMixedStaticAndDynamicSegments(t *testing.T) {
-	analyzer := dynamicpathdetector.NewPathAnalyzer(100)
+	threshold := dynamicpathdetector.OpenDynamicThreshold
+	analyzer := dynamicpathdetector.NewPathAnalyzer(threshold)
 
-	// Create 99 different paths for 'users' but keep 'posts' static
-	for i := 0; i < 101; i++ {
+	for i := 0; i < threshold+1; i++ {
 		path := fmt.Sprintf("/api/users/%d/posts", i)
 		_, err := analyzer.AnalyzePath(path, "api")
 		if err != nil {
@@ -122,42 +132,40 @@ func TestMixedStaticAndDynamicSegments(t *testing.T) {
 		}
 	}
 
-	// Test with the 100th unique user ID but same 'posts' segment (should trigger dynamic segment for users)
-	result, err := analyzer.AnalyzePath("/api/users/99/posts", "api")
+	result, err := analyzer.AnalyzePath("/api/users/0/posts", "api")
 	assert.NoError(t, err)
 	expected := "/api/users/\u22ef/posts"
 	assert.Equal(t, expected, result)
 }
 
 func TestDifferentRootIdentifiers(t *testing.T) {
-	analyzer := dynamicpathdetector.NewPathAnalyzer(100)
+	analyzer := dynamicpathdetector.NewPathAnalyzer(dynamicpathdetector.OpenDynamicThreshold)
 
-	// Analyze paths with different root identifiers
 	result1, _ := analyzer.AnalyzePath("/api/users/123", "api")
 	result2, _ := analyzer.AnalyzePath("/api/products/456", "store")
 
 	assert.Equal(t, "/api/users/123", result1)
-
 	assert.Equal(t, "/api/products/456", result2)
 }
 
 func TestDynamicThreshold(t *testing.T) {
-	analyzer := dynamicpathdetector.NewPathAnalyzer(100)
+	threshold := dynamicpathdetector.OpenDynamicThreshold
+	analyzer := dynamicpathdetector.NewPathAnalyzer(threshold)
 
-	for i := 0; i < 101; i++ {
+	for i := 0; i < threshold+1; i++ {
 		path := fmt.Sprintf("/api/users/%d", i)
 		result, _ := analyzer.AnalyzePath(path, "api")
 		if result != fmt.Sprintf("/api/users/%d", i) {
-			t.Errorf("Path became dynamic before reaching 99 different paths")
+			t.Errorf("Path became dynamic before reaching %d different paths", threshold)
 		}
 	}
 
-	result, _ := analyzer.AnalyzePath("/api/users/991", "api")
+	result, _ := analyzer.AnalyzePath(fmt.Sprintf("/api/users/%d", threshold+2), "api")
 	assert.Equal(t, "/api/users/\u22ef", result)
 }
 
 func TestEdgeCases(t *testing.T) {
-	analyzer := dynamicpathdetector.NewPathAnalyzer(100)
+	analyzer := dynamicpathdetector.NewPathAnalyzer(dynamicpathdetector.OpenDynamicThreshold)
 
 	testCases := []struct {
 		name       string
@@ -180,15 +188,13 @@ func TestEdgeCases(t *testing.T) {
 }
 
 func TestDynamicInsertion(t *testing.T) {
-	analyzer := dynamicpathdetector.NewPathAnalyzer(100)
+	analyzer := dynamicpathdetector.NewPathAnalyzer(dynamicpathdetector.OpenDynamicThreshold)
 
-	// Insert a new path with a different identifier
 	result, err := analyzer.AnalyzePath("/api/users/\u22ef", "api")
 	assert.NoError(t, err)
 	expected := "/api/users/\u22ef"
 	assert.Equal(t, expected, result)
 
-	// Insert a new path with the same identifier
 	result, err = analyzer.AnalyzePath("/api/users/102", "api")
 	assert.NoError(t, err)
 	expected = "/api/users/\u22ef"
@@ -196,35 +202,37 @@ func TestDynamicInsertion(t *testing.T) {
 }
 
 func TestDynamic(t *testing.T) {
-	analyzer := dynamicpathdetector.NewPathAnalyzer(100)
-	for i := 0; i < 101; i++ {
+	threshold := dynamicpathdetector.OpenDynamicThreshold
+	analyzer := dynamicpathdetector.NewPathAnalyzer(threshold)
+	for i := 0; i < threshold+1; i++ {
 		path := fmt.Sprintf("/api/users/%d", i)
 		_, err := analyzer.AnalyzePath(path, "api")
 		assert.NoError(t, err)
 	}
-	result, err := analyzer.AnalyzePath("/api/users/101", "api")
+	result, err := analyzer.AnalyzePath(fmt.Sprintf("/api/users/%d", threshold+1), "api")
 	assert.NoError(t, err)
 	expected := "/api/users/\u22ef"
 	assert.Equal(t, expected, result)
 }
 
 func TestCollapseConfig(t *testing.T) {
+	appThreshold := configThreshold("/app")
 	analyzer := dynamicpathdetector.NewPathAnalyzerWithConfigs([]dynamicpathdetector.CollapseConfig{
 		{
 			Prefix:    "/api",
-			Threshold: 1,
+			Threshold: appThreshold,
 		},
 		{
-			Prefix:    "/169.254.169.254", // todo test this as well
-			Threshold: 50,
+			Prefix:    "/169.254.169.254",
+			Threshold: configThreshold("/etc"),
 		},
 	})
-	for i := 0; i < 2; i++ {
+	for i := 0; i < appThreshold+1; i++ {
 		path := fmt.Sprintf("/api/users/%d", i)
 		_, err := analyzer.AnalyzePath(path, "api")
 		assert.NoError(t, err)
 	}
-	result, err := analyzer.AnalyzePath("/api/users/101", "api")
+	result, err := analyzer.AnalyzePath(fmt.Sprintf("/api/users/%d", appThreshold+1), "api")
 	assert.NoError(t, err)
 	expected := "/api/*"
 	assert.Equal(t, expected, result)
diff --git a/pkg/registry/file/dynamicpathdetector/types.go b/pkg/registry/file/dynamicpathdetector/types.go
index 774171f6f..40f0f4c9a 100644
--- a/pkg/registry/file/dynamicpathdetector/types.go
+++ b/pkg/registry/file/dynamicpathdetector/types.go
@@ -1,17 +1,56 @@
 package dynamicpathdetector
 
-const DynamicIdentifier string = "\u22ef"
+// --- Identifier constants ---
+// DynamicIdentifier matches exactly one path segment (like a single-segment wildcard).
+// WildcardIdentifier matches zero or more path segments (like a glob **).
+const (
+	DynamicIdentifier  = "\u22ef" // U+22EF: ⋯
+	WildcardIdentifier = "*"
+)
 
+// --- Collapse configuration ---
+
+// CollapseConfig controls the threshold at which children of a trie node
+// (under the given path Prefix) are collapsed into a dynamic or wildcard node.
 type CollapseConfig struct {
 	Prefix    string
 	Threshold int
 }
 
+// DefaultCollapseConfigs defines per-prefix thresholds for path collapsing.
+// Paths under these prefixes are collapsed when the number of unique children
+// exceeds the threshold.
+var DefaultCollapseConfigs = []CollapseConfig{
+	{Prefix: "/etc", Threshold: 50},
+	{Prefix: "/opt", Threshold: 5},
+	{Prefix: "/var/run", Threshold: 3},
+	{Prefix: "/app", Threshold: 1},
+}
+
+// DefaultCollapseConfig is the fallback used for paths that don't match any
+// prefix in DefaultCollapseConfigs.
+var DefaultCollapseConfig = CollapseConfig{
+	Prefix:    "/",
+	Threshold: 5,
+}
+
+// --- Default thresholds for processors ---
+
+// OpenDynamicThreshold is the default collapse threshold used when analyzing
+// file-open paths in ApplicationProfile and ContainerProfile processors.
+const OpenDynamicThreshold = 5
+
+// EndpointDynamicThreshold is the default collapse threshold used when
+// analyzing HTTP endpoint paths.
+const EndpointDynamicThreshold = 5
+
+// --- Types ---
+
 type SegmentNode struct {
 	SegmentName string
 	Count       int
 	Children    map[string]*SegmentNode
-	Config      *CollapseConfig // Configuration that applies from this node downwards
+	Config      *CollapseConfig
 }
 
 type PathAnalyzer struct {
@@ -29,8 +68,8 @@ func NewTrieNode() *TrieNode {
 
 type TrieNode struct {
 	Children map[string]*TrieNode
-	Config   *CollapseConfig // Configuration that applies from this node downwards
-	Count    int             // Number of paths passing through this node
+	Config   *CollapseConfig
+	Count    int
 }
 
 func (sn *SegmentNode) IsNextDynamic() bool {

From acb906ceff260f697e49fca777f7493d537870c2 Mon Sep 17 00:00:00 2001
From: Duck <70207455+entlein@users.noreply.github.com>
Date: Sat, 14 Feb 2026 10:30:23 +0100
Subject: [PATCH 57/68] Skip user-managed resources during cleanup

Add check to skip user-managed resources in cleanup.

Signed-off-by: Duck <70207455+entlein@users.noreply.github.com>
---
 pkg/registry/file/cleanup.go | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/pkg/registry/file/cleanup.go b/pkg/registry/file/cleanup.go
index 7a98286b7..1dc714bc2 100644
--- a/pkg/registry/file/cleanup.go
+++ b/pkg/registry/file/cleanup.go
@@ -185,6 +185,11 @@ func (h *ResourcesCleanupHandler) cleanupNamespace(ctx context.Context, ns strin
 				return nil
 			}
 
+			// Skip user-managed resources (e.g., user-defined profiles)
+			if metadata.Labels[helpersv1.ManagedByMetadataKey] == helpersv1.ManagedByUserValue {
+				return nil
+			}
+
 			// either run single handler, or perform OR operation on multiple handlers
 			var toDelete bool
 			if len(handlers) == 1 {

From e20f96b3db643d1f5e39a313904b2a2803987651 Mon Sep 17 00:00:00 2001
From: tanzee <einentlein@gmail.com>
Date: Sat, 14 Feb 2026 13:04:01 +0100
Subject: [PATCH 58/68] asymptotic behavior for backwards compatitbility

---
 .gitignore                                    | 14 ++++++++++-
 .../file/dynamicpathdetector/analyzer.go      | 24 +++++++++++--------
 .../tests/analyze_opens_test.go               |  9 ++++---
 .../file/dynamicpathdetector/types.go         | 13 +++++-----
 4 files changed, 38 insertions(+), 22 deletions(-)

diff --git a/.gitignore b/.gitignore
index 49f87ff70..731bee96c 100644
--- a/.gitignore
+++ b/.gitignore
@@ -3,4 +3,16 @@ vendor/*
 artifacts/simple-image/storage-apiserver
 artifacts/simple-image/kube-sample-apiserver
 logs-*/*
-tmp/*
\ No newline at end of file
+tmp/*
+
+# Integration test artifacts
+tests/integration-test-suite/junit-*.xml
+tests/integration-test-suite/log-*.txt
+tests/integration-test-suite/integration-test-suite.test
+
+# TODO: Fix upstream - these test files import containerwatcher/v1 which was
+# renamed to containerprofilemanager/v1 in node-agent. Until the upstream
+# integration test suite is updated, local builds require patching these imports.
+tests/integration-test-suite/case_*_test.go
+tests/integration-test-suite/go.mod
+tests/integration-test-suite/go.sum
\ No newline at end of file
diff --git a/pkg/registry/file/dynamicpathdetector/analyzer.go b/pkg/registry/file/dynamicpathdetector/analyzer.go
index 744060427..7a18c01ea 100644
--- a/pkg/registry/file/dynamicpathdetector/analyzer.go
+++ b/pkg/registry/file/dynamicpathdetector/analyzer.go
@@ -5,19 +5,20 @@ import (
 )
 
 func NewPathAnalyzer(threshold int) *PathAnalyzer {
-	return newAnalyzer(CollapseConfig{Prefix: "/", Threshold: threshold}, DefaultCollapseConfigs)
+	return newAnalyzer(CollapseConfig{Prefix: "/", Threshold: threshold}, nil, false)
 }
 
 func NewPathAnalyzerWithConfigs(configs []CollapseConfig) *PathAnalyzer {
-	return newAnalyzer(DefaultCollapseConfig, configs)
+	return newAnalyzer(DefaultCollapseConfig, configs, true)
 }
 
-func newAnalyzer(defaultCfg CollapseConfig, configs []CollapseConfig) *PathAnalyzer {
+func newAnalyzer(defaultCfg CollapseConfig, configs []CollapseConfig, collapseAdjacent bool) *PathAnalyzer {
 	matcher := &PathAnalyzer{
-		root:       NewTrieNode(),
-		identRoots: make(map[string]*TrieNode),
-		configs:    make([]CollapseConfig, len(configs)),
-		defaultCfg: defaultCfg,
+		root:             NewTrieNode(),
+		identRoots:       make(map[string]*TrieNode),
+		configs:          make([]CollapseConfig, len(configs)),
+		defaultCfg:       defaultCfg,
+		collapseAdjacent: collapseAdjacent,
 	}
 	copy(matcher.configs, configs)
 	applyConfigsToNode(matcher.root, &matcher.defaultCfg, matcher.configs)
@@ -143,8 +144,8 @@ func (pm *PathAnalyzer) addPathToRoot(root *TrieNode, path string) {
 		}
 		child.Count++
 
-		// Special case: threshold of 1 immediately creates a wildcard
-		if currentConfig != nil && currentConfig.Threshold == 1 && parent.Children[WildcardIdentifier] == nil {
+		// Special case: threshold of 1 immediately creates a wildcard (only with collapseAdjacent)
+		if pm.collapseAdjacent && currentConfig != nil && currentConfig.Threshold == 1 && parent.Children[WildcardIdentifier] == nil {
 			pm.createWildcardNode(parent)
 			parent.Children[WildcardIdentifier].Count++
 			return
@@ -284,7 +285,10 @@ func (pm *PathAnalyzer) AnalyzePath(path string, identifier string) (string, err
 	pm.addPathToRoot(root, cleanPath)
 
 	finalPath := "/" + strings.Join(pathSegments, "/")
-	return CollapseAdjacentDynamicIdentifiers(finalPath), nil
+	if pm.collapseAdjacent {
+		return CollapseAdjacentDynamicIdentifiers(finalPath), nil
+	}
+	return finalPath, nil
 }
 
 // CollapseAdjacentDynamicIdentifiers replaces sequences of truly adjacent dynamic identifiers with a wildcard.
diff --git a/pkg/registry/file/dynamicpathdetector/tests/analyze_opens_test.go b/pkg/registry/file/dynamicpathdetector/tests/analyze_opens_test.go
index b6f174587..fe2ff16ea 100644
--- a/pkg/registry/file/dynamicpathdetector/tests/analyze_opens_test.go
+++ b/pkg/registry/file/dynamicpathdetector/tests/analyze_opens_test.go
@@ -131,13 +131,12 @@ func TestAnalyzeOpensWithAsteriskAndEllipsis(t *testing.T) {
 }
 
 func TestAnalyzeOpensWithMultiCollapse(t *testing.T) {
-	// Use a threshold higher than the /var/run config (3) so /var/run paths do NOT collapse
+	// NewPathAnalyzer uses a uniform threshold (no per-prefix configs).
 	threshold := dynamicpathdetector.DefaultCollapseConfig.Threshold
 	analyzer := dynamicpathdetector.NewPathAnalyzer(threshold)
 
-	// Only 3 paths under /var/run — the per-prefix threshold for /var/run is 3,
-	// but NewPathAnalyzer overrides the default to 'threshold', so /var/run inherits its own config (3).
-	// 3 children <= threshold 3, so these should NOT collapse.
+	// Only 3 paths under /var/run — uniform threshold is 5, so 3 children <= 5.
+	// These should NOT collapse.
 	input := []types.OpenCalls{
 		{Path: "/var/run/txt/file.txt", Flags: []string{"READ"}},
 		{Path: "/var/run/txt1/file.txt", Flags: []string{"READ"}},
@@ -270,7 +269,7 @@ func TestAnalyzeOpensCollapseExactBoundary(t *testing.T) {
 		result, err := dynamicpathdetector.AnalyzeOpens(input, analyzer, mapset.NewSet[string]())
 		assert.NoError(t, err)
 		assert.Equal(t, 1, len(result), "above threshold, paths should collapse to 1")
-		assertPathIsOneOf(t, result[0].Path, "/data/*/info", "/data/\u22ef/info")
+		assert.Equal(t, "/data/\u22ef/info", result[0].Path, "NewPathAnalyzer should only produce \u22ef, never *")
 	})
 }
 
diff --git a/pkg/registry/file/dynamicpathdetector/types.go b/pkg/registry/file/dynamicpathdetector/types.go
index 40f0f4c9a..145d5ca00 100644
--- a/pkg/registry/file/dynamicpathdetector/types.go
+++ b/pkg/registry/file/dynamicpathdetector/types.go
@@ -38,11 +38,11 @@ var DefaultCollapseConfig = CollapseConfig{
 
 // OpenDynamicThreshold is the default collapse threshold used when analyzing
 // file-open paths in ApplicationProfile and ContainerProfile processors.
-const OpenDynamicThreshold = 5
+const OpenDynamicThreshold = 50
 
 // EndpointDynamicThreshold is the default collapse threshold used when
 // analyzing HTTP endpoint paths.
-const EndpointDynamicThreshold = 5
+const EndpointDynamicThreshold = 100
 
 // --- Types ---
 
@@ -54,10 +54,11 @@ type SegmentNode struct {
 }
 
 type PathAnalyzer struct {
-	root       *TrieNode
-	identRoots map[string]*TrieNode
-	configs    []CollapseConfig
-	defaultCfg CollapseConfig
+	root             *TrieNode
+	identRoots       map[string]*TrieNode
+	configs          []CollapseConfig
+	defaultCfg       CollapseConfig
+	collapseAdjacent bool
 }
 
 func NewTrieNode() *TrieNode {

From 841098fce165cbe0b2044634938c689568fc8107 Mon Sep 17 00:00:00 2001
From: tanzee <einentlein@gmail.com>
Date: Sat, 14 Feb 2026 13:14:56 +0100
Subject: [PATCH 59/68] tests must use variables not hardcoded thresholds

---
 .../file/applicationprofile_processor_test.go | 30 ++++++++-----------
 1 file changed, 12 insertions(+), 18 deletions(-)

diff --git a/pkg/registry/file/applicationprofile_processor_test.go b/pkg/registry/file/applicationprofile_processor_test.go
index f097b2c21..5f508d984 100644
--- a/pkg/registry/file/applicationprofile_processor_test.go
+++ b/pkg/registry/file/applicationprofile_processor_test.go
@@ -18,16 +18,10 @@ import (
 	"k8s.io/apimachinery/pkg/runtime"
 )
 
-// configThreshold returns the collapse threshold for the given path prefix
-// from dynamicpathdetector.DefaultCollapseConfigs. Falls back to
-// dynamicpathdetector.DefaultCollapseConfig.Threshold for unconfigured prefixes.
-func configThreshold(prefix string) int {
-	for _, cfg := range dynamicpathdetector.DefaultCollapseConfigs {
-		if cfg.Prefix == prefix {
-			return cfg.Threshold
-		}
-	}
-	return dynamicpathdetector.DefaultCollapseConfig.Threshold
+// openThreshold returns the collapse threshold used by deflateApplicationProfileContainer
+// for file-open paths. NewPathAnalyzer uses a uniform threshold (OpenDynamicThreshold).
+func openThreshold() int {
+	return dynamicpathdetector.OpenDynamicThreshold
 }
 
 var ap = softwarecomposition.ApplicationProfile{
@@ -276,8 +270,8 @@ func generateSOOpens(n int) []softwarecomposition.OpenCalls {
 }
 
 func TestDeflateApplicationProfileContainer_CollapsesManyOpens(t *testing.T) {
-	// Generate enough opens to exceed the threshold for /usr/lib (uses default config)
-	numOpens := configThreshold("/usr/lib") + 1
+	// Generate enough opens to exceed the uniform threshold used by NewPathAnalyzer
+	numOpens := openThreshold() + 1
 	opens := generateSOOpens(numOpens)
 
 	container := softwarecomposition.ApplicationProfileContainer{
@@ -306,7 +300,7 @@ func TestDeflateApplicationProfileContainer_CollapsesManyOpens(t *testing.T) {
 }
 
 func TestDeflateApplicationProfileContainer_CollapsesWithSbomSet(t *testing.T) {
-	numOpens := configThreshold("/usr/lib") + 1
+	numOpens := openThreshold() + 1
 	opens := generateSOOpens(numOpens)
 
 	// Build sbomSet containing ALL the .so paths (realistic scenario)
@@ -330,8 +324,8 @@ func TestDeflateApplicationProfileContainer_CollapsesWithSbomSet(t *testing.T) {
 func TestDeflateApplicationProfileContainer_MixedPathsCollapse(t *testing.T) {
 	var opens []softwarecomposition.OpenCalls
 
-	// /usr/lib uses the default threshold (no specific prefix config)
-	usrLibThreshold := configThreshold("/usr/lib")
+	// /usr/lib uses the uniform threshold from NewPathAnalyzer(OpenDynamicThreshold)
+	usrLibThreshold := openThreshold()
 	for i := 0; i < usrLibThreshold+1; i++ {
 		opens = append(opens, softwarecomposition.OpenCalls{
 			Path:  fmt.Sprintf("/usr/lib/lib%d.so", i),
@@ -339,8 +333,8 @@ func TestDeflateApplicationProfileContainer_MixedPathsCollapse(t *testing.T) {
 		})
 	}
 
-	// /etc has its own threshold in DefaultCollapseConfigs
-	etcThreshold := configThreshold("/etc")
+	// /etc also uses the same uniform threshold
+	etcThreshold := openThreshold()
 	for i := 0; i < etcThreshold+1; i++ {
 		opens = append(opens, softwarecomposition.OpenCalls{
 			Path:  fmt.Sprintf("/etc/conf%d.cfg", i),
@@ -404,7 +398,7 @@ func TestDeflateApplicationProfileContainer_NilSbomNoError(t *testing.T) {
 // TestDeflateApplicationProfileContainer_PreSaveEndToEnd verifies the full
 // PreSave flow with an ApplicationProfile containing many opens that should collapse.
 func TestDeflateApplicationProfileContainer_PreSaveEndToEnd(t *testing.T) {
-	numOpens := configThreshold("/usr/lib") + 1
+	numOpens := openThreshold() + 1
 	opens := generateSOOpens(numOpens)
 
 	profile := &softwarecomposition.ApplicationProfile{

From 10c22975e7b02aa3e64af81c4b139fc360a9c13e Mon Sep 17 00:00:00 2001
From: entlein <einentlein@gmail.com>
Date: Sat, 14 Feb 2026 14:28:51 +0100
Subject: [PATCH 60/68] align the constants

Signed-off-by: entlein <einentlein@gmail.com>
---
 .../file/dynamicpathdetector/types.go         | 20 ++++++-------------
 1 file changed, 6 insertions(+), 14 deletions(-)

diff --git a/pkg/registry/file/dynamicpathdetector/types.go b/pkg/registry/file/dynamicpathdetector/types.go
index 145d5ca00..0d187ad9f 100644
--- a/pkg/registry/file/dynamicpathdetector/types.go
+++ b/pkg/registry/file/dynamicpathdetector/types.go
@@ -21,29 +21,21 @@ type CollapseConfig struct {
 // Paths under these prefixes are collapsed when the number of unique children
 // exceeds the threshold.
 var DefaultCollapseConfigs = []CollapseConfig{
-	{Prefix: "/etc", Threshold: 50},
+	{Prefix: "/etc", Threshold: 100},
+	{Prefix: "/etc/apache2", Threshold: 5}, //this is mostly for our webapp standard test
 	{Prefix: "/opt", Threshold: 5},
 	{Prefix: "/var/run", Threshold: 3},
 	{Prefix: "/app", Threshold: 1},
 }
 
-// DefaultCollapseConfig is the fallback used for paths that don't match any
-// prefix in DefaultCollapseConfigs.
+const OpenDynamicThreshold = 50
+const EndpointDynamicThreshold = 100
+
 var DefaultCollapseConfig = CollapseConfig{
 	Prefix:    "/",
-	Threshold: 5,
+	Threshold: OpenDynamicThreshold,
 }
 
-// --- Default thresholds for processors ---
-
-// OpenDynamicThreshold is the default collapse threshold used when analyzing
-// file-open paths in ApplicationProfile and ContainerProfile processors.
-const OpenDynamicThreshold = 50
-
-// EndpointDynamicThreshold is the default collapse threshold used when
-// analyzing HTTP endpoint paths.
-const EndpointDynamicThreshold = 100
-
 // --- Types ---
 
 type SegmentNode struct {

From 3231e2816a85efaf9d4b1807283f28f6bc414bfd Mon Sep 17 00:00:00 2001
From: tanzee <einentlein@gmail.com>
Date: Sun, 15 Feb 2026 18:56:06 +0100
Subject: [PATCH 61/68] more testing and migrating over to collaps config for
 all function calls

---
 .../file/applicationprofile_processor.go      |   4 +-
 .../file/applicationprofile_processor_test.go |  10 +-
 .../file/containerprofile_processor.go        |   4 +-
 .../file/dynamicpathdetector/analyzer.go      |   8 +-
 .../tests/analyze_endpoints_test.go           |  14 +-
 .../tests/analyze_opens_test.go               | 222 ++++++++++++++++--
 .../tests/benchmark_test.go                   |   6 +-
 .../tests/coverage_test.go                    |  26 +-
 8 files changed, 234 insertions(+), 60 deletions(-)

diff --git a/pkg/registry/file/applicationprofile_processor.go b/pkg/registry/file/applicationprofile_processor.go
index 3c75df152..920db6262 100644
--- a/pkg/registry/file/applicationprofile_processor.go
+++ b/pkg/registry/file/applicationprofile_processor.go
@@ -107,12 +107,12 @@ func (a *ApplicationProfileProcessor) SetStorage(containerProfileStorage Contain
 }
 
 func deflateApplicationProfileContainer(container softwarecomposition.ApplicationProfileContainer, sbomSet mapset.Set[string]) softwarecomposition.ApplicationProfileContainer {
-	opens, err := dynamicpathdetector.AnalyzeOpens(container.Opens, dynamicpathdetector.NewPathAnalyzer(dynamicpathdetector.OpenDynamicThreshold), sbomSet)
+	opens, err := dynamicpathdetector.AnalyzeOpens(container.Opens, dynamicpathdetector.NewPathAnalyzerWithConfigs(dynamicpathdetector.OpenDynamicThreshold, dynamicpathdetector.DefaultCollapseConfigs), sbomSet)
 	if err != nil {
 		logger.L().Debug("falling back to DeflateStringer for opens", loggerhelpers.Error(err))
 		opens = DeflateStringer(container.Opens)
 	}
-	endpoints := dynamicpathdetector.AnalyzeEndpoints(&container.Endpoints, dynamicpathdetector.NewPathAnalyzer(dynamicpathdetector.EndpointDynamicThreshold))
+	endpoints := dynamicpathdetector.AnalyzeEndpoints(&container.Endpoints, dynamicpathdetector.NewPathAnalyzerWithConfigs(dynamicpathdetector.EndpointDynamicThreshold, nil))
 	identifiedCallStacks := callstack.UnifyIdentifiedCallStacks(container.IdentifiedCallStacks)
 
 	return softwarecomposition.ApplicationProfileContainer{
diff --git a/pkg/registry/file/applicationprofile_processor_test.go b/pkg/registry/file/applicationprofile_processor_test.go
index 5f508d984..55e9688d3 100644
--- a/pkg/registry/file/applicationprofile_processor_test.go
+++ b/pkg/registry/file/applicationprofile_processor_test.go
@@ -19,7 +19,7 @@ import (
 )
 
 // openThreshold returns the collapse threshold used by deflateApplicationProfileContainer
-// for file-open paths. NewPathAnalyzer uses a uniform threshold (OpenDynamicThreshold).
+// for file-open paths. NewPathAnalyzerWithConfigs uses OpenDynamicThreshold as the default.
 func openThreshold() int {
 	return dynamicpathdetector.OpenDynamicThreshold
 }
@@ -270,7 +270,7 @@ func generateSOOpens(n int) []softwarecomposition.OpenCalls {
 }
 
 func TestDeflateApplicationProfileContainer_CollapsesManyOpens(t *testing.T) {
-	// Generate enough opens to exceed the uniform threshold used by NewPathAnalyzer
+	// Generate enough opens to exceed the default threshold used by NewPathAnalyzerWithConfigs
 	numOpens := openThreshold() + 1
 	opens := generateSOOpens(numOpens)
 
@@ -324,7 +324,7 @@ func TestDeflateApplicationProfileContainer_CollapsesWithSbomSet(t *testing.T) {
 func TestDeflateApplicationProfileContainer_MixedPathsCollapse(t *testing.T) {
 	var opens []softwarecomposition.OpenCalls
 
-	// /usr/lib uses the uniform threshold from NewPathAnalyzer(OpenDynamicThreshold)
+	// /usr/lib uses the default threshold from NewPathAnalyzerWithConfigs(OpenDynamicThreshold, ...)
 	usrLibThreshold := openThreshold()
 	for i := 0; i < usrLibThreshold+1; i++ {
 		opens = append(opens, softwarecomposition.OpenCalls{
@@ -333,8 +333,8 @@ func TestDeflateApplicationProfileContainer_MixedPathsCollapse(t *testing.T) {
 		})
 	}
 
-	// /etc also uses the same uniform threshold
-	etcThreshold := openThreshold()
+	// /etc uses the /etc config threshold from DefaultCollapseConfigs (100)
+	etcThreshold := 100
 	for i := 0; i < etcThreshold+1; i++ {
 		opens = append(opens, softwarecomposition.OpenCalls{
 			Path:  fmt.Sprintf("/etc/conf%d.cfg", i),
diff --git a/pkg/registry/file/containerprofile_processor.go b/pkg/registry/file/containerprofile_processor.go
index 904fc89d9..ee134a702 100644
--- a/pkg/registry/file/containerprofile_processor.go
+++ b/pkg/registry/file/containerprofile_processor.go
@@ -701,12 +701,12 @@ func (a *ContainerProfileProcessor) getAggregatedData(ctx context.Context, key s
 }
 
 func DeflateContainerProfileSpec(container softwarecomposition.ContainerProfileSpec, sbomSet mapset.Set[string]) softwarecomposition.ContainerProfileSpec {
-	opens, err := dynamicpathdetector.AnalyzeOpens(container.Opens, dynamicpathdetector.NewPathAnalyzer(dynamicpathdetector.OpenDynamicThreshold), sbomSet)
+	opens, err := dynamicpathdetector.AnalyzeOpens(container.Opens, dynamicpathdetector.NewPathAnalyzerWithConfigs(dynamicpathdetector.OpenDynamicThreshold, dynamicpathdetector.DefaultCollapseConfigs), sbomSet)
 	if err != nil {
 		logger.L().Debug("ContainerProfileProcessor.deflateContainerProfileSpec - falling back to DeflateStringer for opens", loggerhelpers.Error(err))
 		opens = DeflateStringer(container.Opens)
 	}
-	endpoints := dynamicpathdetector.AnalyzeEndpoints(&container.Endpoints, dynamicpathdetector.NewPathAnalyzer(dynamicpathdetector.EndpointDynamicThreshold))
+	endpoints := dynamicpathdetector.AnalyzeEndpoints(&container.Endpoints, dynamicpathdetector.NewPathAnalyzerWithConfigs(dynamicpathdetector.EndpointDynamicThreshold, nil))
 	identifiedCallStacks := callstack.UnifyIdentifiedCallStacks(container.IdentifiedCallStacks)
 
 	return softwarecomposition.ContainerProfileSpec{
diff --git a/pkg/registry/file/dynamicpathdetector/analyzer.go b/pkg/registry/file/dynamicpathdetector/analyzer.go
index 7a18c01ea..be95e5bbb 100644
--- a/pkg/registry/file/dynamicpathdetector/analyzer.go
+++ b/pkg/registry/file/dynamicpathdetector/analyzer.go
@@ -4,12 +4,8 @@ import (
 	"strings"
 )
 
-func NewPathAnalyzer(threshold int) *PathAnalyzer {
-	return newAnalyzer(CollapseConfig{Prefix: "/", Threshold: threshold}, nil, false)
-}
-
-func NewPathAnalyzerWithConfigs(configs []CollapseConfig) *PathAnalyzer {
-	return newAnalyzer(DefaultCollapseConfig, configs, true)
+func NewPathAnalyzerWithConfigs(defaultThreshold int, configs []CollapseConfig) *PathAnalyzer {
+	return newAnalyzer(CollapseConfig{Prefix: "/", Threshold: defaultThreshold}, configs, true)
 }
 
 func newAnalyzer(defaultCfg CollapseConfig, configs []CollapseConfig, collapseAdjacent bool) *PathAnalyzer {
diff --git a/pkg/registry/file/dynamicpathdetector/tests/analyze_endpoints_test.go b/pkg/registry/file/dynamicpathdetector/tests/analyze_endpoints_test.go
index 817c5f52c..93172a1aa 100644
--- a/pkg/registry/file/dynamicpathdetector/tests/analyze_endpoints_test.go
+++ b/pkg/registry/file/dynamicpathdetector/tests/analyze_endpoints_test.go
@@ -12,7 +12,7 @@ import (
 )
 
 func TestAnalyzeEndpoints(t *testing.T) {
-	analyzer := dynamicpathdetector.NewPathAnalyzer(dynamicpathdetector.EndpointDynamicThreshold)
+	analyzer := dynamicpathdetector.NewPathAnalyzerWithConfigs(dynamicpathdetector.EndpointDynamicThreshold, nil)
 
 	tests := []struct {
 		name     string
@@ -169,7 +169,7 @@ func TestAnalyzeEndpoints(t *testing.T) {
 
 func TestAnalyzeEndpointsWithThreshold(t *testing.T) {
 	threshold := dynamicpathdetector.EndpointDynamicThreshold
-	analyzer := dynamicpathdetector.NewPathAnalyzer(threshold)
+	analyzer := dynamicpathdetector.NewPathAnalyzerWithConfigs(threshold, nil)
 
 	var input []types.HTTPEndpoint
 	for i := 0; i < threshold+1; i++ {
@@ -192,7 +192,7 @@ func TestAnalyzeEndpointsWithThreshold(t *testing.T) {
 
 func TestAnalyzeEndpointsWithExactThreshold(t *testing.T) {
 	threshold := dynamicpathdetector.EndpointDynamicThreshold
-	analyzer := dynamicpathdetector.NewPathAnalyzer(threshold)
+	analyzer := dynamicpathdetector.NewPathAnalyzerWithConfigs(threshold, nil)
 
 	var input []types.HTTPEndpoint
 	for i := 0; i < threshold; i++ {
@@ -225,7 +225,7 @@ func TestAnalyzeEndpointsWithExactThreshold(t *testing.T) {
 }
 
 func TestAnalyzeEndpointsWithInvalidURL(t *testing.T) {
-	analyzer := dynamicpathdetector.NewPathAnalyzer(dynamicpathdetector.EndpointDynamicThreshold)
+	analyzer := dynamicpathdetector.NewPathAnalyzerWithConfigs(dynamicpathdetector.EndpointDynamicThreshold, nil)
 
 	input := []types.HTTPEndpoint{
 		{
@@ -239,7 +239,7 @@ func TestAnalyzeEndpointsWithInvalidURL(t *testing.T) {
 }
 
 func TestAnalyzeEndpointsWildcardPortAbsorbsSpecificPort(t *testing.T) {
-	analyzer := dynamicpathdetector.NewPathAnalyzer(dynamicpathdetector.EndpointDynamicThreshold)
+	analyzer := dynamicpathdetector.NewPathAnalyzerWithConfigs(dynamicpathdetector.EndpointDynamicThreshold, nil)
 
 	input := []types.HTTPEndpoint{
 		{
@@ -263,7 +263,7 @@ func TestAnalyzeEndpointsWildcardPortAbsorbsSpecificPort(t *testing.T) {
 }
 
 func TestAnalyzeEndpointsWildcardPortAfterSpecificPorts(t *testing.T) {
-	analyzer := dynamicpathdetector.NewPathAnalyzer(dynamicpathdetector.EndpointDynamicThreshold)
+	analyzer := dynamicpathdetector.NewPathAnalyzerWithConfigs(dynamicpathdetector.EndpointDynamicThreshold, nil)
 
 	input := []types.HTTPEndpoint{
 		{
@@ -287,7 +287,7 @@ func TestAnalyzeEndpointsWildcardPortAfterSpecificPorts(t *testing.T) {
 }
 
 func TestAnalyzeEndpointsMultiplePortsMergeIntoWildcard(t *testing.T) {
-	analyzer := dynamicpathdetector.NewPathAnalyzer(dynamicpathdetector.EndpointDynamicThreshold)
+	analyzer := dynamicpathdetector.NewPathAnalyzerWithConfigs(dynamicpathdetector.EndpointDynamicThreshold, nil)
 
 	input := []types.HTTPEndpoint{
 		{
diff --git a/pkg/registry/file/dynamicpathdetector/tests/analyze_opens_test.go b/pkg/registry/file/dynamicpathdetector/tests/analyze_opens_test.go
index fe2ff16ea..3de88ce4a 100644
--- a/pkg/registry/file/dynamicpathdetector/tests/analyze_opens_test.go
+++ b/pkg/registry/file/dynamicpathdetector/tests/analyze_opens_test.go
@@ -14,7 +14,7 @@ import (
 
 func TestAnalyzeOpensWithThreshold(t *testing.T) {
 	threshold := dynamicpathdetector.OpenDynamicThreshold
-	analyzer := dynamicpathdetector.NewPathAnalyzer(threshold)
+	analyzer := dynamicpathdetector.NewPathAnalyzerWithConfigs(threshold, nil)
 
 	var input []types.OpenCalls
 	for i := 0; i < threshold+1; i++ {
@@ -90,7 +90,7 @@ func TestAnalyzeOpensWithFlagMergingAndThreshold(t *testing.T) {
 
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
-			analyzer := dynamicpathdetector.NewPathAnalyzer(threshold)
+			analyzer := dynamicpathdetector.NewPathAnalyzerWithConfigs(threshold, nil)
 			result, err := dynamicpathdetector.AnalyzeOpens(tt.input, analyzer, mapset.NewSet[string]())
 			assert.NoError(t, err)
 
@@ -106,7 +106,7 @@ func TestAnalyzeOpensWithFlagMergingAndThreshold(t *testing.T) {
 
 func TestAnalyzeOpensWithAsteriskAndEllipsis(t *testing.T) {
 	threshold := configThreshold("/var/run")
-	analyzer := dynamicpathdetector.NewPathAnalyzer(threshold)
+	analyzer := dynamicpathdetector.NewPathAnalyzerWithConfigs(threshold, nil)
 
 	// Generate threshold paths + one ⋯ path to trigger collapse
 	var input []types.OpenCalls
@@ -131,9 +131,9 @@ func TestAnalyzeOpensWithAsteriskAndEllipsis(t *testing.T) {
 }
 
 func TestAnalyzeOpensWithMultiCollapse(t *testing.T) {
-	// NewPathAnalyzer uses a uniform threshold (no per-prefix configs).
+	// NewPathAnalyzerWithConfigs with nil configs uses a uniform threshold (no per-prefix configs).
 	threshold := dynamicpathdetector.DefaultCollapseConfig.Threshold
-	analyzer := dynamicpathdetector.NewPathAnalyzer(threshold)
+	analyzer := dynamicpathdetector.NewPathAnalyzerWithConfigs(threshold, nil)
 
 	// Only 3 paths under /var/run — uniform threshold is 5, so 3 children <= 5.
 	// These should NOT collapse.
@@ -162,7 +162,7 @@ func TestAnalyzeOpensWithDynamicConfigs(t *testing.T) {
 	appThreshold := configThreshold("/app")
 	tmpThreshold := 10 // custom for this test
 
-	analyzer := dynamicpathdetector.NewPathAnalyzerWithConfigs([]dynamicpathdetector.CollapseConfig{
+	analyzer := dynamicpathdetector.NewPathAnalyzerWithConfigs(dynamicpathdetector.OpenDynamicThreshold, []dynamicpathdetector.CollapseConfig{
 		{Prefix: "/etc", Threshold: etcThreshold},
 		{Prefix: "/opt", Threshold: optThreshold},
 		{Prefix: "/var/run", Threshold: varRunThreshold},
@@ -240,7 +240,7 @@ func TestAnalyzeOpensCollapseExactBoundary(t *testing.T) {
 	threshold := dynamicpathdetector.DefaultCollapseConfig.Threshold
 
 	t.Run("at threshold - no collapse", func(t *testing.T) {
-		analyzer := dynamicpathdetector.NewPathAnalyzer(threshold)
+		analyzer := dynamicpathdetector.NewPathAnalyzerWithConfigs(threshold, nil)
 		var input []types.OpenCalls
 		for i := 0; i < threshold; i++ {
 			input = append(input, types.OpenCalls{
@@ -258,7 +258,7 @@ func TestAnalyzeOpensCollapseExactBoundary(t *testing.T) {
 	})
 
 	t.Run("above threshold - collapse", func(t *testing.T) {
-		analyzer := dynamicpathdetector.NewPathAnalyzer(threshold)
+		analyzer := dynamicpathdetector.NewPathAnalyzerWithConfigs(threshold, nil)
 		var input []types.OpenCalls
 		for i := 0; i < threshold+1; i++ {
 			input = append(input, types.OpenCalls{
@@ -269,7 +269,7 @@ func TestAnalyzeOpensCollapseExactBoundary(t *testing.T) {
 		result, err := dynamicpathdetector.AnalyzeOpens(input, analyzer, mapset.NewSet[string]())
 		assert.NoError(t, err)
 		assert.Equal(t, 1, len(result), "above threshold, paths should collapse to 1")
-		assert.Equal(t, "/data/\u22ef/info", result[0].Path, "NewPathAnalyzer should only produce \u22ef, never *")
+		assert.Equal(t, "/data/\u22ef/info", result[0].Path, "single \u22ef should not collapse to *")
 	})
 }
 
@@ -277,7 +277,7 @@ func TestAnalyzeOpensCollapseExactBoundary(t *testing.T) {
 // many times does NOT trigger a collapse - only unique segment names count.
 func TestAnalyzeOpensDuplicatePathsNoCollapse(t *testing.T) {
 	threshold := configThreshold("/var/run")
-	analyzer := dynamicpathdetector.NewPathAnalyzer(threshold)
+	analyzer := dynamicpathdetector.NewPathAnalyzerWithConfigs(threshold, nil)
 	var input []types.OpenCalls
 	// Repeat the same path many times — should NOT trigger collapse
 	for i := 0; i < threshold*10; i++ {
@@ -296,7 +296,7 @@ func TestAnalyzeOpensDuplicatePathsNoCollapse(t *testing.T) {
 // under the same prefix have different depths.
 func TestAnalyzeOpensVaryingDepthsUnderPrefix(t *testing.T) {
 	threshold := configThreshold("/var/run")
-	analyzer := dynamicpathdetector.NewPathAnalyzer(threshold)
+	analyzer := dynamicpathdetector.NewPathAnalyzerWithConfigs(threshold, nil)
 
 	// Generate threshold+1 unique children under /data to trigger collapse
 	var input []types.OpenCalls
@@ -319,7 +319,7 @@ func TestAnalyzeOpensVaryingDepthsUnderPrefix(t *testing.T) {
 // the threshold was already crossed gets absorbed by the collapsed node.
 func TestAnalyzeOpensNewPathAfterCollapse(t *testing.T) {
 	threshold := configThreshold("/var/run")
-	analyzer := dynamicpathdetector.NewPathAnalyzer(threshold)
+	analyzer := dynamicpathdetector.NewPathAnalyzerWithConfigs(threshold, nil)
 
 	// First batch: trigger collapse with threshold+1 children
 	var batch1 []types.OpenCalls
@@ -345,7 +345,7 @@ func TestAnalyzeOpensNewPathAfterCollapse(t *testing.T) {
 // TestAnalyzeOpensDefaultThresholdForUnconfiguredPrefix verifies that paths under
 // a prefix without a specific config use the default threshold.
 func TestAnalyzeOpensDefaultThresholdForUnconfiguredPrefix(t *testing.T) {
-	analyzer := dynamicpathdetector.NewPathAnalyzerWithConfigs([]dynamicpathdetector.CollapseConfig{
+	analyzer := dynamicpathdetector.NewPathAnalyzerWithConfigs(dynamicpathdetector.OpenDynamicThreshold, []dynamicpathdetector.CollapseConfig{
 		{Prefix: "/configured", Threshold: 2},
 	})
 
@@ -361,7 +361,7 @@ func TestAnalyzeOpensDefaultThresholdForUnconfiguredPrefix(t *testing.T) {
 
 	// /unconfigured uses default threshold: 3 children should NOT collapse
 	defaultThreshold := dynamicpathdetector.DefaultCollapseConfig.Threshold
-	analyzer2 := dynamicpathdetector.NewPathAnalyzerWithConfigs([]dynamicpathdetector.CollapseConfig{
+	analyzer2 := dynamicpathdetector.NewPathAnalyzerWithConfigs(dynamicpathdetector.OpenDynamicThreshold, []dynamicpathdetector.CollapseConfig{
 		{Prefix: "/configured", Threshold: 2},
 	})
 	unconfiguredInput := []types.OpenCalls{
@@ -379,7 +379,7 @@ func TestAnalyzeOpensDefaultThresholdForUnconfiguredPrefix(t *testing.T) {
 // a wildcard (*) on the very first additional child.
 func TestAnalyzeOpensThreshold1ImmediateWildcard(t *testing.T) {
 	appThreshold := configThreshold("/app") // threshold 1
-	analyzer := dynamicpathdetector.NewPathAnalyzerWithConfigs([]dynamicpathdetector.CollapseConfig{
+	analyzer := dynamicpathdetector.NewPathAnalyzerWithConfigs(dynamicpathdetector.OpenDynamicThreshold, []dynamicpathdetector.CollapseConfig{
 		{Prefix: "/instant", Threshold: appThreshold},
 	})
 
@@ -394,7 +394,7 @@ func TestAnalyzeOpensThreshold1ImmediateWildcard(t *testing.T) {
 	})
 
 	t.Run("two paths - collapsed", func(t *testing.T) {
-		analyzer2 := dynamicpathdetector.NewPathAnalyzerWithConfigs([]dynamicpathdetector.CollapseConfig{
+		analyzer2 := dynamicpathdetector.NewPathAnalyzerWithConfigs(dynamicpathdetector.OpenDynamicThreshold, []dynamicpathdetector.CollapseConfig{
 			{Prefix: "/instant", Threshold: appThreshold},
 		})
 		input := []types.OpenCalls{
@@ -413,7 +413,7 @@ func TestAnalyzeOpensThreshold1ImmediateWildcard(t *testing.T) {
 // one prefix does not affect paths under a sibling prefix.
 func TestAnalyzeOpensCollapseDoesNotAffectSiblingPrefixes(t *testing.T) {
 	threshold := configThreshold("/var/run")
-	analyzer := dynamicpathdetector.NewPathAnalyzer(threshold)
+	analyzer := dynamicpathdetector.NewPathAnalyzerWithConfigs(threshold, nil)
 
 	// /alpha: threshold+1 children → should collapse
 	var input []types.OpenCalls
@@ -442,7 +442,7 @@ func TestAnalyzeOpensCollapseDoesNotAffectSiblingPrefixes(t *testing.T) {
 // that collapse into the same dynamic node are properly merged and deduplicated.
 func TestAnalyzeOpensFlagMergingAfterCollapse(t *testing.T) {
 	threshold := configThreshold("/var/run")
-	analyzer := dynamicpathdetector.NewPathAnalyzer(threshold)
+	analyzer := dynamicpathdetector.NewPathAnalyzerWithConfigs(threshold, nil)
 
 	// Generate threshold+1 children to trigger collapse, with varied flags
 	var input []types.OpenCalls
@@ -464,7 +464,7 @@ func TestAnalyzeOpensFlagMergingAfterCollapse(t *testing.T) {
 // grandchild segments independently exceed their thresholds.
 func TestAnalyzeOpensMultipleLevelsOfCollapse(t *testing.T) {
 	threshold := configThreshold("/var/run")
-	analyzer := dynamicpathdetector.NewPathAnalyzer(threshold)
+	analyzer := dynamicpathdetector.NewPathAnalyzerWithConfigs(threshold, nil)
 
 	var input []types.OpenCalls
 	// threshold+1 unique children under /multi, each with threshold+1 unique grandchildren
@@ -490,7 +490,7 @@ func TestAnalyzeOpensMultipleLevelsOfCollapse(t *testing.T) {
 func TestAnalyzeOpensExistingDynamicSegmentInInput(t *testing.T) {
 	// Use a high threshold so that the two paths alone don't trigger collapse —
 	// instead, the existing ⋯ segment absorbs the specific path.
-	analyzer := dynamicpathdetector.NewPathAnalyzer(dynamicpathdetector.OpenDynamicThreshold)
+	analyzer := dynamicpathdetector.NewPathAnalyzerWithConfigs(dynamicpathdetector.OpenDynamicThreshold, nil)
 	input := []types.OpenCalls{
 		{Path: "/data/\u22ef/config", Flags: []string{"READ"}},
 		{Path: "/data/specific/config", Flags: []string{"WRITE"}},
@@ -506,7 +506,7 @@ func TestAnalyzeOpensExistingDynamicSegmentInInput(t *testing.T) {
 // does not return an error.
 func TestAnalyzeOpens_NilSbomSetNoError(t *testing.T) {
 	threshold := configThreshold("/var/run")
-	analyzer := dynamicpathdetector.NewPathAnalyzer(threshold)
+	analyzer := dynamicpathdetector.NewPathAnalyzerWithConfigs(threshold, nil)
 	input := []types.OpenCalls{
 		{Path: "/usr/lib/libfoo.so", Flags: []string{"READ"}},
 		{Path: "/usr/lib/libbar.so", Flags: []string{"READ"}},
@@ -520,7 +520,7 @@ func TestAnalyzeOpens_NilSbomSetNoError(t *testing.T) {
 // correctly even when sbomSet is nil.
 func TestAnalyzeOpens_NilSbomSetWithCollapse(t *testing.T) {
 	threshold := configThreshold("/var/run")
-	analyzer := dynamicpathdetector.NewPathAnalyzer(threshold)
+	analyzer := dynamicpathdetector.NewPathAnalyzerWithConfigs(threshold, nil)
 
 	var input []types.OpenCalls
 	for i := 0; i < threshold+1; i++ {
@@ -627,3 +627,181 @@ func pathsFromResult(result []types.OpenCalls) []string {
 	}
 	return paths
 }
+
+// TestAnalyzeOpensOverlappingPrefixConfigs verifies that overlapping prefix configs
+// (e.g., /etc at 100 and /etc/apache2 at 5) work correctly: the most specific prefix wins.
+func TestAnalyzeOpensOverlappingPrefixConfigs(t *testing.T) {
+	t.Run("/etc/apache2 uses threshold 5, not /etc's threshold 100", func(t *testing.T) {
+		analyzer := dynamicpathdetector.NewPathAnalyzerWithConfigs(dynamicpathdetector.OpenDynamicThreshold, dynamicpathdetector.DefaultCollapseConfigs)
+		// 6 paths under /etc/apache2/mods-enabled/ — should collapse (6 > 5)
+		var input []types.OpenCalls
+		for i := 0; i < 6; i++ {
+			input = append(input, types.OpenCalls{
+				Path:  fmt.Sprintf("/etc/apache2/mods-enabled/mod%d.conf", i),
+				Flags: []string{"READ"},
+			})
+		}
+		result, err := dynamicpathdetector.AnalyzeOpens(input, analyzer, mapset.NewSet[string]())
+		assert.NoError(t, err)
+		assert.Equal(t, 1, len(result), "6 paths > threshold 5 should collapse to 1, got: %v", pathsFromResult(result))
+		assert.True(t,
+			strings.Contains(result[0].Path, "\u22ef") || strings.Contains(result[0].Path, "*"),
+			"collapsed path should contain dynamic segment, got %q", result[0].Path)
+	})
+
+	t.Run("/etc uses threshold 100, unaffected by /etc/apache2", func(t *testing.T) {
+		analyzer := dynamicpathdetector.NewPathAnalyzerWithConfigs(dynamicpathdetector.OpenDynamicThreshold, dynamicpathdetector.DefaultCollapseConfigs)
+		// 8 paths directly under /etc/ — should NOT collapse (8 < 100)
+		input := []types.OpenCalls{
+			{Path: "/etc/config1", Flags: []string{"READ"}},
+			{Path: "/etc/config2", Flags: []string{"READ"}},
+			{Path: "/etc/config3", Flags: []string{"READ"}},
+			{Path: "/etc/config4", Flags: []string{"READ"}},
+			{Path: "/etc/config5", Flags: []string{"READ"}},
+			{Path: "/etc/config6", Flags: []string{"READ"}},
+			{Path: "/etc/config7", Flags: []string{"READ"}},
+			{Path: "/etc/config8", Flags: []string{"READ"}},
+		}
+		result, err := dynamicpathdetector.AnalyzeOpens(input, analyzer, mapset.NewSet[string]())
+		assert.NoError(t, err)
+		assert.Equal(t, 8, len(result), "/etc paths should NOT collapse (8 < 100), got: %v", pathsFromResult(result))
+	})
+
+	t.Run("unconfigured prefix /var/log uses default threshold", func(t *testing.T) {
+		defaultThreshold := dynamicpathdetector.DefaultCollapseConfig.Threshold
+		// At threshold — should NOT collapse
+		analyzer := dynamicpathdetector.NewPathAnalyzerWithConfigs(dynamicpathdetector.OpenDynamicThreshold, dynamicpathdetector.DefaultCollapseConfigs)
+		var input []types.OpenCalls
+		for i := 0; i < defaultThreshold; i++ {
+			input = append(input, types.OpenCalls{
+				Path:  fmt.Sprintf("/var/log/app%d.log", i),
+				Flags: []string{"READ"},
+			})
+		}
+		result, err := dynamicpathdetector.AnalyzeOpens(input, analyzer, mapset.NewSet[string]())
+		assert.NoError(t, err)
+		assert.Equal(t, defaultThreshold, len(result),
+			"/var/log at exactly default threshold %d should NOT collapse", defaultThreshold)
+
+		// One more — should collapse
+		analyzer2 := dynamicpathdetector.NewPathAnalyzerWithConfigs(dynamicpathdetector.OpenDynamicThreshold, dynamicpathdetector.DefaultCollapseConfigs)
+		input = append(input, types.OpenCalls{
+			Path:  fmt.Sprintf("/var/log/app%d.log", defaultThreshold),
+			Flags: []string{"READ"},
+		})
+		result2, err := dynamicpathdetector.AnalyzeOpens(input, analyzer2, mapset.NewSet[string]())
+		assert.NoError(t, err)
+		assert.Equal(t, 1, len(result2),
+			"/var/log exceeding default threshold %d should collapse", defaultThreshold)
+	})
+
+	t.Run("/var/run uses its own threshold 3, not default", func(t *testing.T) {
+		analyzer := dynamicpathdetector.NewPathAnalyzerWithConfigs(dynamicpathdetector.OpenDynamicThreshold, dynamicpathdetector.DefaultCollapseConfigs)
+		// 4 paths under /var/run/ — should collapse (4 > 3)
+		input := []types.OpenCalls{
+			{Path: "/var/run/pid1.pid", Flags: []string{"READ"}},
+			{Path: "/var/run/pid2.pid", Flags: []string{"READ"}},
+			{Path: "/var/run/pid3.pid", Flags: []string{"READ"}},
+			{Path: "/var/run/pid4.pid", Flags: []string{"READ"}},
+		}
+		result, err := dynamicpathdetector.AnalyzeOpens(input, analyzer, mapset.NewSet[string]())
+		assert.NoError(t, err)
+		assert.Equal(t, 1, len(result), "4 paths > threshold 3 should collapse, got: %v", pathsFromResult(result))
+	})
+
+	t.Run("/app uses threshold 1 (immediate wildcard)", func(t *testing.T) {
+		analyzer := dynamicpathdetector.NewPathAnalyzerWithConfigs(dynamicpathdetector.OpenDynamicThreshold, dynamicpathdetector.DefaultCollapseConfigs)
+		input := []types.OpenCalls{
+			{Path: "/app/service1/config", Flags: []string{"READ"}},
+		}
+		result, err := dynamicpathdetector.AnalyzeOpens(input, analyzer, mapset.NewSet[string]())
+		assert.NoError(t, err)
+		assert.Equal(t, 1, len(result))
+		assert.Equal(t, "/app/*", result[0].Path, "threshold 1 should produce wildcard immediately")
+	})
+
+	t.Run("mixed overlapping: /etc and /etc/apache2 coexist correctly", func(t *testing.T) {
+		analyzer := dynamicpathdetector.NewPathAnalyzerWithConfigs(dynamicpathdetector.OpenDynamicThreshold, dynamicpathdetector.DefaultCollapseConfigs)
+		var input []types.OpenCalls
+
+		// 6 paths under /etc/apache2/conf.d/ (should collapse at threshold 5)
+		for i := 0; i < 6; i++ {
+			input = append(input, types.OpenCalls{
+				Path:  fmt.Sprintf("/etc/apache2/conf.d/site%d.conf", i),
+				Flags: []string{"READ"},
+			})
+		}
+
+		// 8 paths directly under /etc/ (should NOT collapse at threshold 100)
+		for i := 0; i < 8; i++ {
+			input = append(input, types.OpenCalls{
+				Path:  fmt.Sprintf("/etc/setting%d.conf", i),
+				Flags: []string{"READ"},
+			})
+		}
+
+		result, err := dynamicpathdetector.AnalyzeOpens(input, analyzer, mapset.NewSet[string]())
+		assert.NoError(t, err)
+
+		// /etc/apache2 paths should have collapsed
+		apache2Paths := filterByPrefix(result, "/etc/apache2/")
+		assert.Equal(t, 1, len(apache2Paths),
+			"/etc/apache2 paths (6 > threshold 5) should collapse to 1, got: %v", pathsFromResult(apache2Paths))
+		assert.True(t,
+			strings.Contains(apache2Paths[0].Path, "\u22ef") || strings.Contains(apache2Paths[0].Path, "*"),
+			"collapsed apache2 path should contain dynamic segment, got %q", apache2Paths[0].Path)
+
+		// /etc direct paths should remain individual
+		etcDirectPaths := []types.OpenCalls{}
+		for _, r := range result {
+			if strings.HasPrefix(r.Path, "/etc/") && !strings.HasPrefix(r.Path, "/etc/apache2/") {
+				etcDirectPaths = append(etcDirectPaths, r)
+			}
+		}
+		assert.Equal(t, 8, len(etcDirectPaths),
+			"/etc direct paths (8 < threshold 100) should remain individual, got: %v", pathsFromResult(etcDirectPaths))
+	})
+}
+
+// TestFindConfigForPath verifies the config lookup returns the most specific matching prefix.
+func TestFindConfigForPath(t *testing.T) {
+	analyzer := dynamicpathdetector.NewPathAnalyzerWithConfigs(dynamicpathdetector.OpenDynamicThreshold, dynamicpathdetector.DefaultCollapseConfigs)
+
+	tests := []struct {
+		path              string
+		expectedPrefix    string
+		expectedThreshold int
+	}{
+		{
+			path:              "/etc/apache2/mods-enabled/file",
+			expectedPrefix:    "/etc/apache2",
+			expectedThreshold: 5,
+		},
+		{
+			path:              "/etc/hosts",
+			expectedPrefix:    "/etc",
+			expectedThreshold: 100,
+		},
+		{
+			path:              "/var/run/pid1.pid",
+			expectedPrefix:    "/var/run",
+			expectedThreshold: 3,
+		},
+		{
+			path:              "/var/log/app.log",
+			expectedPrefix:    "/",
+			expectedThreshold: dynamicpathdetector.DefaultCollapseConfig.Threshold,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.path, func(t *testing.T) {
+			config := analyzer.FindConfigForPath(tt.path)
+			assert.NotNil(t, config, "config should not be nil for path %q", tt.path)
+			assert.Equal(t, tt.expectedPrefix, config.Prefix,
+				"path %q should match prefix %q", tt.path, tt.expectedPrefix)
+			assert.Equal(t, tt.expectedThreshold, config.Threshold,
+				"path %q should have threshold %d", tt.path, tt.expectedThreshold)
+		})
+	}
+}
diff --git a/pkg/registry/file/dynamicpathdetector/tests/benchmark_test.go b/pkg/registry/file/dynamicpathdetector/tests/benchmark_test.go
index bc06b6458..09dbdf56a 100644
--- a/pkg/registry/file/dynamicpathdetector/tests/benchmark_test.go
+++ b/pkg/registry/file/dynamicpathdetector/tests/benchmark_test.go
@@ -13,7 +13,7 @@ import (
 )
 
 func BenchmarkAnalyzePath(b *testing.B) {
-	analyzer := dynamicpathdetector.NewPathAnalyzer(dynamicpathdetector.OpenDynamicThreshold)
+	analyzer := dynamicpathdetector.NewPathAnalyzerWithConfigs(dynamicpathdetector.OpenDynamicThreshold, nil)
 	paths := generateMixedPaths(10000, 0) // 0 means use default mixed lengths
 
 	identifier := "test"
@@ -33,7 +33,7 @@ func BenchmarkAnalyzePathWithDifferentLengths(b *testing.B) {
 
 	for _, length := range pathLengths {
 		b.Run(fmt.Sprintf("PathLength-%d", length), func(b *testing.B) {
-			analyzer := dynamicpathdetector.NewPathAnalyzer(dynamicpathdetector.OpenDynamicThreshold)
+			analyzer := dynamicpathdetector.NewPathAnalyzerWithConfigs(dynamicpathdetector.OpenDynamicThreshold, nil)
 			paths := generateMixedPaths(10000, length)
 			identifier := "test"
 
@@ -52,7 +52,7 @@ func BenchmarkAnalyzePathWithDifferentLengths(b *testing.B) {
 
 func BenchmarkAnalyzeOpensVsDeflateStringer(b *testing.B) {
 	paths := pathsToOpens(generateMixedPaths(10000, 0))
-	analyzer := dynamicpathdetector.NewPathAnalyzer(dynamicpathdetector.OpenDynamicThreshold)
+	analyzer := dynamicpathdetector.NewPathAnalyzerWithConfigs(dynamicpathdetector.OpenDynamicThreshold, nil)
 
 	b.Run("AnalyzeOpens", func(b *testing.B) {
 		b.ResetTimer()
diff --git a/pkg/registry/file/dynamicpathdetector/tests/coverage_test.go b/pkg/registry/file/dynamicpathdetector/tests/coverage_test.go
index 517e3522f..0f2a2c5d6 100644
--- a/pkg/registry/file/dynamicpathdetector/tests/coverage_test.go
+++ b/pkg/registry/file/dynamicpathdetector/tests/coverage_test.go
@@ -19,15 +19,15 @@ func configThreshold(prefix string) int {
 	return dynamicpathdetector.DefaultCollapseConfig.Threshold
 }
 
-func TestNewPathAnalyzer(t *testing.T) {
-	analyzer := dynamicpathdetector.NewPathAnalyzer(dynamicpathdetector.OpenDynamicThreshold)
+func TestNewPathAnalyzerWithConfigs(t *testing.T) {
+	analyzer := dynamicpathdetector.NewPathAnalyzerWithConfigs(dynamicpathdetector.OpenDynamicThreshold, nil)
 	if analyzer == nil {
-		t.Error("NewPathAnalyzer() returned nil")
+		t.Error("NewPathAnalyzerWithConfigs() returned nil")
 	}
 }
 
 func TestAnalyzePath(t *testing.T) {
-	analyzer := dynamicpathdetector.NewPathAnalyzer(dynamicpathdetector.OpenDynamicThreshold)
+	analyzer := dynamicpathdetector.NewPathAnalyzerWithConfigs(dynamicpathdetector.OpenDynamicThreshold, nil)
 
 	testCases := []struct {
 		name       string
@@ -81,7 +81,7 @@ func TestCollapseAdjacentDynamicIdentifiers(t *testing.T) {
 
 func TestDynamicSegments(t *testing.T) {
 	threshold := dynamicpathdetector.OpenDynamicThreshold
-	analyzer := dynamicpathdetector.NewPathAnalyzer(threshold)
+	analyzer := dynamicpathdetector.NewPathAnalyzerWithConfigs(threshold, nil)
 
 	for i := 0; i < threshold+1; i++ {
 		path := fmt.Sprintf("/api/users/%d", i)
@@ -104,7 +104,7 @@ func TestDynamicSegments(t *testing.T) {
 
 func TestMultipleDynamicSegments(t *testing.T) {
 	threshold := dynamicpathdetector.OpenDynamicThreshold
-	analyzer := dynamicpathdetector.NewPathAnalyzer(threshold)
+	analyzer := dynamicpathdetector.NewPathAnalyzerWithConfigs(threshold, nil)
 
 	for i := 0; i < threshold+10; i++ {
 		path := fmt.Sprintf("/api/users/%d/posts/%d", i, i)
@@ -122,7 +122,7 @@ func TestMultipleDynamicSegments(t *testing.T) {
 
 func TestMixedStaticAndDynamicSegments(t *testing.T) {
 	threshold := dynamicpathdetector.OpenDynamicThreshold
-	analyzer := dynamicpathdetector.NewPathAnalyzer(threshold)
+	analyzer := dynamicpathdetector.NewPathAnalyzerWithConfigs(threshold, nil)
 
 	for i := 0; i < threshold+1; i++ {
 		path := fmt.Sprintf("/api/users/%d/posts", i)
@@ -139,7 +139,7 @@ func TestMixedStaticAndDynamicSegments(t *testing.T) {
 }
 
 func TestDifferentRootIdentifiers(t *testing.T) {
-	analyzer := dynamicpathdetector.NewPathAnalyzer(dynamicpathdetector.OpenDynamicThreshold)
+	analyzer := dynamicpathdetector.NewPathAnalyzerWithConfigs(dynamicpathdetector.OpenDynamicThreshold, nil)
 
 	result1, _ := analyzer.AnalyzePath("/api/users/123", "api")
 	result2, _ := analyzer.AnalyzePath("/api/products/456", "store")
@@ -150,7 +150,7 @@ func TestDifferentRootIdentifiers(t *testing.T) {
 
 func TestDynamicThreshold(t *testing.T) {
 	threshold := dynamicpathdetector.OpenDynamicThreshold
-	analyzer := dynamicpathdetector.NewPathAnalyzer(threshold)
+	analyzer := dynamicpathdetector.NewPathAnalyzerWithConfigs(threshold, nil)
 
 	for i := 0; i < threshold+1; i++ {
 		path := fmt.Sprintf("/api/users/%d", i)
@@ -165,7 +165,7 @@ func TestDynamicThreshold(t *testing.T) {
 }
 
 func TestEdgeCases(t *testing.T) {
-	analyzer := dynamicpathdetector.NewPathAnalyzer(dynamicpathdetector.OpenDynamicThreshold)
+	analyzer := dynamicpathdetector.NewPathAnalyzerWithConfigs(dynamicpathdetector.OpenDynamicThreshold, nil)
 
 	testCases := []struct {
 		name       string
@@ -188,7 +188,7 @@ func TestEdgeCases(t *testing.T) {
 }
 
 func TestDynamicInsertion(t *testing.T) {
-	analyzer := dynamicpathdetector.NewPathAnalyzer(dynamicpathdetector.OpenDynamicThreshold)
+	analyzer := dynamicpathdetector.NewPathAnalyzerWithConfigs(dynamicpathdetector.OpenDynamicThreshold, nil)
 
 	result, err := analyzer.AnalyzePath("/api/users/\u22ef", "api")
 	assert.NoError(t, err)
@@ -203,7 +203,7 @@ func TestDynamicInsertion(t *testing.T) {
 
 func TestDynamic(t *testing.T) {
 	threshold := dynamicpathdetector.OpenDynamicThreshold
-	analyzer := dynamicpathdetector.NewPathAnalyzer(threshold)
+	analyzer := dynamicpathdetector.NewPathAnalyzerWithConfigs(threshold, nil)
 	for i := 0; i < threshold+1; i++ {
 		path := fmt.Sprintf("/api/users/%d", i)
 		_, err := analyzer.AnalyzePath(path, "api")
@@ -217,7 +217,7 @@ func TestDynamic(t *testing.T) {
 
 func TestCollapseConfig(t *testing.T) {
 	appThreshold := configThreshold("/app")
-	analyzer := dynamicpathdetector.NewPathAnalyzerWithConfigs([]dynamicpathdetector.CollapseConfig{
+	analyzer := dynamicpathdetector.NewPathAnalyzerWithConfigs(dynamicpathdetector.OpenDynamicThreshold, []dynamicpathdetector.CollapseConfig{
 		{
 			Prefix:    "/api",
 			Threshold: appThreshold,

From 6e80032741b338609d09e524ec391c9084fc59dd Mon Sep 17 00:00:00 2001
From: tanzee <einentlein@gmail.com>
Date: Mon, 16 Feb 2026 15:37:28 +0100
Subject: [PATCH 62/68] exec events wildcard try2

---
 .../file/dynamicpathdetector/analyzer.go      |   7 +
 .../tests/compare_exec_args_test.go           | 145 ++++++++++++++++++
 .../file/dynamicpathdetector/types.go         |   1 +
 tests/integration-test-suite/alertmanager.go  | 114 ++++++++++++++
 tests/integration-test-suite/helm.go          |  42 +++++
 .../integration_test.go                       |   8 +
 6 files changed, 317 insertions(+)
 create mode 100644 pkg/registry/file/dynamicpathdetector/tests/compare_exec_args_test.go
 create mode 100644 tests/integration-test-suite/alertmanager.go

diff --git a/pkg/registry/file/dynamicpathdetector/analyzer.go b/pkg/registry/file/dynamicpathdetector/analyzer.go
index be95e5bbb..37c1da2bf 100644
--- a/pkg/registry/file/dynamicpathdetector/analyzer.go
+++ b/pkg/registry/file/dynamicpathdetector/analyzer.go
@@ -314,6 +314,13 @@ func CompareDynamic(dynamicPath, regularPath string) bool {
 	return compareSegments(dynamicSegments, regularSegments)
 }
 
+// CompareExecArgs checks whether profileArgs (which may contain DynamicIdentifier
+// or WildcardIdentifier) matches runtimeArgs (literal values only).
+// Same semantics as path matching: ⋯ = one arg, * = zero or more remaining.
+func CompareExecArgs(profileArgs, runtimeArgs []string) bool {
+	return compareSegments(profileArgs, runtimeArgs)
+}
+
 func compareSegments(dynamic, regular []string) bool {
 	if len(dynamic) == 0 {
 		return len(regular) == 0
diff --git a/pkg/registry/file/dynamicpathdetector/tests/compare_exec_args_test.go b/pkg/registry/file/dynamicpathdetector/tests/compare_exec_args_test.go
new file mode 100644
index 000000000..3cd92ce1c
--- /dev/null
+++ b/pkg/registry/file/dynamicpathdetector/tests/compare_exec_args_test.go
@@ -0,0 +1,145 @@
+package dynamicpathdetectortests
+
+import (
+	"testing"
+
+	"github.com/kubescape/storage/pkg/registry/file/dynamicpathdetector"
+	"github.com/stretchr/testify/assert"
+)
+
+func TestCompareExecArgs(t *testing.T) {
+	tests := []struct {
+		name        string
+		profileArgs []string
+		runtimeArgs []string
+		expected    bool
+	}{
+		{
+			name:        "Exact match",
+			profileArgs: []string{"-la"},
+			runtimeArgs: []string{"-la"},
+			expected:    true,
+		},
+		{
+			name:        "Exact mismatch",
+			profileArgs: []string{"-la", "/tmp"},
+			runtimeArgs: []string{"-la", "/home"},
+			expected:    false,
+		},
+		{
+			name:        "Wildcard matches any args",
+			profileArgs: []string{"*"},
+			runtimeArgs: []string{"-la", "/tmp", "--color"},
+			expected:    true,
+		},
+		{
+			name:        "Wildcard matches empty args",
+			profileArgs: []string{"*"},
+			runtimeArgs: []string{},
+			expected:    true,
+		},
+		{
+			name:        "Prefix plus wildcard",
+			profileArgs: []string{"-X", "POST", "*"},
+			runtimeArgs: []string{"-X", "POST", "https://api.example.com", "--header", "Content-Type: application/json"},
+			expected:    true,
+		},
+		{
+			name:        "Prefix plus wildcard zero trailing",
+			profileArgs: []string{"-p", "*"},
+			runtimeArgs: []string{"-p"},
+			expected:    true,
+		},
+		{
+			name:        "Prefix plus wildcard wrong prefix",
+			profileArgs: []string{"-X", "GET", "*"},
+			runtimeArgs: []string{"-X", "POST", "https://api.example.com"},
+			expected:    false,
+		},
+		{
+			name:        "Dynamic matches one arg",
+			profileArgs: []string{"-s", dynamicpathdetector.DynamicIdentifier},
+			runtimeArgs: []string{"-s", "http://any.example.com"},
+			expected:    true,
+		},
+		{
+			name:        "Dynamic does not match zero",
+			profileArgs: []string{"-s", dynamicpathdetector.DynamicIdentifier},
+			runtimeArgs: []string{"-s"},
+			expected:    false,
+		},
+		{
+			name:        "Multiple dynamic",
+			profileArgs: []string{"-p", dynamicpathdetector.DynamicIdentifier, "--out", dynamicpathdetector.DynamicIdentifier},
+			runtimeArgs: []string{"-p", "8080", "--out", "/log"},
+			expected:    true,
+		},
+		{
+			name:        "Dynamic then wildcard",
+			profileArgs: []string{dynamicpathdetector.DynamicIdentifier, "*"},
+			runtimeArgs: []string{"first", "second", "third"},
+			expected:    true,
+		},
+		{
+			name:        "Dynamic then wildcard fails empty",
+			profileArgs: []string{dynamicpathdetector.DynamicIdentifier, "*"},
+			runtimeArgs: []string{},
+			expected:    false,
+		},
+		{
+			name:        "Mixed literal dynamic literal wildcard",
+			profileArgs: []string{"--mode", dynamicpathdetector.DynamicIdentifier, "--config", "*"},
+			runtimeArgs: []string{"--mode", "prod", "--config", "f.yaml", "-v"},
+			expected:    true,
+		},
+		{
+			name:        "Mixed wrong literal",
+			profileArgs: []string{"--mode", dynamicpathdetector.DynamicIdentifier, "--config", "*"},
+			runtimeArgs: []string{"--mode", "prod", "--wrong", "f.yaml"},
+			expected:    false,
+		},
+		{
+			name:        "Both empty",
+			profileArgs: []string{},
+			runtimeArgs: []string{},
+			expected:    true,
+		},
+		{
+			name:        "Both nil",
+			profileArgs: nil,
+			runtimeArgs: nil,
+			expected:    true,
+		},
+		{
+			name:        "Empty profile non-empty runtime",
+			profileArgs: []string{},
+			runtimeArgs: []string{"-la"},
+			expected:    false,
+		},
+		{
+			name:        "Real-world kubectl wildcard",
+			profileArgs: []string{"kubectl", "get", "pods", "-n", dynamicpathdetector.DynamicIdentifier, "*"},
+			runtimeArgs: []string{"kubectl", "get", "pods", "-n", "kube-system", "--output=json"},
+			expected:    true,
+		},
+		{
+			name:        "Real-world iptables complex",
+			profileArgs: []string{"-t", dynamicpathdetector.DynamicIdentifier, "-A", dynamicpathdetector.DynamicIdentifier, "-j", "*"},
+			runtimeArgs: []string{"-t", "nat", "-A", "PREROUTING", "-j", "DNAT", "--to-dest", "10.0.0.1"},
+			expected:    true,
+		},
+		{
+			name:        "Real-world curl user allowlist",
+			profileArgs: []string{"/usr/bin/curl", "-s", "*"},
+			runtimeArgs: []string{"/usr/bin/curl", "-s", "http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/token"},
+			expected:    true,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			result := dynamicpathdetector.CompareExecArgs(tt.profileArgs, tt.runtimeArgs)
+			assert.Equal(t, tt.expected, result)
+		})
+	}
+}
diff --git a/pkg/registry/file/dynamicpathdetector/types.go b/pkg/registry/file/dynamicpathdetector/types.go
index 0d187ad9f..10165f8f7 100644
--- a/pkg/registry/file/dynamicpathdetector/types.go
+++ b/pkg/registry/file/dynamicpathdetector/types.go
@@ -30,6 +30,7 @@ var DefaultCollapseConfigs = []CollapseConfig{
 
 const OpenDynamicThreshold = 50
 const EndpointDynamicThreshold = 100
+const ExecArgDynamicThreshold = 2
 
 var DefaultCollapseConfig = CollapseConfig{
 	Prefix:    "/",
diff --git a/tests/integration-test-suite/alertmanager.go b/tests/integration-test-suite/alertmanager.go
new file mode 100644
index 000000000..4e09f4bc2
--- /dev/null
+++ b/tests/integration-test-suite/alertmanager.go
@@ -0,0 +1,114 @@
+package integration_test_suite
+
+import (
+	"encoding/json"
+	"fmt"
+	"io"
+	"net/http"
+	"os"
+	"os/exec"
+	"testing"
+	"time"
+)
+
+const defaultAlertManagerURL = "http://localhost:9093"
+
+// Alert structure based on the expected JSON format from Alertmanager.
+type Alert struct {
+	Labels map[string]string `json:"labels"`
+}
+
+func getAlertManagerURL() string {
+	if url := os.Getenv("ALERTMANAGER_URL"); url != "" {
+		return url
+	}
+	return defaultAlertManagerURL
+}
+
+// getAlerts retrieves active alerts from Alertmanager filtered by namespace.
+func getAlerts(namespace string) ([]Alert, error) {
+	url := getAlertManagerURL()
+	endpoint := fmt.Sprintf("%s/api/v2/alerts?active=true", url)
+
+	resp, err := http.Get(endpoint)
+	if err != nil {
+		return nil, fmt.Errorf("error connecting to alertmanager at %s: %v", url, err)
+	}
+	defer resp.Body.Close()
+
+	if resp.StatusCode != http.StatusOK {
+		return nil, fmt.Errorf("alertmanager http error: %s", resp.Status)
+	}
+
+	body, err := io.ReadAll(resp.Body)
+	if err != nil {
+		return nil, fmt.Errorf("read error: %v", err)
+	}
+
+	var alerts []Alert
+	if err := json.Unmarshal(body, &alerts); err != nil {
+		return nil, fmt.Errorf("json parsing error: %v", err)
+	}
+
+	// Filter by alertname and namespace
+	var filtered []Alert
+	for _, a := range alerts {
+		if a.Labels["alertname"] == "KubescapeRuleViolated" && a.Labels["namespace"] == namespace {
+			filtered = append(filtered, a)
+		}
+	}
+	return filtered, nil
+}
+
+// assertAlertPresent checks that an alert matching the given rule name and command exists.
+func assertAlertPresent(t *testing.T, alerts []Alert, ruleName, command, containerName string) {
+	t.Helper()
+	for _, a := range alerts {
+		if a.Labels["rule_name"] == ruleName &&
+			a.Labels["comm"] == command &&
+			a.Labels["container_name"] == containerName {
+			return
+		}
+	}
+	t.Errorf("expected alert with rule_name=%q, comm=%q, container_name=%q not found", ruleName, command, containerName)
+	for _, a := range alerts {
+		t.Logf("  alert labels: %v", a.Labels)
+	}
+}
+
+// assertAlertAbsent checks that no alert matching the given rule name and command exists.
+func assertAlertAbsent(t *testing.T, alerts []Alert, ruleName, command, containerName string) {
+	t.Helper()
+	for _, a := range alerts {
+		if a.Labels["rule_name"] == ruleName &&
+			a.Labels["comm"] == command &&
+			a.Labels["container_name"] == containerName {
+			t.Errorf("unexpected alert with rule_name=%q, comm=%q, container_name=%q found", ruleName, command, containerName)
+			return
+		}
+	}
+}
+
+// startAlertManagerPortForward starts kubectl port-forward for AlertManager.
+// Returns the exec.Cmd so the caller can kill it when done.
+func startAlertManagerPortForward(t *testing.T) *exec.Cmd {
+	t.Helper()
+	cmd := exec.Command("kubectl", "port-forward", "svc/alertmanager-operated", "9093:9093", "-n", "monitoring")
+	if err := cmd.Start(); err != nil {
+		t.Fatalf("Failed to start alertmanager port-forward: %v", err)
+	}
+	// Wait for port-forward to establish
+	time.Sleep(5 * time.Second)
+
+	// Verify connectivity
+	url := getAlertManagerURL()
+	resp, err := http.Get(fmt.Sprintf("%s/api/v2/status", url))
+	if err != nil {
+		cmd.Process.Kill()
+		t.Fatalf("AlertManager not reachable after port-forward: %v", err)
+	}
+	resp.Body.Close()
+
+	t.Logf("AlertManager port-forward established at %s", url)
+	return cmd
+}
diff --git a/tests/integration-test-suite/helm.go b/tests/integration-test-suite/helm.go
index 1c1908357..3bc540177 100644
--- a/tests/integration-test-suite/helm.go
+++ b/tests/integration-test-suite/helm.go
@@ -32,6 +32,48 @@ func flattenHelmGetValuesOutput(prefix string, m map[string]interface{}, result
 	}
 }
 
+// EnsurePrometheusStack installs the kube-prometheus-stack (Prometheus + AlertManager)
+// into the monitoring namespace if not already present.
+func EnsurePrometheusStack() error {
+	// Check if prometheus is already installed
+	cmd := exec.Command("helm", "status", "prometheus", "-n", "monitoring")
+	if err := cmd.Run(); err == nil {
+		log.Printf("Prometheus stack already installed - skipping")
+		return nil
+	}
+
+	// Add prometheus-community repo
+	log.Printf("Adding prometheus-community helm repo...")
+	cmd = exec.Command("helm", "repo", "add", "prometheus-community", "https://prometheus-community.github.io/helm-charts")
+	_ = cmd.Run() // ignore error if already exists
+
+	// Update repos
+	log.Printf("Updating helm repos...")
+	cmd = exec.Command("helm", "repo", "update")
+	if out, err := cmd.CombinedOutput(); err != nil {
+		return fmt.Errorf("helm repo update failed: %v\n%s", err, string(out))
+	}
+
+	// Install kube-prometheus-stack
+	log.Printf("Installing kube-prometheus-stack...")
+	args := []string{
+		"upgrade", "--install", "prometheus", "prometheus-community/kube-prometheus-stack",
+		"--namespace", "monitoring", "--create-namespace",
+		"--wait", "--timeout", "5m",
+		"--set", "grafana.enabled=false",
+		"--set", "prometheus.prometheusSpec.podMonitorSelectorNilUsesHelmValues=false",
+		"--set", "prometheus.prometheusSpec.serviceMonitorSelectorNilUsesHelmValues=false",
+	}
+	cmd = exec.Command("helm", args...)
+	out, err := cmd.CombinedOutput()
+	if err != nil {
+		return fmt.Errorf("prometheus stack install failed: %v\n%s", err, string(out))
+	}
+
+	log.Printf("Prometheus stack installed successfully")
+	return nil
+}
+
 func EnsureKubescapeHelmRelease(updateIfPresent bool, extraHelmSetArgs []string) error {
 	releaseName := "kubescape"
 	chartName := "kubescape/kubescape-operator"
diff --git a/tests/integration-test-suite/integration_test.go b/tests/integration-test-suite/integration_test.go
index 8a676b875..03815349e 100644
--- a/tests/integration-test-suite/integration_test.go
+++ b/tests/integration-test-suite/integration_test.go
@@ -59,6 +59,7 @@ func TestMain(m *testing.M) {
 	skipEnsureHelm := pflag.Bool("skip-ensure-helm", false, "Skip ensuring kubescape helm release is installed/upgraded")
 	updateIfPresent := pflag.Bool("update-helm-if-present", true, "If false, do not perform helm upgrade if a release already exists")
 	extraHelmSetArgs := pflag.String("extra-helm-set-args", "", "Comma-separated extra helm set args (e.g. foo=bar,bar=baz)")
+	ensurePrometheus := pflag.Bool("ensure-prometheus", false, "Install Prometheus stack (required for alert-based tests like TestWildcardExecArgsProfile)")
 	pflag.CommandLine.Parse(testBinaryArgs)
 
 	// Parse comma-separated extra helm set args
@@ -72,6 +73,13 @@ func TestMain(m *testing.M) {
 		}
 	}
 
+	// Install Prometheus stack before kubescape (AlertManager must exist for ServiceMonitors)
+	if *ensurePrometheus {
+		if err := EnsurePrometheusStack(); err != nil {
+			panic(err)
+		}
+	}
+
 	if !*skipEnsureHelm {
 		if err := EnsureKubescapeHelmRelease(*updateIfPresent, extraArgs); err != nil {
 			panic(err)

From 1e5473e185a896e2f6502b4eec11b4bf01011de2 Mon Sep 17 00:00:00 2001
From: tanzee <einentlein@gmail.com>
Date: Mon, 16 Feb 2026 15:43:08 +0100
Subject: [PATCH 63/68] old branch hardcoded in ci

---
 .github/workflows/build.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/build.yaml b/.github/workflows/build.yaml
index 490fb1864..ceece2320 100644
--- a/.github/workflows/build.yaml
+++ b/.github/workflows/build.yaml
@@ -20,7 +20,7 @@ on:
             default: false
     push:
       branches:
-        - test/localtestbuild
+        - features/exec
 
 jobs:
   prepare:

From 97e2439582480efb4a3eedcec5eaa8850862e8e8 Mon Sep 17 00:00:00 2001
From: Duck <70207455+entlein@users.noreply.github.com>
Date: Mon, 16 Feb 2026 16:08:22 +0100
Subject: [PATCH 64/68] Change branch name from features/exec to feature/exec

---
 .github/workflows/build.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/build.yaml b/.github/workflows/build.yaml
index ceece2320..5d9bff3f4 100644
--- a/.github/workflows/build.yaml
+++ b/.github/workflows/build.yaml
@@ -20,7 +20,7 @@ on:
             default: false
     push:
       branches:
-        - features/exec
+        - feature/exec
 
 jobs:
   prepare:

From 3ea0dcbef757ac3b6931a8cefa38d0a01986d6d6 Mon Sep 17 00:00:00 2001
From: tanzee <einentlein@gmail.com>
Date: Mon, 16 Feb 2026 19:20:08 +0100
Subject: [PATCH 65/68] auto update remote reference branch

---
 .github/workflows/build.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/build.yaml b/.github/workflows/build.yaml
index 5d9bff3f4..e92298b60 100644
--- a/.github/workflows/build.yaml
+++ b/.github/workflows/build.yaml
@@ -88,6 +88,6 @@ jobs:
           echo "Triggering node-agent build with IMAGE_TAG=${IMAGE_TAG} STORAGE_REF=${IMAGE_TAG}"
           gh workflow run build.yaml \
             --repo "${{ github.repository_owner }}/node-agent" \
-            --ref test/localtestbuild \
+            --ref ${{ github.ref_name }} \
             -f IMAGE_TAG="${IMAGE_TAG}" \
             -f STORAGE_REF="${IMAGE_TAG}"

From 8db3f5463d6c7b3671cb606126f543f1fa4aa76a Mon Sep 17 00:00:00 2001
From: tanzee <einentlein@gmail.com>
Date: Mon, 16 Feb 2026 20:55:38 +0100
Subject: [PATCH 66/68] compare logic changed for exec vs path

---
 .../file/dynamicpathdetector/analyzer.go      |  35 +-
 .../tests/compare_exec_args_test.go           |  79 ++
 tests/integration-test-suite/go.mod           | 308 ++++---
 tests/integration-test-suite/go.sum           | 814 +++++++++++-------
 4 files changed, 813 insertions(+), 423 deletions(-)

diff --git a/pkg/registry/file/dynamicpathdetector/analyzer.go b/pkg/registry/file/dynamicpathdetector/analyzer.go
index 37c1da2bf..ff2208c3d 100644
--- a/pkg/registry/file/dynamicpathdetector/analyzer.go
+++ b/pkg/registry/file/dynamicpathdetector/analyzer.go
@@ -314,11 +314,38 @@ func CompareDynamic(dynamicPath, regularPath string) bool {
 	return compareSegments(dynamicSegments, regularSegments)
 }
 
-// CompareExecArgs checks whether profileArgs (which may contain DynamicIdentifier
-// or WildcardIdentifier) matches runtimeArgs (literal values only).
-// Same semantics as path matching: ⋯ = one arg, * = zero or more remaining.
+
 func CompareExecArgs(profileArgs, runtimeArgs []string) bool {
-	return compareSegments(profileArgs, runtimeArgs)
+	return matchArgs(profileArgs, runtimeArgs, 0, 0)
+}
+
+
+func matchArgs(profile, runtime []string, pi, ri int) bool {
+	for pi < len(profile) {
+		if profile[pi] == WildcardIdentifier {
+			// Trailing * matches everything remaining (including nothing).
+			if pi == len(profile)-1 {
+				return true
+			}
+			// Non-trailing *: try matching the rest starting at every position.
+			for k := ri; k <= len(runtime); k++ {
+				if matchArgs(profile, runtime, pi+1, k) {
+					return true
+				}
+			}
+			return false
+		}
+		if ri >= len(runtime) {
+			return false
+		}
+		if profile[pi] == DynamicIdentifier || profile[pi] == runtime[ri] {
+			pi++
+			ri++
+			continue
+		}
+		return false
+	}
+	return ri == len(runtime)
 }
 
 func compareSegments(dynamic, regular []string) bool {
diff --git a/pkg/registry/file/dynamicpathdetector/tests/compare_exec_args_test.go b/pkg/registry/file/dynamicpathdetector/tests/compare_exec_args_test.go
index 3cd92ce1c..fe03bc10e 100644
--- a/pkg/registry/file/dynamicpathdetector/tests/compare_exec_args_test.go
+++ b/pkg/registry/file/dynamicpathdetector/tests/compare_exec_args_test.go
@@ -134,6 +134,85 @@ func TestCompareExecArgs(t *testing.T) {
 			runtimeArgs: []string{"/usr/bin/curl", "-s", "http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/token"},
 			expected:    true,
 		},
+		// --- Exec-specific scenarios (strict, dynamic, wildcard boundary cases) ---
+		{
+			name:        "Strict mkdir -p with exact dir",
+			profileArgs: []string{"/bin/mkdir", "-p", "/var/lock/apache2"},
+			runtimeArgs: []string{"/bin/mkdir", "-p", "/var/lock/apache2"},
+			expected:    true,
+		},
+		{
+			name:        "Strict mkdir -p with different dir",
+			profileArgs: []string{"/bin/mkdir", "-p", "/var/lock/apache2"},
+			runtimeArgs: []string{"/bin/mkdir", "-p", "/var/log/apache2"},
+			expected:    false,
+		},
+		{
+			name:        "Strict rm -f exact path",
+			profileArgs: []string{"/bin/rm", "-f", "/var/run/apache2/apache2.pid"},
+			runtimeArgs: []string{"/bin/rm", "-f", "/var/run/apache2/apache2.pid"},
+			expected:    true,
+		},
+		{
+			name:        "Strict rm different flags and path",
+			profileArgs: []string{"/bin/rm", "-f", "/var/run/apache2/apache2.pid"},
+			runtimeArgs: []string{"/bin/rm", "-rf", "/tmp"},
+			expected:    false,
+		},
+		{
+			name:        "Dynamic mkdir -p matches any dir",
+			profileArgs: []string{"/bin/mkdir", "-p", dynamicpathdetector.DynamicIdentifier},
+			runtimeArgs: []string{"/bin/mkdir", "-p", "/var/log"},
+			expected:    true,
+		},
+		{
+			name:        "Dynamic mkdir missing -p flag",
+			profileArgs: []string{"/bin/mkdir", "-p", dynamicpathdetector.DynamicIdentifier},
+			runtimeArgs: []string{"/bin/mkdir", "/var/log"},
+			expected:    false,
+		},
+		{
+			name:        "Dynamic mkdir -p extra arg beyond dynamic",
+			profileArgs: []string{"/bin/mkdir", "-p", dynamicpathdetector.DynamicIdentifier},
+			runtimeArgs: []string{"/bin/mkdir", "-p", "-v", "/var/log"},
+			expected:    false,
+		},
+		{
+			name:        "Dynamic requires at least one arg",
+			profileArgs: []string{"/bin/mkdir", "-p", dynamicpathdetector.DynamicIdentifier},
+			runtimeArgs: []string{"/bin/mkdir", "-p"},
+			expected:    false,
+		},
+		{
+			name:        "Dynamic dirname matches any path",
+			profileArgs: []string{"/usr/bin/dirname", dynamicpathdetector.DynamicIdentifier},
+			runtimeArgs: []string{"/usr/bin/dirname", "/var/log"},
+			expected:    true,
+		},
+		{
+			name:        "Dynamic dirname requires one arg",
+			profileArgs: []string{"/usr/bin/dirname", dynamicpathdetector.DynamicIdentifier},
+			runtimeArgs: []string{"/usr/bin/dirname"},
+			expected:    false,
+		},
+		{
+			name:        "Wildcard echo hello matches zero trailing",
+			profileArgs: []string{"/bin/echo", "hello", "*"},
+			runtimeArgs: []string{"/bin/echo", "hello"},
+			expected:    true,
+		},
+		{
+			name:        "Wildcard echo hello matches one trailing",
+			profileArgs: []string{"/bin/echo", "hello", "*"},
+			runtimeArgs: []string{"/bin/echo", "hello", "world"},
+			expected:    true,
+		},
+		{
+			name:        "Wildcard echo hello rejects wrong literal",
+			profileArgs: []string{"/bin/echo", "hello", "*"},
+			runtimeArgs: []string{"/bin/echo", "goodbye"},
+			expected:    false,
+		},
 	}
 
 	for _, tt := range tests {
diff --git a/tests/integration-test-suite/go.mod b/tests/integration-test-suite/go.mod
index c1012de32..51b51c0c8 100644
--- a/tests/integration-test-suite/go.mod
+++ b/tests/integration-test-suite/go.mod
@@ -1,94 +1,114 @@
 module integration-test-suite
 
-go 1.24.0
-
-toolchain go1.24.5
+go 1.25.0
 
 require (
 	github.com/kubescape/node-agent v0.2.343
-	github.com/kubescape/storage v0.0.179
-	github.com/spf13/pflag v1.0.6
+	github.com/kubescape/storage v0.0.239
+	github.com/spf13/pflag v1.0.10
 	github.com/stretchr/testify v1.11.1
 	gopkg.in/yaml.v2 v2.4.0
-	k8s.io/api v0.33.0
-	k8s.io/apimachinery v0.33.0
-	k8s.io/client-go v0.33.0
+	k8s.io/api v0.35.0
+	k8s.io/apimachinery v0.35.0
+	k8s.io/client-go v0.35.0
 )
 
 require (
+	cel.dev/expr v0.24.0 // indirect
 	cyphar.com/go-pathrs v0.2.1 // indirect
-	github.com/AdaLogics/go-fuzz-headers v0.0.0-20230811130428-ced1acdcaa24 // indirect
-	github.com/AdamKorcz/go-118-fuzz-build v0.0.0-20231105174938-2b5cbb29f3e2 // indirect
+	github.com/AdaLogics/go-fuzz-headers v0.0.0-20240806141605-e8a1dd7889d6 // indirect
+	github.com/AdamKorcz/go-118-fuzz-build v0.0.0-20250520111509-a70c2aa677fa // indirect
 	github.com/Azure/go-ansiterm v0.0.0-20250102033503-faa5f7b0171c // indirect
+	github.com/Azure/go-ntlmssp v0.0.0-20221128193559-754e69321358 // indirect
+	github.com/DmitriyVTitov/size v1.5.0 // indirect
 	github.com/Microsoft/go-winio v0.6.2 // indirect
-	github.com/Microsoft/hcsshim v0.12.9 // indirect
+	github.com/Microsoft/hcsshim v0.13.0 // indirect
+	github.com/SergJa/jsonhash v0.0.0-20210531165746-fc45f346aa74 // indirect
 	github.com/acobaugh/osrelease v0.1.0 // indirect
 	github.com/anchore/go-logger v0.0.0-20250318195838-07ae343dd722 // indirect
-	github.com/anchore/packageurl-go v0.1.1-0.20241018175412-5c22e6360c4f // indirect
-	github.com/anchore/stereoscope v0.0.11 // indirect
-	github.com/anchore/syft v1.18.1 // indirect
-	github.com/armosec/armoapi-go v0.0.596 // indirect
+	github.com/anchore/packageurl-go v0.1.1-0.20250220190351-d62adb6e1115 // indirect
+	github.com/anchore/stereoscope v0.1.9 // indirect
+	github.com/anchore/syft v1.32.0 // indirect
+	github.com/antlr4-go/antlr/v4 v4.13.0 // indirect
+	github.com/armosec/armoapi-go v0.0.672 // indirect
 	github.com/armosec/gojay v1.2.17 // indirect
 	github.com/armosec/utils-go v0.0.58 // indirect
-	github.com/armosec/utils-k8s-go v0.0.30 // indirect
+	github.com/armosec/utils-k8s-go v0.0.35 // indirect
 	github.com/asaskevich/govalidator v0.0.0-20230301143203-a9d515a09cc2 // indirect
+	github.com/aws/aws-sdk-go-v2 v1.41.1 // indirect
+	github.com/aws/aws-sdk-go-v2/config v1.32.7 // indirect
+	github.com/aws/aws-sdk-go-v2/credentials v1.19.7 // indirect
+	github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.17 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.17 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.17 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/ini v1.8.4 // indirect
+	github.com/aws/aws-sdk-go-v2/service/ecs v1.71.0 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.4 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.17 // indirect
+	github.com/aws/aws-sdk-go-v2/service/signin v1.0.5 // indirect
+	github.com/aws/aws-sdk-go-v2/service/sso v1.30.9 // indirect
+	github.com/aws/aws-sdk-go-v2/service/ssooidc v1.35.13 // indirect
+	github.com/aws/aws-sdk-go-v2/service/sts v1.41.6 // indirect
+	github.com/aws/smithy-go v1.24.0 // indirect
 	github.com/becheran/wildmatch-go v1.0.0 // indirect
 	github.com/beorn7/perks v1.0.1 // indirect
+	github.com/blang/semver v3.5.1+incompatible // indirect
 	github.com/blang/semver/v4 v4.0.0 // indirect
-	github.com/bmatcuk/doublestar/v4 v4.7.1 // indirect
+	github.com/bmatcuk/doublestar/v4 v4.9.1 // indirect
 	github.com/briandowns/spinner v1.23.2 // indirect
-	github.com/cenkalti/backoff v2.2.1+incompatible // indirect
 	github.com/cenkalti/backoff/v4 v4.3.0 // indirect
-	github.com/cenkalti/backoff/v5 v5.0.2 // indirect
+	github.com/cenkalti/backoff/v5 v5.0.3 // indirect
 	github.com/cespare/xxhash/v2 v2.3.0 // indirect
 	github.com/cilium/cilium v1.16.17 // indirect
-	github.com/cilium/ebpf v0.18.0 // indirect
+	github.com/cilium/ebpf v0.20.0 // indirect
+	github.com/cloudflare/cbpfc v0.0.0-20240920015331-ff978e94500b // indirect
 	github.com/containerd/cgroups/v3 v3.0.5 // indirect
-	github.com/containerd/containerd v1.7.29 // indirect
-	github.com/containerd/containerd/api v1.8.0 // indirect
-	github.com/containerd/continuity v0.4.4 // indirect
+	github.com/containerd/containerd v1.7.30 // indirect
+	github.com/containerd/containerd/api v1.9.0 // indirect
+	github.com/containerd/continuity v0.4.5 // indirect
 	github.com/containerd/errdefs v1.0.0 // indirect
 	github.com/containerd/errdefs/pkg v0.3.0 // indirect
 	github.com/containerd/fifo v1.1.0 // indirect
 	github.com/containerd/log v0.1.0 // indirect
+	github.com/containerd/nri v0.9.0 // indirect
 	github.com/containerd/platforms v0.2.1 // indirect
 	github.com/containerd/ttrpc v1.2.7 // indirect
 	github.com/containerd/typeurl/v2 v2.2.3 // indirect
-	github.com/containers/common v0.63.0 // indirect
-	github.com/coreos/go-oidc/v3 v3.14.1 // indirect
-	github.com/coreos/go-systemd/v22 v22.5.0 // indirect
+	github.com/containers/common v0.64.2 // indirect
+	github.com/coreos/go-oidc/v3 v3.17.0 // indirect
+	github.com/coreos/go-systemd/v22 v22.6.0 // indirect
 	github.com/crewjam/rfc5424 v0.1.0 // indirect
 	github.com/cyphar/filepath-securejoin v0.6.0 // indirect
 	github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
-	github.com/deckarep/golang-set/v2 v2.7.0 // indirect
+	github.com/deckarep/golang-set/v2 v2.8.0 // indirect
 	github.com/dghubble/trie v0.1.0 // indirect
 	github.com/distribution/reference v0.6.0 // indirect
-	github.com/docker/cli v28.1.1+incompatible // indirect
-	github.com/docker/docker v28.1.1+incompatible // indirect
+	github.com/docker/cli v29.1.3+incompatible // indirect
+	github.com/docker/docker v28.5.2+incompatible // indirect
 	github.com/docker/docker-credential-helpers v0.9.3 // indirect
-	github.com/docker/go-connections v0.5.0 // indirect
-	github.com/docker/go-events v0.0.0-20190806004212-e31b211e4f1c // indirect
+	github.com/docker/go-connections v0.6.0 // indirect
+	github.com/docker/go-events v0.0.0-20250114142523-c867878c5e32 // indirect
 	github.com/docker/go-units v0.5.0 // indirect
-	github.com/ebitengine/purego v0.8.2 // indirect
-	github.com/emicklei/go-restful/v3 v3.12.1 // indirect
-	github.com/evanphx/json-patch v5.9.0+incompatible // indirect
+	github.com/dustin/go-humanize v1.0.1 // indirect
+	github.com/emicklei/go-restful/v3 v3.12.2 // indirect
 	github.com/facebookincubator/nvdtools v0.1.5 // indirect
 	github.com/fatih/color v1.18.0 // indirect
 	github.com/felixge/httpsnoop v1.0.4 // indirect
+	github.com/florianl/go-tc v0.4.7 // indirect
 	github.com/francoispqt/gojay v1.2.13 // indirect
 	github.com/fsnotify/fsnotify v1.9.0 // indirect
-	github.com/fxamacker/cbor/v2 v2.8.0 // indirect
-	github.com/gabriel-vasile/mimetype v1.4.7 // indirect
-	github.com/gammazero/deque v1.0.0 // indirect
-	github.com/github/go-spdx/v2 v2.3.2 // indirect
+	github.com/fxamacker/cbor/v2 v2.9.0 // indirect
+	github.com/gabriel-vasile/mimetype v1.4.10 // indirect
+	github.com/github/go-spdx/v2 v2.3.3 // indirect
+	github.com/go-asn1-ber/asn1-ber v1.5.7 // indirect
 	github.com/go-errors/errors v1.5.1 // indirect
-	github.com/go-jose/go-jose/v4 v4.0.5 // indirect
-	github.com/go-logr/logr v1.4.2 // indirect
+	github.com/go-jose/go-jose/v4 v4.1.3 // indirect
+	github.com/go-ldap/ldap/v3 v3.4.10 // indirect
+	github.com/go-logr/logr v1.4.3 // indirect
 	github.com/go-logr/stdr v1.2.2 // indirect
-	github.com/go-ole/go-ole v1.2.6 // indirect
 	github.com/go-openapi/analysis v0.23.0 // indirect
-	github.com/go-openapi/errors v0.22.1 // indirect
-	github.com/go-openapi/jsonpointer v0.21.0 // indirect
+	github.com/go-openapi/errors v0.22.2 // indirect
+	github.com/go-openapi/jsonpointer v0.21.2 // indirect
 	github.com/go-openapi/jsonreference v0.21.0 // indirect
 	github.com/go-openapi/loads v0.22.0 // indirect
 	github.com/go-openapi/runtime v0.28.0 // indirect
@@ -97,159 +117,189 @@ require (
 	github.com/go-openapi/swag v0.23.1 // indirect
 	github.com/go-openapi/validate v0.24.0 // indirect
 	github.com/go-viper/mapstructure/v2 v2.4.0 // indirect
-	github.com/godbus/dbus/v5 v5.1.0 // indirect
+	github.com/godbus/dbus/v5 v5.2.0 // indirect
+	github.com/gofrs/flock v0.13.0 // indirect
 	github.com/gogo/protobuf v1.3.2 // indirect
+	github.com/gohugoio/hashstructure v0.5.0 // indirect
+	github.com/golang-jwt/jwt/v4 v4.5.2 // indirect
 	github.com/golang/groupcache v0.0.0-20241129210726-2c02b8208cf8 // indirect
 	github.com/google/btree v1.1.3 // indirect
-	github.com/google/gnostic-models v0.6.9 // indirect
+	github.com/google/cel-go v0.26.1 // indirect
+	github.com/google/gnostic-models v0.7.0 // indirect
 	github.com/google/go-cmp v0.7.0 // indirect
-	github.com/google/go-containerregistry v0.20.3 // indirect
-	github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510 // indirect
+	github.com/google/go-containerregistry v0.20.7 // indirect
+	github.com/google/licensecheck v0.3.1 // indirect
 	github.com/google/uuid v1.6.0 // indirect
-	github.com/gopacket/gopacket v1.3.2-0.20241202175635-b43272ae1eb8 // indirect
 	github.com/goradd/maps v1.0.0 // indirect
 	github.com/gregjones/httpcache v0.0.0-20190611155906-901d90724c79 // indirect
-	github.com/grpc-ecosystem/grpc-gateway/v2 v2.26.3 // indirect
+	github.com/grpc-ecosystem/grpc-gateway/v2 v2.27.3 // indirect
 	github.com/hashicorp/errwrap v1.1.0 // indirect
 	github.com/hashicorp/go-multierror v1.1.1 // indirect
 	github.com/hashicorp/golang-lru/v2 v2.0.7 // indirect
 	github.com/iceber/iouring-go v0.0.0-20230403020409-002cfd2e2a90 // indirect
+	github.com/in-toto/in-toto-golang v0.9.0 // indirect
 	github.com/inconshreveable/mousetrap v1.1.0 // indirect
-	github.com/inspektor-gadget/inspektor-gadget v0.40.0 // indirect
+	github.com/inspektor-gadget/inspektor-gadget v0.45.1-0.20251020222545-c91c23581ebf // indirect
 	github.com/jinzhu/copier v0.4.0 // indirect
+	github.com/joncrlsn/dque v0.0.0-20241024143830-7723fd131a64 // indirect
 	github.com/josharian/intern v1.0.0 // indirect
+	github.com/josharian/native v1.1.0 // indirect
 	github.com/json-iterator/go v1.1.12 // indirect
-	github.com/klauspost/compress v1.18.0 // indirect
+	github.com/klauspost/compress v1.18.1 // indirect
 	github.com/kubescape/go-logger v0.0.24 // indirect
-	github.com/kubescape/k8s-interface v0.0.195 // indirect
-	github.com/kubescape/workerpool v0.0.0-20250526074519-0e4a4e7f44cf // indirect
+	github.com/kubescape/k8s-interface v0.0.202 // indirect
 	github.com/liggitt/tabwriter v0.0.0-20181228230101-89fcab3d43de // indirect
-	github.com/lufia/plan9stats v0.0.0-20211012122336-39d0f177ccd0 // indirect
 	github.com/mackerelio/go-osstat v0.2.5 // indirect
 	github.com/mailru/easyjson v0.9.0 // indirect
 	github.com/mattn/go-colorable v0.1.14 // indirect
 	github.com/mattn/go-isatty v0.0.20 // indirect
+	github.com/mdlayher/netlink v1.7.2 // indirect
+	github.com/mdlayher/socket v0.4.1 // indirect
 	github.com/mitchellh/go-homedir v1.1.0 // indirect
-	github.com/mitchellh/hashstructure/v2 v2.0.2 // indirect
 	github.com/mitchellh/mapstructure v1.5.0 // indirect
 	github.com/moby/docker-image-spec v1.3.1 // indirect
 	github.com/moby/locker v1.0.1 // indirect
-	github.com/moby/moby v28.1.1+incompatible // indirect
+	github.com/moby/moby v28.5.2+incompatible // indirect
 	github.com/moby/sys/mountinfo v0.7.2 // indirect
 	github.com/moby/sys/sequential v0.6.0 // indirect
-	github.com/moby/sys/signal v0.7.0 // indirect
+	github.com/moby/sys/signal v0.7.1 // indirect
 	github.com/moby/sys/user v0.4.0 // indirect
 	github.com/moby/sys/userns v0.1.0 // indirect
 	github.com/moby/term v0.5.2 // indirect
 	github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
-	github.com/modern-go/reflect2 v1.0.2 // indirect
+	github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee // indirect
 	github.com/monochromegane/go-gitignore v0.0.0-20200626010858-205db1a8cc00 // indirect
 	github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
+	github.com/ncruces/go-strftime v0.1.9 // indirect
+	github.com/ncw/directio v1.0.5 // indirect
+	github.com/notaryproject/notation-core-go v1.3.0 // indirect
+	github.com/notaryproject/notation-go v1.3.2 // indirect
+	github.com/notaryproject/notation-plugin-framework-go v1.0.0 // indirect
+	github.com/notaryproject/tspclient-go v1.0.0 // indirect
 	github.com/oklog/ulid v1.3.1 // indirect
 	github.com/olvrng/ujson v1.1.0 // indirect
+	github.com/opcoder0/capabilities v0.0.0-20221222060822-17fd73bffd2a // indirect
+	github.com/opcoder0/fanotify v0.4.2 // indirect
 	github.com/opencontainers/go-digest v1.0.0 // indirect
 	github.com/opencontainers/image-spec v1.1.1 // indirect
 	github.com/opencontainers/runtime-spec v1.2.1 // indirect
-	github.com/opencontainers/selinux v1.13.0 // indirect
+	github.com/opencontainers/selinux v1.13.1 // indirect
 	github.com/opentracing/opentracing-go v1.2.1-0.20220228012449-10b1cf09e00b // indirect
-	github.com/panjf2000/ants/v2 v2.10.0 // indirect
-	github.com/pelletier/go-toml/v2 v2.2.3 // indirect
+	github.com/packetcap/go-pcap v0.0.0-20250723190045-d00b185f30b7 // indirect
+	github.com/pelletier/go-toml/v2 v2.2.4 // indirect
 	github.com/peterbourgon/diskv v2.0.1+incompatible // indirect
 	github.com/petermattis/goid v0.0.0-20241211131331-93ee7e083c43 // indirect
+	github.com/picatz/xcel v0.0.0-20250816143731-885b5f678a12 // indirect
 	github.com/pierrec/lz4/v4 v4.1.22 // indirect
 	github.com/pkg/errors v0.9.1 // indirect
 	github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
-	github.com/power-devops/perfstat v0.0.0-20210106213030-5aafc221ea8c // indirect
 	github.com/prometheus/alertmanager v0.27.0 // indirect
-	github.com/prometheus/client_golang v1.22.0 // indirect
-	github.com/prometheus/client_model v0.6.1 // indirect
-	github.com/prometheus/common v0.62.0 // indirect
-	github.com/prometheus/procfs v0.15.1 // indirect
+	github.com/prometheus/client_golang v1.23.2 // indirect
+	github.com/prometheus/client_model v0.6.2 // indirect
+	github.com/prometheus/common v0.67.4 // indirect
+	github.com/prometheus/procfs v0.19.2 // indirect
+	github.com/puzpuzpuz/xsync/v2 v2.4.1 // indirect
+	github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec // indirect
 	github.com/s3rj1k/go-fanotify/fanotify v0.0.0-20240229202106-bca3154da60a // indirect
-	github.com/sagikazarmark/locafero v0.7.0 // indirect
+	github.com/sagikazarmark/locafero v0.11.0 // indirect
 	github.com/sasha-s/go-deadlock v0.3.5 // indirect
 	github.com/scylladb/go-set v1.0.3-0.20200225121959-cc7b2070d91e // indirect
-	github.com/seccomp/libseccomp-golang v0.10.0 // indirect
-	github.com/shirou/gopsutil/v4 v4.25.1 // indirect
-	github.com/sirupsen/logrus v1.9.3 // indirect
-	github.com/sourcegraph/conc v0.3.0 // indirect
-	github.com/spf13/afero v1.12.0 // indirect
-	github.com/spf13/cast v1.7.1 // indirect
-	github.com/spf13/cobra v1.9.1 // indirect
-	github.com/spf13/viper v1.20.1 // indirect
+	github.com/seccomp/libseccomp-golang v0.11.0 // indirect
+	github.com/secure-systems-lab/go-securesystemslib v0.9.1 // indirect
+	github.com/shibumi/go-pathspec v1.3.0 // indirect
+	github.com/sigstore/protobuf-specs v0.5.0 // indirect
+	github.com/sigstore/sigstore v1.10.4 // indirect
+	github.com/sirupsen/logrus v1.9.4-0.20230606125235-dd1b4c2e81af // indirect
+	github.com/sourcegraph/conc v0.3.1-0.20240121214520-5f936abd7ae8 // indirect
+	github.com/spf13/afero v1.15.0 // indirect
+	github.com/spf13/cast v1.10.0 // indirect
+	github.com/spf13/cobra v1.10.2 // indirect
+	github.com/spf13/viper v1.21.0 // indirect
+	github.com/stoewer/go-strcase v1.3.0 // indirect
 	github.com/stripe/stripe-go/v74 v74.30.0 // indirect
 	github.com/subosito/gotenv v1.6.0 // indirect
-	github.com/sylabs/squashfs v1.0.4 // indirect
-	github.com/syndtr/gocapability v0.0.0-20200815063812-42c35b437635 // indirect
+	github.com/sylabs/squashfs v1.0.6 // indirect
 	github.com/therootcompany/xz v1.0.1 // indirect
-	github.com/tklauser/go-sysconf v0.3.12 // indirect
-	github.com/tklauser/numcpus v0.10.0 // indirect
 	github.com/ulikunitz/xz v0.5.15 // indirect
 	github.com/uptrace/opentelemetry-go-extra/otelutil v0.3.2 // indirect
 	github.com/uptrace/opentelemetry-go-extra/otelzap v0.3.2 // indirect
-	github.com/uptrace/uptrace-go v1.35.1 // indirect
-	github.com/vishvananda/netlink v1.3.1-0.20241022031324-976bd8de7d81 // indirect
+	github.com/uptrace/uptrace-go v1.38.0 // indirect
+	github.com/veraison/go-cose v1.3.0 // indirect
+	github.com/vishvananda/netlink v1.3.1 // indirect
 	github.com/vishvananda/netns v0.0.5 // indirect
 	github.com/wagoodman/go-partybus v0.0.0-20230516145632-8ccac152c651 // indirect
 	github.com/wagoodman/go-progress v0.0.0-20230925121702-07e42b3cdba0 // indirect
 	github.com/x448/float16 v0.8.4 // indirect
 	github.com/xlab/treeprint v1.2.0 // indirect
 	github.com/yl2chen/cidranger v1.0.2 // indirect
-	github.com/yusufpapurcu/wmi v1.2.4 // indirect
-	go.mongodb.org/mongo-driver v1.17.1 // indirect
+	go.mongodb.org/mongo-driver v1.17.4 // indirect
 	go.opencensus.io v0.24.0 // indirect
-	go.opentelemetry.io/auto/sdk v1.1.0 // indirect
-	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.59.0 // indirect
-	go.opentelemetry.io/contrib/instrumentation/runtime v0.60.0 // indirect
-	go.opentelemetry.io/otel v1.35.0 // indirect
-	go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp v0.11.0 // indirect
-	go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp v1.35.0 // indirect
-	go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.35.0 // indirect
-	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.35.0 // indirect
-	go.opentelemetry.io/otel/exporters/stdout/stdouttrace v1.35.0 // indirect
-	go.opentelemetry.io/otel/log v0.11.0 // indirect
-	go.opentelemetry.io/otel/metric v1.35.0 // indirect
-	go.opentelemetry.io/otel/sdk v1.35.0 // indirect
-	go.opentelemetry.io/otel/sdk/log v0.11.0 // indirect
-	go.opentelemetry.io/otel/sdk/metric v1.35.0 // indirect
-	go.opentelemetry.io/otel/trace v1.35.0 // indirect
-	go.opentelemetry.io/proto/otlp v1.5.0 // indirect
+	go.opentelemetry.io/auto/sdk v1.2.1 // indirect
+	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.63.0 // indirect
+	go.opentelemetry.io/contrib/instrumentation/runtime v0.64.0 // indirect
+	go.opentelemetry.io/otel v1.39.0 // indirect
+	go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp v0.14.0 // indirect
+	go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp v1.38.0 // indirect
+	go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.38.0 // indirect
+	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.38.0 // indirect
+	go.opentelemetry.io/otel/exporters/stdout/stdouttrace v1.38.0 // indirect
+	go.opentelemetry.io/otel/log v0.15.0 // indirect
+	go.opentelemetry.io/otel/metric v1.39.0 // indirect
+	go.opentelemetry.io/otel/sdk v1.39.0 // indirect
+	go.opentelemetry.io/otel/sdk/log v0.15.0 // indirect
+	go.opentelemetry.io/otel/sdk/metric v1.39.0 // indirect
+	go.opentelemetry.io/otel/trace v1.39.0 // indirect
+	go.opentelemetry.io/proto/otlp v1.9.0 // indirect
 	go.uber.org/multierr v1.11.0 // indirect
 	go.uber.org/zap v1.27.0 // indirect
+	go.yaml.in/yaml/v2 v2.4.3 // indirect
+	go.yaml.in/yaml/v3 v3.0.4 // indirect
 	go4.org/netipx v0.0.0-20231129151722-fdeea329fbba // indirect
-	golang.org/x/crypto v0.45.0 // indirect
-	golang.org/x/exp v0.0.0-20250103183323-7d7fa50e5329 // indirect
-	golang.org/x/net v0.47.0 // indirect
-	golang.org/x/oauth2 v0.30.0 // indirect
-	golang.org/x/sync v0.18.0 // indirect
-	golang.org/x/sys v0.38.0 // indirect
-	golang.org/x/term v0.37.0 // indirect
-	golang.org/x/text v0.31.0 // indirect
-	golang.org/x/time v0.12.0 // indirect
-	google.golang.org/genproto v0.0.0-20241118233622-e639e219e697 // indirect
-	google.golang.org/genproto/googleapis/api v0.0.0-20250519155744-55703ea1f237 // indirect
-	google.golang.org/genproto/googleapis/rpc v0.0.0-20250519155744-55703ea1f237 // indirect
-	google.golang.org/grpc v1.72.1 // indirect
-	google.golang.org/protobuf v1.36.6 // indirect
-	gopkg.in/evanphx/json-patch.v4 v4.12.0 // indirect
+	golang.org/x/crypto v0.46.0 // indirect
+	golang.org/x/exp v0.0.0-20250718183923-645b1fa84792 // indirect
+	golang.org/x/mod v0.30.0 // indirect
+	golang.org/x/net v0.48.0 // indirect
+	golang.org/x/oauth2 v0.33.0 // indirect
+	golang.org/x/sync v0.19.0 // indirect
+	golang.org/x/sys v0.39.0 // indirect
+	golang.org/x/term v0.38.0 // indirect
+	golang.org/x/text v0.32.0 // indirect
+	golang.org/x/time v0.14.0 // indirect
+	google.golang.org/genproto v0.0.0-20250715232539-7130f93afb79 // indirect
+	google.golang.org/genproto/googleapis/api v0.0.0-20251202230838-ff82c1b0f217 // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20251202230838-ff82c1b0f217 // indirect
+	google.golang.org/grpc v1.77.0 // indirect
+	google.golang.org/protobuf v1.36.11 // indirect
+	gopkg.in/evanphx/json-patch.v4 v4.13.0 // indirect
 	gopkg.in/inf.v0 v0.9.1 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
 	istio.io/pkg v0.0.0-20231221211216-7635388a563e // indirect
-	k8s.io/apiextensions-apiserver v0.33.0 // indirect
-	k8s.io/apiserver v0.33.0 // indirect
-	k8s.io/cli-runtime v0.33.0 // indirect
-	k8s.io/component-base v0.33.0 // indirect
-	k8s.io/cri-api v0.33.0 // indirect
+	k8s.io/apiextensions-apiserver v0.35.0 // indirect
+	k8s.io/apiserver v0.35.0 // indirect
+	k8s.io/cli-runtime v0.35.0 // indirect
+	k8s.io/component-base v0.35.0 // indirect
+	k8s.io/cri-api v0.35.0 // indirect
 	k8s.io/klog/v2 v2.130.1 // indirect
-	k8s.io/kube-openapi v0.0.0-20250318190949-c8a335a9a2ff // indirect
-	k8s.io/kubelet v0.33.0 // indirect
-	k8s.io/utils v0.0.0-20250321185631-1f6e0b77f77e // indirect
-	oras.land/oras-go/v2 v2.5.0 // indirect
-	sigs.k8s.io/controller-runtime v0.20.4 // indirect
-	sigs.k8s.io/json v0.0.0-20241014173422-cfa47c3a1cc8 // indirect
-	sigs.k8s.io/kustomize/api v0.19.0 // indirect
-	sigs.k8s.io/kustomize/kyaml v0.19.0 // indirect
+	k8s.io/kube-openapi v0.0.0-20250910181357-589584f1c912 // indirect
+	k8s.io/kubelet v0.35.0 // indirect
+	k8s.io/utils v0.0.0-20251002143259-bc988d571ff4 // indirect
+	modernc.org/libc v1.66.3 // indirect
+	modernc.org/mathutil v1.7.1 // indirect
+	modernc.org/memory v1.11.0 // indirect
+	modernc.org/sqlite v1.38.2 // indirect
+	oras.land/oras-go/v2 v2.6.0 // indirect
+	sigs.k8s.io/controller-runtime v0.21.0 // indirect
+	sigs.k8s.io/json v0.0.0-20250730193827-2d320260d730 // indirect
+	sigs.k8s.io/kustomize/api v0.20.1 // indirect
+	sigs.k8s.io/kustomize/kyaml v0.20.1 // indirect
 	sigs.k8s.io/randfill v1.0.0 // indirect
-	sigs.k8s.io/structured-merge-diff/v4 v4.7.0 // indirect
-	sigs.k8s.io/yaml v1.4.0 // indirect
+	sigs.k8s.io/structured-merge-diff/v6 v6.3.0 // indirect
+	sigs.k8s.io/yaml v1.6.0 // indirect
+	zombiezen.com/go/sqlite v1.4.0 // indirect
 )
+
+replace github.com/kubescape/storage => ../../
+
+replace github.com/kubescape/node-agent => ../../../node-agent
+
+replace github.com/inspektor-gadget/inspektor-gadget => github.com/matthyx/inspektor-gadget v0.0.0-20260203101533-6ef87216d3dd
diff --git a/tests/integration-test-suite/go.sum b/tests/integration-test-suite/go.sum
index ba3bc59c0..972cfe8f7 100644
--- a/tests/integration-test-suite/go.sum
+++ b/tests/integration-test-suite/go.sum
@@ -1,3 +1,5 @@
+cel.dev/expr v0.24.0 h1:56OvJKSH3hDGL0ml5uSxZmz3/3Pq4tJ+fb1unVLAFcY=
+cel.dev/expr v0.24.0/go.mod h1:hLPLo1W4QUmuYdA72RBX06QTs6MXw941piREPl3Yfiw=
 cloud.google.com/go v0.26.0/go.mod h1:aQUYkXzVsufM+DwF1aE+0xfcU+56JwCaLick0ClmMTw=
 cloud.google.com/go v0.31.0/go.mod h1:aQUYkXzVsufM+DwF1aE+0xfcU+56JwCaLick0ClmMTw=
 cloud.google.com/go v0.34.0/go.mod h1:aQUYkXzVsufM+DwF1aE+0xfcU+56JwCaLick0ClmMTw=
@@ -49,29 +51,37 @@ cloud.google.com/go/storage v1.8.0/go.mod h1:Wv1Oy7z6Yz3DshWRJFhqM/UCfaWIRTdp0RX
 cloud.google.com/go/storage v1.10.0/go.mod h1:FLPqc6j+Ki4BU591ie1oL6qBQGu2Bl/tZ9ullr3+Kg0=
 cyphar.com/go-pathrs v0.2.1 h1:9nx1vOgwVvX1mNBWDu93+vaceedpbsDqo+XuBGL40b8=
 cyphar.com/go-pathrs v0.2.1/go.mod h1:y8f1EMG7r+hCuFf/rXsKqMJrJAUoADZGNh5/vZPKcGc=
-dario.cat/mergo v1.0.1 h1:Ra4+bf83h2ztPIQYNP99R6m+Y7KfnARDfID+a+vLl4s=
-dario.cat/mergo v1.0.1/go.mod h1:uNxQE+84aUszobStD9th8a29P2fMDhsBdgRYvZOxGmk=
+dario.cat/mergo v1.0.2 h1:85+piFYR1tMbRrLcDwR18y4UKJ3aH1Tbzi24VRW1TK8=
+dario.cat/mergo v1.0.2/go.mod h1:E/hbnu0NxMFBjpMIE34DRGLWqDy0g5FuKDhCb31ngxA=
 dmitri.shuralyov.com/app/changes v0.0.0-20180602232624-0a106ad413e3/go.mod h1:Yl+fi1br7+Rr3LqpNJf1/uxUdtRUV+Tnj0o93V2B9MU=
 dmitri.shuralyov.com/gpu/mtl v0.0.0-20190408044501-666a987793e9/go.mod h1:H6x//7gZCb22OMCxBHrMx7a5I7Hp++hsVxbQ4BYO7hU=
 dmitri.shuralyov.com/html/belt v0.0.0-20180602232347-f7d459c86be0/go.mod h1:JLBrvjyP0v+ecvNYvCpyZgu5/xkfAUhi6wJj28eUfSU=
 dmitri.shuralyov.com/service/change v0.0.0-20181023043359-a85b471d5412/go.mod h1:a1inKt/atXimZ4Mv927x+r7UpyzRUf4emIoiiSC2TN4=
 dmitri.shuralyov.com/state v0.0.0-20180228185332-28bcc343414c/go.mod h1:0PRwlb0D6DFvNNtx+9ybjezNCa8XF0xaYcETyp6rHWU=
 git.apache.org/thrift.git v0.0.0-20180902110319-2566ecd5d999/go.mod h1:fPE2ZNJGynbRyZ4dJvy6G277gSllfV2HJqblrnkyeyg=
-github.com/AdaLogics/go-fuzz-headers v0.0.0-20230811130428-ced1acdcaa24 h1:bvDV9vkmnHYOMsOr4WLk+Vo07yKIzd94sVoIqshQ4bU=
-github.com/AdaLogics/go-fuzz-headers v0.0.0-20230811130428-ced1acdcaa24/go.mod h1:8o94RPi1/7XTJvwPpRSzSUedZrtlirdB3r9Z20bi2f8=
-github.com/AdamKorcz/go-118-fuzz-build v0.0.0-20231105174938-2b5cbb29f3e2 h1:dIScnXFlF784X79oi7MzVT6GWqr/W1uUt0pB5CsDs9M=
-github.com/AdamKorcz/go-118-fuzz-build v0.0.0-20231105174938-2b5cbb29f3e2/go.mod h1:gCLVsLfv1egrcZu+GoJATN5ts75F2s62ih/457eWzOw=
+github.com/AdaLogics/go-fuzz-headers v0.0.0-20240806141605-e8a1dd7889d6 h1:He8afgbRMd7mFxO99hRNu+6tazq8nFF9lIwo9JFroBk=
+github.com/AdaLogics/go-fuzz-headers v0.0.0-20240806141605-e8a1dd7889d6/go.mod h1:8o94RPi1/7XTJvwPpRSzSUedZrtlirdB3r9Z20bi2f8=
+github.com/AdamKorcz/go-118-fuzz-build v0.0.0-20250520111509-a70c2aa677fa h1:x6kFzdPgBoLbyoNkA/jny0ENpoEz4wqY8lPTQL2DPkg=
+github.com/AdamKorcz/go-118-fuzz-build v0.0.0-20250520111509-a70c2aa677fa/go.mod h1:gCLVsLfv1egrcZu+GoJATN5ts75F2s62ih/457eWzOw=
 github.com/Azure/go-ansiterm v0.0.0-20250102033503-faa5f7b0171c h1:udKWzYgxTojEKWjV8V+WSxDXJ4NFATAsZjh8iIbsQIg=
 github.com/Azure/go-ansiterm v0.0.0-20250102033503-faa5f7b0171c/go.mod h1:xomTg63KZ2rFqZQzSB4Vz2SUXa1BpHTVz9L5PTmPC4E=
+github.com/Azure/go-ntlmssp v0.0.0-20221128193559-754e69321358 h1:mFRzDkZVAjdal+s7s0MwaRv9igoPqLRdzOLzw/8Xvq8=
+github.com/Azure/go-ntlmssp v0.0.0-20221128193559-754e69321358/go.mod h1:chxPXzSsl7ZWRAuOIE23GDNzjWuZquvFlgA8xmpunjU=
 github.com/BurntSushi/toml v0.3.1/go.mod h1:xHWCNGjB5oqiDr8zfno3MHue2Ht5sIBksp03qcyfWMU=
 github.com/BurntSushi/toml v0.4.1/go.mod h1:CxXYINrC8qIiEnFrOxCa7Jy5BFHlXnUU2pbicEuybxQ=
 github.com/BurntSushi/xgb v0.0.0-20160522181843-27f122750802/go.mod h1:IVnqGOEym/WlBOVXweHU+Q+/VP0lqqI8lqeDx9IjBqo=
 github.com/DataDog/datadog-go v3.2.0+incompatible/go.mod h1:LButxg5PwREeZtORoXG3tL4fMGNddJ+vMq1mwgfaqoQ=
+github.com/DmitriyVTitov/size v1.5.0 h1:/PzqxYrOyOUX1BXj6J9OuVRVGe+66VL4D9FlUaW515g=
+github.com/DmitriyVTitov/size v1.5.0/go.mod h1:le6rNI4CoLQV1b9gzp1+3d7hMAD/uu2QcJ+aYbNgiU0=
+github.com/Masterminds/semver/v3 v3.4.0 h1:Zog+i5UMtVoCU8oKka5P7i9q9HgrJeGzI9SA1Xbatp0=
+github.com/Masterminds/semver/v3 v3.4.0/go.mod h1:4V+yj/TJE1HU9XfppCwVMZq3I84lprf4nC11bSS5beM=
 github.com/Microsoft/go-winio v0.6.2 h1:F2VQgta7ecxGYO8k3ZZz3RS8fVIXVxONVUPlNERoyfY=
 github.com/Microsoft/go-winio v0.6.2/go.mod h1:yd8OoFMLzJbo9gZq8j5qaps8bJ9aShtEA8Ipt1oGCvU=
-github.com/Microsoft/hcsshim v0.12.9 h1:2zJy5KA+l0loz1HzEGqyNnjd3fyZA31ZBCGKacp6lLg=
-github.com/Microsoft/hcsshim v0.12.9/go.mod h1:fJ0gkFAna6ukt0bLdKB8djt4XIJhF/vEPuoIWYVvZ8Y=
+github.com/Microsoft/hcsshim v0.13.0 h1:/BcXOiS6Qi7N9XqUcv27vkIuVOkBEcWstd2pMlWSeaA=
+github.com/Microsoft/hcsshim v0.13.0/go.mod h1:9KWJ/8DgU+QzYGupX4tzMhRQE8h6w90lH6HAaclpEok=
 github.com/OneOfOne/xxhash v1.2.2/go.mod h1:HSdplMjZKSmBqAxg5vPj2TmRDmfkzw+cTzAElWljhcU=
+github.com/SergJa/jsonhash v0.0.0-20210531165746-fc45f346aa74 h1:zZX7V5abnOB0VTEFnwYxwbuot0GCZUjQZQpjHKnG1Kk=
+github.com/SergJa/jsonhash v0.0.0-20210531165746-fc45f346aa74/go.mod h1:GE9lvSMBrKhFDkoh660mCThn1v7/jfb1r0Z+DpUX4zQ=
 github.com/acobaugh/osrelease v0.1.0 h1:Yb59HQDGGNhCj4suHaFQQfBps5wyoKLSSX/J/+UifRE=
 github.com/acobaugh/osrelease v0.1.0/go.mod h1:4bFEs0MtgHNHBrmHCt67gNisnabCRAlzdVasCEGHTWY=
 github.com/adrg/xdg v0.5.3 h1:xRnxJXne7+oWDatRhR1JLnvuccuIeCoBu2rtuLqQB78=
@@ -80,38 +90,72 @@ github.com/alecthomas/template v0.0.0-20160405071501-a0175ee3bccc/go.mod h1:LOuy
 github.com/alecthomas/template v0.0.0-20190718012654-fb15b899a751/go.mod h1:LOuyumcjzFXgccqObfd/Ljyb9UuFJ6TxHnclSeseNhc=
 github.com/alecthomas/units v0.0.0-20151022065526-2efee857e7cf/go.mod h1:ybxpYRFXyAe+OPACYpWeL0wqObRcbAqCMya13uyzqw0=
 github.com/alecthomas/units v0.0.0-20190717042225-c3de453c63f4/go.mod h1:ybxpYRFXyAe+OPACYpWeL0wqObRcbAqCMya13uyzqw0=
-github.com/anchore/clio v0.0.0-20241115144204-29e89f9fa837 h1:bIG3WsfosZsJ5LMC7PB9J/ekFM3a0j0ZEDvN3ID6GTI=
-github.com/anchore/clio v0.0.0-20241115144204-29e89f9fa837/go.mod h1:tRQVKkjYeejrh9AdM0s1esbwtMU7rdHAHSQWkv4qskE=
-github.com/anchore/fangs v0.0.0-20250402135612-96e29e45f3fe h1:qv/xxpjF5RdKPqZjx8RM0aBi3HUCAO0DhRBMs2xhY1I=
-github.com/anchore/fangs v0.0.0-20250402135612-96e29e45f3fe/go.mod h1:vrcYMDps9YXwwx2a9AsvipM6Fi5H9//9bymGb8G8BIQ=
+github.com/alexbrainman/sspi v0.0.0-20231016080023-1a75b4708caa h1:LHTHcTQiSGT7VVbI0o4wBRNQIgn917usHWOd6VAffYI=
+github.com/alexbrainman/sspi v0.0.0-20231016080023-1a75b4708caa/go.mod h1:cEWa1LVoE5KvSD9ONXsZrj0z6KqySlCCNKHlLzbqAt4=
+github.com/anchore/clio v0.0.0-20250715152405-a0fa658e5084 h1:7DUAXEdAxoANPlDgxYiaSRKnWnTygvdrrWhnmvEjNLg=
+github.com/anchore/clio v0.0.0-20250715152405-a0fa658e5084/go.mod h1:42dWox8z4//b898OIELsQnSdYq9q1aCXkwp5fKF+BEU=
+github.com/anchore/fangs v0.0.0-20250716230140-94c22408c232 h1:aVC6r9h5wGNh8BYTW3CXxOdPoZzY/bBRWne1NvSTlO8=
+github.com/anchore/fangs v0.0.0-20250716230140-94c22408c232/go.mod h1:Zees1AEKNpXIRgdVAMYWITncarLFiPOtEQ7rl45V/h0=
 github.com/anchore/go-homedir v0.0.0-20250319154043-c29668562e4d h1:gT69osH9AsdpOfqxbRwtxcNnSZ1zg4aKy2BevO3ZBdc=
 github.com/anchore/go-homedir v0.0.0-20250319154043-c29668562e4d/go.mod h1:PhSnuFYknwPZkOWKB1jXBNToChBA+l0FjwOxtViIc50=
 github.com/anchore/go-logger v0.0.0-20250318195838-07ae343dd722 h1:2SqmFgE7h+Ql4VyBzhjLkRF/3gDrcpUBj8LjvvO6OOM=
 github.com/anchore/go-logger v0.0.0-20250318195838-07ae343dd722/go.mod h1:oFuE8YuTCM+spgMXhePGzk3asS94yO9biUfDzVTFqNw=
-github.com/anchore/packageurl-go v0.1.1-0.20241018175412-5c22e6360c4f h1:dAQPIrQ3a5PBqZeZ+B9NGZsGmodk4NO9OjDIsQmQyQM=
-github.com/anchore/packageurl-go v0.1.1-0.20241018175412-5c22e6360c4f/go.mod h1:KoYIv7tdP5+CC9VGkeZV4/vGCKsY55VvoG+5dadg4YI=
-github.com/anchore/stereoscope v0.0.11 h1:d+dePyWyQzoQehnWOnx/aISW5HW1zLAQKzvaFIpydsU=
-github.com/anchore/stereoscope v0.0.11/go.mod h1:dxQyMHSdvgOCscQd/lInPHeP5xCJsZYxpzvzy8Y804Y=
-github.com/anchore/syft v1.18.1 h1:JZ7CLbeWrWolCZa4f6SJBLJ9qGBLFCzHrFd8c4bsm94=
-github.com/anchore/syft v1.18.1/go.mod h1:ufXPZcjmoTjERaC0HTEW2+chF+fQdryhaQ9arcUO2WQ=
+github.com/anchore/packageurl-go v0.1.1-0.20250220190351-d62adb6e1115 h1:ZyRCmiEjnoGJZ1+Ah0ZZ/mKKqNhGcUZBl0s7PTTDzvY=
+github.com/anchore/packageurl-go v0.1.1-0.20250220190351-d62adb6e1115/go.mod h1:KoYIv7tdP5+CC9VGkeZV4/vGCKsY55VvoG+5dadg4YI=
+github.com/anchore/stereoscope v0.1.9 h1:Nhvk8g6PRx9ubaJU4asAhD3fGcY5HKXZCDGkxI2e0sI=
+github.com/anchore/stereoscope v0.1.9/go.mod h1:YkrCtDgz7A+w6Ggd0yxU9q58CerqQFwYARS+F2RvLQQ=
+github.com/anchore/syft v1.32.0 h1:JcX9W+P/Xjv5DNg3TNBtwiEyZommuTaP16/NC9r0Yfo=
+github.com/anchore/syft v1.32.0/go.mod h1:E6Kd4iBM2ljUOUQvSt7hVK6vBwaHkMXwcvBZmGMSY5o=
 github.com/andreyvit/diff v0.0.0-20170406064948-c7f18ee00883/go.mod h1:rCTlJbsFo29Kk6CurOXKm700vrz8f0KW0JNfpkRJY/8=
 github.com/anmitsu/go-shlex v0.0.0-20161002113705-648efa622239/go.mod h1:2FmKhYUyUczH0OGQWaF5ceTx0UBShxjsH6f8oGKYe2c=
 github.com/antihax/optional v1.0.0/go.mod h1:uupD/76wgC+ih3iEmQUL+0Ugr19nfwCT1kdvxnR2qWY=
+github.com/antlr4-go/antlr/v4 v4.13.0 h1:lxCg3LAv+EUK6t1i0y1V6/SLeUi0eKEKdhQAlS8TVTI=
+github.com/antlr4-go/antlr/v4 v4.13.0/go.mod h1:pfChB/xh/Unjila75QW7+VU4TSnWnnk9UTnmpPaOR2g=
 github.com/armon/circbuf v0.0.0-20150827004946-bbbad097214e/go.mod h1:3U/XgcO3hCbHZ8TKRvWD2dDTCfh9M9ya+I9JpbB7O8o=
 github.com/armon/go-metrics v0.0.0-20180917152333-f0300d1749da/go.mod h1:Q73ZrmVTwzkszR9V5SSuryQ31EELlFMUz1kKyl939pY=
 github.com/armon/go-metrics v0.3.10/go.mod h1:4O98XIr/9W0sxpJ8UaYkvjk10Iff7SnFrb4QAOwNTFc=
 github.com/armon/go-radix v0.0.0-20180808171621-7fddfc383310/go.mod h1:ufUuZ+zHj4x4TnLV4JWEpy2hxWSpsRywHrMgIH9cCH8=
 github.com/armon/go-radix v1.0.0/go.mod h1:ufUuZ+zHj4x4TnLV4JWEpy2hxWSpsRywHrMgIH9cCH8=
-github.com/armosec/armoapi-go v0.0.596 h1:n8xB6Y/zuzjAqqwc7zJPXxdvn6pqZK94IC6x7nvj1oI=
-github.com/armosec/armoapi-go v0.0.596/go.mod h1:GQQzRuP8OBvbDx7GGwOyw3TCjk5NtK3WbeyfuLoiEts=
+github.com/armosec/armoapi-go v0.0.672 h1:Js3yvV3GnqYCw3Dyq5HHo9br1mCthgrVwHuWCzNX/2w=
+github.com/armosec/armoapi-go v0.0.672/go.mod h1:9jAH0g8ZsryhiBDd/aNMX4+n10bGwTx/doWCyyjSxts=
 github.com/armosec/gojay v1.2.17 h1:VSkLBQzD1c2V+FMtlGFKqWXNsdNvIKygTKJI9ysY8eM=
 github.com/armosec/gojay v1.2.17/go.mod h1:vuvX3DlY0nbVrJ0qCklSS733AWMoQboq3cFyuQW9ybc=
 github.com/armosec/utils-go v0.0.58 h1:g9RnRkxZAmzTfPe2ruMo2OXSYLwVSegQSkSavOfmaIE=
 github.com/armosec/utils-go v0.0.58/go.mod h1:CdqKHKruVJMCxGcZXYW9J+5P9FZou8dMzVpcB0Xt8pk=
-github.com/armosec/utils-k8s-go v0.0.30 h1:Gj8MJck0jZPSLSq8ZMiRPT3F/laOYQdaLxXKKcjijt4=
-github.com/armosec/utils-k8s-go v0.0.30/go.mod h1:t0vvPJhYE+X+bOsaMsD2SzWU7WkJmV2Ltn9hg66AIe8=
+github.com/armosec/utils-k8s-go v0.0.35 h1:CliNObhAca5UYl84m5OQecOTm9ZfMFI8648pYhQJiu4=
+github.com/armosec/utils-k8s-go v0.0.35/go.mod h1:iHwR/KhMFtdd8Px1oYexLZYOHqmdknfGTZ8b7sZS0Ms=
 github.com/asaskevich/govalidator v0.0.0-20230301143203-a9d515a09cc2 h1:DklsrG3dyBCFEj5IhUbnKptjxatkF07cF2ak3yi77so=
 github.com/asaskevich/govalidator v0.0.0-20230301143203-a9d515a09cc2/go.mod h1:WaHUgvxTVq04UNunO+XhnAqY/wQc+bxr74GqbsZ/Jqw=
+github.com/aws/aws-sdk-go-v2 v1.41.1 h1:ABlyEARCDLN034NhxlRUSZr4l71mh+T5KAeGh6cerhU=
+github.com/aws/aws-sdk-go-v2 v1.41.1/go.mod h1:MayyLB8y+buD9hZqkCW3kX1AKq07Y5pXxtgB+rRFhz0=
+github.com/aws/aws-sdk-go-v2/config v1.32.7 h1:vxUyWGUwmkQ2g19n7JY/9YL8MfAIl7bTesIUykECXmY=
+github.com/aws/aws-sdk-go-v2/config v1.32.7/go.mod h1:2/Qm5vKUU/r7Y+zUk/Ptt2MDAEKAfUtKc1+3U1Mo3oY=
+github.com/aws/aws-sdk-go-v2/credentials v1.19.7 h1:tHK47VqqtJxOymRrNtUXN5SP/zUTvZKeLx4tH6PGQc8=
+github.com/aws/aws-sdk-go-v2/credentials v1.19.7/go.mod h1:qOZk8sPDrxhf+4Wf4oT2urYJrYt3RejHSzgAquYeppw=
+github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.17 h1:I0GyV8wiYrP8XpA70g1HBcQO1JlQxCMTW9npl5UbDHY=
+github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.17/go.mod h1:tyw7BOl5bBe/oqvoIeECFJjMdzXoa/dfVz3QQ5lgHGA=
+github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.17 h1:xOLELNKGp2vsiteLsvLPwxC+mYmO6OZ8PYgiuPJzF8U=
+github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.17/go.mod h1:5M5CI3D12dNOtH3/mk6minaRwI2/37ifCURZISxA/IQ=
+github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.17 h1:WWLqlh79iO48yLkj1v3ISRNiv+3KdQoZ6JWyfcsyQik=
+github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.17/go.mod h1:EhG22vHRrvF8oXSTYStZhJc1aUgKtnJe+aOiFEV90cM=
+github.com/aws/aws-sdk-go-v2/internal/ini v1.8.4 h1:WKuaxf++XKWlHWu9ECbMlha8WOEGm0OUEZqm4K/Gcfk=
+github.com/aws/aws-sdk-go-v2/internal/ini v1.8.4/go.mod h1:ZWy7j6v1vWGmPReu0iSGvRiise4YI5SkR3OHKTZ6Wuc=
+github.com/aws/aws-sdk-go-v2/service/ecs v1.71.0 h1:MzP/ElwTpINq+hS80ZQz4epKVnUTlz8Sz+P/AFORCKM=
+github.com/aws/aws-sdk-go-v2/service/ecs v1.71.0/go.mod h1:pMlGFDpHoLTJOIZHGdJOAWmi+xeIlQXuFTuQxs1epYE=
+github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.4 h1:0ryTNEdJbzUCEWkVXEXoqlXV72J5keC1GvILMOuD00E=
+github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.4/go.mod h1:HQ4qwNZh32C3CBeO6iJLQlgtMzqeG17ziAA/3KDJFow=
+github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.17 h1:RuNSMoozM8oXlgLG/n6WLaFGoea7/CddrCfIiSA+xdY=
+github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.17/go.mod h1:F2xxQ9TZz5gDWsclCtPQscGpP0VUOc8RqgFM3vDENmU=
+github.com/aws/aws-sdk-go-v2/service/signin v1.0.5 h1:VrhDvQib/i0lxvr3zqlUwLwJP4fpmpyD9wYG1vfSu+Y=
+github.com/aws/aws-sdk-go-v2/service/signin v1.0.5/go.mod h1:k029+U8SY30/3/ras4G/Fnv/b88N4mAfliNn08Dem4M=
+github.com/aws/aws-sdk-go-v2/service/sso v1.30.9 h1:v6EiMvhEYBoHABfbGB4alOYmCIrcgyPPiBE1wZAEbqk=
+github.com/aws/aws-sdk-go-v2/service/sso v1.30.9/go.mod h1:yifAsgBxgJWn3ggx70A3urX2AN49Y5sJTD1UQFlfqBw=
+github.com/aws/aws-sdk-go-v2/service/ssooidc v1.35.13 h1:gd84Omyu9JLriJVCbGApcLzVR3XtmC4ZDPcAI6Ftvds=
+github.com/aws/aws-sdk-go-v2/service/ssooidc v1.35.13/go.mod h1:sTGThjphYE4Ohw8vJiRStAcu3rbjtXRsdNB0TvZ5wwo=
+github.com/aws/aws-sdk-go-v2/service/sts v1.41.6 h1:5fFjR/ToSOzB2OQ/XqWpZBmNvmP/pJ1jOWYlFDJTjRQ=
+github.com/aws/aws-sdk-go-v2/service/sts v1.41.6/go.mod h1:qgFDZQSD/Kys7nJnVqYlWKnh0SSdMjAi0uSwON4wgYQ=
+github.com/aws/smithy-go v1.24.0 h1:LpilSUItNPFr1eY85RYgTIg5eIEPtvFbskaFcmmIUnk=
+github.com/aws/smithy-go v1.24.0/go.mod h1:LEj2LM3rBRQJxPZTB4KuzZkaZYnZPnvgIhb4pu07mx0=
 github.com/becheran/wildmatch-go v1.0.0 h1:mE3dGGkTmpKtT4Z+88t8RStG40yN9T+kFEGj2PZFSzA=
 github.com/becheran/wildmatch-go v1.0.0/go.mod h1:gbMvj0NtVdJ15Mg/mH9uxk2R1QCistMyU7d9KFzroX4=
 github.com/beorn7/perks v0.0.0-20180321164747-3a771d992973/go.mod h1:Dwedo/Wpr24TaqPxmxbtue+5NUziq4I4S80YR8gNf3Q=
@@ -119,20 +163,20 @@ github.com/beorn7/perks v1.0.0/go.mod h1:KWe93zE9D1o94FZ5RNwFwVgaQK1VOXiVxmqh+Ce
 github.com/beorn7/perks v1.0.1 h1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM=
 github.com/beorn7/perks v1.0.1/go.mod h1:G2ZrVWU2WbWT9wwq4/hrbKbnv/1ERSJQ0ibhJ6rlkpw=
 github.com/bgentry/speakeasy v0.1.0/go.mod h1:+zsyZBPWlz7T6j88CTgSN5bM796AkVf0kBD4zp0CCIs=
+github.com/blang/semver v3.5.1+incompatible h1:cQNTCjp13qL8KC3Nbxr/y2Bqb63oX6wdnnjpJbkM4JQ=
+github.com/blang/semver v3.5.1+incompatible/go.mod h1:kRBLl5iJ+tD4TcOOxsy/0fnwebNt5EWlYSAyrTnjyyk=
 github.com/blang/semver/v4 v4.0.0 h1:1PFHFE6yCCTv8C1TeyNNarDzntLi7wMI5i/pzqYIsAM=
 github.com/blang/semver/v4 v4.0.0/go.mod h1:IbckMUScFkM3pff0VJDNKRiT6TG/YpiHIM2yvyW5YoQ=
-github.com/bmatcuk/doublestar/v4 v4.7.1 h1:fdDeAqgT47acgwd9bd9HxJRDmc9UAmPpc+2m0CXv75Q=
-github.com/bmatcuk/doublestar/v4 v4.7.1/go.mod h1:xBQ8jztBU6kakFMg+8WGxn0c6z1fTSPVIjEY1Wr7jzc=
+github.com/bmatcuk/doublestar/v4 v4.9.1 h1:X8jg9rRZmJd4yRy7ZeNDRnM+T3ZfHv15JiBJ/avrEXE=
+github.com/bmatcuk/doublestar/v4 v4.9.1/go.mod h1:xBQ8jztBU6kakFMg+8WGxn0c6z1fTSPVIjEY1Wr7jzc=
 github.com/bradfitz/go-smtpd v0.0.0-20170404230938-deb6d6237625/go.mod h1:HYsPBTaaSFSlLx/70C2HPIMNZpVV8+vt/A+FMnYP11g=
 github.com/briandowns/spinner v1.23.2 h1:Zc6ecUnI+YzLmJniCfDNaMbW0Wid1d5+qcTq4L2FW8w=
 github.com/briandowns/spinner v1.23.2/go.mod h1:LaZeM4wm2Ywy6vO571mvhQNRcWfRUnXOs0RcKV0wYKM=
 github.com/buger/jsonparser v0.0.0-20181115193947-bf1c66bbce23/go.mod h1:bbYlZJ7hK1yFx9hf58LP0zeX7UjIGs20ufpu3evjr+s=
-github.com/cenkalti/backoff v2.2.1+incompatible h1:tNowT99t7UNflLxfYYSlKYsBpXdEet03Pg2g16Swow4=
-github.com/cenkalti/backoff v2.2.1+incompatible/go.mod h1:90ReRw6GdpyfrHakVjL/QHaoyV4aDUVVkXQJJJ3NXXM=
 github.com/cenkalti/backoff/v4 v4.3.0 h1:MyRJ/UdXutAwSAT+s3wNd7MfTIcy71VQueUuFK343L8=
 github.com/cenkalti/backoff/v4 v4.3.0/go.mod h1:Y3VNntkOUPxTVeUxJ/G5vcM//AlwfmyYozVcomhLiZE=
-github.com/cenkalti/backoff/v5 v5.0.2 h1:rIfFVxEf1QsI7E1ZHfp/B4DF/6QBAUhmgkxc0H7Zss8=
-github.com/cenkalti/backoff/v5 v5.0.2/go.mod h1:rkhZdG3JZukswDf7f0cwqPNk4K0sa+F97BxZthm/crw=
+github.com/cenkalti/backoff/v5 v5.0.3 h1:ZN+IMa753KfX5hd8vVaMixjnqRZ3y8CuJKRKj1xcsSM=
+github.com/cenkalti/backoff/v5 v5.0.3/go.mod h1:rkhZdG3JZukswDf7f0cwqPNk4K0sa+F97BxZthm/crw=
 github.com/census-instrumentation/opencensus-proto v0.2.1/go.mod h1:f6KPmirojxKA12rnyqOA5BBL4O983OfeGPqjHWSTneU=
 github.com/census-instrumentation/opencensus-proto v0.3.0/go.mod h1:f6KPmirojxKA12rnyqOA5BBL4O983OfeGPqjHWSTneU=
 github.com/cespare/xxhash v1.1.0/go.mod h1:XrSqR1VqqWfGrhpAt58auRo0WTKS1nRRg3ghfAqPWnc=
@@ -145,11 +189,16 @@ github.com/chzyer/readline v0.0.0-20180603132655-2972be24d48e/go.mod h1:nSuG5e5P
 github.com/chzyer/test v0.0.0-20180213035817-a1ea475d72b1/go.mod h1:Q3SI9o4m/ZMnBNeIyt5eFwwo7qiLfzFZmjNmxjkiQlU=
 github.com/cilium/cilium v1.16.17 h1:5DUFyl/DhCEhWGdMQjw0eA9FlI8dBFpg2ENYJan3Wk0=
 github.com/cilium/cilium v1.16.17/go.mod h1:Wa47utg/8XuOe8pq64KwNOM8wDsXoYP3HZ6uw3IYDVg=
-github.com/cilium/ebpf v0.18.0 h1:OsSwqS4y+gQHxaKgg2U/+Fev834kdnsQbtzRnbVC6Gs=
-github.com/cilium/ebpf v0.18.0/go.mod h1:vmsAT73y4lW2b4peE+qcOqw6MxvWQdC+LiU5gd/xyo4=
+github.com/cilium/ebpf v0.5.0/go.mod h1:4tRaxcgiL706VnOzHOdBlY8IEAIdxINsQBcU4xJJXRs=
+github.com/cilium/ebpf v0.7.0/go.mod h1:/oI2+1shJiTGAMgl6/RgJr36Eo1jzrRcAWbcXO2usCA=
+github.com/cilium/ebpf v0.8.1/go.mod h1:f5zLIM0FSNuAkSyLAN7X+Hy6yznlF1mNiWUMfxMtrgk=
+github.com/cilium/ebpf v0.20.0 h1:atwWj9d3NffHyPZzVlx3hmw1on5CLe9eljR8VuHTwhM=
+github.com/cilium/ebpf v0.20.0/go.mod h1:pzLjFymM+uZPLk/IXZUL63xdx5VXEo+enTzxkZXdycw=
 github.com/circonus-labs/circonus-gometrics v2.3.1+incompatible/go.mod h1:nmEj6Dob7S7YxXgwXpfOuvO54S+tGdZdw9fuRZt25Ag=
 github.com/circonus-labs/circonusllhist v0.1.3/go.mod h1:kMXHVDlOchFAehlya5ePtbp5jckzBHf4XRpQvBOLI+I=
 github.com/client9/misspell v0.3.4/go.mod h1:qj6jICC3Q7zFZvVWo7KLAzC3yx5G7kyvSDkc90ppPyw=
+github.com/cloudflare/cbpfc v0.0.0-20240920015331-ff978e94500b h1:EgR1t4Lnq6uP6QxJQ+oIFtENOHUY3/7gMOE76vL0KcA=
+github.com/cloudflare/cbpfc v0.0.0-20240920015331-ff978e94500b/go.mod h1:X/9cHz8JVzKlvoZyKBgMgrogKZlLf+pWjmm5gSUm5dI=
 github.com/cncf/udpa/go v0.0.0-20191209042840-269d4d468f6f/go.mod h1:M8M6+tZqaGXZJjfX53e64911xZQV5JYwmTeXPW+k8Sc=
 github.com/cncf/udpa/go v0.0.0-20200629203442-efcf912fb354/go.mod h1:WmhPx2Nbnhtbo57+VJT5O0JRkEi1Wbu0z5j0R8u5Hbk=
 github.com/cncf/udpa/go v0.0.0-20201120205902-5459f2c99403/go.mod h1:WmhPx2Nbnhtbo57+VJT5O0JRkEi1Wbu0z5j0R8u5Hbk=
@@ -160,14 +209,16 @@ github.com/cncf/xds/go v0.0.0-20210922020428-25de7278fc84/go.mod h1:eXthEFrGJvWH
 github.com/cncf/xds/go v0.0.0-20211001041855-01bcc9b48dfe/go.mod h1:eXthEFrGJvWHgFFCl3hGmgk+/aYT6PnTQLykKQRLhEs=
 github.com/cncf/xds/go v0.0.0-20211011173535-cb28da3451f1/go.mod h1:eXthEFrGJvWHgFFCl3hGmgk+/aYT6PnTQLykKQRLhEs=
 github.com/cncf/xds/go v0.0.0-20211130200136-a8f946100490/go.mod h1:eXthEFrGJvWHgFFCl3hGmgk+/aYT6PnTQLykKQRLhEs=
+github.com/codahale/rfc6979 v0.0.0-20141003034818-6a90f24967eb h1:EDmT6Q9Zs+SbUoc7Ik9EfrFqcylYqgPZ9ANSbTAntnE=
+github.com/codahale/rfc6979 v0.0.0-20141003034818-6a90f24967eb/go.mod h1:ZjrT6AXHbDs86ZSdt/osfBi5qfexBrKUdONk989Wnk4=
 github.com/containerd/cgroups/v3 v3.0.5 h1:44na7Ud+VwyE7LIoJ8JTNQOa549a8543BmzaJHo6Bzo=
 github.com/containerd/cgroups/v3 v3.0.5/go.mod h1:SA5DLYnXO8pTGYiAHXz94qvLQTKfVM5GEVisn4jpins=
-github.com/containerd/containerd v1.7.29 h1:90fWABQsaN9mJhGkoVnuzEY+o1XDPbg9BTC9QTAHnuE=
-github.com/containerd/containerd v1.7.29/go.mod h1:azUkWcOvHrWvaiUjSQH0fjzuHIwSPg1WL5PshGP4Szs=
-github.com/containerd/containerd/api v1.8.0 h1:hVTNJKR8fMc/2Tiw60ZRijntNMd1U+JVMyTRdsD2bS0=
-github.com/containerd/containerd/api v1.8.0/go.mod h1:dFv4lt6S20wTu/hMcP4350RL87qPWLVa/OHOwmmdnYc=
-github.com/containerd/continuity v0.4.4 h1:/fNVfTJ7wIl/YPMHjf+5H32uFhl63JucB34PlCpMKII=
-github.com/containerd/continuity v0.4.4/go.mod h1:/lNJvtJKUQStBzpVQ1+rasXO1LAWtUQssk28EZvJ3nE=
+github.com/containerd/containerd v1.7.30 h1:/2vezDpLDVGGmkUXmlNPLCCNKHJ5BbC5tJB5JNzQhqE=
+github.com/containerd/containerd v1.7.30/go.mod h1:fek494vwJClULlTpExsmOyKCMUAbuVjlFsJQc4/j44M=
+github.com/containerd/containerd/api v1.9.0 h1:HZ/licowTRazus+wt9fM6r/9BQO7S0vD5lMcWspGIg0=
+github.com/containerd/containerd/api v1.9.0/go.mod h1:GhghKFmTR3hNtyznBoQ0EMWr9ju5AqHjcZPsSpTKutI=
+github.com/containerd/continuity v0.4.5 h1:ZRoN1sXq9u7V6QoHMcVWGhOwDFqZ4B9i5H6un1Wh0x4=
+github.com/containerd/continuity v0.4.5/go.mod h1:/lNJvtJKUQStBzpVQ1+rasXO1LAWtUQssk28EZvJ3nE=
 github.com/containerd/errdefs v1.0.0 h1:tg5yIfIlQIrxYtu9ajqY42W3lpS19XqdxRQeEwYG8PI=
 github.com/containerd/errdefs v1.0.0/go.mod h1:+YBYIdtsnF4Iw6nWZhJcqGSg/dwvV7tyJ/kCkyJ2k+M=
 github.com/containerd/errdefs/pkg v0.3.0 h1:9IKJ06FvyNlexW690DXuQNx2KA2cUJXx151Xdx3ZPPE=
@@ -176,25 +227,28 @@ github.com/containerd/fifo v1.1.0 h1:4I2mbh5stb1u6ycIABlBw9zgtlK8viPI9QkQNRQEEmY
 github.com/containerd/fifo v1.1.0/go.mod h1:bmC4NWMbXlt2EZ0Hc7Fx7QzTFxgPID13eH0Qu+MAb2o=
 github.com/containerd/log v0.1.0 h1:TCJt7ioM2cr/tfR8GPbGf9/VRAX8D2B4PjzCpfX540I=
 github.com/containerd/log v0.1.0/go.mod h1:VRRf09a7mHDIRezVKTRCrOq78v577GXq3bSa3EhrzVo=
+github.com/containerd/nri v0.9.0 h1:jribDJs/oQ95vLO4Yn19HKFYriZGWKiG6nKWjl9Y/x4=
+github.com/containerd/nri v0.9.0/go.mod h1:sDRoMy5U4YolsWthg7TjTffAwPb6LEr//83O+D3xVU4=
 github.com/containerd/platforms v0.2.1 h1:zvwtM3rz2YHPQsF2CHYM8+KtB5dvhISiXh5ZpSBQv6A=
 github.com/containerd/platforms v0.2.1/go.mod h1:XHCb+2/hzowdiut9rkudds9bE5yJ7npe7dG/wG+uFPw=
 github.com/containerd/ttrpc v1.2.7 h1:qIrroQvuOL9HQ1X6KHe2ohc7p+HP/0VE6XPU7elJRqQ=
 github.com/containerd/ttrpc v1.2.7/go.mod h1:YCXHsb32f+Sq5/72xHubdiJRQY9inL4a4ZQrAbN1q9o=
 github.com/containerd/typeurl/v2 v2.2.3 h1:yNA/94zxWdvYACdYO8zofhrTVuQY73fFU1y++dYSw40=
 github.com/containerd/typeurl/v2 v2.2.3/go.mod h1:95ljDnPfD3bAbDJRugOiShd/DlAAsxGtUBhJxIn7SCk=
-github.com/containers/common v0.63.0 h1:ox6vgUYX5TSvt4W+bE36sYBVz/aXMAfRGVAgvknSjBg=
-github.com/containers/common v0.63.0/go.mod h1:+3GCotSqNdIqM3sPs152VvW7m5+Mg8Kk+PExT3G9hZw=
-github.com/coreos/go-oidc/v3 v3.14.1 h1:9ePWwfdwC4QKRlCXsJGou56adA/owXczOzwKdOumLqk=
-github.com/coreos/go-oidc/v3 v3.14.1/go.mod h1:HaZ3szPaZ0e4r6ebqvsLWlk2Tn+aejfmrfah6hnSYEU=
+github.com/containers/common v0.64.2 h1:1xepE7QwQggUXxmyQ1Dbh6Cn0yd7ktk14sN3McSWf5I=
+github.com/containers/common v0.64.2/go.mod h1:o29GfYy4tefUuShm8mOn2AiL5Mpzdio+viHI7n24KJ4=
+github.com/coreos/go-oidc/v3 v3.17.0 h1:hWBGaQfbi0iVviX4ibC7bk8OKT5qNr4klBaCHVNvehc=
+github.com/coreos/go-oidc/v3 v3.17.0/go.mod h1:wqPbKFrVnE90vty060SB40FCJ8fTHTxSwyXJqZH+sI8=
 github.com/coreos/go-semver v0.3.0/go.mod h1:nnelYz7RCh+5ahJtPPxZlU+153eP4D4r3EedlOD2RNk=
 github.com/coreos/go-systemd v0.0.0-20181012123002-c6f51f82210d/go.mod h1:F5haX7vjVVG0kc13fIWeqUViNPyEJxv/OmvnBo0Yme4=
 github.com/coreos/go-systemd/v22 v22.3.2/go.mod h1:Y58oyj3AT4RCenI/lSvhwexgC+NSVTIJ3seZv2GcEnc=
-github.com/coreos/go-systemd/v22 v22.5.0 h1:RrqgGjYQKalulkV8NGVIfkXQf6YYmOyiJKk8iXXhfZs=
-github.com/coreos/go-systemd/v22 v22.5.0/go.mod h1:Y58oyj3AT4RCenI/lSvhwexgC+NSVTIJ3seZv2GcEnc=
+github.com/coreos/go-systemd/v22 v22.6.0 h1:aGVa/v8B7hpb0TKl0MWoAavPDmHvobFe5R5zn0bCJWo=
+github.com/coreos/go-systemd/v22 v22.6.0/go.mod h1:iG+pp635Fo7ZmV/j14KUcmEyWF+0X7Lua8rrTWzYgWU=
 github.com/cpuguy83/go-md2man/v2 v2.0.1/go.mod h1:tgQtvFlXSQOSOSIRvRPT7W67SCa46tRHOmNcaadrF8o=
 github.com/cpuguy83/go-md2man/v2 v2.0.6/go.mod h1:oOW0eioCTA6cOiMLiUPZOpcVxMig6NIQQ7OS05n1F4g=
-github.com/creack/pty v1.1.20 h1:VIPb/a2s17qNeQgDnkfZC35RScx+blkKF8GV68n80J4=
-github.com/creack/pty v1.1.20/go.mod h1:MOBLtS5ELjhRRrroQr9kyvTxUAFNvYEK993ew/Vr4O4=
+github.com/creack/pty v1.1.9/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ33E=
+github.com/creack/pty v1.1.24 h1:bJrF4RRfyJnbTJqzRLHzcGaZK1NeM5kTC9jGgovnR1s=
+github.com/creack/pty v1.1.24/go.mod h1:08sCNb52WyoAwi2QDyzUCTgcvVFhUzewun7wtTfvcwE=
 github.com/crewjam/rfc5424 v0.1.0 h1:MSeXJm22oKovLzWj44AHwaItjIMUMugYGkEzfa831H8=
 github.com/crewjam/rfc5424 v0.1.0/go.mod h1:RCi9M3xHVOeerf6ULZzqv2xOGRO/zYaVUeRyPnBW3gQ=
 github.com/cyphar/filepath-securejoin v0.6.0 h1:BtGB77njd6SVO6VztOHfPxKitJvd/VPT+OFBFMOi1Is=
@@ -203,30 +257,30 @@ github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSs
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc h1:U9qPSI2PIWSS1VwoXQT9A3Wy9MM3WgvqSxFWenqJduM=
 github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
-github.com/deckarep/golang-set/v2 v2.7.0 h1:gIloKvD7yH2oip4VLhsv3JyLLFnC0Y2mlusgcvJYW5k=
-github.com/deckarep/golang-set/v2 v2.7.0/go.mod h1:VAky9rY/yGXJOLEDv3OMci+7wtDpOF4IN+y82NBOac4=
+github.com/deckarep/golang-set/v2 v2.8.0 h1:swm0rlPCmdWn9mESxKOjWk8hXSqoxOp+ZlfuyaAdFlQ=
+github.com/deckarep/golang-set/v2 v2.8.0/go.mod h1:VAky9rY/yGXJOLEDv3OMci+7wtDpOF4IN+y82NBOac4=
 github.com/dghubble/trie v0.1.0 h1:kJnjBLFFElBwS60N4tkPvnLhnpcDxbBjIulgI8CpNGM=
 github.com/dghubble/trie v0.1.0/go.mod h1:sOmnzfBNH7H92ow2292dDFWNsVQuh/izuD7otCYb1ak=
 github.com/dgrijalva/jwt-go/v4 v4.0.0-preview1/go.mod h1:+hnT3ywWDTAFrW5aE+u2Sa/wT555ZqwoCS+pk3p6ry4=
 github.com/distribution/reference v0.6.0 h1:0IXCQ5g4/QMHHkarYzh5l+u8T3t73zM5QvfrDyIgxBk=
 github.com/distribution/reference v0.6.0/go.mod h1:BbU0aIcezP1/5jX/8MP0YiH4SdvB5Y4f/wlDRiLyi3E=
-github.com/docker/cli v28.1.1+incompatible h1:eyUemzeI45DY7eDPuwUcmDyDj1pM98oD5MdSpiItp8k=
-github.com/docker/cli v28.1.1+incompatible/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8=
-github.com/docker/docker v28.1.1+incompatible h1:49M11BFLsVO1gxY9UX9p/zwkE/rswggs8AdFmXQw51I=
-github.com/docker/docker v28.1.1+incompatible/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk=
+github.com/docker/cli v29.1.3+incompatible h1:+kz9uDWgs+mAaIZojWfFt4d53/jv0ZUOOoSh5ZnH36c=
+github.com/docker/cli v29.1.3+incompatible/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8=
+github.com/docker/docker v28.5.2+incompatible h1:DBX0Y0zAjZbSrm1uzOkdr1onVghKaftjlSWt4AFexzM=
+github.com/docker/docker v28.5.2+incompatible/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk=
 github.com/docker/docker-credential-helpers v0.9.3 h1:gAm/VtF9wgqJMoxzT3Gj5p4AqIjCBS4wrsOh9yRqcz8=
 github.com/docker/docker-credential-helpers v0.9.3/go.mod h1:x+4Gbw9aGmChi3qTLZj8Dfn0TD20M/fuWy0E5+WDeCo=
-github.com/docker/go-connections v0.5.0 h1:USnMq7hx7gwdVZq1L49hLXaFtUdTADjXGp+uj1Br63c=
-github.com/docker/go-connections v0.5.0/go.mod h1:ov60Kzw0kKElRwhNs9UlUHAE/F9Fe6GLaXnqyDdmEXc=
-github.com/docker/go-events v0.0.0-20190806004212-e31b211e4f1c h1:+pKlWGMw7gf6bQ+oDZB4KHQFypsfjYlq/C4rfL7D3g8=
-github.com/docker/go-events v0.0.0-20190806004212-e31b211e4f1c/go.mod h1:Uw6UezgYA44ePAFQYUehOuCzmy5zmg/+nl2ZfMWGkpA=
+github.com/docker/go-connections v0.6.0 h1:LlMG9azAe1TqfR7sO+NJttz1gy6KO7VJBh+pMmjSD94=
+github.com/docker/go-connections v0.6.0/go.mod h1:AahvXYshr6JgfUJGdDCs2b5EZG/vmaMAntpSFH5BFKE=
+github.com/docker/go-events v0.0.0-20250114142523-c867878c5e32 h1:EHZfspsnLAz8Hzccd67D5abwLiqoqym2jz/jOS39mCk=
+github.com/docker/go-events v0.0.0-20250114142523-c867878c5e32/go.mod h1:Uw6UezgYA44ePAFQYUehOuCzmy5zmg/+nl2ZfMWGkpA=
 github.com/docker/go-units v0.5.0 h1:69rxXcBk27SvSaaxTtLh/8llcHD8vYHT7WSdRZ/jvr4=
 github.com/docker/go-units v0.5.0/go.mod h1:fgPhTUdO+D/Jk86RDLlptpiXQzgHJF7gydDDbaIK4Dk=
 github.com/dustin/go-humanize v1.0.0/go.mod h1:HtrtbFcZ19U5GC7JDqmcUSB87Iq5E25KnS6fMYU6eOk=
-github.com/ebitengine/purego v0.8.2 h1:jPPGWs2sZ1UgOSgD2bClL0MJIqu58nOmIcBuXr62z1I=
-github.com/ebitengine/purego v0.8.2/go.mod h1:iIjxzd6CiRiOG0UyXP+V1+jWqUXVjPKLAI0mRfJZTmQ=
-github.com/emicklei/go-restful/v3 v3.12.1 h1:PJMDIM/ak7btuL8Ex0iYET9hxM3CI2sjZtzpL63nKAU=
-github.com/emicklei/go-restful/v3 v3.12.1/go.mod h1:6n3XBCmQQb25CM2LCACGz8ukIrRry+4bhvbpWn3mrbc=
+github.com/dustin/go-humanize v1.0.1 h1:GzkhY7T5VNhEkwH0PVJgjz+fX1rhBrR7pRT3mDkpeCY=
+github.com/dustin/go-humanize v1.0.1/go.mod h1:Mu1zIs6XwVuF/gI1OepvI0qD18qycQx+mFykh5fBlto=
+github.com/emicklei/go-restful/v3 v3.12.2 h1:DhwDP0vY3k8ZzE0RunuJy8GhNpPL6zqLkDf9B/a0/xU=
+github.com/emicklei/go-restful/v3 v3.12.2/go.mod h1:6n3XBCmQQb25CM2LCACGz8ukIrRry+4bhvbpWn3mrbc=
 github.com/envoyproxy/go-control-plane v0.9.0/go.mod h1:YTl/9mNaCwkRvm6d1a2C3ymFceY/DCBVvsKhRF0iEA4=
 github.com/envoyproxy/go-control-plane v0.9.1-0.20191026205805-5f8ba28d4473/go.mod h1:YTl/9mNaCwkRvm6d1a2C3ymFceY/DCBVvsKhRF0iEA4=
 github.com/envoyproxy/go-control-plane v0.9.4/go.mod h1:6rpuAdCZL397s3pYoYcLgu1mIlRU8Am5FuJP05cCM98=
@@ -238,8 +292,6 @@ github.com/envoyproxy/go-control-plane v0.9.10-0.20210907150352-cf90f659a021/go.
 github.com/envoyproxy/go-control-plane v0.10.1/go.mod h1:AY7fTTXNdv/aJ2O5jwpxAPOWUZ7hQAEvzN5Pf27BkQQ=
 github.com/envoyproxy/protoc-gen-validate v0.1.0/go.mod h1:iSmxcyjqTsJpI2R4NaDN7+kN2VEUnK/pcBlmesArF7c=
 github.com/envoyproxy/protoc-gen-validate v0.6.2/go.mod h1:2t7qjJNvHPx8IjnBOzl9E9/baC+qXE/TeeyBRzgJDws=
-github.com/evanphx/json-patch v5.9.0+incompatible h1:fBXyNpNMuTTDdquAq/uisOr2lShz4oaXpDTX2bLe7ls=
-github.com/evanphx/json-patch v5.9.0+incompatible/go.mod h1:50XU6AFN0ol/bzJsmQLiYLvXMP4fmwYFNcr97nuDLSk=
 github.com/facebookincubator/flog v0.0.0-20190930132826-d2511d0ce33c/go.mod h1:QGzNH9ujQ2ZUr/CjDGZGWeDAVStrWNjHeEcjJL96Nuk=
 github.com/facebookincubator/nvdtools v0.1.5 h1:jbmDT1nd6+k+rlvKhnkgMokrCAzHoASWE5LtHbX2qFQ=
 github.com/facebookincubator/nvdtools v0.1.5/go.mod h1:Kh55SAWnjckS96TBSrXI99KrEKH4iB0OJby3N8GRJO4=
@@ -250,56 +302,60 @@ github.com/fatih/color v1.18.0 h1:S8gINlzdQ840/4pfAwic/ZE0djQEH3wM94VfqLTZcOM=
 github.com/fatih/color v1.18.0/go.mod h1:4FelSpRwEGDpQ12mAdzqdOukCy4u8WUtOY6lkT/6HfU=
 github.com/fatih/set v0.2.1 h1:nn2CaJyknWE/6txyUDGwysr3G5QC6xWB/PtVjPBbeaA=
 github.com/fatih/set v0.2.1/go.mod h1:+RKtMCH+favT2+3YecHGxcc0b4KyVWA1QWWJUs4E0CI=
-github.com/felixge/fgprof v0.9.4 h1:ocDNwMFlnA0NU0zSB3I52xkO4sFXk80VK9lXjLClu88=
-github.com/felixge/fgprof v0.9.4/go.mod h1:yKl+ERSa++RYOs32d8K6WEXCB4uXdLls4ZaZPpayhMM=
+github.com/felixge/fgprof v0.9.5 h1:8+vR6yu2vvSKn08urWyEuxx75NWPEvybbkBirEpsbVY=
+github.com/felixge/fgprof v0.9.5/go.mod h1:yKl+ERSa++RYOs32d8K6WEXCB4uXdLls4ZaZPpayhMM=
 github.com/felixge/httpsnoop v1.0.4 h1:NFTV2Zj1bL4mc9sqWACXbQFVBBg2W3GPvqp8/ESS2Wg=
 github.com/felixge/httpsnoop v1.0.4/go.mod h1:m8KPJKqk1gH5J9DgRY2ASl2lWCfGKXixSwevea8zH2U=
+github.com/florianl/go-tc v0.4.7 h1:Ysai5TIx4PgOzqI/1cse/pquOFCEkWofKtc/EPumfrg=
+github.com/florianl/go-tc v0.4.7/go.mod h1:Fdz6eHitQZwylSvpAW3y9R9cUrnS/zinuAdjJpD7XqY=
 github.com/flynn/go-shlex v0.0.0-20150515145356-3f9db97f8568/go.mod h1:xEzjJPgXI435gkrCt3MPfRiAkVrwSbHsst4LCFVfpJc=
 github.com/francoispqt/gojay v1.2.13 h1:d2m3sFjloqoIUQU3TsHBgj6qg/BVGlTBeHDUmyJnXKk=
 github.com/francoispqt/gojay v1.2.13/go.mod h1:ehT5mTG4ua4581f1++1WLG0vPdaA9HaiDsoyrBGkyDY=
+github.com/frankban/quicktest v1.11.3/go.mod h1:wRf/ReqHper53s+kmmSZizM8NamnL3IM0I9ntUbOk+k=
+github.com/frankban/quicktest v1.14.0/go.mod h1:NeW+ay9A/U67EYXNFA1nPE8e/tnQv/09mUdL/ijj8og=
 github.com/frankban/quicktest v1.14.6 h1:7Xjx+VpznH+oBnejlPUj8oUpdxnVs4f8XU8WnHkI4W8=
 github.com/frankban/quicktest v1.14.6/go.mod h1:4ptaffx2x8+WTWXmUCuVU6aPUX1/Mz7zb5vbUoiM6w0=
 github.com/fsnotify/fsnotify v1.4.7/go.mod h1:jwhsz4b93w/PPRr/qN1Yymfu8t87LnFCMoQvtojpjFo=
 github.com/fsnotify/fsnotify v1.5.1/go.mod h1:T3375wBYaZdLLcVNkcVbzGHY7f1l/uK5T5Ai1i3InKU=
 github.com/fsnotify/fsnotify v1.9.0 h1:2Ml+OJNzbYCTzsxtv8vKSFD9PbJjmhYF14k/jKC7S9k=
 github.com/fsnotify/fsnotify v1.9.0/go.mod h1:8jBTzvmWwFyi3Pb8djgCCO5IBqzKJ/Jwo8TRcHyHii0=
-github.com/fxamacker/cbor/v2 v2.8.0 h1:fFtUGXUzXPHTIUdne5+zzMPTfffl3RD5qYnkY40vtxU=
-github.com/fxamacker/cbor/v2 v2.8.0/go.mod h1:vM4b+DJCtHn+zz7h3FFp/hDAI9WNWCsZj23V5ytsSxQ=
-github.com/gabriel-vasile/mimetype v1.4.7 h1:SKFKl7kD0RiPdbht0s7hFtjl489WcQ1VyPW8ZzUMYCA=
-github.com/gabriel-vasile/mimetype v1.4.7/go.mod h1:GDlAgAyIRT27BhFl53XNAFtfjzOkLaF35JdEG0P7LtU=
-github.com/gammazero/deque v1.0.0 h1:LTmimT8H7bXkkCy6gZX7zNLtkbz4NdS2z8LZuor3j34=
-github.com/gammazero/deque v1.0.0/go.mod h1:iflpYvtGfM3U8S8j+sZEKIak3SAKYpA5/SQewgfXDKo=
+github.com/fxamacker/cbor/v2 v2.9.0 h1:NpKPmjDBgUfBms6tr6JZkTHtfFGcMKsw3eGcmD/sapM=
+github.com/fxamacker/cbor/v2 v2.9.0/go.mod h1:vM4b+DJCtHn+zz7h3FFp/hDAI9WNWCsZj23V5ytsSxQ=
+github.com/gabriel-vasile/mimetype v1.4.10 h1:zyueNbySn/z8mJZHLt6IPw0KoZsiQNszIpU+bX4+ZK0=
+github.com/gabriel-vasile/mimetype v1.4.10/go.mod h1:d+9Oxyo1wTzWdyVUPMmXFvp4F9tea18J8ufA774AB3s=
 github.com/ghodss/yaml v1.0.0/go.mod h1:4dBDuWmgqj2HViK6kFavaiC9ZROes6MMH2rRYeMEF04=
-github.com/github/go-spdx/v2 v2.3.2 h1:IfdyNHTqzs4zAJjXdVQfRnxt1XMfycXoHBE2Vsm1bjs=
-github.com/github/go-spdx/v2 v2.3.2/go.mod h1:2ZxKsOhvBp+OYBDlsGnUMcchLeo2mrpEBn2L1C+U3IQ=
+github.com/github/go-spdx/v2 v2.3.3 h1:QI7evnHWEfWkT54eJwkoV/f3a0xD3gLlnVmT5wQG6LE=
+github.com/github/go-spdx/v2 v2.3.3/go.mod h1:2ZxKsOhvBp+OYBDlsGnUMcchLeo2mrpEBn2L1C+U3IQ=
 github.com/gliderlabs/ssh v0.1.1/go.mod h1:U7qILu1NlMHj9FlMhZLlkCdDnU1DBEAqr0aevW3Awn0=
+github.com/go-asn1-ber/asn1-ber v1.5.7 h1:DTX+lbVTWaTw1hQ+PbZPlnDZPEIs0SS/GCZAl535dDk=
+github.com/go-asn1-ber/asn1-ber v1.5.7/go.mod h1:hEBeB/ic+5LoWskz+yKT7vGhhPYkProFKoKdwZRWMe0=
 github.com/go-errors/errors v1.0.1/go.mod h1:f4zRHt4oKfwPJE5k8C9vpYG+aDHdBFUsgrm6/TyX73Q=
 github.com/go-errors/errors v1.5.1 h1:ZwEMSLRCapFLflTpT7NKaAc7ukJ8ZPEjzlxt8rPN8bk=
 github.com/go-errors/errors v1.5.1/go.mod h1:sIVyrIiJhuEF+Pj9Ebtd6P/rEYROXFi3BopGUQ5a5Og=
 github.com/go-gl/glfw v0.0.0-20190409004039-e6da0acd62b1/go.mod h1:vR7hzQXu2zJy9AVAgeJqvqgH9Q5CA+iKCZ2gyEVpxRU=
 github.com/go-gl/glfw/v3.3/glfw v0.0.0-20191125211704-12ad95a8df72/go.mod h1:tQ2UAYgL5IevRw8kRxooKSPJfGvJ9fJQFa0TUsXzTg8=
 github.com/go-gl/glfw/v3.3/glfw v0.0.0-20200222043503-6f7a984d4dc4/go.mod h1:tQ2UAYgL5IevRw8kRxooKSPJfGvJ9fJQFa0TUsXzTg8=
-github.com/go-jose/go-jose/v4 v4.0.5 h1:M6T8+mKZl/+fNNuFHvGIzDz7BTLQPIounk/b9dw3AaE=
-github.com/go-jose/go-jose/v4 v4.0.5/go.mod h1:s3P1lRrkT8igV8D9OjyL4WRyHvjB6a4JSllnOrmmBOA=
+github.com/go-jose/go-jose/v4 v4.1.3 h1:CVLmWDhDVRa6Mi/IgCgaopNosCaHz7zrMeF9MlZRkrs=
+github.com/go-jose/go-jose/v4 v4.1.3/go.mod h1:x4oUasVrzR7071A4TnHLGSPpNOm2a21K9Kf04k1rs08=
 github.com/go-kit/kit v0.8.0/go.mod h1:xBxKIO96dXMWWy0MnWVtmwkA9/13aqxPnvrjFYMA2as=
 github.com/go-kit/kit v0.9.0/go.mod h1:xBxKIO96dXMWWy0MnWVtmwkA9/13aqxPnvrjFYMA2as=
+github.com/go-ldap/ldap/v3 v3.4.10 h1:ot/iwPOhfpNVgB1o+AVXljizWZ9JTp7YF5oeyONmcJU=
+github.com/go-ldap/ldap/v3 v3.4.10/go.mod h1:JXh4Uxgi40P6E9rdsYqpUtbW46D9UTjJ9QSwGRznplY=
 github.com/go-logfmt/logfmt v0.3.0/go.mod h1:Qt1PoO58o5twSAckw1HlFXLmHsOX5/0LbT9GBnD5lWE=
 github.com/go-logfmt/logfmt v0.4.0/go.mod h1:3RMwSq7FuexP4Kalkev3ejPJsZTpXXBr9+V4qmtdjCk=
 github.com/go-logr/logr v1.2.2/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
-github.com/go-logr/logr v1.4.2 h1:6pFjapn8bFcIbiKo3XT4j/BhANplGihG6tvd+8rYgrY=
-github.com/go-logr/logr v1.4.2/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
+github.com/go-logr/logr v1.4.3 h1:CjnDlHq8ikf6E492q6eKboGOC0T8CDaOvkHCIg8idEI=
+github.com/go-logr/logr v1.4.3/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
 github.com/go-logr/stdr v1.2.2 h1:hSWxHoqTgW2S2qGc0LTAI563KZ5YKYRhT3MFKZMbjag=
 github.com/go-logr/stdr v1.2.2/go.mod h1:mMo/vtBO5dYbehREoey6XUKy/eSumjCCveDpRre4VKE=
 github.com/go-logr/zapr v1.3.0 h1:XGdV8XW8zdwFiwOA2Dryh1gj2KRQyOOoNmBy4EplIcQ=
 github.com/go-logr/zapr v1.3.0/go.mod h1:YKepepNBd1u/oyhd/yQmtjVXmm9uML4IXUgMOwR8/Gg=
-github.com/go-ole/go-ole v1.2.6 h1:/Fpf6oFPoeFik9ty7siob0G6Ke8QvQEuVcuChpwXzpY=
-github.com/go-ole/go-ole v1.2.6/go.mod h1:pprOEPIfldk/42T2oK7lQ4v4JSDwmV0As9GaiUsvbm0=
 github.com/go-openapi/analysis v0.23.0 h1:aGday7OWupfMs+LbmLZG4k0MYXIANxcuBTYUC03zFCU=
 github.com/go-openapi/analysis v0.23.0/go.mod h1:9mz9ZWaSlV8TvjQHLl2mUW2PbZtemkE8yA5v22ohupo=
-github.com/go-openapi/errors v0.22.1 h1:kslMRRnK7NCb/CvR1q1VWuEQCEIsBGn5GgKD9e+HYhU=
-github.com/go-openapi/errors v0.22.1/go.mod h1:+n/5UdIqdVnLIJ6Q9Se8HNGUXYaY6CN8ImWzfi/Gzp0=
-github.com/go-openapi/jsonpointer v0.21.0 h1:YgdVicSA9vH5RiHs9TZW5oyafXZFc6+2Vc1rr/O9oNQ=
-github.com/go-openapi/jsonpointer v0.21.0/go.mod h1:IUyH9l/+uyhIYQ/PXVA41Rexl+kOkAPDdXEYns6fzUY=
+github.com/go-openapi/errors v0.22.2 h1:rdxhzcBUazEcGccKqbY1Y7NS8FDcMyIRr0934jrYnZg=
+github.com/go-openapi/errors v0.22.2/go.mod h1:+n/5UdIqdVnLIJ6Q9Se8HNGUXYaY6CN8ImWzfi/Gzp0=
+github.com/go-openapi/jsonpointer v0.21.2 h1:AqQaNADVwq/VnkCmQg6ogE+M3FOsKTytwges0JdwVuA=
+github.com/go-openapi/jsonpointer v0.21.2/go.mod h1:50I1STOfbY1ycR8jGz8DaMeLCdXiI6aDteEdRNNzpdk=
 github.com/go-openapi/jsonreference v0.21.0 h1:Rs+Y7hSXT83Jacb7kFyjn4ijOuVGSvOdF2+tg1TRrwQ=
 github.com/go-openapi/jsonreference v0.21.0/go.mod h1:LmZmgsrTkVg9LG4EaHeY8cBDslNPMo06cago5JNLkm4=
 github.com/go-openapi/loads v0.22.0 h1:ECPGd4jX1U6NApCGG1We+uEozOAvXvJSF4nnwHZ8Aco=
@@ -325,11 +381,18 @@ github.com/go-test/deep v1.1.1/go.mod h1:5C2ZWiW0ErCdrYzpqxLbTX7MG14M9iiw8DgHncV
 github.com/go-viper/mapstructure/v2 v2.4.0 h1:EBsztssimR/CONLSZZ04E8qAkxNYq4Qp9LvH92wZUgs=
 github.com/go-viper/mapstructure/v2 v2.4.0/go.mod h1:oJDH3BJKyqBA2TXFhDsKDGDTlndYOZ6rGS0BRZIxGhM=
 github.com/godbus/dbus/v5 v5.0.4/go.mod h1:xhWf0FNVPg57R7Z0UbKHbJfkEywrmjJnf7w5xrFpKfA=
-github.com/godbus/dbus/v5 v5.1.0 h1:4KLkAxT3aOY8Li4FRJe/KvhoNFFxo0m6fNuFUO8QJUk=
-github.com/godbus/dbus/v5 v5.1.0/go.mod h1:xhWf0FNVPg57R7Z0UbKHbJfkEywrmjJnf7w5xrFpKfA=
+github.com/godbus/dbus/v5 v5.2.0 h1:3WexO+U+yg9T70v9FdHr9kCxYlazaAXUhx2VMkbfax8=
+github.com/godbus/dbus/v5 v5.2.0/go.mod h1:3AAv2+hPq5rdnr5txxxRwiGjPXamgoIHgz9FPBfOp3c=
+github.com/gofrs/flock v0.7.1/go.mod h1:F1TvTiK9OcQqauNUHlbJvyl9Qa1QvF/gOUDKA14jxHU=
+github.com/gofrs/flock v0.13.0 h1:95JolYOvGMqeH31+FC7D2+uULf6mG61mEZ/A8dRYMzw=
+github.com/gofrs/flock v0.13.0/go.mod h1:jxeyy9R1auM5S6JYDBhDt+E2TCo7DkratH4Pgi8P+Z0=
 github.com/gogo/protobuf v1.1.1/go.mod h1:r8qH/GZQm5c6nD/R0oafs1akxWv10x8SbQlK7atdtwQ=
 github.com/gogo/protobuf v1.3.2 h1:Ov1cvc58UF3b5XjBnZv7+opcTcQFZebYjWzi34vdm4Q=
 github.com/gogo/protobuf v1.3.2/go.mod h1:P1XiOD3dCwIKUDQYPy72D8LYyHL2YPYrpS2s69NZV8Q=
+github.com/gohugoio/hashstructure v0.5.0 h1:G2fjSBU36RdwEJBWJ+919ERvOVqAg9tfcYp47K9swqg=
+github.com/gohugoio/hashstructure v0.5.0/go.mod h1:Ser0TniXuu/eauYmrwM4o64EBvySxNzITEOLlm4igec=
+github.com/golang-jwt/jwt/v4 v4.5.2 h1:YtQM7lnr8iZ+j5q71MGKkNw9Mn7AjHM68uc9g5fXeUI=
+github.com/golang-jwt/jwt/v4 v4.5.2/go.mod h1:m21LjoU+eqJr34lmDMbreY2eSTRJ1cv77w39/MY0Ch0=
 github.com/golang/glog v0.0.0-20160126235308-23def4e6c14b/go.mod h1:SBH7ygxi8pfUlaOkMMuAQtPIUF8ecWP5IEl/CR7VP2Q=
 github.com/golang/groupcache v0.0.0-20190702054246-869f871628b6/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
 github.com/golang/groupcache v0.0.0-20191227052852-215e87163ea7/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
@@ -371,8 +434,10 @@ github.com/google/btree v0.0.0-20180813153112-4030bb1f1f0c/go.mod h1:lNA+9X1NB3Z
 github.com/google/btree v1.0.0/go.mod h1:lNA+9X1NB3Zf8V7Ke586lFgjr2dZNuvo3lPJSGZ5JPQ=
 github.com/google/btree v1.1.3 h1:CVpQJjYgC4VbzxeGVHfvZrv1ctoYCAI8vbl07Fcxlyg=
 github.com/google/btree v1.1.3/go.mod h1:qOPhT0dTNdNzV6Z/lhRX0YXUafgPLFUh+gZMl761Gm4=
-github.com/google/gnostic-models v0.6.9 h1:MU/8wDLif2qCXZmzncUQ/BOfxWfthHi63KqpoNbWqVw=
-github.com/google/gnostic-models v0.6.9/go.mod h1:CiWsm0s6BSQd1hRn8/QmxqB6BesYcbSZxsz9b0KuDBw=
+github.com/google/cel-go v0.26.1 h1:iPbVVEdkhTX++hpe3lzSk7D3G3QSYqLGoHOcEio+UXQ=
+github.com/google/cel-go v0.26.1/go.mod h1:A9O8OU9rdvrK5MQyrqfIxo1a0u4g3sF8KB6PUIaryMM=
+github.com/google/gnostic-models v0.7.0 h1:qwTtogB15McXDaNqTZdzPJRHvaVJlAl+HVQnLmJEJxo=
+github.com/google/gnostic-models v0.7.0/go.mod h1:whL5G0m6dmc5cPxKc5bdKdEN3UjI7OUGxBlw57miDrQ=
 github.com/google/go-cmp v0.2.0/go.mod h1:oXzfMopK8JAjlY9xF4vHSVASa0yLyX7SntLO5aqRK0M=
 github.com/google/go-cmp v0.3.0/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU=
 github.com/google/go-cmp v0.3.1/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU=
@@ -385,14 +450,17 @@ github.com/google/go-cmp v0.5.3/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/
 github.com/google/go-cmp v0.5.4/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
 github.com/google/go-cmp v0.5.5/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
 github.com/google/go-cmp v0.5.6/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
-github.com/google/go-cmp v0.5.9/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
+github.com/google/go-cmp v0.5.7/go.mod h1:n+brtR0CgQNWTVd5ZUFpTBC8YFBDLK/h/bpaJ8/DtOE=
+github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
 github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
 github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
-github.com/google/go-containerregistry v0.20.3 h1:oNx7IdTI936V8CQRveCjaxOiegWwvM7kqkbXTpyiovI=
-github.com/google/go-containerregistry v0.20.3/go.mod h1:w00pIgBRDVUDFM6bq+Qx8lwNWK+cxgCuX1vd3PIBDNI=
+github.com/google/go-containerregistry v0.20.7 h1:24VGNpS0IwrOZ2ms2P1QE3Xa5X9p4phx0aUgzYzHW6I=
+github.com/google/go-containerregistry v0.20.7/go.mod h1:Lx5LCZQjLH1QBaMPeGwsME9biPeo1lPx6lbGj/UmzgM=
 github.com/google/go-github v17.0.0+incompatible/go.mod h1:zLgOLi98H3fifZn+44m+umXrS52loVEgC2AApnigrVQ=
 github.com/google/go-querystring v1.0.0/go.mod h1:odCYkC5MyYFN7vkCjXpyrEuKhc/BUO6wN/zVPAxq5ck=
 github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
+github.com/google/licensecheck v0.3.1 h1:QoxgoDkaeC4nFrtGN1jV7IPmDCHFNIVh54e5hSt6sPs=
+github.com/google/licensecheck v0.3.1/go.mod h1:ORkR35t/JjW+emNKtfJDII0zlciG9JgbT7SmsohlHmY=
 github.com/google/martian v2.1.0+incompatible/go.mod h1:9I4somxYTbIHy5NJKHRl3wXiIaQGbYVAs8BPL6v8lEs=
 github.com/google/martian/v3 v3.0.0/go.mod h1:y5Zk1BBys9G+gd6Jrk0W3cC1+ELVxBWuIGO+w/tUAp0=
 github.com/google/martian/v3 v3.1.0/go.mod h1:y5Zk1BBys9G+gd6Jrk0W3cC1+ELVxBWuIGO+w/tUAp0=
@@ -411,11 +479,9 @@ github.com/google/pprof v0.0.0-20210226084205-cbba55b83ad5/go.mod h1:kpwsk12EmLe
 github.com/google/pprof v0.0.0-20210601050228-01bbb1931b22/go.mod h1:kpwsk12EmLew5upagYY7GY0pfYCcupk39gWOCRROcvE=
 github.com/google/pprof v0.0.0-20210609004039-a478d1d731e9/go.mod h1:kpwsk12EmLew5upagYY7GY0pfYCcupk39gWOCRROcvE=
 github.com/google/pprof v0.0.0-20210720184732-4bb14d4b1be1/go.mod h1:kpwsk12EmLew5upagYY7GY0pfYCcupk39gWOCRROcvE=
-github.com/google/pprof v0.0.0-20250403155104-27863c87afa6 h1:BHT72Gu3keYf3ZEu2J0b1vyeLSOYI8bm5wbJM/8yDe8=
-github.com/google/pprof v0.0.0-20250403155104-27863c87afa6/go.mod h1:boTsfXsheKC2y+lKOCMpSfarhxDeIzfZG1jqGcPl3cA=
+github.com/google/pprof v0.0.0-20250630185457-6e76a2b096b5 h1:xhMrHhTJ6zxu3gA4enFM9MLn9AY7613teCdFnlUVbSQ=
+github.com/google/pprof v0.0.0-20250630185457-6e76a2b096b5/go.mod h1:5hDyRhoBCxViHszMt12TnOpEI4VVi+U8Gm9iphldiMA=
 github.com/google/renameio v0.1.0/go.mod h1:KWCgfxg9yswjAJkECMjeO8J8rahYeXnNhOm40UhjYkI=
-github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510 h1:El6M4kTTCOh6aBiKaUGG7oYTSPP8MxqL4YI3kZKwcP4=
-github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510/go.mod h1:pupxD2MaaD3pAXIBCelhxNneeOaAeabZDe5s4K6zSpQ=
 github.com/google/uuid v1.1.2/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
 github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
 github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
@@ -426,20 +492,22 @@ github.com/googleapis/gax-go/v2 v2.0.5/go.mod h1:DWXyrwAJ9X0FpwwEdw+IPEYBICEFu5m
 github.com/googleapis/gax-go/v2 v2.1.0/go.mod h1:Q3nei7sK6ybPYH7twZdmQpAd1MKb7pfu6SK+H1/DsU0=
 github.com/googleapis/gax-go/v2 v2.1.1/go.mod h1:hddJymUZASv3XPyGkUpKj8pPO47Rmb0eJc8R6ouapiM=
 github.com/gookit/color v1.2.5/go.mod h1:AhIE+pS6D4Ql0SQWbBeXPHw7gY0/sjHoA4s/n1KB7xg=
-github.com/gookit/color v1.5.4 h1:FZmqs7XOyGgCAxmWyPslpiok1k05wmY3SJTytgvYFs0=
-github.com/gookit/color v1.5.4/go.mod h1:pZJOeOS8DM43rXbp4AZo1n9zCU2qjpcRko0b6/QJi9w=
-github.com/gopacket/gopacket v1.3.2-0.20241202175635-b43272ae1eb8 h1:PoilRl1aPz9JlypuskS97qoGuXbEGBGza7YmXQyAwP8=
-github.com/gopacket/gopacket v1.3.2-0.20241202175635-b43272ae1eb8/go.mod h1:3I13qcqSpB2R9fFQg866OOgzylYkZxLTmkvcXhvf6qg=
+github.com/gookit/color v1.6.0 h1:JjJXBTk1ETNyqyilJhkTXJYYigHG24TM9Xa2M1xAhRA=
+github.com/gookit/color v1.6.0/go.mod h1:9ACFc7/1IpHGBW8RwuDm/0YEnhg3dwwXpoMsmtyHfjs=
+github.com/gopacket/gopacket v1.5.0 h1:9s9fcSUVKFlRV97B77Bq9XNV3ly2gvvsneFMQUGjc+M=
+github.com/gopacket/gopacket v1.5.0/go.mod h1:i3NaGaqfoWKAr1+g7qxEdWsmfT+MXuWkAe9+THv8LME=
 github.com/gopherjs/gopherjs v0.0.0-20181017120253-0766667cb4d1/go.mod h1:wJfORRmW1u3UXTncJ5qlYoELFm8eSnnEO6hX4iZ3EWY=
 github.com/goradd/maps v1.0.0 h1:21HC3xxKFk3p6BdQsELZXg/ByANMVYhCl0Mylzt0R38=
 github.com/goradd/maps v1.0.0/go.mod h1:O3i5k17BAjHa9h5dzGWWfRJizF03umiBDZsNSqFdbVA=
+github.com/gorilla/securecookie v1.1.1/go.mod h1:ra0sb63/xPlUeL+yeDciTfxMRAA+MP+HVt/4epWDjd4=
+github.com/gorilla/sessions v1.2.1/go.mod h1:dk2InVEVJ0sfLlnXv9EAgkf6ecYs/i80K/zI+bUmuGM=
 github.com/gregjones/httpcache v0.0.0-20180305231024-9cad4c3443a7/go.mod h1:FecbI9+v66THATjSRHfNgh1IVFe/9kFxbXtjV0ctIMA=
 github.com/gregjones/httpcache v0.0.0-20190611155906-901d90724c79 h1:+ngKgrYPPJrOjhax5N+uePQ0Fh1Z7PheYoUI/0nzkPA=
 github.com/gregjones/httpcache v0.0.0-20190611155906-901d90724c79/go.mod h1:FecbI9+v66THATjSRHfNgh1IVFe/9kFxbXtjV0ctIMA=
 github.com/grpc-ecosystem/grpc-gateway v1.5.0/go.mod h1:RSKVYQBd5MCa4OVpNdGskqpgL2+G+NZTnrVHpWWfpdw=
 github.com/grpc-ecosystem/grpc-gateway v1.16.0/go.mod h1:BDjrQk3hbvj6Nolgz8mAMFbcEtjT1g+wF4CSlocrBnw=
-github.com/grpc-ecosystem/grpc-gateway/v2 v2.26.3 h1:5ZPtiqj0JL5oKWmcsq4VMaAW5ukBEgSGXEN89zeH1Jo=
-github.com/grpc-ecosystem/grpc-gateway/v2 v2.26.3/go.mod h1:ndYquD05frm2vACXE1nsccT4oJzjhw2arTS2cpUD1PI=
+github.com/grpc-ecosystem/grpc-gateway/v2 v2.27.3 h1:NmZ1PKzSTQbuGHw9DGPFomqkkLWMC+vZCkfs+FHv1Vg=
+github.com/grpc-ecosystem/grpc-gateway/v2 v2.27.3/go.mod h1:zQrxl1YP88HQlA6i9c63DSVPFklWpGX4OWAc9bFuaH4=
 github.com/hashicorp/consul/api v1.11.0/go.mod h1:XjsvQN+RJGWI2TWy1/kqaE16HrR2J/FWgkYjdZQsX9M=
 github.com/hashicorp/consul/sdk v0.8.0/go.mod h1:GBvyrGALthsZObzUGsfgHZQDXjg4lOjagTIwIR1vPms=
 github.com/hashicorp/errwrap v1.0.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
@@ -463,6 +531,9 @@ github.com/hashicorp/go-sockaddr v1.0.0/go.mod h1:7Xibr9yA9JjQq1JpNB2Vw7kxv8xerX
 github.com/hashicorp/go-syslog v1.0.0/go.mod h1:qPfqrKkXGihmCqbJM2mZgkZGvKG1dFdvsLplgctolz4=
 github.com/hashicorp/go-uuid v1.0.0/go.mod h1:6SBZvOh/SIDV7/2o3Jml5SYk/TvGqwFJ/bN7x4byOro=
 github.com/hashicorp/go-uuid v1.0.1/go.mod h1:6SBZvOh/SIDV7/2o3Jml5SYk/TvGqwFJ/bN7x4byOro=
+github.com/hashicorp/go-uuid v1.0.2/go.mod h1:6SBZvOh/SIDV7/2o3Jml5SYk/TvGqwFJ/bN7x4byOro=
+github.com/hashicorp/go-uuid v1.0.3 h1:2gKiV6YVmrJ1i2CKKa9obLvRieoRGviZFL26PcT/Co8=
+github.com/hashicorp/go-uuid v1.0.3/go.mod h1:6SBZvOh/SIDV7/2o3Jml5SYk/TvGqwFJ/bN7x4byOro=
 github.com/hashicorp/golang-lru v0.5.0/go.mod h1:/m3WP610KZHVQ1SGc6re/UDhFvYD7pJ4Ao+sR/qLZy8=
 github.com/hashicorp/golang-lru v0.5.1/go.mod h1:/m3WP610KZHVQ1SGc6re/UDhFvYD7pJ4Ao+sR/qLZy8=
 github.com/hashicorp/golang-lru v0.5.4/go.mod h1:iADmTwqILo4mZ8BN3D2Q6+9jd8WM5uGBxy+E8yxSoD4=
@@ -483,18 +554,44 @@ github.com/ianlancetaylor/demangle v0.0.0-20181102032728-5e5cf60278f6/go.mod h1:
 github.com/ianlancetaylor/demangle v0.0.0-20200824232613-28f6c0f3b639/go.mod h1:aSSvb/t6k1mPoxDqO4vJh6VOCGPwU4O0C2/Eqndh1Sc=
 github.com/iceber/iouring-go v0.0.0-20230403020409-002cfd2e2a90 h1:xrtfZokN++5kencK33hn2Kx3Uj8tGnjMEhdt6FMvHD0=
 github.com/iceber/iouring-go v0.0.0-20230403020409-002cfd2e2a90/go.mod h1:LEzdaZarZ5aqROlLIwJ4P7h3+4o71008fSy6wpaEB+s=
+github.com/in-toto/in-toto-golang v0.9.0 h1:tHny7ac4KgtsfrG6ybU8gVOZux2H8jN05AXJ9EBM1XU=
+github.com/in-toto/in-toto-golang v0.9.0/go.mod h1:xsBVrVsHNsB61++S6Dy2vWosKhuA3lUTQd+eF9HdeMo=
 github.com/inconshreveable/mousetrap v1.0.0/go.mod h1:PxqpIevigyE2G7u3NXJIT2ANytuPF1OarO4DADm73n8=
 github.com/inconshreveable/mousetrap v1.1.0 h1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2s0bqwp9tc8=
 github.com/inconshreveable/mousetrap v1.1.0/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw=
-github.com/inspektor-gadget/inspektor-gadget v0.40.0 h1:9FUDFDsBuQuUZQfJG5YbUx+u42djH9ZhLxzVsK9UM6k=
-github.com/inspektor-gadget/inspektor-gadget v0.40.0/go.mod h1:LQZUe5deEVRlpYLQ9usvR+9vXoP8M3xo0rB8Nf3UO7o=
+github.com/jcmturner/aescts/v2 v2.0.0 h1:9YKLH6ey7H4eDBXW8khjYslgyqG2xZikXP0EQFKrle8=
+github.com/jcmturner/aescts/v2 v2.0.0/go.mod h1:AiaICIRyfYg35RUkr8yESTqvSy7csK90qZ5xfvvsoNs=
+github.com/jcmturner/dnsutils/v2 v2.0.0 h1:lltnkeZGL0wILNvrNiVCR6Ro5PGU/SeBvVO/8c/iPbo=
+github.com/jcmturner/dnsutils/v2 v2.0.0/go.mod h1:b0TnjGOvI/n42bZa+hmXL+kFJZsFT7G4t3HTlQ184QM=
+github.com/jcmturner/gofork v1.7.6 h1:QH0l3hzAU1tfT3rZCnW5zXl+orbkNMMRGJfdJjHVETg=
+github.com/jcmturner/gofork v1.7.6/go.mod h1:1622LH6i/EZqLloHfE7IeZ0uEJwMSUyQ/nDd82IeqRo=
+github.com/jcmturner/goidentity/v6 v6.0.1 h1:VKnZd2oEIMorCTsFBnJWbExfNN7yZr3EhJAxwOkZg6o=
+github.com/jcmturner/goidentity/v6 v6.0.1/go.mod h1:X1YW3bgtvwAXju7V3LCIMpY0Gbxyjn/mY9zx4tFonSg=
+github.com/jcmturner/gokrb5/v8 v8.4.4 h1:x1Sv4HaTpepFkXbt2IkL29DXRf8sOfZXo8eRKh687T8=
+github.com/jcmturner/gokrb5/v8 v8.4.4/go.mod h1:1btQEpgT6k+unzCwX1KdWMEwPPkkgBtP+F6aCACiMrs=
+github.com/jcmturner/rpc/v2 v2.0.3 h1:7FXXj8Ti1IaVFpSAziCZWNzbNuZmnvw/i6CqLNdWfZY=
+github.com/jcmturner/rpc/v2 v2.0.3/go.mod h1:VUJYCIDm3PVOEHw8sgt091/20OJjskO/YJki3ELg/Hc=
 github.com/jellevandenhooff/dkim v0.0.0-20150330215556-f50fe3d243e1/go.mod h1:E0B/fFc00Y+Rasa88328GlI/XbtyysCtTHZS8h7IrBU=
 github.com/jinzhu/copier v0.4.0 h1:w3ciUoD19shMCRargcpm0cm91ytaBhDvuRpz1ODO/U8=
 github.com/jinzhu/copier v0.4.0/go.mod h1:DfbEm0FYsaqBcKcFuvmOZb218JkPGtvSHsKg8S8hyyg=
+github.com/joncrlsn/dque v0.0.0-20241024143830-7723fd131a64 h1:fmH2K7R8pZJ0wVvJyGFmDnECuAE3NLjfAoJkN9mtfc8=
+github.com/joncrlsn/dque v0.0.0-20241024143830-7723fd131a64/go.mod h1:dNKs71rs2VJGBAmttu7fouEsRQlRjxy0p1Sx+T5wbpY=
 github.com/josharian/intern v1.0.0 h1:vlS4z54oSdjm0bgjRigI+G1HpF+tI+9rE5LLzOg8HmY=
 github.com/josharian/intern v1.0.0/go.mod h1:5DoeVV0s6jJacbCEi61lwdGj/aVlrQvzHFFd8Hwg//Y=
+github.com/josharian/native v0.0.0-20200817173448-b6b71def0850/go.mod h1:7X/raswPFr05uY3HiLlYeyQntB6OO7E/d2Cu7qoaN2w=
+github.com/josharian/native v1.0.0/go.mod h1:7X/raswPFr05uY3HiLlYeyQntB6OO7E/d2Cu7qoaN2w=
 github.com/josharian/native v1.1.0 h1:uuaP0hAbW7Y4l0ZRQ6C9zfb7Mg1mbFKry/xzDAfmtLA=
 github.com/josharian/native v1.1.0/go.mod h1:7X/raswPFr05uY3HiLlYeyQntB6OO7E/d2Cu7qoaN2w=
+github.com/jsimonetti/rtnetlink v0.0.0-20190606172950-9527aa82566a/go.mod h1:Oz+70psSo5OFh8DBl0Zv2ACw7Esh6pPUphlvZG9x7uw=
+github.com/jsimonetti/rtnetlink v0.0.0-20200117123717-f846d4f6c1f4/go.mod h1:WGuG/smIU4J/54PblvSbh+xvCZmpJnFgr3ds6Z55XMQ=
+github.com/jsimonetti/rtnetlink v0.0.0-20201009170750-9c6f07d100c1/go.mod h1:hqoO/u39cqLeBLebZ8fWdE96O7FxrAsRYhnVOdgHxok=
+github.com/jsimonetti/rtnetlink v0.0.0-20201216134343-bde56ed16391/go.mod h1:cR77jAZG3Y3bsb8hF6fHJbFoyFukLFOkQ98S0pQz3xw=
+github.com/jsimonetti/rtnetlink v0.0.0-20201220180245-69540ac93943/go.mod h1:z4c53zj6Eex712ROyh8WI0ihysb5j2ROyV42iNogmAs=
+github.com/jsimonetti/rtnetlink v0.0.0-20210122163228-8d122574c736/go.mod h1:ZXpIyOK59ZnN7J0BV99cZUPmsqDRZ3eq5X+st7u/oSA=
+github.com/jsimonetti/rtnetlink v0.0.0-20210212075122-66c871082f2b/go.mod h1:8w9Rh8m+aHZIG69YPGGem1i5VzoyRC8nw2kA8B+ik5U=
+github.com/jsimonetti/rtnetlink v0.0.0-20210525051524-4cc836578190/go.mod h1:NmKSdU4VGSiv1bMsdqNALI4RSvvjtz65tTMCnD05qLo=
+github.com/jsimonetti/rtnetlink v0.0.0-20211022192332-93da33804786 h1:N527AHMa793TP5z5GNAn/VLPzlc0ewzWdeP/25gDfgQ=
+github.com/jsimonetti/rtnetlink v0.0.0-20211022192332-93da33804786/go.mod h1:v4hqbTdfQngbVSZJVWUhGE/lbTFf9jb+ygmNUDQMuOs=
 github.com/jsimonetti/rtnetlink/v2 v2.0.1 h1:xda7qaHDSVOsADNouv7ukSuicKZO7GgVUCXxpaIEIlM=
 github.com/jsimonetti/rtnetlink/v2 v2.0.1/go.mod h1:7MoNYNbb3UaDHtF8udiJo/RH6VsTKP1pqKLUTVCvToE=
 github.com/json-iterator/go v1.1.6/go.mod h1:+SdeFBvtyEkXs7REEP0seUULqWtbJapLOCVDaaPEHmU=
@@ -505,15 +602,19 @@ github.com/json-iterator/go v1.1.12/go.mod h1:e30LSqwooZae/UwlEbR2852Gd8hjQvJoHm
 github.com/jstemmer/go-junit-report v0.0.0-20190106144839-af01ea7f8024/go.mod h1:6v2b51hI/fHJwM22ozAgKL4VKDeJcHhJFhtBdhmNjmU=
 github.com/jstemmer/go-junit-report v0.9.1/go.mod h1:Brl9GWCQeLvo8nXZwPNNblvFj/XSXhF0NWZEnDohbsk=
 github.com/julienschmidt/httprouter v1.2.0/go.mod h1:SYymIcj16QtmaHHD7aYtjjsJG7VTCxuUUipMqKk8s4w=
+github.com/kinbiko/jsonassert v1.2.0 h1:+/JthIVXdIrThrOtSN9ry0mNtWKXMWuvxR0nU7gQ+tI=
+github.com/kinbiko/jsonassert v1.2.0/go.mod h1:pCc3uudOt+lVAbkji9O0uw8MSVt4s+1ZJ0y8Ux2F1Og=
 github.com/kisielk/errcheck v1.5.0/go.mod h1:pFxgyoBC7bSaBwPgfKdkLd5X25qrDl4LWUI2bnpBCr8=
 github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+oQHNcck=
-github.com/klauspost/compress v1.18.0 h1:c/Cqfb0r+Yi+JtIEq73FWXVkRonBlf0CRNYc8Zttxdo=
-github.com/klauspost/compress v1.18.0/go.mod h1:2Pp+KzxcywXVXMr50+X0Q/Lsb43OQHYWRCY2AiWywWQ=
+github.com/klauspost/compress v1.18.1 h1:bcSGx7UbpBqMChDtsF28Lw6v/G94LPrrbMbdC3JH2co=
+github.com/klauspost/compress v1.18.1/go.mod h1:ZQFFVG+MdnR0P+l6wpXgIL4NTtwiKIdBnrBd8Nrxr+0=
 github.com/konsorten/go-windows-terminal-sequences v1.0.1/go.mod h1:T0+1ngSBFLxvqU3pZ+m/2kptfBszLMUkC4ZK/EgS/cQ=
 github.com/kr/fs v0.1.0/go.mod h1:FFnZGqtBN9Gxj7eW1uZ42v5BccTP0vu6NEaFoC2HwRg=
 github.com/kr/logfmt v0.0.0-20140226030751-b84e30acd515/go.mod h1:+0opPa2QZZtGFBFZlji/RkVcI2GknAs/DXo4wKdlNEc=
 github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORNo=
 github.com/kr/pretty v0.2.0/go.mod h1:ipq/a2n7PKx3OHsz4KJII5eveXtPO4qwEXGdVfWzfnI=
+github.com/kr/pretty v0.2.1/go.mod h1:ipq/a2n7PKx3OHsz4KJII5eveXtPO4qwEXGdVfWzfnI=
+github.com/kr/pretty v0.3.0/go.mod h1:640gp4NfQd8pI5XOwp5fnNeVWj67G7CFk/SaSQn7NBk=
 github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE=
 github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk=
 github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ=
@@ -523,20 +624,12 @@ github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
 github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
 github.com/kubescape/go-logger v0.0.24 h1:JRNlblY16Ty7hD6MSYNPvWYDxNzVAufsDDX/sZJayL0=
 github.com/kubescape/go-logger v0.0.24/go.mod h1:sMPVCr3VpW/e+SeMaXig5kClGvmZbDXN8YktUeNU4nY=
-github.com/kubescape/k8s-interface v0.0.195 h1:pJ1PT3x3fd1WatLjyZbKAfE64PWtEbvxiFjOBKSBwuU=
-github.com/kubescape/k8s-interface v0.0.195/go.mod h1:j9snZbH+RxOaa1yG/bWgTClj90q7To0rGgQepxy4b+k=
-github.com/kubescape/node-agent v0.2.343 h1:9pQuCL21uUgGpthdnA1YU5g1saSyMBE60G9rUUcPfjU=
-github.com/kubescape/node-agent v0.2.343/go.mod h1:sD9nmO1QoldIsdI1eC0Q0T6d/VPIsf3ymW0qXNQuSx4=
-github.com/kubescape/storage v0.0.179 h1:IC2T6SPFu8zY1QTDfw5t6hsbru1779TFoefq/6gs4oY=
-github.com/kubescape/storage v0.0.179/go.mod h1:SBOGxgq1Hhhcu7yUd7LdENhPZU2ixvFhi10BIr8gSHk=
-github.com/kubescape/workerpool v0.0.0-20250526074519-0e4a4e7f44cf h1:hI0jVwrB6fT4GJWvuUjzObfci1CUknrZdRHfnRVtKM0=
-github.com/kubescape/workerpool v0.0.0-20250526074519-0e4a4e7f44cf/go.mod h1:Il5baM40PV9cTt4OGdLMeTRRAai3TMfvImu31itIeCM=
+github.com/kubescape/k8s-interface v0.0.202 h1:yu9x+07crFQAgrBatFFU2WuuxMJfHUMHVuCzuHE9Q4M=
+github.com/kubescape/k8s-interface v0.0.202/go.mod h1:d4NVhL81bVXe8yEXlkT4ZHrt3iEppEIN39b8N1oXm5s=
 github.com/kylelemons/godebug v1.1.0 h1:RPNrshWIDI6G2gRW9EHilWtl7Z6Sb1BR0xunSBf0SNc=
 github.com/kylelemons/godebug v1.1.0/go.mod h1:9/0rRGxNHcop5bhtWyNeEfOS8JIWk580+fNqagV/RAw=
 github.com/liggitt/tabwriter v0.0.0-20181228230101-89fcab3d43de h1:9TO3cAIGXtEhnIaL+V+BEER86oLrvS+kWobKpbJuye0=
 github.com/liggitt/tabwriter v0.0.0-20181228230101-89fcab3d43de/go.mod h1:zAbeS9B/r2mtpb6U+EI2rYA5OAXxsYw6wTamcNW+zcE=
-github.com/lufia/plan9stats v0.0.0-20211012122336-39d0f177ccd0 h1:6E+4a0GO5zZEnZ81pIr0yLvtUWk2if982qA3F3QD6H4=
-github.com/lufia/plan9stats v0.0.0-20211012122336-39d0f177ccd0/go.mod h1:zJYVVT2jmtg6P3p1VtQj7WsuWi/y4VnjVBn7F8KPB3I=
 github.com/lunixbochs/vtclean v1.0.0/go.mod h1:pHhQNgMf3btfWnGBVipUOjRYhoOsdGqdm/+2c2E2WMI=
 github.com/lyft/protoc-gen-star v0.5.3/go.mod h1:V0xaHgaf5oCCqmcxYcWiDfTiKsZsRc87/1qhoTACD8w=
 github.com/mackerelio/go-osstat v0.2.5 h1:+MqTbZUhoIt4m8qzkVoXUJg1EuifwlAJSk4Yl2GXh+o=
@@ -545,6 +638,8 @@ github.com/magiconair/properties v1.8.5/go.mod h1:y3VJvCyxH9uVvJTWEGAELF3aiYNyPK
 github.com/mailru/easyjson v0.0.0-20190312143242-1de009706dbe/go.mod h1:C1wdFJiN94OJF2b5HbByQZoLdCWB1Yqtg26g4irojpc=
 github.com/mailru/easyjson v0.9.0 h1:PrnmzHw7262yW8sTBwxi1PdJA3Iw/EKBa8psRf7d9a4=
 github.com/mailru/easyjson v0.9.0/go.mod h1:1+xMtQp2MRNVL/V1bOzuP3aP8VNwRW55fQUto+XFtTU=
+github.com/matthyx/inspektor-gadget v0.0.0-20260203101533-6ef87216d3dd h1:n8zR1L5t5UWzmQ/DgQ98DF/NrYJL7gUI57GkiDlyu9Y=
+github.com/matthyx/inspektor-gadget v0.0.0-20260203101533-6ef87216d3dd/go.mod h1:V4TgEmWo37K72pQvC7XuRQssysrxIIkrNX4TtEkgiE0=
 github.com/mattn/go-colorable v0.0.9/go.mod h1:9vuHe8Xs5qXnSaW/c/ABM9alt+Vo+STaOChaDxuIBZU=
 github.com/mattn/go-colorable v0.1.4/go.mod h1:U0ppj6V5qS13XJ6of8GYAs25YV2eR4EVcfRqFIhoBtE=
 github.com/mattn/go-colorable v0.1.6/go.mod h1:u6P/XSegPjTcexA+o6vUJrdnUu04hMope9wVRipJSqc=
@@ -561,8 +656,23 @@ github.com/mattn/go-isatty v0.0.14/go.mod h1:7GGIvUiUoEMVVmxf/4nioHXj79iQHKdU27k
 github.com/mattn/go-isatty v0.0.20 h1:xfD0iDuEKnDkl03q4limB+vH+GxLEtL/jb4xVJSWWEY=
 github.com/mattn/go-isatty v0.0.20/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=
 github.com/matttproud/golang_protobuf_extensions v1.0.1/go.mod h1:D8He9yQNgCq6Z5Ld7szi9bcBfOoFv/3dc6xSMkL2PC0=
+github.com/mdlayher/ethtool v0.0.0-20210210192532-2b88debcdd43/go.mod h1:+t7E0lkKfbBsebllff1xdTmyJt8lH37niI6kwFk9OTo=
+github.com/mdlayher/genetlink v1.0.0/go.mod h1:0rJ0h4itni50A86M2kHcgS85ttZazNt7a8H2a2cw0Gc=
+github.com/mdlayher/netlink v0.0.0-20190409211403-11939a169225/go.mod h1:eQB3mZE4aiYnlUsyGGCOpPETfdQq4Jhsgf1fk3cwQaA=
+github.com/mdlayher/netlink v1.0.0/go.mod h1:KxeJAFOFLG6AjpyDkQ/iIhxygIUKD+vcwqcnu43w/+M=
+github.com/mdlayher/netlink v1.1.0/go.mod h1:H4WCitaheIsdF9yOYu8CFmCgQthAPIWZmcKp9uZHgmY=
+github.com/mdlayher/netlink v1.1.1/go.mod h1:WTYpFb/WTvlRJAyKhZL5/uy69TDDpHHu2VZmb2XgV7o=
+github.com/mdlayher/netlink v1.2.0/go.mod h1:kwVW1io0AZy9A1E2YYgaD4Cj+C+GPkU6klXCMzIJ9p8=
+github.com/mdlayher/netlink v1.2.1/go.mod h1:bacnNlfhqHqqLo4WsYeXSqfyXkInQ9JneWI68v1KwSU=
+github.com/mdlayher/netlink v1.2.2-0.20210123213345-5cc92139ae3e/go.mod h1:bacnNlfhqHqqLo4WsYeXSqfyXkInQ9JneWI68v1KwSU=
+github.com/mdlayher/netlink v1.3.0/go.mod h1:xK/BssKuwcRXHrtN04UBkwQ6dY9VviGGuriDdoPSWys=
+github.com/mdlayher/netlink v1.4.0/go.mod h1:dRJi5IABcZpBD2A3D0Mv/AiX8I9uDEu5oGkAVrekmf8=
+github.com/mdlayher/netlink v1.4.1/go.mod h1:e4/KuJ+s8UhfUpO9z00/fDZZmhSrs+oxyqAS9cNgn6Q=
+github.com/mdlayher/netlink v1.6.0/go.mod h1:0o3PlBmGst1xve7wQ7j/hwpNaFaH4qCRyWCdcZk8/vA=
 github.com/mdlayher/netlink v1.7.2 h1:/UtM3ofJap7Vl4QWCPDGXY8d3GIY2UGSDbK+QWmY8/g=
 github.com/mdlayher/netlink v1.7.2/go.mod h1:xraEF7uJbxLhc5fpHL4cPe221LI2bdttWlU+ZGLfQSw=
+github.com/mdlayher/socket v0.0.0-20210307095302-262dc9984e00/go.mod h1:GAFlyu4/XV68LkQKYzKhIo/WW7j3Zi0YRAz/BOoanUc=
+github.com/mdlayher/socket v0.1.1/go.mod h1:mYV5YIZAfHh4dzDVzI8x8tWLWCliuX8Mon5Awbj+qDs=
 github.com/mdlayher/socket v0.4.1 h1:eM9y2/jlbs1M615oshPQOHZzj6R6wMT7bX5NPiQvn2U=
 github.com/mdlayher/socket v0.4.1/go.mod h1:cAqeGjoufqdxWkD7DkpyS+wcefOtmu5OQ8KuoJGIReA=
 github.com/mgutz/ansi v0.0.0-20200706080929-d51e80ef957d h1:5PJl274Y63IEHC+7izoQE9x6ikvDFZS2mDVS3drnohI=
@@ -575,8 +685,6 @@ github.com/mitchellh/cli v1.1.0/go.mod h1:xcISNoH86gajksDmfB23e/pu+B+GeFRMYmoHXx
 github.com/mitchellh/go-homedir v1.1.0 h1:lukF9ziXFxDFPkA1vsr5zpc1XuPDn/wFntq5mG+4E0Y=
 github.com/mitchellh/go-homedir v1.1.0/go.mod h1:SfyaCUpYCn1Vlf4IUYiD9fPX4A5wJrkLzIz1N1q0pr0=
 github.com/mitchellh/go-testing-interface v1.0.0/go.mod h1:kRemZodwjscx+RGhAo8eIhFbs2+BFgRtFPeD/KE+zxI=
-github.com/mitchellh/hashstructure/v2 v2.0.2 h1:vGKWl0YJqUNxE8d+h8f6NJLcCJrgbhC4NcD46KavDd4=
-github.com/mitchellh/hashstructure/v2 v2.0.2/go.mod h1:MG3aRVU/N29oo/V/IhBX8GR/zz4kQkprJgF2EVszyDE=
 github.com/mitchellh/mapstructure v0.0.0-20160808181253-ca63d7c062ee/go.mod h1:FVVH3fgwuzCH5S8UJGiWEs2h04kUh9fWfEaFds41c1Y=
 github.com/mitchellh/mapstructure v1.1.2/go.mod h1:FVVH3fgwuzCH5S8UJGiWEs2h04kUh9fWfEaFds41c1Y=
 github.com/mitchellh/mapstructure v1.4.3/go.mod h1:bFUtVrKA4DC2yAKiSyO/QUcy7e+RRV2QTWOzhPopBRo=
@@ -586,16 +694,18 @@ github.com/moby/docker-image-spec v1.3.1 h1:jMKff3w6PgbfSa69GfNg+zN/XLhfXJGnEx3N
 github.com/moby/docker-image-spec v1.3.1/go.mod h1:eKmb5VW8vQEh/BAr2yvVNvuiJuY6UIocYsFu/DxxRpo=
 github.com/moby/locker v1.0.1 h1:fOXqR41zeveg4fFODix+1Ch4mj/gT0NE1XJbp/epuBg=
 github.com/moby/locker v1.0.1/go.mod h1:S7SDdo5zpBK84bzzVlKr2V0hz+7x9hWbYC/kq7oQppc=
-github.com/moby/moby v28.1.1+incompatible h1:lyEaGTiUhIdXRUv/vPamckAbPt5LcPQkeHmwAHN98eQ=
-github.com/moby/moby v28.1.1+incompatible/go.mod h1:fDXVQ6+S340veQPv35CzDahGBmHsiclFwfEygB/TWMc=
+github.com/moby/moby v28.5.2+incompatible h1:hIn6qcenb3JY1E3STwqEbBvJ8bha+u1LpqjX4CBvNCk=
+github.com/moby/moby v28.5.2+incompatible/go.mod h1:fDXVQ6+S340veQPv35CzDahGBmHsiclFwfEygB/TWMc=
 github.com/moby/sys/atomicwriter v0.1.0 h1:kw5D/EqkBwsBFi0ss9v1VG3wIkVhzGvLklJ+w3A14Sw=
 github.com/moby/sys/atomicwriter v0.1.0/go.mod h1:Ul8oqv2ZMNHOceF643P6FKPXeCmYtlQMvpizfsSoaWs=
+github.com/moby/sys/capability v0.4.0 h1:4D4mI6KlNtWMCM1Z/K0i7RV1FkX+DBDHKVJpCndZoHk=
+github.com/moby/sys/capability v0.4.0/go.mod h1:4g9IK291rVkms3LKCDOoYlnV8xKwoDTpIrNEE35Wq0I=
 github.com/moby/sys/mountinfo v0.7.2 h1:1shs6aH5s4o5H2zQLn796ADW1wMrIwHsyJ2v9KouLrg=
 github.com/moby/sys/mountinfo v0.7.2/go.mod h1:1YOa8w8Ih7uW0wALDUgT1dTTSBrZ+HiBLGws92L2RU4=
 github.com/moby/sys/sequential v0.6.0 h1:qrx7XFUd/5DxtqcoH1h438hF5TmOvzC/lspjy7zgvCU=
 github.com/moby/sys/sequential v0.6.0/go.mod h1:uyv8EUTrca5PnDsdMGXhZe6CCe8U/UiTWd+lL+7b/Ko=
-github.com/moby/sys/signal v0.7.0 h1:25RW3d5TnQEoKvRbEKUGay6DCQ46IxAVTT9CUMgmsSI=
-github.com/moby/sys/signal v0.7.0/go.mod h1:GQ6ObYZfqacOwTtlXvcmh9A26dVRul/hbOZn88Kg8Tg=
+github.com/moby/sys/signal v0.7.1 h1:PrQxdvxcGijdo6UXXo/lU/TvHUWyPhj7UOpSo8tuvk0=
+github.com/moby/sys/signal v0.7.1/go.mod h1:Se1VGehYokAkrSQwL4tDzHvETwUZlnY7S5XtQ50mQp8=
 github.com/moby/sys/user v0.4.0 h1:jhcMKit7SA80hivmFJcbB1vqmw//wU61Zdui2eQXuMs=
 github.com/moby/sys/user v0.4.0/go.mod h1:bG+tYYYJgaMtRKgEmuueC0hJEAZWwtIbZTB+85uoHjs=
 github.com/moby/sys/userns v0.1.0 h1:tVLXkFOxVu9A64/yh59slHVv9ahO9UIev4JZusOLG/g=
@@ -607,8 +717,9 @@ github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd h1:TRLaZ9cD/w
 github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
 github.com/modern-go/reflect2 v0.0.0-20180701023420-4b7aa43c6742/go.mod h1:bx2lNnkwVCuqBIxFjflWJWanXIb3RllmbCylyMrvgv0=
 github.com/modern-go/reflect2 v1.0.1/go.mod h1:bx2lNnkwVCuqBIxFjflWJWanXIb3RllmbCylyMrvgv0=
-github.com/modern-go/reflect2 v1.0.2 h1:xBagoLtFs94CBntxluKeaWgTMpvLxC4ur3nMaC9Gz0M=
 github.com/modern-go/reflect2 v1.0.2/go.mod h1:yWuevngMOJpCy52FWWMvUC8ws7m/LJsjYzDa0/r8luk=
+github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee h1:W5t00kpgFdJifH4BDsTlE89Zl93FEloxaWZfGcifgq8=
+github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee/go.mod h1:yWuevngMOJpCy52FWWMvUC8ws7m/LJsjYzDa0/r8luk=
 github.com/monochromegane/go-gitignore v0.0.0-20200626010858-205db1a8cc00 h1:n6/2gBQ3RWajuToeY6ZtZTIKv2v7ThUy5KKusIT0yc0=
 github.com/monochromegane/go-gitignore v0.0.0-20200626010858-205db1a8cc00/go.mod h1:Pm3mSP3c5uWn86xMLZ5Sa7JB9GsEZySvHYXCTK4E9q4=
 github.com/morikuni/aec v1.0.0 h1:nP9CBfwrvYnBRgY6qfDQkygYDmYwOilePFkwzv4dU8A=
@@ -616,45 +727,63 @@ github.com/morikuni/aec v1.0.0/go.mod h1:BbKIizmSmc5MMPqRYbxO4ZU0S0+P200+tUnFx7P
 github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 h1:C3w9PqII01/Oq1c1nUAm88MOHcQC9l5mIlSMApZMrHA=
 github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822/go.mod h1:+n7T8mK8HuQTcFwEeznm/DIxMOiR9yIdICNftLE1DvQ=
 github.com/mwitkow/go-conntrack v0.0.0-20161129095857-cc309e4a2223/go.mod h1:qRWi+5nqEBWmkhHvq77mSJWrCKwh8bxhgT7d/eI7P4U=
+github.com/ncruces/go-strftime v0.1.9 h1:bY0MQC28UADQmHmaF5dgpLmImcShSi2kHU9XLdhx/f4=
+github.com/ncruces/go-strftime v0.1.9/go.mod h1:Fwc5htZGVVkseilnfgOVb9mKy6w1naJmn9CehxcKcls=
+github.com/ncw/directio v1.0.5 h1:JSUBhdjEvVaJvOoyPAbcW0fnd0tvRXD76wEfZ1KcQz4=
+github.com/ncw/directio v1.0.5/go.mod h1:rX/pKEYkOXBGOggmcyJeJGloCkleSvphPx2eV3t6ROk=
 github.com/neelance/astrewrite v0.0.0-20160511093645-99348263ae86/go.mod h1:kHJEU3ofeGjhHklVoIGuVj85JJwZ6kWPaJwCIxgnFmo=
 github.com/neelance/sourcemap v0.0.0-20151028013722-8c68805598ab/go.mod h1:Qr6/a/Q4r9LP1IltGz7tA7iOK1WonHEYhu1HRBA7ZiM=
 github.com/niemeyer/pretty v0.0.0-20200227124842-a10e7caefd8e/go.mod h1:zD1mROLANZcx1PVRCS0qkT7pwLkGfwJo4zjcN/Tysno=
+github.com/notaryproject/notation-core-go v1.3.0 h1:mWJaw1QBpBxpjLSiKOjzbZvB+xh2Abzk14FHWQ+9Kfs=
+github.com/notaryproject/notation-core-go v1.3.0/go.mod h1:hzvEOit5lXfNATGNBT8UQRx2J6Fiw/dq/78TQL8aE64=
+github.com/notaryproject/notation-go v1.3.2 h1:4223iLXOHhEV7ZPzIUJEwwMkhlgzoYFCsMJvSH1Chb8=
+github.com/notaryproject/notation-go v1.3.2/go.mod h1:/1kuq5WuLF6Gaer5re0Z6HlkQRlKYO4EbWWT/L7J1Uw=
+github.com/notaryproject/notation-plugin-framework-go v1.0.0 h1:6Qzr7DGXoCgXEQN+1gTZWuJAZvxh3p8Lryjn5FaLzi4=
+github.com/notaryproject/notation-plugin-framework-go v1.0.0/go.mod h1:RqWSrTOtEASCrGOEffq0n8pSg2KOgKYiWqFWczRSics=
+github.com/notaryproject/tspclient-go v1.0.0 h1:AwQ4x0gX8IHnyiZB1tggpn5NFqHpTEm1SDX8YNv4Dg4=
+github.com/notaryproject/tspclient-go v1.0.0/go.mod h1:LGyA/6Kwd2FlM0uk8Vc5il3j0CddbWSHBj/4kxQDbjs=
 github.com/oklog/ulid v1.3.1 h1:EGfNDEx6MqHz8B3uNV6QAib1UR2Lm97sHi3ocA6ESJ4=
 github.com/oklog/ulid v1.3.1/go.mod h1:CirwcVhetQ6Lv90oh/F+FBtV6XMibvdAFo93nm5qn4U=
 github.com/olvrng/ujson v1.1.0 h1:8xVUzVlqwdMVWh5d1UHBtLQ1D50nxoPuPEq9Wozs8oA=
 github.com/olvrng/ujson v1.1.0/go.mod h1:Mz4G3RODTUfbkKyvi0lgmPx/7vd3Saksk+1jgk8s9xo=
 github.com/onsi/ginkgo v1.16.5 h1:8xi0RTUf59SOSfEtZMvwTvXYMzG4gV23XVHOZiXNtnE=
-github.com/onsi/ginkgo/v2 v2.23.4 h1:ktYTpKJAVZnDT4VjxSbiBenUjmlL/5QkBEocaWXiQus=
-github.com/onsi/ginkgo/v2 v2.23.4/go.mod h1:Bt66ApGPBFzHyR+JO10Zbt0Gsp4uWxu5mIOTusL46e8=
-github.com/onsi/gomega v1.37.0 h1:CdEG8g0S133B4OswTDC/5XPSzE1OeP29QOioj2PID2Y=
-github.com/onsi/gomega v1.37.0/go.mod h1:8D9+Txp43QWKhM24yyOBEdpkzN8FvJyAwecBgsU4KU0=
+github.com/onsi/ginkgo/v2 v2.27.2 h1:LzwLj0b89qtIy6SSASkzlNvX6WktqurSHwkk2ipF/Ns=
+github.com/onsi/ginkgo/v2 v2.27.2/go.mod h1:ArE1D/XhNXBXCBkKOLkbsb2c81dQHCRcF5zwn/ykDRo=
+github.com/onsi/gomega v1.38.2 h1:eZCjf2xjZAqe+LeWvKb5weQ+NcPwX84kqJ0cZNxok2A=
+github.com/onsi/gomega v1.38.2/go.mod h1:W2MJcYxRGV63b418Ai34Ud0hEdTVXq9NW9+Sx6uXf3k=
+github.com/opcoder0/capabilities v0.0.0-20221222060822-17fd73bffd2a h1:sbMMqulR2c6d2aeqOg5kzWv87unK0O4V78Dl1+YG4ys=
+github.com/opcoder0/capabilities v0.0.0-20221222060822-17fd73bffd2a/go.mod h1:77JxdABQ4m37PtO4WMtRBrI+DDphomu/8tGeijYXspk=
+github.com/opcoder0/fanotify v0.4.2 h1:Bp7h8scp/LNoWmC16Z1kf7GfxehhQLcDPxqJ31+SThs=
+github.com/opcoder0/fanotify v0.4.2/go.mod h1:S0LITNqjkZwifQ+0qB1fT1S/SmDmnFH+h0SLBzoKW2Q=
 github.com/opencontainers/go-digest v1.0.0 h1:apOUWs51W5PlhuyGyz9FCeeBIOUDA/6nW8Oi/yOhh5U=
 github.com/opencontainers/go-digest v1.0.0/go.mod h1:0JzlMkj0TRzQZfJkVvzbP0HBR3IKzErnv2BNG4W4MAM=
 github.com/opencontainers/image-spec v1.1.1 h1:y0fUlFfIZhPF1W537XOLg0/fcx6zcHCJwooC2xJA040=
 github.com/opencontainers/image-spec v1.1.1/go.mod h1:qpqAh3Dmcf36wStyyWU+kCeDgrGnAve2nCC8+7h8Q0M=
 github.com/opencontainers/runtime-spec v1.2.1 h1:S4k4ryNgEpxW1dzyqffOmhI1BHYcjzU8lpJfSlR0xww=
 github.com/opencontainers/runtime-spec v1.2.1/go.mod h1:jwyrGlmzljRJv/Fgzds9SsS/C5hL+LL3ko9hs6T5lQ0=
-github.com/opencontainers/runtime-tools v0.9.1-0.20250303011046-260e151b8552 h1:CkXngT0nixZqQUPDVfwVs3GiuhfTqCMk0V+OoHpxIvA=
-github.com/opencontainers/runtime-tools v0.9.1-0.20250303011046-260e151b8552/go.mod h1:T487Kf80NeF2i0OyVXHiylg217e0buz8pQsa0T791RA=
-github.com/opencontainers/selinux v1.13.0 h1:Zza88GWezyT7RLql12URvoxsbLfjFx988+LGaWfbL84=
-github.com/opencontainers/selinux v1.13.0/go.mod h1:XxWTed+A/s5NNq4GmYScVy+9jzXhGBVEOAyucdRUY8s=
+github.com/opencontainers/runtime-tools v0.9.1-0.20250523060157-0ea5ed0382a2 h1:2xZEHOdeQBV6PW8ZtimN863bIOl7OCW/X10K0cnxKeA=
+github.com/opencontainers/runtime-tools v0.9.1-0.20250523060157-0ea5ed0382a2/go.mod h1:MXdPzqAA8pHC58USHqNCSjyLnRQ6D+NjbpP+02Z1U/0=
+github.com/opencontainers/selinux v1.13.1 h1:A8nNeceYngH9Ow++M+VVEwJVpdFmrlxsN22F+ISDCJE=
+github.com/opencontainers/selinux v1.13.1/go.mod h1:S10WXZ/osk2kWOYKy1x2f/eXF5ZHJoUs8UU/2caNRbg=
 github.com/opentracing/opentracing-go v1.2.1-0.20220228012449-10b1cf09e00b h1:FfH+VrHHk6Lxt9HdVS0PXzSXFyS2NbZKXv33FYPol0A=
 github.com/opentracing/opentracing-go v1.2.1-0.20220228012449-10b1cf09e00b/go.mod h1:AC62GU6hc0BrNm+9RK9VSiwa/EUe1bkIeFORAMcHvJU=
 github.com/openzipkin/zipkin-go v0.1.1/go.mod h1:NtoC/o8u3JlF1lSlyPNswIbeQH9bJTmOf0Erfk+hxe8=
-github.com/panjf2000/ants/v2 v2.10.0 h1:zhRg1pQUtkyRiOFo2Sbqwjp0GfBNo9cUY2/Grpx1p+8=
-github.com/panjf2000/ants/v2 v2.10.0/go.mod h1:7ZxyxsqE4vvW0M7LSD8aI3cKwgFhBHbxnlN8mDqHa1I=
+github.com/packetcap/go-pcap v0.0.0-20250723190045-d00b185f30b7 h1:MfXxQU9tEe3zmyLVVwE8gJwQVtsG2aqzBkFNz0N6eAo=
+github.com/packetcap/go-pcap v0.0.0-20250723190045-d00b185f30b7/go.mod h1:1jryUz9E2ndKwZBNHzVhLMzS3WHO0fOKydYi9XWWu9w=
 github.com/pascaldekloe/goe v0.0.0-20180627143212-57f6aae5913c/go.mod h1:lzWF7FIEvWOWxwDKqyGYQf6ZUaNfKdP144TG7ZOy1lc=
 github.com/pascaldekloe/goe v0.1.0/go.mod h1:lzWF7FIEvWOWxwDKqyGYQf6ZUaNfKdP144TG7ZOy1lc=
 github.com/pborman/indent v1.2.1 h1:lFiviAbISHv3Rf0jcuh489bi06hj98JsVMtIDZQb9yM=
 github.com/pborman/indent v1.2.1/go.mod h1:FitS+t35kIYtB5xWTZAPhnmrxcciEEOdbyrrpz5K6Vw=
 github.com/pelletier/go-toml v1.9.4/go.mod h1:u1nR/EPcESfeI/szUZKdtJ0xRNbUoANCkoOuaOx1Y+c=
-github.com/pelletier/go-toml/v2 v2.2.3 h1:YmeHyLY8mFWbdkNWwpr+qIL2bEqT0o95WSdkNHvL12M=
-github.com/pelletier/go-toml/v2 v2.2.3/go.mod h1:MfCQTFTvCcUyyvvwm1+G6H/jORL20Xlb6rzQu9GuUkc=
+github.com/pelletier/go-toml/v2 v2.2.4 h1:mye9XuhQ6gvn5h28+VilKrrPoQVanw5PMw/TB0t5Ec4=
+github.com/pelletier/go-toml/v2 v2.2.4/go.mod h1:2gIqNv+qfxSVS7cM2xJQKtLSTLUE9V8t9Stt+h56mCY=
 github.com/peterbourgon/diskv v2.0.1+incompatible h1:UBdAOUP5p4RWqPBg048CAvpKN+vxiaj6gdUUzhl4XmI=
 github.com/peterbourgon/diskv v2.0.1+incompatible/go.mod h1:uqqh8zWWbv1HBMNONnaR/tNboyR3/BZd58JJSHlUSCU=
 github.com/petermattis/goid v0.0.0-20240813172612-4fcff4a6cae7/go.mod h1:pxMtw7cyUw6B2bRH0ZBANSPg+AoSud1I1iyJHI69jH4=
 github.com/petermattis/goid v0.0.0-20241211131331-93ee7e083c43 h1:ah1dvbqPMN5+ocrg/ZSgZ6k8bOk+kcZQ7fnyx6UvOm4=
 github.com/petermattis/goid v0.0.0-20241211131331-93ee7e083c43/go.mod h1:pxMtw7cyUw6B2bRH0ZBANSPg+AoSud1I1iyJHI69jH4=
+github.com/picatz/xcel v0.0.0-20250816143731-885b5f678a12 h1:RS7RxrC+OtnYpgI0li0NwvpE0cqYewsZGXUb6wAe0oQ=
+github.com/picatz/xcel v0.0.0-20250816143731-885b5f678a12/go.mod h1:jxNaYyVlWe+WPV3G45KzlMLvplS3PQdHLUsFePIcaEg=
 github.com/pierrec/lz4/v4 v4.1.22 h1:cKFw6uJDK+/gfw5BcDL0JL5aBsAFdsIT18eRtLj7VIU=
 github.com/pierrec/lz4/v4 v4.1.22/go.mod h1:gZWDp/Ze/IJXGXf23ltt2EXimqmTUXEy0GFuRQyBid4=
 github.com/pkg/errors v0.8.0/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
@@ -669,59 +798,64 @@ github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 h1:Jamvg5psRI
 github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/posener/complete v1.1.1/go.mod h1:em0nMJCgc9GFtwrmVmEMR/ZL6WyhyjMBndrE9hABlRI=
 github.com/posener/complete v1.2.3/go.mod h1:WZIdtGGp+qx0sLrYKtIRAruyNpv6hFCicSgv7Sy7s/s=
-github.com/power-devops/perfstat v0.0.0-20210106213030-5aafc221ea8c h1:ncq/mPwQF4JjgDlrVEn3C11VoGHZN7m8qihwgMEtzYw=
-github.com/power-devops/perfstat v0.0.0-20210106213030-5aafc221ea8c/go.mod h1:OmDBASR4679mdNQnz2pUhc2G8CO2JrUAVFDRBDP/hJE=
 github.com/prometheus/alertmanager v0.27.0 h1:V6nTa2J5V4s8TG4C4HtrBP/WNSebCCTYGGv4qecA/+I=
 github.com/prometheus/alertmanager v0.27.0/go.mod h1:8Ia/R3urPmbzJ8OsdvmZvIprDwvwmYCmUbwBL+jlPOE=
 github.com/prometheus/client_golang v0.8.0/go.mod h1:7SWBe2y4D6OKWSNQJUaRYU/AaXPKyh/dDVn+NZz0KFw=
 github.com/prometheus/client_golang v0.9.1/go.mod h1:7SWBe2y4D6OKWSNQJUaRYU/AaXPKyh/dDVn+NZz0KFw=
 github.com/prometheus/client_golang v1.0.0/go.mod h1:db9x61etRT2tGnBNRi70OPL5FsnadC4Ky3P0J6CfImo=
 github.com/prometheus/client_golang v1.4.0/go.mod h1:e9GMxYsXl05ICDXkRhurwBS4Q3OK1iX/F2sw+iXX5zU=
-github.com/prometheus/client_golang v1.22.0 h1:rb93p9lokFEsctTys46VnV1kLCDpVZ0a/Y92Vm0Zc6Q=
-github.com/prometheus/client_golang v1.22.0/go.mod h1:R7ljNsLXhuQXYZYtw6GAE9AZg8Y7vEW5scdCXrWRXC0=
+github.com/prometheus/client_golang v1.23.2 h1:Je96obch5RDVy3FDMndoUsjAhG5Edi49h0RJWRi/o0o=
+github.com/prometheus/client_golang v1.23.2/go.mod h1:Tb1a6LWHB3/SPIzCoaDXI4I8UHKeFTEQ1YCr+0Gyqmg=
 github.com/prometheus/client_model v0.0.0-20180712105110-5c3871d89910/go.mod h1:MbSGuTsp3dbXC40dX6PRTWyKYBIrTGTE9sqQNg2J8bo=
 github.com/prometheus/client_model v0.0.0-20190129233127-fd36f4220a90/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA=
 github.com/prometheus/client_model v0.0.0-20190812154241-14fe0d1b01d4/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA=
 github.com/prometheus/client_model v0.2.0/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA=
-github.com/prometheus/client_model v0.6.1 h1:ZKSh/rekM+n3CeS952MLRAdFwIKqeY8b62p8ais2e9E=
-github.com/prometheus/client_model v0.6.1/go.mod h1:OrxVMOVHjw3lKMa8+x6HeMGkHMQyHDk9E3jmP2AmGiY=
+github.com/prometheus/client_model v0.6.2 h1:oBsgwpGs7iVziMvrGhE53c/GrLUsZdHnqNwqPLxwZyk=
+github.com/prometheus/client_model v0.6.2/go.mod h1:y3m2F6Gdpfy6Ut/GBsUqTWZqCUvMVzSfMLjcu6wAwpE=
 github.com/prometheus/common v0.0.0-20180801064454-c7de2306084e/go.mod h1:daVV7qP5qjZbuso7PdcryaAu0sAZbrN9i7WWcTMWvro=
 github.com/prometheus/common v0.4.1/go.mod h1:TNfzLD0ON7rHzMJeJkieUDPYmFC7Snx/y86RQel1bk4=
 github.com/prometheus/common v0.9.1/go.mod h1:yhUN8i9wzaXS3w1O07YhxHEBxD+W35wd8bs7vj7HSQ4=
-github.com/prometheus/common v0.62.0 h1:xasJaQlnWAeyHdUBeGjXmutelfJHWMRr+Fg4QszZ2Io=
-github.com/prometheus/common v0.62.0/go.mod h1:vyBcEuLSvWos9B1+CyL7JZ2up+uFzXhkqml0W5zIY1I=
+github.com/prometheus/common v0.67.4 h1:yR3NqWO1/UyO1w2PhUvXlGQs/PtFmoveVO0KZ4+Lvsc=
+github.com/prometheus/common v0.67.4/go.mod h1:gP0fq6YjjNCLssJCQp0yk4M8W6ikLURwkdd/YKtTbyI=
 github.com/prometheus/procfs v0.0.0-20180725123919-05ee40e3a273/go.mod h1:c3At6R/oaqEKCNdg8wHV1ftS6bRYblBhIjjI8uT2IGk=
 github.com/prometheus/procfs v0.0.0-20181005140218-185b4288413d/go.mod h1:c3At6R/oaqEKCNdg8wHV1ftS6bRYblBhIjjI8uT2IGk=
 github.com/prometheus/procfs v0.0.2/go.mod h1:TjEm7ze935MbeOT/UhFTIMYKhuLP4wbCsTZCD3I8kEA=
 github.com/prometheus/procfs v0.0.8/go.mod h1:7Qr8sr6344vo1JqZ6HhLceV9o3AJ1Ff+GxbHq6oeK9A=
-github.com/prometheus/procfs v0.15.1 h1:YagwOFzUgYfKKHX6Dr+sHT7km/hxC76UB0learggepc=
-github.com/prometheus/procfs v0.15.1/go.mod h1:fB45yRUv8NstnjriLhBQLuOUt+WW4BsoGhij/e3PBqk=
+github.com/prometheus/procfs v0.19.2 h1:zUMhqEW66Ex7OXIiDkll3tl9a1ZdilUOd/F6ZXw4Vws=
+github.com/prometheus/procfs v0.19.2/go.mod h1:M0aotyiemPhBCM0z5w87kL22CxfcH05ZpYlu+b4J7mw=
+github.com/puzpuzpuz/xsync/v2 v2.4.1 h1:aGdE1C/HaR/QC6YAFdtZXi60Df8/qBIrs8PKrzkItcM=
+github.com/puzpuzpuz/xsync/v2 v2.4.1/go.mod h1:gD2H2krq/w52MfPLE+Uy64TzJDVY7lP2znR9qmR35kU=
+github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec h1:W09IVJc94icq4NjY3clb7Lk8O1qJ8BdBEF8z0ibU0rE=
+github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec/go.mod h1:qqbHyh8v60DhA7CoWK5oRCqLrMHRGoxYCSS9EjAz6Eo=
 github.com/rogpeppe/fastuuid v1.2.0/go.mod h1:jVj6XXZzXRy/MSR5jhDC/2q6DgLz+nrA6LYCDYWNEvQ=
 github.com/rogpeppe/go-internal v1.3.0/go.mod h1:M8bDsm7K2OlrFYOpmOWEs/qY81heoFRclV5y23lUDJ4=
-github.com/rogpeppe/go-internal v1.13.2-0.20241226121412-a5dc8ff20d0a h1:w3tdWGKbLGBPtR/8/oO74W6hmz0qE5q0z9aqSAewaaM=
-github.com/rogpeppe/go-internal v1.13.2-0.20241226121412-a5dc8ff20d0a/go.mod h1:S8kfXMp+yh77OxPD4fdM6YUknrZpQxLhvxzS4gDHENY=
+github.com/rogpeppe/go-internal v1.6.1/go.mod h1:xXDCJY+GAPziupqXw64V24skbSoqbTEfhy4qGm1nDQc=
+github.com/rogpeppe/go-internal v1.14.1 h1:UQB4HGPB6osV0SQTLymcB4TgvyWu6ZyliaW0tI/otEQ=
+github.com/rogpeppe/go-internal v1.14.1/go.mod h1:MaRKkUm5W0goXpeCfT7UZI6fk/L7L7so1lCWt35ZSgc=
 github.com/russross/blackfriday v1.5.2/go.mod h1:JO/DiYxRf+HjHt06OyowR9PTA263kcR/rfWxYHBV53g=
 github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
 github.com/ryanuber/columnize v0.0.0-20160712163229-9b3edd62028f/go.mod h1:sm1tb6uqfes/u+d4ooFouqFdy9/2g9QGwK3SQygK0Ts=
 github.com/s3rj1k/go-fanotify/fanotify v0.0.0-20240229202106-bca3154da60a h1:4VFls9SuqkqeioVevnaeTXrYKQ7JiEsxqKHfxp+/ovA=
 github.com/s3rj1k/go-fanotify/fanotify v0.0.0-20240229202106-bca3154da60a/go.mod h1:2zG1g57bc+D6FpNc68gsRXJgkidteqTMhWiiUP3m8UE=
 github.com/sagikazarmark/crypt v0.3.0/go.mod h1:uD/D+6UF4SrIR1uGEv7bBNkNqLGqUr43MRiaGWX1Nig=
-github.com/sagikazarmark/locafero v0.7.0 h1:5MqpDsTGNDhY8sGp0Aowyf0qKsPrhewaLSsFaodPcyo=
-github.com/sagikazarmark/locafero v0.7.0/go.mod h1:2za3Cg5rMaTMoG/2Ulr9AwtFaIppKXTRYnozin4aB5k=
+github.com/sagikazarmark/locafero v0.11.0 h1:1iurJgmM9G3PA/I+wWYIOw/5SyBtxapeHDcg+AAIFXc=
+github.com/sagikazarmark/locafero v0.11.0/go.mod h1:nVIGvgyzw595SUSUE6tvCp3YYTeHs15MvlmU87WwIik=
 github.com/sasha-s/go-deadlock v0.3.5 h1:tNCOEEDG6tBqrNDOX35j/7hL5FcFViG6awUGROb2NsU=
 github.com/sasha-s/go-deadlock v0.3.5/go.mod h1:bugP6EGbdGYObIlx7pUZtWqlvo8k9H6vCBBsiChJQ5U=
 github.com/scylladb/go-set v1.0.3-0.20200225121959-cc7b2070d91e h1:7q6NSFZDeGfvvtIRwBrU/aegEYJYmvev0cHAwo17zZQ=
 github.com/scylladb/go-set v1.0.3-0.20200225121959-cc7b2070d91e/go.mod h1:DkpGd78rljTxKAnTDPFqXSGxvETQnJyuSOQwsHycqfs=
 github.com/sean-/seed v0.0.0-20170313163322-e2103e2c3529/go.mod h1:DxrIzT+xaE7yg65j358z/aeFdxmN0P9QXhEzd20vsDc=
-github.com/seccomp/libseccomp-golang v0.10.0 h1:aA4bp+/Zzi0BnWZ2F1wgNBs5gTpm+na2rWM6M9YjLpY=
-github.com/seccomp/libseccomp-golang v0.10.0/go.mod h1:JA8cRccbGaA1s33RQf7Y1+q9gHmZX1yB/z9WDN1C6fg=
+github.com/seccomp/libseccomp-golang v0.11.0 h1:SDkcBRqGLP+sezmMACkxO1EfgbghxIxnRKfd6mHUEis=
+github.com/seccomp/libseccomp-golang v0.11.0/go.mod h1:5m1Lk8E9OwgZTTVz4bBOer7JuazaBa+xTkM895tDiWc=
+github.com/secure-systems-lab/go-securesystemslib v0.9.1 h1:nZZaNz4DiERIQguNy0cL5qTdn9lR8XKHf4RUyG1Sx3g=
+github.com/secure-systems-lab/go-securesystemslib v0.9.1/go.mod h1:np53YzT0zXGMv6x4iEWc9Z59uR+x+ndLwCLqPYpLXVU=
 github.com/sergi/go-diff v1.0.0/go.mod h1:0CfEIISq7TuYL3j771MWULgwwjU+GofnZX9QAmXWZgo=
 github.com/sergi/go-diff v1.1.0/go.mod h1:STckp+ISIX8hZLjrqAeVduY0gWCT9IjLuqbuNXdaHfM=
 github.com/sergi/go-diff v1.2.0/go.mod h1:STckp+ISIX8hZLjrqAeVduY0gWCT9IjLuqbuNXdaHfM=
-github.com/sergi/go-diff v1.3.2-0.20230802210424-5b0b94c5c0d3 h1:n661drycOFuPLCN3Uc8sB6B/s6Z4t2xvBgU1htSHuq8=
-github.com/sergi/go-diff v1.3.2-0.20230802210424-5b0b94c5c0d3/go.mod h1:A0bzQcvG0E7Rwjx0REVgAGH58e96+X0MeOfepqsbeW4=
-github.com/shirou/gopsutil/v4 v4.25.1 h1:QSWkTc+fu9LTAWfkZwZ6j8MSUk4A2LV7rbH0ZqmLjXs=
-github.com/shirou/gopsutil/v4 v4.25.1/go.mod h1:RoUCUpndaJFtT+2zsZzzmhvbfGoDCJ7nFXKJf8GqJbI=
+github.com/sergi/go-diff v1.4.0 h1:n/SP9D5ad1fORl+llWyN+D6qoUETXNZARKjyY2/KVCw=
+github.com/sergi/go-diff v1.4.0/go.mod h1:A0bzQcvG0E7Rwjx0REVgAGH58e96+X0MeOfepqsbeW4=
+github.com/shibumi/go-pathspec v1.3.0 h1:QUyMZhFo0Md5B8zV8x2tesohbb5kfbpTi9rBnKh5dkI=
+github.com/shibumi/go-pathspec v1.3.0/go.mod h1:Xutfslp817l2I1cZvgcfeMQJG5QnU2lh5tVaaMCl3jE=
 github.com/shurcooL/component v0.0.0-20170202220835-f88ec8f54cc4/go.mod h1:XhFIlyj5a1fBNx5aJTbKoIq0mNaPvOagO+HjB3EtxrY=
 github.com/shurcooL/events v0.0.0-20181021180414-410e4ca65f48/go.mod h1:5u70Mqkb5O5cxEA8nxTsgrgLehJeAw6Oc4Ab1c/P1HM=
 github.com/shurcooL/github_flavored_markdown v0.0.0-20181002035957-2122de532470/go.mod h1:2dOwnU2uBioM+SGy2aZoq1f/Sd1l9OkAeAUvjSyvgU0=
@@ -744,32 +878,39 @@ github.com/shurcooL/reactions v0.0.0-20181006231557-f2e0b4ca5b82/go.mod h1:TCR1l
 github.com/shurcooL/sanitized_anchor_name v0.0.0-20170918181015-86672fcb3f95/go.mod h1:1NzhyTcUVG4SuEtjjoZeVRXNmyL/1OwPU0+IJeTBvfc=
 github.com/shurcooL/users v0.0.0-20180125191416-49c67e49c537/go.mod h1:QJTqeLYEDaXHZDBsXlPCDqdhQuJkuw4NOtaxYe3xii4=
 github.com/shurcooL/webdavfs v0.0.0-20170829043945-18c3829fa133/go.mod h1:hKmq5kWdCj2z2KEozexVbfEZIWiTjhE0+UjmZgPqehw=
+github.com/sigstore/protobuf-specs v0.5.0 h1:F8YTI65xOHw70NrvPwJ5PhAzsvTnuJMGLkA4FIkofAY=
+github.com/sigstore/protobuf-specs v0.5.0/go.mod h1:+gXR+38nIa2oEupqDdzg4qSBT0Os+sP7oYv6alWewWc=
+github.com/sigstore/sigstore v1.10.4 h1:ytOmxMgLdcUed3w1SbbZOgcxqwMG61lh1TmZLN+WeZE=
+github.com/sigstore/sigstore v1.10.4/go.mod h1:tDiyrdOref3q6qJxm2G+JHghqfmvifB7hw+EReAfnbI=
 github.com/sirupsen/logrus v1.2.0/go.mod h1:LxeOpSwHxABJmUn/MG1IvRgCAasNZTLOkJPxbbu5VWo=
 github.com/sirupsen/logrus v1.4.2/go.mod h1:tLMulIdttU9McNUspp0xgXVQah82FyeX6MwdIuYE2rE=
-github.com/sirupsen/logrus v1.9.3 h1:dueUQJ1C2q9oE3F7wvmSGAaVtTmUizReu6fjN8uqzbQ=
-github.com/sirupsen/logrus v1.9.3/go.mod h1:naHLuLoDiP4jHNo9R0sCBMtWGeIprob74mVsIT4qYEQ=
+github.com/sirupsen/logrus v1.9.4-0.20230606125235-dd1b4c2e81af h1:Sp5TG9f7K39yfB+If0vjp97vuT74F72r8hfRpP8jLU0=
+github.com/sirupsen/logrus v1.9.4-0.20230606125235-dd1b4c2e81af/go.mod h1:naHLuLoDiP4jHNo9R0sCBMtWGeIprob74mVsIT4qYEQ=
 github.com/sourcegraph/annotate v0.0.0-20160123013949-f4cad6c6324d/go.mod h1:UdhH50NIW0fCiwBSr0co2m7BnFLdv4fQTgdqdJTHFeE=
-github.com/sourcegraph/conc v0.3.0 h1:OQTbbt6P72L20UqAkXXuLOj79LfEanQ+YQFNpLA9ySo=
-github.com/sourcegraph/conc v0.3.0/go.mod h1:Sdozi7LEKbFPqYX2/J+iBAM6HpqSLTASQIKqDmF7Mt0=
+github.com/sourcegraph/conc v0.3.1-0.20240121214520-5f936abd7ae8 h1:+jumHNA0Wrelhe64i8F6HNlS8pkoyMv5sreGx2Ry5Rw=
+github.com/sourcegraph/conc v0.3.1-0.20240121214520-5f936abd7ae8/go.mod h1:3n1Cwaq1E1/1lhQhtRK2ts/ZwZEhjcQeJQ1RuC6Q/8U=
 github.com/sourcegraph/syntaxhighlight v0.0.0-20170531221838-bd320f5d308e/go.mod h1:HuIsMU8RRBOtsCgI77wP899iHVBQpCmg4ErYMZB+2IA=
 github.com/spaolacci/murmur3 v0.0.0-20180118202830-f09979ecbc72/go.mod h1:JwIasOWyU6f++ZhiEuf87xNszmSA2myDM2Kzu9HwQUA=
 github.com/spf13/afero v1.3.3/go.mod h1:5KUK8ByomD5Ti5Artl0RtHeI5pTF7MIDuXL3yY520V4=
 github.com/spf13/afero v1.6.0/go.mod h1:Ai8FlHk4v/PARR026UzYexafAt9roJ7LcLMAmO6Z93I=
-github.com/spf13/afero v1.12.0 h1:UcOPyRBYczmFn6yvphxkn9ZEOY65cpwGKb5mL36mrqs=
-github.com/spf13/afero v1.12.0/go.mod h1:ZTlWwG4/ahT8W7T0WQ5uYmjI9duaLQGy3Q2OAl4sk/4=
+github.com/spf13/afero v1.15.0 h1:b/YBCLWAJdFWJTN9cLhiXXcD7mzKn9Dm86dNnfyQw1I=
+github.com/spf13/afero v1.15.0/go.mod h1:NC2ByUVxtQs4b3sIUphxK0NioZnmxgyCrfzeuq8lxMg=
 github.com/spf13/cast v1.4.1/go.mod h1:Qx5cxh0v+4UWYiBimWS+eyWzqEqokIECu5etghLkUJE=
-github.com/spf13/cast v1.7.1 h1:cuNEagBQEHWN1FnbGEjCXL2szYEXqfJPbP2HNUaca9Y=
-github.com/spf13/cast v1.7.1/go.mod h1:ancEpBxwJDODSW/UG4rDrAqiKolqNNh2DX3mk86cAdo=
+github.com/spf13/cast v1.10.0 h1:h2x0u2shc1QuLHfxi+cTJvs30+ZAHOGRic8uyGTDWxY=
+github.com/spf13/cast v1.10.0/go.mod h1:jNfB8QC9IA6ZuY2ZjDp0KtFO2LZZlg4S/7bzP6qqeHo=
 github.com/spf13/cobra v1.3.0/go.mod h1:BrRVncBjOJa/eUcVVm9CE+oC6as8k+VYr4NY7WCi9V4=
-github.com/spf13/cobra v1.9.1 h1:CXSaggrXdbHK9CF+8ywj8Amf7PBRmPCOJugH954Nnlo=
-github.com/spf13/cobra v1.9.1/go.mod h1:nDyEzZ8ogv936Cinf6g1RU9MRY64Ir93oCnqb9wxYW0=
+github.com/spf13/cobra v1.10.2 h1:DMTTonx5m65Ic0GOoRY2c16WCbHxOOw6xxezuLaBpcU=
+github.com/spf13/cobra v1.10.2/go.mod h1:7C1pvHqHw5A4vrJfjNwvOdzYu0Gml16OCs2GRiTUUS4=
 github.com/spf13/jwalterweatherman v1.1.0/go.mod h1:aNWZUN0dPAAO/Ljvb5BEdw96iTZ0EXowPYD95IqWIGo=
 github.com/spf13/pflag v1.0.5/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
-github.com/spf13/pflag v1.0.6 h1:jFzHGLGAlb3ruxLB8MhbI6A8+AQX/2eW4qeyNZXNp2o=
-github.com/spf13/pflag v1.0.6/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
+github.com/spf13/pflag v1.0.9/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
+github.com/spf13/pflag v1.0.10 h1:4EBh2KAYBwaONj6b2Ye1GiHfwjqyROoF4RwYO+vPwFk=
+github.com/spf13/pflag v1.0.10/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
 github.com/spf13/viper v1.10.0/go.mod h1:SoyBPwAtKDzypXNDFKN5kzH7ppppbGZtls1UpIy5AsM=
-github.com/spf13/viper v1.20.1 h1:ZMi+z/lvLyPSCoNtFCpqjy0S4kPbirhpTMwl8BkW9X4=
-github.com/spf13/viper v1.20.1/go.mod h1:P9Mdzt1zoHIG8m2eZQinpiBjo6kCmZSKBClNNqjJvu4=
+github.com/spf13/viper v1.21.0 h1:x5S+0EU27Lbphp4UKm1C+1oQO+rKx36vfCoaVebLFSU=
+github.com/spf13/viper v1.21.0/go.mod h1:P0lhsswPGWD/1lZJ9ny3fYnVqxiegrlNrEmgLjbTCAY=
+github.com/stoewer/go-strcase v1.3.0 h1:g0eASXYtp+yvN9fK8sH94oCIk0fau9uV1/ZdJ0AVEzs=
+github.com/stoewer/go-strcase v1.3.0/go.mod h1:fAH5hQ5pehh+j3nZfvwdk2RgEgQjAoM8wodgtPmh1xo=
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
 github.com/stretchr/objx v0.1.1/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
 github.com/stretchr/objx v0.4.0/go.mod h1:YvHI0jy2hoMjB+UWwv71VJQ9isScKT/TqJzVSSt89Yw=
@@ -785,7 +926,6 @@ github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/
 github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
 github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU=
 github.com/stretchr/testify v1.8.1/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4=
-github.com/stretchr/testify v1.8.2/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4=
 github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
 github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
 github.com/stripe/stripe-go/v74 v74.30.0 h1:0Kf0KkeFnY7iRhOwvTerX0Ia1BRw+eV1CVJ51mGYAUY=
@@ -793,18 +933,11 @@ github.com/stripe/stripe-go/v74 v74.30.0/go.mod h1:f9L6LvaXa35ja7eyvP6GQswoaIPaB
 github.com/subosito/gotenv v1.2.0/go.mod h1:N0PQaV/YGNqwC0u51sEeR/aUtSLEXKX9iv69rRypqCw=
 github.com/subosito/gotenv v1.6.0 h1:9NlTDc1FTs4qu0DDq7AEtTPNw6SVm7uBMsUCUjABIf8=
 github.com/subosito/gotenv v1.6.0/go.mod h1:Dk4QP5c2W3ibzajGcXpNraDfq2IrhjMIvMSWPKKo0FU=
-github.com/sylabs/squashfs v1.0.4 h1:uFSw7WXv7zjutPvU+JzY0nY494Vw8s4FAf4+7DhoMdI=
-github.com/sylabs/squashfs v1.0.4/go.mod h1:PDgf8YmCntvN4d9Y8hBUBDCZL6qZOzOQwRGxnIdbERk=
-github.com/syndtr/gocapability v0.0.0-20200815063812-42c35b437635 h1:kdXcSzyDtseVEc4yCz2qF8ZrQvIDBJLl4S1c3GCXmoI=
-github.com/syndtr/gocapability v0.0.0-20200815063812-42c35b437635/go.mod h1:hkRG7XYTFWNJGYcbNJQlaLq0fg1yr4J4t/NcTQtrfww=
+github.com/sylabs/squashfs v1.0.6 h1:PvJcDzxr+vIm2kH56mEMbaOzvGu79gK7P7IX+R7BDZI=
+github.com/sylabs/squashfs v1.0.6/go.mod h1:DlDeUawVXLWAsSRa085Eo0ZenGzAB32JdAUFaB0LZfE=
 github.com/tarm/serial v0.0.0-20180830185346-98f6abe2eb07/go.mod h1:kDXzergiv9cbyO7IOYJZWg1U88JhDg3PB6klq9Hg2pA=
 github.com/therootcompany/xz v1.0.1 h1:CmOtsn1CbtmyYiusbfmhmkpAAETj0wBIH6kCYaX+xzw=
 github.com/therootcompany/xz v1.0.1/go.mod h1:3K3UH1yCKgBneZYhuQUvJ9HPD19UEXEI0BWbMn8qNMY=
-github.com/tklauser/go-sysconf v0.3.12 h1:0QaGUFOdQaIVdPgfITYzaTegZvdCjmYO52cSFAEVmqU=
-github.com/tklauser/go-sysconf v0.3.12/go.mod h1:Ho14jnntGE1fpdOqQEEaiKRpvIavV0hSfmBq8nJbHYI=
-github.com/tklauser/numcpus v0.6.1/go.mod h1:1XfjsgE2zo8GVw7POkMbHENHzVg3GzmoZ9fESEdAacY=
-github.com/tklauser/numcpus v0.10.0 h1:18njr6LDBk1zuna922MgdjQuJFjrdppsZG60sHGfjso=
-github.com/tklauser/numcpus v0.10.0/go.mod h1:BiTKazU708GQTYF4mB+cmlpT2Is1gLk7XVuEeem8LsQ=
 github.com/tv42/httpunix v0.0.0-20150427012821-b75d8614f926/go.mod h1:9ESjWnEqriFuLhtthL60Sar/7RFoluCcXsuvEwTV5KM=
 github.com/ulikunitz/xz v0.5.15 h1:9DNdB5s+SgV3bQ2ApL10xRc35ck0DuIX/isZvIk+ubY=
 github.com/ulikunitz/xz v0.5.15/go.mod h1:nbz6k7qbPmH4IRqmfOplQw/tblSgqTqBwxkY0oWt/14=
@@ -812,13 +945,14 @@ github.com/uptrace/opentelemetry-go-extra/otelutil v0.3.2 h1:3/aHKUq7qaFMWxyQV0W
 github.com/uptrace/opentelemetry-go-extra/otelutil v0.3.2/go.mod h1:Zit4b8AQXaXvA68+nzmbyDzqiyFRISyw1JiD5JqUBjw=
 github.com/uptrace/opentelemetry-go-extra/otelzap v0.3.2 h1:cj/Z6FKTTYBnstI0Lni9PA+k2foounKIPUmj1LBwNiQ=
 github.com/uptrace/opentelemetry-go-extra/otelzap v0.3.2/go.mod h1:LDaXk90gKEC2nC7JH3Lpnhfu+2V7o/TsqomJJmqA39o=
-github.com/uptrace/uptrace-go v1.35.1 h1:ZK+YwrPyZcpC9nJUrFiVogI8pBuPtlTbGyjs8LAhirk=
-github.com/uptrace/uptrace-go v1.35.1/go.mod h1:N+XGgxkQP1/6iw8fvbP2PrkbK1adyTutLmMgm3Xw7x8=
+github.com/uptrace/uptrace-go v1.38.0 h1:QdJfyQkaz7HNPbqM9OkaQ2L9jfdf0DpfZJv9em7YIgE=
+github.com/uptrace/uptrace-go v1.38.0/go.mod h1:SdE9nA+/y+SOIzatuIK2tZeYhoWgrAzAr08kJEquZyM=
+github.com/veraison/go-cose v1.3.0 h1:2/H5w8kdSpQJyVtIhx8gmwPJ2uSz1PkyWFx0idbd7rk=
+github.com/veraison/go-cose v1.3.0/go.mod h1:df09OV91aHoQWLmy1KsDdYiagtXgyAwAl8vFeFn1gMc=
 github.com/viant/assertly v0.4.8/go.mod h1:aGifi++jvCrUaklKEKT0BU95igDNaqkvz+49uaYMPRU=
 github.com/viant/toolbox v0.24.0/go.mod h1:OxMCG57V0PXuIP2HNQrtJf2CjqdmbrOx5EkMILuUhzM=
-github.com/vishvananda/netlink v1.3.1-0.20241022031324-976bd8de7d81 h1:9fkQcQYvtTr9ayFXuMfDMVuDt4+BYG9FwsGLnrBde0M=
-github.com/vishvananda/netlink v1.3.1-0.20241022031324-976bd8de7d81/go.mod h1:i6NetklAujEcC6fK0JPjT8qSwWyO0HLn4UKG+hGqeJs=
-github.com/vishvananda/netns v0.0.4/go.mod h1:SpkAiCQRtJ6TvvxPnOSyH3BMl6unz3xZlaprSwhNNJM=
+github.com/vishvananda/netlink v1.3.1 h1:3AEMt62VKqz90r0tmNhog0r/PpWKmrEShJU0wJW6bV0=
+github.com/vishvananda/netlink v1.3.1/go.mod h1:ARtKouGSTGchR8aMwmkzC0qiNPrrWO5JS/XMVl45+b4=
 github.com/vishvananda/netns v0.0.5 h1:DfiHV+j8bA32MFM7bfEunvT8IAqQ/NzSJHtcmW5zdEY=
 github.com/vishvananda/netns v0.0.5/go.mod h1:SpkAiCQRtJ6TvvxPnOSyH3BMl6unz3xZlaprSwhNNJM=
 github.com/wagoodman/go-partybus v0.0.0-20230516145632-8ccac152c651 h1:jIVmlAFIqV3d+DOxazTR9v+zgj8+VYuQBzPgBZvWBHA=
@@ -838,13 +972,12 @@ github.com/yuin/goldmark v1.1.27/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9de
 github.com/yuin/goldmark v1.1.32/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
 github.com/yuin/goldmark v1.2.1/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
 github.com/yuin/goldmark v1.3.5/go.mod h1:mwnBkeHKe2W/ZEtQ+71ViKU8L12m81fl3OWwC1Zlc8k=
-github.com/yusufpapurcu/wmi v1.2.4 h1:zFUKzehAFReQwLys1b/iSMl+JQGSCSjtVqQn9bBrPo0=
-github.com/yusufpapurcu/wmi v1.2.4/go.mod h1:SBZ9tNy3G9/m5Oi98Zks0QjeHVDvuK0qfxQmPyzfmi0=
+github.com/yuin/goldmark v1.4.13/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY=
 go.etcd.io/etcd/api/v3 v3.5.1/go.mod h1:cbVKeC6lCfl7j/8jBhAK6aIYO9XOjdptoxU/nLQcPvs=
 go.etcd.io/etcd/client/pkg/v3 v3.5.1/go.mod h1:IJHfcCEKxYu1Os13ZdwCwIUTUVGYTSAM3YSwc9/Ac1g=
 go.etcd.io/etcd/client/v2 v2.305.1/go.mod h1:pMEacxZW7o8pg4CrFE7pquyCJJzZvkvdD2RibOCCCGs=
-go.mongodb.org/mongo-driver v1.17.1 h1:Wic5cJIwJgSpBhe3lx3+/RybR5PiYRMpVFgO7cOHyIM=
-go.mongodb.org/mongo-driver v1.17.1/go.mod h1:wwWm/+BuOddhcq3n68LKRmgk2wXzmF6s0SFOa0GINL4=
+go.mongodb.org/mongo-driver v1.17.4 h1:jUorfmVzljjr0FLzYQsGP8cgN/qzzxlY9Vh0C9KFXVw=
+go.mongodb.org/mongo-driver v1.17.4/go.mod h1:Hy04i7O2kC4RS06ZrhPRqj/u4DTYkFDAAccj+rVKqgQ=
 go.opencensus.io v0.18.0/go.mod h1:vKdFvxhtzZ9onBp9VKHK8z/sRpBMnKAsufL7wlDrCOA=
 go.opencensus.io v0.21.0/go.mod h1:mSImk1erAIZhrmZN+AvHh14ztQfjbGwt4TtuofqLduU=
 go.opencensus.io v0.22.0/go.mod h1:+kGneAE2xo2IficOXnaByMWTGM9T73dGwxeWcUqIpI8=
@@ -855,42 +988,42 @@ go.opencensus.io v0.22.5/go.mod h1:5pWMHQbX5EPX2/62yrJeAkowc+lfs/XD7Uxpq3pI6kk=
 go.opencensus.io v0.23.0/go.mod h1:XItmlyltB5F7CS4xOC1DcqMoFqwtC6OG2xF7mCv7P7E=
 go.opencensus.io v0.24.0 h1:y73uSU6J157QMP2kn2r30vwW1A2W2WFwSCGnAVxeaD0=
 go.opencensus.io v0.24.0/go.mod h1:vNK8G9p7aAivkbmorf4v+7Hgx+Zs0yY+0fOtgBfjQKo=
-go.opentelemetry.io/auto/sdk v1.1.0 h1:cH53jehLUN6UFLY71z+NDOiNJqDdPRaXzTel0sJySYA=
-go.opentelemetry.io/auto/sdk v1.1.0/go.mod h1:3wSPjt5PWp2RhlCcmmOial7AvC4DQqZb7a7wCow3W8A=
-go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.59.0 h1:CV7UdSGJt/Ao6Gp4CXckLxVRRsRgDHoI8XjbL3PDl8s=
-go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.59.0/go.mod h1:FRmFuRJfag1IZ2dPkHnEoSFVgTVPUd2qf5Vi69hLb8I=
-go.opentelemetry.io/contrib/instrumentation/runtime v0.60.0 h1:0NgN/3SYkqYJ9NBlDfl/2lzVlwos/YQLvi8sUrzJRBE=
-go.opentelemetry.io/contrib/instrumentation/runtime v0.60.0/go.mod h1:oxpUfhTkhgQaYIjtBt3T3w135dLoxq//qo3WPlPIKkE=
-go.opentelemetry.io/otel v1.35.0 h1:xKWKPxrxB6OtMCbmMY021CqC45J+3Onta9MqjhnusiQ=
-go.opentelemetry.io/otel v1.35.0/go.mod h1:UEqy8Zp11hpkUrL73gSlELM0DupHoiq72dR+Zqel/+Y=
-go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp v0.11.0 h1:C/Wi2F8wEmbxJ9Kuzw/nhP+Z9XaHYMkyDmXy6yR2cjw=
-go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp v0.11.0/go.mod h1:0Lr9vmGKzadCTgsiBydxr6GEZ8SsZ7Ks53LzjWG5Ar4=
-go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp v1.35.0 h1:0NIXxOCFx+SKbhCVxwl3ETG8ClLPAa0KuKV6p3yhxP8=
-go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp v1.35.0/go.mod h1:ChZSJbbfbl/DcRZNc9Gqh6DYGlfjw4PvO1pEOZH1ZsE=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.35.0 h1:1fTNlAIJZGWLP5FVu0fikVry1IsiUnXjf7QFvoNN3Xw=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.35.0/go.mod h1:zjPK58DtkqQFn+YUMbx0M2XV3QgKU0gS9LeGohREyK4=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.35.0 h1:xJ2qHD0C1BeYVTLLR9sX12+Qb95kfeD/byKj6Ky1pXg=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.35.0/go.mod h1:u5BF1xyjstDowA1R5QAO9JHzqK+ublenEW/dyqTjBVk=
-go.opentelemetry.io/otel/exporters/stdout/stdouttrace v1.35.0 h1:T0Ec2E+3YZf5bgTNQVet8iTDW7oIk03tXHq+wkwIDnE=
-go.opentelemetry.io/otel/exporters/stdout/stdouttrace v1.35.0/go.mod h1:30v2gqH+vYGJsesLWFov8u47EpYTcIQcBjKpI6pJThg=
-go.opentelemetry.io/otel/log v0.11.0 h1:c24Hrlk5WJ8JWcwbQxdBqxZdOK7PcP/LFtOtwpDTe3Y=
-go.opentelemetry.io/otel/log v0.11.0/go.mod h1:U/sxQ83FPmT29trrifhQg+Zj2lo1/IPN1PF6RTFqdwc=
-go.opentelemetry.io/otel/metric v1.35.0 h1:0znxYu2SNyuMSQT4Y9WDWej0VpcsxkuklLa4/siN90M=
-go.opentelemetry.io/otel/metric v1.35.0/go.mod h1:nKVFgxBZ2fReX6IlyW28MgZojkoAkJGaE8CpgeAU3oE=
-go.opentelemetry.io/otel/sdk v1.35.0 h1:iPctf8iprVySXSKJffSS79eOjl9pvxV9ZqOWT0QejKY=
-go.opentelemetry.io/otel/sdk v1.35.0/go.mod h1:+ga1bZliga3DxJ3CQGg3updiaAJoNECOgJREo9KHGQg=
-go.opentelemetry.io/otel/sdk/log v0.11.0 h1:7bAOpjpGglWhdEzP8z0VXc4jObOiDEwr3IYbhBnjk2c=
-go.opentelemetry.io/otel/sdk/log v0.11.0/go.mod h1:dndLTxZbwBstZoqsJB3kGsRPkpAgaJrWfQg3lhlHFFY=
-go.opentelemetry.io/otel/sdk/metric v1.35.0 h1:1RriWBmCKgkeHEhM7a2uMjMUfP7MsOF5JpUCaEqEI9o=
-go.opentelemetry.io/otel/sdk/metric v1.35.0/go.mod h1:is6XYCUMpcKi+ZsOvfluY5YstFnhW0BidkR+gL+qN+w=
-go.opentelemetry.io/otel/trace v1.35.0 h1:dPpEfJu1sDIqruz7BHFG3c7528f6ddfSWfFDVt/xgMs=
-go.opentelemetry.io/otel/trace v1.35.0/go.mod h1:WUk7DtFp1Aw2MkvqGdwiXYDZZNvA/1J8o6xRXLrIkyc=
+go.opentelemetry.io/auto/sdk v1.2.1 h1:jXsnJ4Lmnqd11kwkBV2LgLoFMZKizbCi5fNZ/ipaZ64=
+go.opentelemetry.io/auto/sdk v1.2.1/go.mod h1:KRTj+aOaElaLi+wW1kO/DZRXwkF4C5xPbEe3ZiIhN7Y=
+go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.63.0 h1:RbKq8BG0FI8OiXhBfcRtqqHcZcka+gU3cskNuf05R18=
+go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.63.0/go.mod h1:h06DGIukJOevXaj/xrNjhi/2098RZzcLTbc0jDAUbsg=
+go.opentelemetry.io/contrib/instrumentation/runtime v0.64.0 h1:/+/+UjlXjFcdDlXxKL1PouzX8Z2Vl0OxolRKeBEgYDw=
+go.opentelemetry.io/contrib/instrumentation/runtime v0.64.0/go.mod h1:Ldm/PDuzY2DP7IypudopCR3OCOW42NJlN9+mNEroevo=
+go.opentelemetry.io/otel v1.39.0 h1:8yPrr/S0ND9QEfTfdP9V+SiwT4E0G7Y5MO7p85nis48=
+go.opentelemetry.io/otel v1.39.0/go.mod h1:kLlFTywNWrFyEdH0oj2xK0bFYZtHRYUdv1NklR/tgc8=
+go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp v0.14.0 h1:QQqYw3lkrzwVsoEX0w//EhH/TCnpRdEenKBOOEIMjWc=
+go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp v0.14.0/go.mod h1:gSVQcr17jk2ig4jqJ2DX30IdWH251JcNAecvrqTxH1s=
+go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp v1.38.0 h1:Oe2z/BCg5q7k4iXC3cqJxKYg0ieRiOqF0cecFYdPTwk=
+go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp v1.38.0/go.mod h1:ZQM5lAJpOsKnYagGg/zV2krVqTtaVdYdDkhMoX6Oalg=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.38.0 h1:GqRJVj7UmLjCVyVJ3ZFLdPRmhDUp2zFmQe3RHIOsw24=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.38.0/go.mod h1:ri3aaHSmCTVYu2AWv44YMauwAQc0aqI9gHKIcSbI1pU=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.38.0 h1:aTL7F04bJHUlztTsNGJ2l+6he8c+y/b//eR0jjjemT4=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.38.0/go.mod h1:kldtb7jDTeol0l3ewcmd8SDvx3EmIE7lyvqbasU3QC4=
+go.opentelemetry.io/otel/exporters/stdout/stdouttrace v1.38.0 h1:kJxSDN4SgWWTjG/hPp3O7LCGLcHXFlvS2/FFOrwL+SE=
+go.opentelemetry.io/otel/exporters/stdout/stdouttrace v1.38.0/go.mod h1:mgIOzS7iZeKJdeB8/NYHrJ48fdGc71Llo5bJ1J4DWUE=
+go.opentelemetry.io/otel/log v0.15.0 h1:0VqVnc3MgyYd7QqNVIldC3dsLFKgazR6P3P3+ypkyDY=
+go.opentelemetry.io/otel/log v0.15.0/go.mod h1:9c/G1zbyZfgu1HmQD7Qj84QMmwTp2QCQsZH1aeoWDE4=
+go.opentelemetry.io/otel/metric v1.39.0 h1:d1UzonvEZriVfpNKEVmHXbdf909uGTOQjA0HF0Ls5Q0=
+go.opentelemetry.io/otel/metric v1.39.0/go.mod h1:jrZSWL33sD7bBxg1xjrqyDjnuzTUB0x1nBERXd7Ftcs=
+go.opentelemetry.io/otel/sdk v1.39.0 h1:nMLYcjVsvdui1B/4FRkwjzoRVsMK8uL/cj0OyhKzt18=
+go.opentelemetry.io/otel/sdk v1.39.0/go.mod h1:vDojkC4/jsTJsE+kh+LXYQlbL8CgrEcwmt1ENZszdJE=
+go.opentelemetry.io/otel/sdk/log v0.15.0 h1:WgMEHOUt5gjJE93yqfqJOkRflApNif84kxoHWS9VVHE=
+go.opentelemetry.io/otel/sdk/log v0.15.0/go.mod h1:qDC/FlKQCXfH5hokGsNg9aUBGMJQsrUyeOiW5u+dKBQ=
+go.opentelemetry.io/otel/sdk/log/logtest v0.14.0 h1:Ijbtz+JKXl8T2MngiwqBlPaHqc4YCaP/i13Qrow6gAM=
+go.opentelemetry.io/otel/sdk/log/logtest v0.14.0/go.mod h1:dCU8aEL6q+L9cYTqcVOk8rM9Tp8WdnHOPLiBgp0SGOA=
+go.opentelemetry.io/otel/sdk/metric v1.39.0 h1:cXMVVFVgsIf2YL6QkRF4Urbr/aMInf+2WKg+sEJTtB8=
+go.opentelemetry.io/otel/sdk/metric v1.39.0/go.mod h1:xq9HEVH7qeX69/JnwEfp6fVq5wosJsY1mt4lLfYdVew=
+go.opentelemetry.io/otel/trace v1.39.0 h1:2d2vfpEDmCJ5zVYz7ijaJdOF59xLomrvj7bjt6/qCJI=
+go.opentelemetry.io/otel/trace v1.39.0/go.mod h1:88w4/PnZSazkGzz/w84VHpQafiU4EtqqlVdxWy+rNOA=
 go.opentelemetry.io/proto/otlp v0.7.0/go.mod h1:PqfVotwruBrMGOCsRd/89rSnXhoiJIqeYNgFYFoEGnI=
-go.opentelemetry.io/proto/otlp v1.5.0 h1:xJvq7gMzB31/d406fB8U5CBdyQGw4P399D1aQWU/3i4=
-go.opentelemetry.io/proto/otlp v1.5.0/go.mod h1:keN8WnHxOy8PG0rQZjJJ5A2ebUoafqWp0eVQ4yIXvJ4=
+go.opentelemetry.io/proto/otlp v1.9.0 h1:l706jCMITVouPOqEnii2fIAuO3IVGBRPV5ICjceRb/A=
+go.opentelemetry.io/proto/otlp v1.9.0/go.mod h1:xE+Cx5E/eEHw+ISFkwPLwCZefwVjY+pqKg1qcK03+/4=
 go.uber.org/atomic v1.7.0/go.mod h1:fEN4uk6kAWBTFdckzkM89CLk9XfWZrxpCo0nPH17wJc=
-go.uber.org/automaxprocs v1.6.0 h1:O3y2/QNTOdbF+e/dpXNNW7Rx2hZ4sTIPyybbxyNqTUs=
-go.uber.org/automaxprocs v1.6.0/go.mod h1:ifeIMSnPZuznNm6jmdzmU3/bfk01Fe2fotchwEFJ8r8=
 go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto=
 go.uber.org/goleak v1.3.0/go.mod h1:CoHD4mav9JJNrW/WLlf7HGZPjdw8EucARQHekz1X6bE=
 go.uber.org/multierr v1.6.0/go.mod h1:cdWPpRnG4AhwMwsgIHip0KRBQjJy5kYEpYjJxpXp9iU=
@@ -899,6 +1032,10 @@ go.uber.org/multierr v1.11.0/go.mod h1:20+QtiLqy0Nd6FdQB9TLXag12DsQkrbs3htMFfDN8
 go.uber.org/zap v1.17.0/go.mod h1:MXVU+bhUf/A7Xi2HNOnopQOrmycQ5Ih87HtOu4q5SSo=
 go.uber.org/zap v1.27.0 h1:aJMhYGrd5QSmlpLMr2MftRKl7t8J8PTZPA732ud/XR8=
 go.uber.org/zap v1.27.0/go.mod h1:GB2qFLM7cTU87MWRP2mPIjqfIDnGu+VIO4V/SdhGo2E=
+go.yaml.in/yaml/v2 v2.4.3 h1:6gvOSjQoTB3vt1l+CU+tSyi/HOjfOjRLJ4YwYZGwRO0=
+go.yaml.in/yaml/v2 v2.4.3/go.mod h1:zSxWcmIDjOzPXpjlTTbAsKokqkDNAVtZO0WOMiT90s8=
+go.yaml.in/yaml/v3 v3.0.4 h1:tfq32ie2Jv2UxXFdLJdh3jXuOzWiL1fo0bu/FbuKpbc=
+go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg=
 go4.org v0.0.0-20180809161055-417644f6feb5/go.mod h1:MkTOUMDaeVYJUOUsaDXIhWPZYa1yOyC1qaOBpL57BhE=
 go4.org/netipx v0.0.0-20231129151722-fdeea329fbba h1:0b9z3AuHCjxk0x/opv64kcgZLBseWJUpBw5I82+2U4M=
 go4.org/netipx v0.0.0-20231129151722-fdeea329fbba/go.mod h1:PLyyIXexvUFg3Owu6p/WfdlivPbZJsZdgWZlrGope/Y=
@@ -915,8 +1052,14 @@ golang.org/x/crypto v0.0.0-20190923035154-9ee001bba392/go.mod h1:/lpIB1dKB+9EgE3
 golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
 golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
 golang.org/x/crypto v0.0.0-20210817164053-32db794688a5/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
-golang.org/x/crypto v0.45.0 h1:jMBrvKuj23MTlT0bQEOBcAE0mjg8mK9RXFhRH6nyF3Q=
-golang.org/x/crypto v0.45.0/go.mod h1:XTGrrkGJve7CYK7J8PEww4aY7gM3qMCElcJQ8n8JdX4=
+golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
+golang.org/x/crypto v0.6.0/go.mod h1:OFC/31mSvZgRz0V1QTNCzfAI1aIRzbiufJtkMIlEp58=
+golang.org/x/crypto v0.13.0/go.mod h1:y6Z2r+Rw4iayiXXAIxJIDAJ1zMW4yaTpebo8fPOliYc=
+golang.org/x/crypto v0.19.0/go.mod h1:Iy9bg/ha4yyC70EfRS8jz+B6ybOBKMaSxLj6P6oBDfU=
+golang.org/x/crypto v0.23.0/go.mod h1:CKFgDieR+mRhux2Lsu27y0fO304Db0wZe70UKqHu0v8=
+golang.org/x/crypto v0.31.0/go.mod h1:kDsLvtWBEx7MV9tJOj9bnXsPbxwJQ6csT/x4KIN4Ssk=
+golang.org/x/crypto v0.46.0 h1:cKRW/pmt1pKAfetfu+RCEvjvZkA9RimPbh7bhFjGVBU=
+golang.org/x/crypto v0.46.0/go.mod h1:Evb/oLKmMraqjZ2iQTwDwvCtJkczlDuTmdJXoZVzqU0=
 golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
 golang.org/x/exp v0.0.0-20190306152737-a1d7652674e8/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
 golang.org/x/exp v0.0.0-20190510132918-efd6b22b2522/go.mod h1:ZjyILWgesfNpC6sMxTJOJm9Kp84zZh5NQWvqDGG3Qr8=
@@ -927,8 +1070,8 @@ golang.org/x/exp v0.0.0-20191227195350-da58074b4299/go.mod h1:2RIsYlXP63K8oxa1u0
 golang.org/x/exp v0.0.0-20200119233911-0405dc783f0a/go.mod h1:2RIsYlXP63K8oxa1u096TMicItID8zy7Y6sNkU49FU4=
 golang.org/x/exp v0.0.0-20200207192155-f17229e696bd/go.mod h1:J/WKrq2StrnmMY6+EHIKF9dgMWnmCNThgcyBT1FY9mM=
 golang.org/x/exp v0.0.0-20200224162631-6cc2880d07d6/go.mod h1:3jZMyOhIsHpP37uCMkUooju7aAi5cS1Q23tOzKc+0MU=
-golang.org/x/exp v0.0.0-20250103183323-7d7fa50e5329 h1:9kj3STMvgqy3YA4VQXBrN7925ICMxD5wzMRcgA30588=
-golang.org/x/exp v0.0.0-20250103183323-7d7fa50e5329/go.mod h1:qj5a5QZpwLU2NLQudwIN5koi3beDhSAlJwa67PuM98c=
+golang.org/x/exp v0.0.0-20250718183923-645b1fa84792 h1:R9PFI6EUdfVKgwKjZef7QIwGcBKu86OEFpJ9nUEP2l4=
+golang.org/x/exp v0.0.0-20250718183923-645b1fa84792/go.mod h1:A+z0yzpGtvnG90cToK5n2tu8UJVP2XUATh+r+sfOOOc=
 golang.org/x/image v0.0.0-20190227222117-0694c2d4d067/go.mod h1:kZ7UVZpmo3dzQBMxlp+ypCbDeSB+sBbTgSJuh5dn5js=
 golang.org/x/image v0.0.0-20190802002840-cff245a6509b/go.mod h1:FeLwcggjj3mMvU+oOTbSwawSJRM1uh48EjtB4UJZlP0=
 golang.org/x/lint v0.0.0-20180702182130-06c8688daad7/go.mod h1:UVdnD1Gm6xHRNCYTkRU2/jEulfH38KcIWyp/GAMgvoE=
@@ -956,6 +1099,13 @@ golang.org/x/mod v0.4.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.4.1/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.4.2/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.5.0/go.mod h1:5OXOZSfqPIIbmVBIIKWRFfZjPR0E5r58TLhUjH0a2Ro=
+golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4=
+golang.org/x/mod v0.8.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
+golang.org/x/mod v0.12.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
+golang.org/x/mod v0.15.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=
+golang.org/x/mod v0.17.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=
+golang.org/x/mod v0.30.0 h1:fDEXFVZ/fmCKProc/yAXXUijritrDzahmwwefnjoPFk=
+golang.org/x/mod v0.30.0/go.mod h1:lAsf5O2EvJeSFMiBxXDki7sCgAxEUcZHXoXMKT4GJKc=
 golang.org/x/net v0.0.0-20180724234803-3673e40ba225/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20180826012351-8a410e7b638d/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20180906233101-161cd47e91fd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
@@ -975,7 +1125,9 @@ golang.org/x/net v0.0.0-20190613194153-d28f0bde5980/go.mod h1:z5CRVTTTmAJ677TzLL
 golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20190628185345-da137c7871d7/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20190724013045-ca1201d0de80/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
+golang.org/x/net v0.0.0-20190827160401-ba9fcec4b297/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20190923162816-aa69164e4478/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
+golang.org/x/net v0.0.0-20191007182048-72f939374954/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20191209160850-c0dbc17a3553/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20200114155413-6afb5195e5aa/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20200202094626-16171245cfb2/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
@@ -990,10 +1142,13 @@ golang.org/x/net v0.0.0-20200520182314-0ba52f642ac2/go.mod h1:qpuaurCH72eLCgpAm/
 golang.org/x/net v0.0.0-20200625001655-4c5254603344/go.mod h1:/O7V0waA8r7cgGh81Ro3o1hOxt32SMVPicZroKQ2sZA=
 golang.org/x/net v0.0.0-20200707034311-ab3426394381/go.mod h1:/O7V0waA8r7cgGh81Ro3o1hOxt32SMVPicZroKQ2sZA=
 golang.org/x/net v0.0.0-20200822124328-c89045814202/go.mod h1:/O7V0waA8r7cgGh81Ro3o1hOxt32SMVPicZroKQ2sZA=
+golang.org/x/net v0.0.0-20201010224723-4f7140c49acb/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
 golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
 golang.org/x/net v0.0.0-20201031054903-ff519b6c9102/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
 golang.org/x/net v0.0.0-20201110031124-69a78807bb2b/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
 golang.org/x/net v0.0.0-20201209123823-ac852fbbde11/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
+golang.org/x/net v0.0.0-20201216054612-986b41b23924/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
+golang.org/x/net v0.0.0-20201224014010-6772e930b67b/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
 golang.org/x/net v0.0.0-20210119194325-5f4716e94777/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
 golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
 golang.org/x/net v0.0.0-20210316092652-d523dce5a7f4/go.mod h1:RBQZq4jEuRlivfhVLdyRGr576XBO4/greRjx4P4O3yc=
@@ -1001,9 +1156,20 @@ golang.org/x/net v0.0.0-20210405180319-a5a99cb37ef4/go.mod h1:p54w0d4576C0XHj96b
 golang.org/x/net v0.0.0-20210410081132-afb366fc7cd1/go.mod h1:9tjilg8BloeKEkVJvy7fQ90B1CfIiPueXVOjqfkSzI8=
 golang.org/x/net v0.0.0-20210503060351-7fd8e65b6420/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
 golang.org/x/net v0.0.0-20210520170846-37e1c6afe023/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
+golang.org/x/net v0.0.0-20210525063256-abc453219eb5/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
 golang.org/x/net v0.0.0-20210813160813-60bc85c4be6d/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
-golang.org/x/net v0.47.0 h1:Mx+4dIFzqraBXUugkia1OOvlD6LemFo1ALMHjrXDOhY=
-golang.org/x/net v0.47.0/go.mod h1:/jNxtkgq5yWUGYkaZGqo27cfGZ1c5Nen03aYrrKpVRU=
+golang.org/x/net v0.0.0-20210928044308-7d9f5e0b762b/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
+golang.org/x/net v0.0.0-20220127200216-cd36cc0744dd/go.mod h1:CfG3xpIq0wQ8r1q4Su4UZFWDARRcnwPjda9FqA0JpMk=
+golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
+golang.org/x/net v0.6.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=
+golang.org/x/net v0.7.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=
+golang.org/x/net v0.10.0/go.mod h1:0qNGK6F8kojg2nk9dLZ2mShWaEBan6FAoqfSigmmuDg=
+golang.org/x/net v0.15.0/go.mod h1:idbUs1IY1+zTqbi8yxTbhexhEEk5ur9LInksu6HrEpk=
+golang.org/x/net v0.21.0/go.mod h1:bIjVDfnllIU7BJ2DNgfnXvpSvtn8VRwhlsaeUTyUS44=
+golang.org/x/net v0.25.0/go.mod h1:JkAGAh7GEvH74S6FOH42FLoXpXbE/aqXSrIQjXgsiwM=
+golang.org/x/net v0.33.0/go.mod h1:HXLR5J+9DxmrqMwG9qjGCxZ+zKXxBru04zlTvWlWuN4=
+golang.org/x/net v0.48.0 h1:zyQRTTrjc33Lhh0fBgT/H3oZq9WuvRR5gPC70xpDiQU=
+golang.org/x/net v0.48.0/go.mod h1:+ndRgGjkh8FGtu1w1FGbEC31if4VrNVMuKTgcAAnQRY=
 golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
 golang.org/x/oauth2 v0.0.0-20181017192945-9dcd33a902f4/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
 golang.org/x/oauth2 v0.0.0-20181203162652-d668ce993890/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
@@ -1023,8 +1189,8 @@ golang.org/x/oauth2 v0.0.0-20210805134026-6f1e6394065a/go.mod h1:KelEdhl1UZF7XfJ
 golang.org/x/oauth2 v0.0.0-20210819190943-2bc19b11175f/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A=
 golang.org/x/oauth2 v0.0.0-20211005180243-6b3c2da341f1/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A=
 golang.org/x/oauth2 v0.0.0-20211104180415-d3ed0bb246c8/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A=
-golang.org/x/oauth2 v0.30.0 h1:dnDm7JmhM45NNpd8FDDeLhK6FwqbOf4MLCM9zb1BOHI=
-golang.org/x/oauth2 v0.30.0/go.mod h1:B++QgG3ZKulg6sRPGD/mqlHQs5rB3Ml9erfeDY7xKlU=
+golang.org/x/oauth2 v0.33.0 h1:4Q+qn+E5z8gPRJfmRy7C2gGG3T4jIprK6aSYgTXGRpo=
+golang.org/x/oauth2 v0.33.0/go.mod h1:lzm5WQJQwKZ3nwavOZ3IS5Aulzxi68dUSgRHujetwEA=
 golang.org/x/perf v0.0.0-20180704124530-6e6d33e29852/go.mod h1:JLpeXjPJfIyPr5TlbXLkXWLhP8nz10XfvxElABhCtcw=
 golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20181108010431-42b317875d0f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
@@ -1037,9 +1203,14 @@ golang.org/x/sync v0.0.0-20200625203802-6e8e738ad208/go.mod h1:RxMgew5VJxzue5/jJ
 golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20201207232520-09787c993a3a/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20210220032951-036812b2e83c/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.1.0/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.3.0/go.mod h1:FU7BRWz2tNW+3quACPkgCx/L+uEAv1htQ0V83Z9Rj+Y=
-golang.org/x/sync v0.18.0 h1:kr88TuHDroi+UVf+0hZnirlk8o8T+4MrK6mr60WkH/I=
-golang.org/x/sync v0.18.0/go.mod h1:9KTHXmSnoGruLpwFjVSX0lNNA75CykiMECbovNTZqGI=
+golang.org/x/sync v0.6.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
+golang.org/x/sync v0.7.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
+golang.org/x/sync v0.10.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
+golang.org/x/sync v0.19.0 h1:vV+1eWNmZ5geRlYjzm2adRgW2/mcpevXNg50YZtPCE4=
+golang.org/x/sync v0.19.0/go.mod h1:9KTHXmSnoGruLpwFjVSX0lNNA75CykiMECbovNTZqGI=
 golang.org/x/sys v0.0.0-20180823144017-11551d06cbcc/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20180830151530-49385e6e1522/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20180905080454-ebe1bf3edb33/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
@@ -1051,6 +1222,7 @@ golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5h
 golang.org/x/sys v0.0.0-20190222072716-a9d3bda3a223/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190312061237-fead79001313/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20190316082340-a2f829d7f35f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20190411185658-b44545bcd369/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20190422165155-953cdadca894/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20190502145724-3ef323f4f1fd/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
@@ -1058,7 +1230,7 @@ golang.org/x/sys v0.0.0-20190507160741-ecd444e8653b/go.mod h1:h1NjWce9XRLGQEsW7w
 golang.org/x/sys v0.0.0-20190606165138-5da285871e9c/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20190624142023-c5567b49c5d0/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20190726091711-fc99dfbffb4e/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20190916202348-b4ddaad3f8a3/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20190826190057-c7b8b68b1456/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20190922100055-0a153f010e69/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20190924154521-2837fb4f24fe/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20191001151750-bb3f8db39f24/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
@@ -1084,11 +1256,17 @@ golang.org/x/sys v0.0.0-20200803210538-64077c9b5642/go.mod h1:h1NjWce9XRLGQEsW7w
 golang.org/x/sys v0.0.0-20200905004654-be1d3432aa8f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200923182605-d9f96fdee20d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20201009025420-dfb3f7c4e634/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20201118182958-a01c418693c7/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20201201145000-ef89a241ccb3/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20201204225414-ed752295db88/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20201218084310-7d0127a74742/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210104204734-6f8348627aad/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20210110051926-789bb1bd4061/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210119212857-b64e53b001e4/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20210123111255-9b0068b26619/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20210124154548-22da62e12c0c/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20210216163648-f7da38b97c65/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210220050731-9a76102bfb43/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210303074136-134d130e1a04/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210305230114-8fe3ee5dd75b/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
@@ -1099,6 +1277,7 @@ golang.org/x/sys v0.0.0-20210403161142-5e06dd20ab57/go.mod h1:h1NjWce9XRLGQEsW7w
 golang.org/x/sys v0.0.0-20210423082822-04245dca01da/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210510120138-977fb7262007/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20210514084401-e8d321eab015/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20210525143221-35b2ab0089ea/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20210603125802-9665404d3644/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20210616094352-59db8d763f22/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
@@ -1106,23 +1285,39 @@ golang.org/x/sys v0.0.0-20210630005230-0f9fa26af87c/go.mod h1:oPkhp1MJrh7nUepCBc
 golang.org/x/sys v0.0.0-20210806184541-e5e7981a1069/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20210816183151-1e6c022a8912/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20210823070655-63515b42dcdf/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20210906170528-6f6e22806c34/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20210908233432-aa78b53d3365/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20210927094055-39ccf1dd6fa6/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20211007075335-d3039528d8ac/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20211025201205-69cdffdb9359/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20211124211545-fe61309f8881/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20211205182925-97ca703d548d/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20211216021012-1d35b9e2eb4e/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20220128215802-99c3d69c2c27/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220715151400-c0bba94af5f8/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.2.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.8.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.10.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.11.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.38.0 h1:3yZWxaJjBmCWXqhN1qh02AkOnCQ1poK6oF+a7xWL6Gc=
-golang.org/x/sys v0.38.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks=
+golang.org/x/sys v0.12.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.17.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
+golang.org/x/sys v0.20.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
+golang.org/x/sys v0.28.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
+golang.org/x/sys v0.39.0 h1:CvCKL8MeisomCi6qNZ+wbb0DN9E5AATixKsvNtMoMFk=
+golang.org/x/sys v0.39.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks=
+golang.org/x/telemetry v0.0.0-20240228155512-f48c80bd79b2/go.mod h1:TeRTkGYfJXctD9OcfyVLyj2J3IxLnKwHJR8f4D8a3YE=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
-golang.org/x/term v0.37.0 h1:8EGAD0qCmHYZg6J17DvsMy9/wJ7/D/4pV/wfnld5lTU=
-golang.org/x/term v0.37.0/go.mod h1:5pB4lxRNYYVZuTLmy8oR2BH8dflOR+IbTYFD8fi3254=
+golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
+golang.org/x/term v0.5.0/go.mod h1:jMB1sMXY+tzblOD4FWmEbocvup2/aLOaQEp7JmGp78k=
+golang.org/x/term v0.8.0/go.mod h1:xPskH00ivmX89bAKVGSKKtLOWNx2+17Eiy94tnKShWo=
+golang.org/x/term v0.12.0/go.mod h1:owVbMEjm3cBLCHdkQu9b1opXd4ETQWc3BhuQGKgXgvU=
+golang.org/x/term v0.17.0/go.mod h1:lLRBjIVuehSbZlaOtGMbcMncT+aqLLLmKrsjNrUguwk=
+golang.org/x/term v0.20.0/go.mod h1:8UkIAJTvZgivsXaD6/pH6U9ecQzZ45awqEOzuCvwpFY=
+golang.org/x/term v0.27.0/go.mod h1:iMsnZpn0cago0GOrHO2+Y7u7JPn5AylBrcoWkElMTSM=
+golang.org/x/term v0.38.0 h1:PQ5pkm/rLO6HnxFR7N2lJHOZX6Kez5Y1gDSJla6jo7Q=
+golang.org/x/term v0.38.0/go.mod h1:bSEAKrOT1W+VSu9TSCMtoGEOUcKxOKgl3LE5QEF/xVg=
 golang.org/x/text v0.0.0-20170915032832-14c0d48ead0c/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.1-0.20180807135948-17ff2d5776d2/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
@@ -1132,14 +1327,20 @@ golang.org/x/text v0.3.4/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.5/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
-golang.org/x/text v0.31.0 h1:aC8ghyu4JhP8VojJ2lEHBnochRno1sgL6nEi9WGFGMM=
-golang.org/x/text v0.31.0/go.mod h1:tKRAlv61yKIjGGHX/4tP1LTbc13YSec1pxVEWXzfoeM=
+golang.org/x/text v0.7.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
+golang.org/x/text v0.9.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8=
+golang.org/x/text v0.13.0/go.mod h1:TvPlkZtksWOMsz7fbANvkp4WM8x/WCo/om8BMLbz+aE=
+golang.org/x/text v0.14.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
+golang.org/x/text v0.15.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
+golang.org/x/text v0.21.0/go.mod h1:4IBbMaMmOPCJ8SecivzSH54+73PCFmPWxNTLm+vZkEQ=
+golang.org/x/text v0.32.0 h1:ZD01bjUt1FQ9WJ0ClOL5vxgxOI/sVCNgX1YtKwcY0mU=
+golang.org/x/text v0.32.0/go.mod h1:o/rUWzghvpD5TXrTIBuJU77MTaN0ljMWE47kxGJQ7jY=
 golang.org/x/time v0.0.0-20180412165947-fbb02b2291d2/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.0.0-20181108054448-85acf8d2951c/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.0.0-20190308202827-9d24e82272b4/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.0.0-20191024005414-555d28b269f0/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
-golang.org/x/time v0.12.0 h1:ScB/8o8olJvc+CQPWrK3fPZNfh7qgwCrY0zJmoEQLSE=
-golang.org/x/time v0.12.0/go.mod h1:CDIdPxbZBQxdj6cxyCIdrNogrJKMJ7pr37NYpMcMDSg=
+golang.org/x/time v0.14.0 h1:MRx4UaLrDotUKUdCIqzPC48t1Y9hANFKIRpNx+Te8PI=
+golang.org/x/time v0.14.0/go.mod h1:eL/Oa2bBBK0TkX57Fyni+NgnyQQN4LitPmob2Hjnqw4=
 golang.org/x/tools v0.0.0-20180828015842-6cd1fcedba52/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20181030000716-a0a13e073c7b/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
@@ -1196,12 +1397,18 @@ golang.org/x/tools v0.1.2/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk=
 golang.org/x/tools v0.1.3/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk=
 golang.org/x/tools v0.1.4/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk=
 golang.org/x/tools v0.1.5/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk=
-golang.org/x/tools v0.38.0 h1:Hx2Xv8hISq8Lm16jvBZ2VQf+RLmbd7wVUsALibYI/IQ=
-golang.org/x/tools v0.38.0/go.mod h1:yEsQ/d/YK8cjh0L6rZlY8tgtlKiBNTL14pGDJPJpYQs=
+golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc=
+golang.org/x/tools v0.6.0/go.mod h1:Xwgl3UAJ/d3gWutnCtw505GrjyAbvKui8lOU390QaIU=
+golang.org/x/tools v0.13.0/go.mod h1:HvlwmtVNQAhOuCjW7xxvovg8wbNq7LwfXh/k7wXUl58=
+golang.org/x/tools v0.21.1-0.20240508182429-e35e4ccd0d2d/go.mod h1:aiJjzUbINMkxbQROHiO6hDPo2LHcIPhhQsa9DLh0yGk=
+golang.org/x/tools v0.39.0 h1:ik4ho21kwuQln40uelmciQPp9SipgNDdrafrYA4TmQQ=
+golang.org/x/tools v0.39.0/go.mod h1:JnefbkDPyD8UU2kI5fuf8ZX4/yUeh9W877ZeBONxUqQ=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
+gonum.org/v1/gonum v0.16.0 h1:5+ul4Swaf3ESvrOnidPp4GZbzf0mxVQpDCYUQE7OJfk=
+gonum.org/v1/gonum v0.16.0/go.mod h1:fef3am4MQ93R2HHpKnLk4/Tbh/s0+wqD5nfa6Pnwy4E=
 google.golang.org/api v0.0.0-20180910000450-7ca32eb868bf/go.mod h1:4mhQ8q/RsB7i+udVvVy5NUi08OU8ZlA0gRVgrF7VFY0=
 google.golang.org/api v0.0.0-20181030000543-1d582fd0359e/go.mod h1:4mhQ8q/RsB7i+udVvVy5NUi08OU8ZlA0gRVgrF7VFY0=
 google.golang.org/api v0.1.0/go.mod h1:UGEZY7KEX120AnNLIHFMKIo4obdJhkp2tPbaPlQx13Y=
@@ -1313,12 +1520,12 @@ google.golang.org/genproto v0.0.0-20211129164237-f09f9a12af12/go.mod h1:5CzLGKJ6
 google.golang.org/genproto v0.0.0-20211203200212-54befc351ae9/go.mod h1:5CzLGKJ67TSI2B9POpiiyGha0AjJvZIUgRMt1dSmuhc=
 google.golang.org/genproto v0.0.0-20211206160659-862468c7d6e0/go.mod h1:5CzLGKJ67TSI2B9POpiiyGha0AjJvZIUgRMt1dSmuhc=
 google.golang.org/genproto v0.0.0-20211208223120-3a66f561d7aa/go.mod h1:5CzLGKJ67TSI2B9POpiiyGha0AjJvZIUgRMt1dSmuhc=
-google.golang.org/genproto v0.0.0-20241118233622-e639e219e697 h1:ToEetK57OidYuqD4Q5w+vfEnPvPpuTwedCNVohYJfNk=
-google.golang.org/genproto v0.0.0-20241118233622-e639e219e697/go.mod h1:JJrvXBWRZaFMxBufik1a4RpFw4HhgVtBBWQeQgUj2cc=
-google.golang.org/genproto/googleapis/api v0.0.0-20250519155744-55703ea1f237 h1:Kog3KlB4xevJlAcbbbzPfRG0+X9fdoGM+UBRKVz6Wr0=
-google.golang.org/genproto/googleapis/api v0.0.0-20250519155744-55703ea1f237/go.mod h1:ezi0AVyMKDWy5xAncvjLWH7UcLBB5n7y2fQ8MzjJcto=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20250519155744-55703ea1f237 h1:cJfm9zPbe1e873mHJzmQ1nwVEeRDU/T1wXDK2kUSU34=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20250519155744-55703ea1f237/go.mod h1:qQ0YXyHHx3XkvlzUtpXDkS29lDSafHMZBAZDc03LQ3A=
+google.golang.org/genproto v0.0.0-20250715232539-7130f93afb79 h1:Nt6z9UHqSlIdIGJdz6KhTIs2VRx/iOsA5iE8bmQNcxs=
+google.golang.org/genproto v0.0.0-20250715232539-7130f93afb79/go.mod h1:kTmlBHMPqR5uCZPBvwa2B18mvubkjyY3CRLI0c6fj0s=
+google.golang.org/genproto/googleapis/api v0.0.0-20251202230838-ff82c1b0f217 h1:fCvbg86sFXwdrl5LgVcTEvNC+2txB5mgROGmRL5mrls=
+google.golang.org/genproto/googleapis/api v0.0.0-20251202230838-ff82c1b0f217/go.mod h1:+rXWjjaukWZun3mLfjmVnQi18E1AsFbDN9QdJ5YXLto=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20251202230838-ff82c1b0f217 h1:gRkg/vSppuSQoDjxyiGfN4Upv/h/DQmIR10ZU8dh4Ww=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20251202230838-ff82c1b0f217/go.mod h1:7i2o+ce6H/6BluujYR+kqX3GKH+dChPTQU19wjRPiGk=
 google.golang.org/grpc v1.14.0/go.mod h1:yo6s7OP7yaDglbqo1J04qKzAhqBH6lvTonzMVmEdcZw=
 google.golang.org/grpc v1.16.0/go.mod h1:0JHn/cJsOMiMfNA9+DeHDlAU7KAAB5GDlYFpa9MZMio=
 google.golang.org/grpc v1.17.0/go.mod h1:6QZJwpn2B+Zp71q/5VxRsJ6NXXVCE5NRUHRo+f3cWCs=
@@ -1349,8 +1556,8 @@ google.golang.org/grpc v1.39.1/go.mod h1:PImNr+rS9TWYb2O4/emRugxiyHZ5JyHW5F+RPnD
 google.golang.org/grpc v1.40.0/go.mod h1:ogyxbiOoUXAkP+4+xa6PZSE9DZgIHtSpzjDTB9KAK34=
 google.golang.org/grpc v1.40.1/go.mod h1:ogyxbiOoUXAkP+4+xa6PZSE9DZgIHtSpzjDTB9KAK34=
 google.golang.org/grpc v1.42.0/go.mod h1:k+4IHHFw41K8+bbowsex27ge2rCb65oeWqe4jJ590SU=
-google.golang.org/grpc v1.72.1 h1:HR03wO6eyZ7lknl75XlxABNVLLFc2PAb6mHlYh756mA=
-google.golang.org/grpc v1.72.1/go.mod h1:wH5Aktxcg25y1I3w7H69nHfXdOG3UiadoBtjh3izSDM=
+google.golang.org/grpc v1.77.0 h1:wVVY6/8cGA6vvffn+wWK5ToddbgdU3d8MNENr4evgXM=
+google.golang.org/grpc v1.77.0/go.mod h1:z0BY1iVj0q8E1uSQCjL9cppRj+gnZjzDnzV0dHhrNig=
 google.golang.org/grpc/cmd/protoc-gen-go-grpc v1.1.0/go.mod h1:6Kw0yEErY5E/yWrBtf03jp27GLLJujG4z/JK95pnjjw=
 google.golang.org/protobuf v0.0.0-20200109180630-ec00e32a8dfd/go.mod h1:DFci5gLYBciE7Vtevhsrf46CRTquxDuWsQurQQe4oz8=
 google.golang.org/protobuf v0.0.0-20200221191635-4d8936d0db64/go.mod h1:kwYJMbMJ01Woi6D6+Kah6886xMZcty6N08ah7+eCXa0=
@@ -1365,8 +1572,8 @@ google.golang.org/protobuf v1.25.0/go.mod h1:9JNX74DMeImyA3h4bdi1ymwjUzf21/xIlba
 google.golang.org/protobuf v1.26.0-rc.1/go.mod h1:jlhhOSvTdKEhbULTjvd4ARK9grFBp09yW+WbY/TyQbw=
 google.golang.org/protobuf v1.26.0/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc=
 google.golang.org/protobuf v1.27.1/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc=
-google.golang.org/protobuf v1.36.6 h1:z1NpPI8ku2WgiWnf+t9wTPsn6eP1L7ksHUlkfLvd9xY=
-google.golang.org/protobuf v1.36.6/go.mod h1:jduwjTPXsFjZGTmRluh+L6NjiWu7pchiJ2/5YcXBHnY=
+google.golang.org/protobuf v1.36.11 h1:fV6ZwhNocDyBLK0dj+fg8ektcVegBBuEolpbTQyBNVE=
+google.golang.org/protobuf v1.36.11/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco=
 gopkg.in/alecthomas/kingpin.v2 v2.2.6/go.mod h1:FMv+mEhP44yOT+4EoQTLFTRgOQ1FBLkstjWtayDeSgw=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20180628173108-788fd7840127/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
@@ -1375,8 +1582,8 @@ gopkg.in/check.v1 v1.0.0-20200227125254-8fa46927fb4f/go.mod h1:Co6ibVJAznAaIkqp8
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=
 gopkg.in/errgo.v2 v2.1.0/go.mod h1:hNsd1EY+bozCKY1Ytp96fpM3vjJbqLJn88ws8XvfDNI=
-gopkg.in/evanphx/json-patch.v4 v4.12.0 h1:n6jtcsulIzXPJaxegRbvFNNrZDjbij7ny3gmSPG+6V4=
-gopkg.in/evanphx/json-patch.v4 v4.12.0/go.mod h1:p8EYWUEYMpynmqDbY58zCKCFZw8pRWMG4EsWvDvM72M=
+gopkg.in/evanphx/json-patch.v4 v4.13.0 h1:czT3CmqEaQ1aanPc5SdlgQrrEIb8w/wwCvWWnfEbYzo=
+gopkg.in/evanphx/json-patch.v4 v4.13.0/go.mod h1:p8EYWUEYMpynmqDbY58zCKCFZw8pRWMG4EsWvDvM72M=
 gopkg.in/inf.v0 v0.9.1 h1:73M5CoZyi3ZLMOyDlQh031Cx6N9NDJ2Vvfl76EDAgDc=
 gopkg.in/inf.v0 v0.9.1/go.mod h1:cWUDdTG/fYaXco+Dcufb5Vnc6Gp2YChqWtbxRZE0mXw=
 gopkg.in/ini.v1 v1.66.2/go.mod h1:pNLf8WUiyNEtQjuu5G5vTm06TEv9tsIgeAvK8hOrP4k=
@@ -1407,49 +1614,76 @@ honnef.co/go/tools v0.0.1-2020.1.3/go.mod h1:X/FiERA/W4tHapMX5mGpAtMSVEeEUOyHaw9
 honnef.co/go/tools v0.0.1-2020.1.4/go.mod h1:X/FiERA/W4tHapMX5mGpAtMSVEeEUOyHaw9vFzvIQ3k=
 istio.io/pkg v0.0.0-20231221211216-7635388a563e h1:ZlLVbKDlCzfP0MPbWc6VRcY23d9NdjLxwpPQpDrh3Gc=
 istio.io/pkg v0.0.0-20231221211216-7635388a563e/go.mod h1:fvmqEdHhZjYYwf6dSiIwvwc7db54kMWVTfsb91KmhzY=
-k8s.io/api v0.33.0 h1:yTgZVn1XEe6opVpP1FylmNrIFWuDqe2H0V8CT5gxfIU=
-k8s.io/api v0.33.0/go.mod h1:CTO61ECK/KU7haa3qq8sarQ0biLq2ju405IZAd9zsiM=
-k8s.io/apiextensions-apiserver v0.33.0 h1:d2qpYL7Mngbsc1taA4IjJPRJ9ilnsXIrndH+r9IimOs=
-k8s.io/apiextensions-apiserver v0.33.0/go.mod h1:VeJ8u9dEEN+tbETo+lFkwaaZPg6uFKLGj5vyNEwwSzc=
-k8s.io/apimachinery v0.33.0 h1:1a6kHrJxb2hs4t8EE5wuR/WxKDwGN1FKH3JvDtA0CIQ=
-k8s.io/apimachinery v0.33.0/go.mod h1:BHW0YOu7n22fFv/JkYOEfkUYNRN0fj0BlvMFWA7b+SM=
-k8s.io/apiserver v0.33.0 h1:QqcM6c+qEEjkOODHppFXRiw/cE2zP85704YrQ9YaBbc=
-k8s.io/apiserver v0.33.0/go.mod h1:EixYOit0YTxt8zrO2kBU7ixAtxFce9gKGq367nFmqI8=
-k8s.io/cli-runtime v0.33.0 h1:Lbl/pq/1o8BaIuyn+aVLdEPHVN665tBAXUePs8wjX7c=
-k8s.io/cli-runtime v0.33.0/go.mod h1:QcA+r43HeUM9jXFJx7A+yiTPfCooau/iCcP1wQh4NFw=
-k8s.io/client-go v0.33.0 h1:UASR0sAYVUzs2kYuKn/ZakZlcs2bEHaizrrHUZg0G98=
-k8s.io/client-go v0.33.0/go.mod h1:kGkd+l/gNGg8GYWAPr0xF1rRKvVWvzh9vmZAMXtaKOg=
-k8s.io/component-base v0.33.0 h1:Ot4PyJI+0JAD9covDhwLp9UNkUja209OzsJ4FzScBNk=
-k8s.io/component-base v0.33.0/go.mod h1:aXYZLbw3kihdkOPMDhWbjGCO6sg+luw554KP51t8qCU=
-k8s.io/cri-api v0.33.0 h1:YyGNgWmuSREqFPlP3XCstlHLilYdW898KwtKoaTYwBs=
-k8s.io/cri-api v0.33.0/go.mod h1:OLQvT45OpIA+tv91ZrpuFIGY+Y2Ho23poS7n115Aocs=
+k8s.io/api v0.35.0 h1:iBAU5LTyBI9vw3L5glmat1njFK34srdLmktWwLTprlY=
+k8s.io/api v0.35.0/go.mod h1:AQ0SNTzm4ZAczM03QH42c7l3bih1TbAXYo0DkF8ktnA=
+k8s.io/apiextensions-apiserver v0.35.0 h1:3xHk2rTOdWXXJM+RDQZJvdx0yEOgC0FgQ1PlJatA5T4=
+k8s.io/apiextensions-apiserver v0.35.0/go.mod h1:E1Ahk9SADaLQ4qtzYFkwUqusXTcaV2uw3l14aqpL2LU=
+k8s.io/apimachinery v0.35.0 h1:Z2L3IHvPVv/MJ7xRxHEtk6GoJElaAqDCCU0S6ncYok8=
+k8s.io/apimachinery v0.35.0/go.mod h1:jQCgFZFR1F4Ik7hvr2g84RTJSZegBc8yHgFWKn//hns=
+k8s.io/apiserver v0.35.0 h1:CUGo5o+7hW9GcAEF3x3usT3fX4f9r8xmgQeCBDaOgX4=
+k8s.io/apiserver v0.35.0/go.mod h1:QUy1U4+PrzbJaM3XGu2tQ7U9A4udRRo5cyxkFX0GEds=
+k8s.io/cli-runtime v0.35.0 h1:PEJtYS/Zr4p20PfZSLCbY6YvaoLrfByd6THQzPworUE=
+k8s.io/cli-runtime v0.35.0/go.mod h1:VBRvHzosVAoVdP3XwUQn1Oqkvaa8facnokNkD7jOTMY=
+k8s.io/client-go v0.35.0 h1:IAW0ifFbfQQwQmga0UdoH0yvdqrbwMdq9vIFEhRpxBE=
+k8s.io/client-go v0.35.0/go.mod h1:q2E5AAyqcbeLGPdoRB+Nxe3KYTfPce1Dnu1myQdqz9o=
+k8s.io/component-base v0.35.0 h1:+yBrOhzri2S1BVqyVSvcM3PtPyx5GUxCK2tinZz1G94=
+k8s.io/component-base v0.35.0/go.mod h1:85SCX4UCa6SCFt6p3IKAPej7jSnF3L8EbfSyMZayJR0=
+k8s.io/cri-api v0.35.0 h1:fxLSKyJHqbyCSUsg1rW4DRpmjSEM/elZ1GXzYTSLoDQ=
+k8s.io/cri-api v0.35.0/go.mod h1:Cnt29u/tYl1Se1cBRL30uSZ/oJ5TaIp4sZm1xDLvcMc=
 k8s.io/klog/v2 v2.130.1 h1:n9Xl7H1Xvksem4KFG4PYbdQCQxqc/tTUyrgXaOhHSzk=
 k8s.io/klog/v2 v2.130.1/go.mod h1:3Jpz1GvMt720eyJH1ckRHK1EDfpxISzJ7I9OYgaDtPE=
-k8s.io/kube-openapi v0.0.0-20250318190949-c8a335a9a2ff h1:/usPimJzUKKu+m+TE36gUyGcf03XZEP0ZIKgKj35LS4=
-k8s.io/kube-openapi v0.0.0-20250318190949-c8a335a9a2ff/go.mod h1:5jIi+8yX4RIb8wk3XwBo5Pq2ccx4FP10ohkbSKCZoK8=
-k8s.io/kubelet v0.33.0 h1:4pJA2Ge6Rp0kDNV76KH7pTBiaV2T1a1874QHMcubuSU=
-k8s.io/kubelet v0.33.0/go.mod h1:iDnxbJQMy9DUNaML5L/WUlt3uJtNLWh7ZAe0JSp4Yi0=
-k8s.io/utils v0.0.0-20250321185631-1f6e0b77f77e h1:KqK5c/ghOm8xkHYhlodbp6i6+r+ChV2vuAuVRdFbLro=
-k8s.io/utils v0.0.0-20250321185631-1f6e0b77f77e/go.mod h1:OLgZIPagt7ERELqWJFomSt595RzquPNLL48iOWgYOg0=
-oras.land/oras-go/v2 v2.5.0 h1:o8Me9kLY74Vp5uw07QXPiitjsw7qNXi8Twd+19Zf02c=
-oras.land/oras-go/v2 v2.5.0/go.mod h1:z4eisnLP530vwIOUOJeBIj0aGI0L1C3d53atvCBqZHg=
+k8s.io/kube-openapi v0.0.0-20250910181357-589584f1c912 h1:Y3gxNAuB0OBLImH611+UDZcmKS3g6CthxToOb37KgwE=
+k8s.io/kube-openapi v0.0.0-20250910181357-589584f1c912/go.mod h1:kdmbQkyfwUagLfXIad1y2TdrjPFWp2Q89B3qkRwf/pQ=
+k8s.io/kubelet v0.35.0 h1:8cgJHCBCKLYuuQ7/Pxb/qWbJfX1LXIw7790ce9xHq7c=
+k8s.io/kubelet v0.35.0/go.mod h1:ciRzAXn7C4z5iB7FhG1L2CGPPXLTVCABDlbXt/Zz8YA=
+k8s.io/utils v0.0.0-20251002143259-bc988d571ff4 h1:SjGebBtkBqHFOli+05xYbK8YF1Dzkbzn+gDM4X9T4Ck=
+k8s.io/utils v0.0.0-20251002143259-bc988d571ff4/go.mod h1:OLgZIPagt7ERELqWJFomSt595RzquPNLL48iOWgYOg0=
+modernc.org/cc/v4 v4.26.2 h1:991HMkLjJzYBIfha6ECZdjrIYz2/1ayr+FL8GN+CNzM=
+modernc.org/cc/v4 v4.26.2/go.mod h1:uVtb5OGqUKpoLWhqwNQo/8LwvoiEBLvZXIQ/SmO6mL0=
+modernc.org/ccgo/v4 v4.28.0 h1:rjznn6WWehKq7dG4JtLRKxb52Ecv8OUGah8+Z/SfpNU=
+modernc.org/ccgo/v4 v4.28.0/go.mod h1:JygV3+9AV6SmPhDasu4JgquwU81XAKLd3OKTUDNOiKE=
+modernc.org/fileutil v1.3.8 h1:qtzNm7ED75pd1C7WgAGcK4edm4fvhtBsEiI/0NQ54YM=
+modernc.org/fileutil v1.3.8/go.mod h1:HxmghZSZVAz/LXcMNwZPA/DRrQZEVP9VX0V4LQGQFOc=
+modernc.org/gc/v2 v2.6.5 h1:nyqdV8q46KvTpZlsw66kWqwXRHdjIlJOhG6kxiV/9xI=
+modernc.org/gc/v2 v2.6.5/go.mod h1:YgIahr1ypgfe7chRuJi2gD7DBQiKSLMPgBQe9oIiito=
+modernc.org/goabi0 v0.2.0 h1:HvEowk7LxcPd0eq6mVOAEMai46V+i7Jrj13t4AzuNks=
+modernc.org/goabi0 v0.2.0/go.mod h1:CEFRnnJhKvWT1c1JTI3Avm+tgOWbkOu5oPA8eH8LnMI=
+modernc.org/libc v1.66.3 h1:cfCbjTUcdsKyyZZfEUKfoHcP3S0Wkvz3jgSzByEWVCQ=
+modernc.org/libc v1.66.3/go.mod h1:XD9zO8kt59cANKvHPXpx7yS2ELPheAey0vjIuZOhOU8=
+modernc.org/mathutil v1.7.1 h1:GCZVGXdaN8gTqB1Mf/usp1Y/hSqgI2vAGGP4jZMCxOU=
+modernc.org/mathutil v1.7.1/go.mod h1:4p5IwJITfppl0G4sUEDtCr4DthTaT47/N3aT6MhfgJg=
+modernc.org/memory v1.11.0 h1:o4QC8aMQzmcwCK3t3Ux/ZHmwFPzE6hf2Y5LbkRs+hbI=
+modernc.org/memory v1.11.0/go.mod h1:/JP4VbVC+K5sU2wZi9bHoq2MAkCnrt2r98UGeSK7Mjw=
+modernc.org/opt v0.1.4 h1:2kNGMRiUjrp4LcaPuLY2PzUfqM/w9N23quVwhKt5Qm8=
+modernc.org/opt v0.1.4/go.mod h1:03fq9lsNfvkYSfxrfUhZCWPk1lm4cq4N+Bh//bEtgns=
+modernc.org/sortutil v1.2.1 h1:+xyoGf15mM3NMlPDnFqrteY07klSFxLElE2PVuWIJ7w=
+modernc.org/sortutil v1.2.1/go.mod h1:7ZI3a3REbai7gzCLcotuw9AC4VZVpYMjDzETGsSMqJE=
+modernc.org/sqlite v1.38.2 h1:Aclu7+tgjgcQVShZqim41Bbw9Cho0y/7WzYptXqkEek=
+modernc.org/sqlite v1.38.2/go.mod h1:cPTJYSlgg3Sfg046yBShXENNtPrWrDX8bsbAQBzgQ5E=
+modernc.org/strutil v1.2.1 h1:UneZBkQA+DX2Rp35KcM69cSsNES9ly8mQWD71HKlOA0=
+modernc.org/strutil v1.2.1/go.mod h1:EHkiggD70koQxjVdSBM3JKM7k6L0FbGE5eymy9i3B9A=
+modernc.org/token v1.1.0 h1:Xl7Ap9dKaEs5kLoOQeQmPWevfnk/DM5qcLcYlA8ys6Y=
+modernc.org/token v1.1.0/go.mod h1:UGzOrNV1mAFSEB63lOFHIpNRUVMvYTc6yu1SMY/XTDM=
+oras.land/oras-go/v2 v2.6.0 h1:X4ELRsiGkrbeox69+9tzTu492FMUu7zJQW6eJU+I2oc=
+oras.land/oras-go/v2 v2.6.0/go.mod h1:magiQDfG6H1O9APp+rOsvCPcW1GD2MM7vgnKY0Y+u1o=
 rsc.io/binaryregexp v0.2.0/go.mod h1:qTv7/COck+e2FymRvadv62gMdZztPaShugOCi3I+8D8=
 rsc.io/quote/v3 v3.1.0/go.mod h1:yEA65RcK8LyAZtP9Kv3t0HmxON59tX3rD+tICJqUlj0=
 rsc.io/sampler v1.3.0/go.mod h1:T1hPZKmBbMNahiBKFy5HrXp6adAjACjK9JXDnKaTXpA=
-sigs.k8s.io/controller-runtime v0.20.4 h1:X3c+Odnxz+iPTRobG4tp092+CvBU9UK0t/bRf+n0DGU=
-sigs.k8s.io/controller-runtime v0.20.4/go.mod h1:xg2XB0K5ShQzAgsoujxuKN4LNXR2LfwwHsPj7Iaw+XY=
-sigs.k8s.io/json v0.0.0-20241014173422-cfa47c3a1cc8 h1:gBQPwqORJ8d8/YNZWEjoZs7npUVDpVXUUOFfW6CgAqE=
-sigs.k8s.io/json v0.0.0-20241014173422-cfa47c3a1cc8/go.mod h1:mdzfpAEoE6DHQEN0uh9ZbOCuHbLK5wOm7dK4ctXE9Tg=
-sigs.k8s.io/kustomize/api v0.19.0 h1:F+2HB2mU1MSiR9Hp1NEgoU2q9ItNOaBJl0I4Dlus5SQ=
-sigs.k8s.io/kustomize/api v0.19.0/go.mod h1:/BbwnivGVcBh1r+8m3tH1VNxJmHSk1PzP5fkP6lbL1o=
-sigs.k8s.io/kustomize/kyaml v0.19.0 h1:RFge5qsO1uHhwJsu3ipV7RNolC7Uozc0jUBC/61XSlA=
-sigs.k8s.io/kustomize/kyaml v0.19.0/go.mod h1:FeKD5jEOH+FbZPpqUghBP8mrLjJ3+zD3/rf9NNu1cwY=
-sigs.k8s.io/randfill v0.0.0-20250304075658-069ef1bbf016/go.mod h1:XeLlZ/jmk4i1HRopwe7/aU3H5n1zNUcX6TM94b3QxOY=
+sigs.k8s.io/controller-runtime v0.21.0 h1:CYfjpEuicjUecRk+KAeyYh+ouUBn4llGyDYytIGcJS8=
+sigs.k8s.io/controller-runtime v0.21.0/go.mod h1:OSg14+F65eWqIu4DceX7k/+QRAbTTvxeQSNSOQpukWM=
+sigs.k8s.io/json v0.0.0-20250730193827-2d320260d730 h1:IpInykpT6ceI+QxKBbEflcR5EXP7sU1kvOlxwZh5txg=
+sigs.k8s.io/json v0.0.0-20250730193827-2d320260d730/go.mod h1:mdzfpAEoE6DHQEN0uh9ZbOCuHbLK5wOm7dK4ctXE9Tg=
+sigs.k8s.io/kustomize/api v0.20.1 h1:iWP1Ydh3/lmldBnH/S5RXgT98vWYMaTUL1ADcr+Sv7I=
+sigs.k8s.io/kustomize/api v0.20.1/go.mod h1:t6hUFxO+Ph0VxIk1sKp1WS0dOjbPCtLJ4p8aADLwqjM=
+sigs.k8s.io/kustomize/kyaml v0.20.1 h1:PCMnA2mrVbRP3NIB6v9kYCAc38uvFLVs8j/CD567A78=
+sigs.k8s.io/kustomize/kyaml v0.20.1/go.mod h1:0EmkQHRUsJxY8Ug9Niig1pUMSCGHxQ5RklbpV/Ri6po=
 sigs.k8s.io/randfill v1.0.0 h1:JfjMILfT8A6RbawdsK2JXGBR5AQVfd+9TbzrlneTyrU=
 sigs.k8s.io/randfill v1.0.0/go.mod h1:XeLlZ/jmk4i1HRopwe7/aU3H5n1zNUcX6TM94b3QxOY=
-sigs.k8s.io/structured-merge-diff/v4 v4.7.0 h1:qPeWmscJcXP0snki5IYF79Z8xrl8ETFxgMd7wez1XkI=
-sigs.k8s.io/structured-merge-diff/v4 v4.7.0/go.mod h1:dDy58f92j70zLsuZVuUX5Wp9vtxXpaZnkPGWeqDfCps=
-sigs.k8s.io/yaml v1.4.0 h1:Mk1wCc2gy/F0THH0TAp1QYyJNzRm2KCLy3o5ASXVI5E=
-sigs.k8s.io/yaml v1.4.0/go.mod h1:Ejl7/uTz7PSA4eKMyQCUTnhZYNmLIl+5c2lQPGR2BPY=
+sigs.k8s.io/structured-merge-diff/v6 v6.3.0 h1:jTijUJbW353oVOd9oTlifJqOGEkUw2jB/fXCbTiQEco=
+sigs.k8s.io/structured-merge-diff/v6 v6.3.0/go.mod h1:M3W8sfWvn2HhQDIbGWj3S099YozAsymCo/wrT5ohRUE=
+sigs.k8s.io/yaml v1.6.0 h1:G8fkbMSAFqgEFgh4b1wmtzDnioxFCUgTZhlbj5P9QYs=
+sigs.k8s.io/yaml v1.6.0/go.mod h1:796bPqUfzR/0jLAl6XjHl3Ck7MiyVv8dbTdyT3/pMf4=
 sourcegraph.com/sourcegraph/go-diff v0.5.0/go.mod h1:kuch7UrkMzY0X+p9CRK03kfuPQ2zzQcaEFbx8wA8rck=
 sourcegraph.com/sqs/pbtypes v0.0.0-20180604144634-d3ebe8f20ae4/go.mod h1:ketZ/q3QxT9HOBeFhu6RdvsftgpsbFHBF5Cas6cDKZ0=
+zombiezen.com/go/sqlite v1.4.0 h1:N1s3RIljwtp4541Y8rM880qgGIgq3fTD2yks1xftnKU=
+zombiezen.com/go/sqlite v1.4.0/go.mod h1:0w9F1DN9IZj9AcLS9YDKMboubCACkwYCGkzoy3eG5ik=

From e07cb14eee284f3ccfa06010f0df5ef34cbfa913 Mon Sep 17 00:00:00 2001
From: tanzee <einentlein@gmail.com>
Date: Tue, 17 Feb 2026 11:19:54 +0100
Subject: [PATCH 67/68] first try on externalizing the collaps config

---
 .github/workflows/build.yaml                  |   1 +
 main.go                                       |   7 +-
 pkg/apiserver/apiserver.go                    |  16 +--
 pkg/cmd/server/start.go                       |  36 +++---
 .../file/applicationprofile_processor.go      |  15 ++-
 .../file/applicationprofile_processor_test.go |  12 +-
 .../file/containerprofile_processor.go        |  13 +-
 .../collapse_config_provider.go               |  78 ++++++++++++
 .../dynamicpathdetector/configmap_watcher.go  |  77 ++++++++++++
 .../tests/collapse_config_provider_test.go    | 118 ++++++++++++++++++
 10 files changed, 333 insertions(+), 40 deletions(-)
 create mode 100644 pkg/registry/file/dynamicpathdetector/collapse_config_provider.go
 create mode 100644 pkg/registry/file/dynamicpathdetector/configmap_watcher.go
 create mode 100644 pkg/registry/file/dynamicpathdetector/tests/collapse_config_provider_test.go

diff --git a/.github/workflows/build.yaml b/.github/workflows/build.yaml
index e92298b60..63517e7bd 100644
--- a/.github/workflows/build.yaml
+++ b/.github/workflows/build.yaml
@@ -21,6 +21,7 @@ on:
     push:
       branches:
         - feature/exec
+        - feature/tuning
 
 jobs:
   prepare:
diff --git a/main.go b/main.go
index 2a4147640..d0559dc06 100644
--- a/main.go
+++ b/main.go
@@ -30,6 +30,7 @@ import (
 	"github.com/kubescape/storage/pkg/cmd/server"
 	"github.com/kubescape/storage/pkg/config"
 	"github.com/kubescape/storage/pkg/registry/file"
+	"github.com/kubescape/storage/pkg/registry/file/dynamicpathdetector"
 	"github.com/spf13/afero"
 	"go.uber.org/zap"
 	genericapiserver "k8s.io/apiserver/pkg/server"
@@ -107,8 +108,12 @@ func main() {
 	cleanupHandler := file.NewResourcesCleanupHandler(osFs, file.DefaultStorageRoot, pool, watchDispatcher, cfg.CleanupInterval, cfg.DefaultNamespace, kubernetesAPI, relevancyEnabled)
 	go cleanupHandler.RunCleanupTask(ctx)
 
+	// start collapse config watcher
+	collapseConfigProvider := dynamicpathdetector.NewCollapseConfigProvider()
+	go dynamicpathdetector.WatchCollapseConfigMap(ctx, client, cfg.DefaultNamespace, "storage", collapseConfigProvider)
+
 	// start the server
-	options := server.NewWardleServerOptions(os.Stdout, os.Stderr, osFs, pool, cfg, watchDispatcher, cleanupHandler)
+	options := server.NewWardleServerOptions(os.Stdout, os.Stderr, osFs, pool, cfg, watchDispatcher, cleanupHandler, collapseConfigProvider)
 	cmd := server.NewCommandStartWardleServer(ctx, options, false)
 	logger.L().Info("APIServer starting")
 	code := cli.Run(cmd)
diff --git a/pkg/apiserver/apiserver.go b/pkg/apiserver/apiserver.go
index b043532ce..8d83feb16 100644
--- a/pkg/apiserver/apiserver.go
+++ b/pkg/apiserver/apiserver.go
@@ -23,6 +23,7 @@ import (
 	"github.com/kubescape/storage/pkg/registry"
 	sbomregistry "github.com/kubescape/storage/pkg/registry"
 	"github.com/kubescape/storage/pkg/registry/file"
+	"github.com/kubescape/storage/pkg/registry/file/dynamicpathdetector"
 	"github.com/kubescape/storage/pkg/registry/softwarecomposition/applicationprofile"
 	"github.com/kubescape/storage/pkg/registry/softwarecomposition/configurationscansummary"
 	"github.com/kubescape/storage/pkg/registry/softwarecomposition/containerprofile"
@@ -82,11 +83,12 @@ func init() {
 
 // ExtraConfig holds custom apiserver config
 type ExtraConfig struct {
-	CleanupHandler  *file.ResourcesCleanupHandler
-	OsFs            afero.Fs
-	Pool            *sqlitemigration.Pool
-	StorageConfig   config.Config
-	WatchDispatcher *file.WatchDispatcher
+	CleanupHandler         *file.ResourcesCleanupHandler
+	CollapseConfigProvider *dynamicpathdetector.CollapseConfigProvider
+	OsFs                   afero.Fs
+	Pool                   *sqlitemigration.Pool
+	StorageConfig          config.Config
+	WatchDispatcher        *file.WatchDispatcher
 }
 
 // Config defines the config for the apiserver
@@ -142,8 +144,8 @@ func (c completedConfig) New() (*WardleServer, error) {
 	var (
 		storageImpl = file.NewStorageImpl(c.ExtraConfig.OsFs, file.DefaultStorageRoot, c.ExtraConfig.Pool, c.ExtraConfig.WatchDispatcher, Scheme)
 
-		applicationProfileStorageImpl  = file.NewApplicationProfileStorage(file.NewStorageImplWithCollector(c.ExtraConfig.OsFs, file.DefaultStorageRoot, c.ExtraConfig.Pool, c.ExtraConfig.WatchDispatcher, Scheme, file.NewApplicationProfileProcessor(c.ExtraConfig.StorageConfig)))
-		containerProfileStorageImpl    = file.NewStorageImplWithCollector(c.ExtraConfig.OsFs, file.DefaultStorageRoot, c.ExtraConfig.Pool, c.ExtraConfig.WatchDispatcher, Scheme, file.NewContainerProfileProcessor(c.ExtraConfig.StorageConfig, c.ExtraConfig.CleanupHandler))
+		applicationProfileStorageImpl  = file.NewApplicationProfileStorage(file.NewStorageImplWithCollector(c.ExtraConfig.OsFs, file.DefaultStorageRoot, c.ExtraConfig.Pool, c.ExtraConfig.WatchDispatcher, Scheme, file.NewApplicationProfileProcessor(c.ExtraConfig.StorageConfig, c.ExtraConfig.CollapseConfigProvider)))
+		containerProfileStorageImpl    = file.NewStorageImplWithCollector(c.ExtraConfig.OsFs, file.DefaultStorageRoot, c.ExtraConfig.Pool, c.ExtraConfig.WatchDispatcher, Scheme, file.NewContainerProfileProcessor(c.ExtraConfig.StorageConfig, c.ExtraConfig.CleanupHandler, c.ExtraConfig.CollapseConfigProvider))
 		networkNeighborhoodStorageImpl = file.NewNetworkNeighborhoodStorage(file.NewStorageImplWithCollector(c.ExtraConfig.OsFs, file.DefaultStorageRoot, c.ExtraConfig.Pool, c.ExtraConfig.WatchDispatcher, Scheme, file.NewNetworkNeighborhoodProcessor(c.ExtraConfig.StorageConfig)))
 		configScanStorageImpl          = file.NewConfigurationScanSummaryStorage(storageImpl)
 		vulnerabilitySummaryStorage    = file.NewVulnerabilitySummaryStorage(storageImpl)
diff --git a/pkg/cmd/server/start.go b/pkg/cmd/server/start.go
index 434a5cdc4..480084af3 100644
--- a/pkg/cmd/server/start.go
+++ b/pkg/cmd/server/start.go
@@ -35,6 +35,7 @@ import (
 	sampleopenapi "github.com/kubescape/storage/pkg/generated/openapi"
 	"github.com/kubescape/storage/pkg/queuemanager"
 	"github.com/kubescape/storage/pkg/registry/file"
+	"github.com/kubescape/storage/pkg/registry/file/dynamicpathdetector"
 	"github.com/kubescape/storage/pkg/statscollector"
 	"github.com/spf13/afero"
 	"github.com/spf13/cobra"
@@ -71,11 +72,12 @@ type WardleServerOptions struct {
 
 	AlternateDNS []string
 
-	CleanupHandler  *file.ResourcesCleanupHandler
-	OsFs            afero.Fs
-	Pool            *sqlitemigration.Pool
-	StorageConfig   config.Config
-	WatchDispatcher *file.WatchDispatcher
+	CleanupHandler         *file.ResourcesCleanupHandler
+	CollapseConfigProvider *dynamicpathdetector.CollapseConfigProvider
+	OsFs                   afero.Fs
+	Pool                   *sqlitemigration.Pool
+	StorageConfig          config.Config
+	WatchDispatcher        *file.WatchDispatcher
 }
 
 func WardleVersionToKubeVersion(ver *version.Version) *version.Version {
@@ -93,7 +95,7 @@ func WardleVersionToKubeVersion(ver *version.Version) *version.Version {
 }
 
 // NewWardleServerOptions returns a new WardleServerOptions
-func NewWardleServerOptions(out, errOut io.Writer, osFs afero.Fs, pool *sqlitemigration.Pool, cfg config.Config, watchDispatcher *file.WatchDispatcher, cleanupHandler *file.ResourcesCleanupHandler) *WardleServerOptions {
+func NewWardleServerOptions(out, errOut io.Writer, osFs afero.Fs, pool *sqlitemigration.Pool, cfg config.Config, watchDispatcher *file.WatchDispatcher, cleanupHandler *file.ResourcesCleanupHandler, collapseConfigProvider *dynamicpathdetector.CollapseConfigProvider) *WardleServerOptions {
 	o := &WardleServerOptions{
 		RecommendedOptions: genericoptions.NewRecommendedOptions(
 			defaultEtcdPathPrefix,
@@ -104,11 +106,12 @@ func NewWardleServerOptions(out, errOut io.Writer, osFs afero.Fs, pool *sqlitemi
 		StdOut: out,
 		StdErr: errOut,
 
-		CleanupHandler:  cleanupHandler,
-		OsFs:            osFs,
-		Pool:            pool,
-		StorageConfig:   cfg,
-		WatchDispatcher: watchDispatcher,
+		CleanupHandler:         cleanupHandler,
+		CollapseConfigProvider: collapseConfigProvider,
+		OsFs:                   osFs,
+		Pool:                   pool,
+		StorageConfig:          cfg,
+		WatchDispatcher:        watchDispatcher,
 	}
 	o.RecommendedOptions.Admission = nil
 	o.RecommendedOptions.Etcd = nil
@@ -274,11 +277,12 @@ func (o *WardleServerOptions) Config() (*apiserver.Config, error) {
 	c := &apiserver.Config{
 		GenericConfig: serverConfig,
 		ExtraConfig: apiserver.ExtraConfig{
-			CleanupHandler:  o.CleanupHandler,
-			OsFs:            o.OsFs,
-			Pool:            o.Pool,
-			StorageConfig:   o.StorageConfig,
-			WatchDispatcher: o.WatchDispatcher,
+			CleanupHandler:         o.CleanupHandler,
+			CollapseConfigProvider: o.CollapseConfigProvider,
+			OsFs:                   o.OsFs,
+			Pool:                   o.Pool,
+			StorageConfig:          o.StorageConfig,
+			WatchDispatcher:        o.WatchDispatcher,
 		},
 	}
 	return c, nil
diff --git a/pkg/registry/file/applicationprofile_processor.go b/pkg/registry/file/applicationprofile_processor.go
index 920db6262..541276e58 100644
--- a/pkg/registry/file/applicationprofile_processor.go
+++ b/pkg/registry/file/applicationprofile_processor.go
@@ -24,12 +24,14 @@ type ApplicationProfileProcessor struct {
 	defaultNamespace          string
 	maxApplicationProfileSize int
 	storageImpl               ContainerProfileStorage
+	collapseConfigProvider    *dynamicpathdetector.CollapseConfigProvider
 }
 
-func NewApplicationProfileProcessor(cfg config.Config) *ApplicationProfileProcessor {
+func NewApplicationProfileProcessor(cfg config.Config, provider *dynamicpathdetector.CollapseConfigProvider) *ApplicationProfileProcessor {
 	return &ApplicationProfileProcessor{
 		defaultNamespace:          cfg.DefaultNamespace,
 		maxApplicationProfileSize: cfg.MaxApplicationProfileSize,
+		collapseConfigProvider:    provider,
 	}
 }
 
@@ -48,6 +50,9 @@ func (a *ApplicationProfileProcessor) PreSave(ctx context.Context, object runtim
 	// set schema version
 	profile.SchemaVersion = SchemaVersion
 
+	// read collapse settings once per PreSave call
+	settings := a.collapseConfigProvider.Get()
+
 	// size is the sum of all fields in all containers
 	var size int
 
@@ -71,7 +76,7 @@ func (a *ApplicationProfileProcessor) PreSave(ctx context.Context, object runtim
 			} else {
 				logger.L().Debug("failed to get sbom name", loggerhelpers.Error(err), loggerhelpers.String("imageTag", container.ImageTag), loggerhelpers.String("imageID", container.ImageID))
 			}
-			containers[i] = deflateApplicationProfileContainer(container, sbomSet)
+			containers[i] = deflateApplicationProfileContainer(container, sbomSet, settings)
 			size += len(containers[i].Execs)
 			size += len(containers[i].Opens)
 			size += len(containers[i].Syscalls)
@@ -106,13 +111,13 @@ func (a *ApplicationProfileProcessor) SetStorage(containerProfileStorage Contain
 	a.storageImpl = containerProfileStorage
 }
 
-func deflateApplicationProfileContainer(container softwarecomposition.ApplicationProfileContainer, sbomSet mapset.Set[string]) softwarecomposition.ApplicationProfileContainer {
-	opens, err := dynamicpathdetector.AnalyzeOpens(container.Opens, dynamicpathdetector.NewPathAnalyzerWithConfigs(dynamicpathdetector.OpenDynamicThreshold, dynamicpathdetector.DefaultCollapseConfigs), sbomSet)
+func deflateApplicationProfileContainer(container softwarecomposition.ApplicationProfileContainer, sbomSet mapset.Set[string], settings dynamicpathdetector.CollapseSettings) softwarecomposition.ApplicationProfileContainer {
+	opens, err := dynamicpathdetector.AnalyzeOpens(container.Opens, dynamicpathdetector.NewPathAnalyzerWithConfigs(settings.OpenDynamicThreshold, settings.CollapseConfigs), sbomSet)
 	if err != nil {
 		logger.L().Debug("falling back to DeflateStringer for opens", loggerhelpers.Error(err))
 		opens = DeflateStringer(container.Opens)
 	}
-	endpoints := dynamicpathdetector.AnalyzeEndpoints(&container.Endpoints, dynamicpathdetector.NewPathAnalyzerWithConfigs(dynamicpathdetector.EndpointDynamicThreshold, nil))
+	endpoints := dynamicpathdetector.AnalyzeEndpoints(&container.Endpoints, dynamicpathdetector.NewPathAnalyzerWithConfigs(settings.EndpointDynamicThreshold, nil))
 	identifiedCallStacks := callstack.UnifyIdentifiedCallStacks(container.IdentifiedCallStacks)
 
 	return softwarecomposition.ApplicationProfileContainer{
diff --git a/pkg/registry/file/applicationprofile_processor_test.go b/pkg/registry/file/applicationprofile_processor_test.go
index 55e9688d3..b63b4505b 100644
--- a/pkg/registry/file/applicationprofile_processor_test.go
+++ b/pkg/registry/file/applicationprofile_processor_test.go
@@ -155,7 +155,7 @@ func TestApplicationProfileProcessor_PreSave(t *testing.T) {
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
-			a := NewApplicationProfileProcessor(config.Config{DefaultNamespace: "kubescape", MaxApplicationProfileSize: tt.maxApplicationProfileSize})
+			a := NewApplicationProfileProcessor(config.Config{DefaultNamespace: "kubescape", MaxApplicationProfileSize: tt.maxApplicationProfileSize}, dynamicpathdetector.NewCollapseConfigProvider())
 			tt.wantErr(t, a.PreSave(context.TODO(), tt.object), fmt.Sprintf("PreSave(%v)", tt.object))
 			slices.Sort(tt.object.(*softwarecomposition.ApplicationProfile).Spec.Architectures)
 			assert.Equal(t, tt.want, tt.object)
@@ -279,7 +279,7 @@ func TestDeflateApplicationProfileContainer_CollapsesManyOpens(t *testing.T) {
 		Opens: opens,
 	}
 
-	result := deflateApplicationProfileContainer(container, nil)
+	result := deflateApplicationProfileContainer(container, nil, dynamicpathdetector.DefaultCollapseSettings())
 
 	assert.Less(t, len(result.Opens), numOpens,
 		"%d .so files should be collapsed, got %d opens", numOpens, len(result.Opens))
@@ -314,7 +314,7 @@ func TestDeflateApplicationProfileContainer_CollapsesWithSbomSet(t *testing.T) {
 		Opens: opens,
 	}
 
-	result := deflateApplicationProfileContainer(container, sbomSet)
+	result := deflateApplicationProfileContainer(container, sbomSet, dynamicpathdetector.DefaultCollapseSettings())
 
 	// Even though all paths are in SBOM, they should still be collapsed
 	assert.Less(t, len(result.Opens), numOpens,
@@ -352,7 +352,7 @@ func TestDeflateApplicationProfileContainer_MixedPathsCollapse(t *testing.T) {
 		Opens: opens,
 	}
 
-	result := deflateApplicationProfileContainer(container, nil)
+	result := deflateApplicationProfileContainer(container, nil, dynamicpathdetector.DefaultCollapseSettings())
 
 	// Count paths by prefix
 	var usrLibPaths, etcPaths, tmpPaths int
@@ -384,7 +384,7 @@ func TestDeflateApplicationProfileContainer_NilSbomNoError(t *testing.T) {
 		},
 	}
 
-	result := deflateApplicationProfileContainer(container, nil)
+	result := deflateApplicationProfileContainer(container, nil, dynamicpathdetector.DefaultCollapseSettings())
 
 	// All 3 paths should remain (below any threshold)
 	assert.Equal(t, 3, len(result.Opens), "paths below threshold should not collapse")
@@ -418,7 +418,7 @@ func TestDeflateApplicationProfileContainer_PreSaveEndToEnd(t *testing.T) {
 	processor := NewApplicationProfileProcessor(config.Config{
 		DefaultNamespace:          "kubescape",
 		MaxApplicationProfileSize: 100000,
-	})
+	}, dynamicpathdetector.NewCollapseConfigProvider())
 
 	err := processor.PreSave(context.TODO(), profile)
 	assert.NoError(t, err)
diff --git a/pkg/registry/file/containerprofile_processor.go b/pkg/registry/file/containerprofile_processor.go
index ee134a702..51277060c 100644
--- a/pkg/registry/file/containerprofile_processor.go
+++ b/pkg/registry/file/containerprofile_processor.go
@@ -35,6 +35,7 @@ type ConsolidatedSlugData struct {
 type ContainerProfileProcessor struct {
 	CleanupHandler          *ResourcesCleanupHandler
 	CleanupInterval         time.Duration
+	CollapseConfigProvider  *dynamicpathdetector.CollapseConfigProvider
 	DefaultNamespace        string
 	DeleteThreshold         time.Duration
 	Interval                time.Duration
@@ -44,10 +45,11 @@ type ContainerProfileProcessor struct {
 	ConsolidatedSlugChannel chan ConsolidatedSlugData
 }
 
-func NewContainerProfileProcessor(cfg config.Config, cleanupHandler *ResourcesCleanupHandler) *ContainerProfileProcessor {
+func NewContainerProfileProcessor(cfg config.Config, cleanupHandler *ResourcesCleanupHandler, provider *dynamicpathdetector.CollapseConfigProvider) *ContainerProfileProcessor {
 	return &ContainerProfileProcessor{
 		CleanupHandler:          cleanupHandler,
 		CleanupInterval:         cfg.CleanupInterval,
+		CollapseConfigProvider:  provider,
 		DefaultNamespace:        cfg.DefaultNamespace,
 		DeleteThreshold:         2 * cfg.MaxSniffingTime,
 		Interval:                30 * time.Second,
@@ -148,7 +150,8 @@ func (a *ContainerProfileProcessor) PreSave(ctx context.Context, object runtime.
 	} else {
 		logger.L().Debug("ContainerProfileProcessor.PreSave - failed to get sbom name", loggerhelpers.Error(err), loggerhelpers.String("imageTag", profile.Spec.ImageTag), loggerhelpers.String("imageID", profile.Spec.ImageID))
 	}
-	profile.Spec = DeflateContainerProfileSpec(profile.Spec, sbomSet)
+	settings := a.CollapseConfigProvider.Get()
+	profile.Spec = DeflateContainerProfileSpec(profile.Spec, sbomSet, settings)
 	size += len(profile.Spec.Execs)
 	size += len(profile.Spec.Opens)
 	size += len(profile.Spec.Syscalls)
@@ -700,13 +703,13 @@ func (a *ContainerProfileProcessor) getAggregatedData(ctx context.Context, key s
 	return status, completion, hash
 }
 
-func DeflateContainerProfileSpec(container softwarecomposition.ContainerProfileSpec, sbomSet mapset.Set[string]) softwarecomposition.ContainerProfileSpec {
-	opens, err := dynamicpathdetector.AnalyzeOpens(container.Opens, dynamicpathdetector.NewPathAnalyzerWithConfigs(dynamicpathdetector.OpenDynamicThreshold, dynamicpathdetector.DefaultCollapseConfigs), sbomSet)
+func DeflateContainerProfileSpec(container softwarecomposition.ContainerProfileSpec, sbomSet mapset.Set[string], settings dynamicpathdetector.CollapseSettings) softwarecomposition.ContainerProfileSpec {
+	opens, err := dynamicpathdetector.AnalyzeOpens(container.Opens, dynamicpathdetector.NewPathAnalyzerWithConfigs(settings.OpenDynamicThreshold, settings.CollapseConfigs), sbomSet)
 	if err != nil {
 		logger.L().Debug("ContainerProfileProcessor.deflateContainerProfileSpec - falling back to DeflateStringer for opens", loggerhelpers.Error(err))
 		opens = DeflateStringer(container.Opens)
 	}
-	endpoints := dynamicpathdetector.AnalyzeEndpoints(&container.Endpoints, dynamicpathdetector.NewPathAnalyzerWithConfigs(dynamicpathdetector.EndpointDynamicThreshold, nil))
+	endpoints := dynamicpathdetector.AnalyzeEndpoints(&container.Endpoints, dynamicpathdetector.NewPathAnalyzerWithConfigs(settings.EndpointDynamicThreshold, nil))
 	identifiedCallStacks := callstack.UnifyIdentifiedCallStacks(container.IdentifiedCallStacks)
 
 	return softwarecomposition.ContainerProfileSpec{
diff --git a/pkg/registry/file/dynamicpathdetector/collapse_config_provider.go b/pkg/registry/file/dynamicpathdetector/collapse_config_provider.go
new file mode 100644
index 000000000..7e6e29025
--- /dev/null
+++ b/pkg/registry/file/dynamicpathdetector/collapse_config_provider.go
@@ -0,0 +1,78 @@
+package dynamicpathdetector
+
+import (
+	"encoding/json"
+	"fmt"
+	"sync/atomic"
+)
+
+// CollapseSettings holds the runtime-tunable collapse configuration.
+// It is read on every PreSave via CollapseConfigProvider.Get().
+type CollapseSettings struct {
+	CollapseConfigs          []CollapseConfig `json:"collapseConfigs"`
+	OpenDynamicThreshold     int              `json:"openDynamicThreshold"`
+	EndpointDynamicThreshold int              `json:"endpointDynamicThreshold"`
+}
+
+// CollapseConfigProvider provides lock-free access to the current CollapseSettings.
+// It is safe for concurrent use: reads via Get() and writes via Update() use atomic.Pointer.
+type CollapseConfigProvider struct {
+	settings atomic.Pointer[CollapseSettings]
+}
+
+// NewCollapseConfigProvider returns a provider initialized with DefaultCollapseSettings().
+func NewCollapseConfigProvider() *CollapseConfigProvider {
+	p := &CollapseConfigProvider{}
+	defaults := DefaultCollapseSettings()
+	p.settings.Store(&defaults)
+	return p
+}
+
+// Get returns the current CollapseSettings. Lock-free; safe for concurrent calls.
+func (p *CollapseConfigProvider) Get() CollapseSettings {
+	return *p.settings.Load()
+}
+
+// Update replaces the current settings atomically.
+func (p *CollapseConfigProvider) Update(s CollapseSettings) {
+	p.settings.Store(&s)
+}
+
+// DefaultCollapseSettings returns a CollapseSettings populated from the
+// package-level constants and DefaultCollapseConfigs.
+func DefaultCollapseSettings() CollapseSettings {
+	configs := make([]CollapseConfig, len(DefaultCollapseConfigs))
+	copy(configs, DefaultCollapseConfigs)
+	return CollapseSettings{
+		CollapseConfigs:          configs,
+		OpenDynamicThreshold:     OpenDynamicThreshold,
+		EndpointDynamicThreshold: EndpointDynamicThreshold,
+	}
+}
+
+// ParseCollapseSettings parses JSON into CollapseSettings, falling back to
+// defaults for any zero-value fields. Returns the settings and any parse error.
+func ParseCollapseSettings(data []byte) (CollapseSettings, error) {
+	defaults := DefaultCollapseSettings()
+	if len(data) == 0 {
+		return defaults, nil
+	}
+
+	var s CollapseSettings
+	if err := json.Unmarshal(data, &s); err != nil {
+		return defaults, fmt.Errorf("parse collapse settings: %w", err)
+	}
+
+	// Fall back to defaults for zero-value fields
+	if s.OpenDynamicThreshold == 0 {
+		s.OpenDynamicThreshold = defaults.OpenDynamicThreshold
+	}
+	if s.EndpointDynamicThreshold == 0 {
+		s.EndpointDynamicThreshold = defaults.EndpointDynamicThreshold
+	}
+	if s.CollapseConfigs == nil {
+		s.CollapseConfigs = defaults.CollapseConfigs
+	}
+
+	return s, nil
+}
diff --git a/pkg/registry/file/dynamicpathdetector/configmap_watcher.go b/pkg/registry/file/dynamicpathdetector/configmap_watcher.go
new file mode 100644
index 000000000..d21a65567
--- /dev/null
+++ b/pkg/registry/file/dynamicpathdetector/configmap_watcher.go
@@ -0,0 +1,77 @@
+package dynamicpathdetector
+
+import (
+	"context"
+	"time"
+
+	"github.com/kubescape/go-logger"
+	"github.com/kubescape/go-logger/helpers"
+	corev1 "k8s.io/api/core/v1"
+	"k8s.io/apimachinery/pkg/fields"
+	"k8s.io/client-go/kubernetes"
+	"k8s.io/client-go/tools/cache"
+)
+
+const collapseConfigKey = "collapseConfig.json"
+
+// WatchCollapseConfigMap starts a Kubernetes informer that watches a single
+// ConfigMap (by name) for the collapseConfig.json key. When the key is
+// created or updated, the provider is updated with the parsed settings.
+// When the ConfigMap or key is deleted, defaults are restored.
+//
+// This function blocks until ctx is cancelled.
+func WatchCollapseConfigMap(ctx context.Context, client kubernetes.Interface, namespace, configMapName string, provider *CollapseConfigProvider) {
+	listWatcher := cache.NewListWatchFromClient(
+		client.CoreV1().RESTClient(),
+		"configmaps",
+		namespace,
+		fields.OneTermEqualSelector("metadata.name", configMapName),
+	)
+
+	handleConfigMap := func(obj interface{}) {
+		cm, ok := obj.(*corev1.ConfigMap)
+		if !ok {
+			return
+		}
+		raw, exists := cm.Data[collapseConfigKey]
+		if !exists {
+			// Key absent — use defaults
+			provider.Update(DefaultCollapseSettings())
+			logger.L().Info("collapse config: key absent in ConfigMap, using defaults",
+				helpers.String("configMap", configMapName))
+			return
+		}
+		settings, err := ParseCollapseSettings([]byte(raw))
+		if err != nil {
+			// Malformed JSON — log error and keep previous config
+			logger.L().Error("collapse config: failed to parse, keeping previous config",
+				helpers.Error(err), helpers.String("configMap", configMapName))
+			return
+		}
+		provider.Update(settings)
+		logger.L().Info("collapse config: updated from ConfigMap",
+			helpers.String("configMap", configMapName),
+			helpers.Int("openThreshold", settings.OpenDynamicThreshold),
+			helpers.Int("endpointThreshold", settings.EndpointDynamicThreshold),
+			helpers.Int("collapseConfigs", len(settings.CollapseConfigs)))
+	}
+
+	_, informer := cache.NewInformer(
+		listWatcher,
+		&corev1.ConfigMap{},
+		30*time.Second, // resync period
+		cache.ResourceEventHandlerFuncs{
+			AddFunc: handleConfigMap,
+			UpdateFunc: func(_, newObj interface{}) {
+				handleConfigMap(newObj)
+			},
+			DeleteFunc: func(_ interface{}) {
+				provider.Update(DefaultCollapseSettings())
+				logger.L().Info("collapse config: ConfigMap deleted, reverting to defaults",
+					helpers.String("configMap", configMapName))
+			},
+		},
+	)
+
+	informer.Run(ctx.Done())
+}
diff --git a/pkg/registry/file/dynamicpathdetector/tests/collapse_config_provider_test.go b/pkg/registry/file/dynamicpathdetector/tests/collapse_config_provider_test.go
new file mode 100644
index 000000000..01d5a57a1
--- /dev/null
+++ b/pkg/registry/file/dynamicpathdetector/tests/collapse_config_provider_test.go
@@ -0,0 +1,118 @@
+package dynamicpathdetectortests
+
+import (
+	"sync"
+	"testing"
+
+	"github.com/kubescape/storage/pkg/registry/file/dynamicpathdetector"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestDefaultCollapseSettings(t *testing.T) {
+	s := dynamicpathdetector.DefaultCollapseSettings()
+	assert.Equal(t, dynamicpathdetector.OpenDynamicThreshold, s.OpenDynamicThreshold)
+	assert.Equal(t, dynamicpathdetector.EndpointDynamicThreshold, s.EndpointDynamicThreshold)
+	assert.Equal(t, dynamicpathdetector.DefaultCollapseConfigs, s.CollapseConfigs)
+}
+
+func TestParseCollapseSettings_Empty(t *testing.T) {
+	s, err := dynamicpathdetector.ParseCollapseSettings(nil)
+	require.NoError(t, err)
+	assert.Equal(t, dynamicpathdetector.DefaultCollapseSettings(), s)
+
+	s, err = dynamicpathdetector.ParseCollapseSettings([]byte{})
+	require.NoError(t, err)
+	assert.Equal(t, dynamicpathdetector.DefaultCollapseSettings(), s)
+}
+
+func TestParseCollapseSettings_Partial(t *testing.T) {
+	// Only set openDynamicThreshold — others should get defaults
+	data := []byte(`{"openDynamicThreshold": 99}`)
+	s, err := dynamicpathdetector.ParseCollapseSettings(data)
+	require.NoError(t, err)
+	assert.Equal(t, 99, s.OpenDynamicThreshold)
+	assert.Equal(t, dynamicpathdetector.EndpointDynamicThreshold, s.EndpointDynamicThreshold)
+	assert.Equal(t, dynamicpathdetector.DefaultCollapseConfigs, s.CollapseConfigs)
+}
+
+func TestParseCollapseSettings_Full(t *testing.T) {
+	data := []byte(`{
+		"openDynamicThreshold": 10,
+		"endpointDynamicThreshold": 20,
+		"collapseConfigs": [
+			{"prefix": "/tmp", "threshold": 3}
+		]
+	}`)
+	s, err := dynamicpathdetector.ParseCollapseSettings(data)
+	require.NoError(t, err)
+	assert.Equal(t, 10, s.OpenDynamicThreshold)
+	assert.Equal(t, 20, s.EndpointDynamicThreshold)
+	require.Len(t, s.CollapseConfigs, 1)
+	assert.Equal(t, "/tmp", s.CollapseConfigs[0].Prefix)
+	assert.Equal(t, 3, s.CollapseConfigs[0].Threshold)
+}
+
+func TestParseCollapseSettings_InvalidJSON(t *testing.T) {
+	data := []byte(`{invalid json}`)
+	s, err := dynamicpathdetector.ParseCollapseSettings(data)
+	assert.Error(t, err)
+	// Should return defaults on error
+	assert.Equal(t, dynamicpathdetector.DefaultCollapseSettings(), s)
+}
+
+func TestCollapseConfigProvider_GetAfterUpdate(t *testing.T) {
+	p := dynamicpathdetector.NewCollapseConfigProvider()
+
+	// Verify defaults
+	s := p.Get()
+	assert.Equal(t, dynamicpathdetector.OpenDynamicThreshold, s.OpenDynamicThreshold)
+
+	// Update and verify
+	custom := dynamicpathdetector.CollapseSettings{
+		OpenDynamicThreshold:     7,
+		EndpointDynamicThreshold: 14,
+		CollapseConfigs: []dynamicpathdetector.CollapseConfig{
+			{Prefix: "/foo", Threshold: 2},
+		},
+	}
+	p.Update(custom)
+
+	s = p.Get()
+	assert.Equal(t, 7, s.OpenDynamicThreshold)
+	assert.Equal(t, 14, s.EndpointDynamicThreshold)
+	require.Len(t, s.CollapseConfigs, 1)
+	assert.Equal(t, "/foo", s.CollapseConfigs[0].Prefix)
+}
+
+func TestCollapseConfigProvider_ConcurrentAccess(t *testing.T) {
+	p := dynamicpathdetector.NewCollapseConfigProvider()
+
+	var wg sync.WaitGroup
+	// Readers
+	for i := 0; i < 100; i++ {
+		wg.Add(1)
+		go func() {
+			defer wg.Done()
+			for j := 0; j < 1000; j++ {
+				s := p.Get()
+				_ = s.OpenDynamicThreshold
+			}
+		}()
+	}
+	// Writer
+	wg.Add(1)
+	go func() {
+		defer wg.Done()
+		for j := 0; j < 1000; j++ {
+			p.Update(dynamicpathdetector.CollapseSettings{
+				OpenDynamicThreshold:     j,
+				EndpointDynamicThreshold: j * 2,
+				CollapseConfigs:          dynamicpathdetector.DefaultCollapseConfigs,
+			})
+		}
+	}()
+
+	wg.Wait()
+	// If we get here without a data race, the test passes
+}

From 44f008068a28d09d6b80bec410bae8ce2a392144 Mon Sep 17 00:00:00 2001
From: tanzee <einentlein@gmail.com>
Date: Fri, 20 Feb 2026 15:33:24 +0100
Subject: [PATCH 68/68] test script added

---
 hack/demo-hot-reload-collapse-config.sh | 233 ++++++++++++++++++++++++
 1 file changed, 233 insertions(+)
 create mode 100755 hack/demo-hot-reload-collapse-config.sh

diff --git a/hack/demo-hot-reload-collapse-config.sh b/hack/demo-hot-reload-collapse-config.sh
new file mode 100755
index 000000000..4adc0269e
--- /dev/null
+++ b/hack/demo-hot-reload-collapse-config.sh
@@ -0,0 +1,233 @@
+#!/usr/bin/env bash
+# ============================================================================
+# demo-hot-reload-collapse-config.sh
+#
+# Demonstrates hot-reloading of CollapseConfig via the storage ConfigMap.
+# Designed for k3s on iximiuz labs — only needs kubectl and jq.
+#
+# What it does:
+#   1. Shows the current storage ConfigMap (no collapseConfig.json key)
+#   2. Creates a profile with 4 /var/run paths — default threshold=3 → collapses
+#   3. Patches the ConfigMap to raise /var/run threshold to 10
+#   4. Waits for the informer to pick up the change (~5s)
+#   5. Creates a second profile with the same 4 paths — now below threshold → NOT collapsed
+#   6. Side-by-side comparison proves the hot-reload worked
+#   7. Cleans up
+#
+# Usage:
+#   chmod +x demo-hot-reload-collapse-config.sh
+#   ./demo-hot-reload-collapse-config.sh
+# ============================================================================
+
+set -euo pipefail
+
+# --- Configuration -----------------------------------------------------------
+KS_NS="kubescape"
+CM_NAME="storage"
+TEST_NS="demo-collapse-$$"
+API_GROUP="spdx.softwarecomposition.kubescape.io"
+API_VERSION="v1beta1"
+INFORMER_WAIT=6  # seconds to let the informer pick up changes
+
+# --- Colors ------------------------------------------------------------------
+RED='\033[0;31m'
+GREEN='\033[0;32m'
+YELLOW='\033[1;33m'
+CYAN='\033[0;36m'
+BOLD='\033[1m'
+RESET='\033[0m'
+
+# --- Helpers -----------------------------------------------------------------
+banner() { echo -e "\n${CYAN}${BOLD}=== $1 ===${RESET}\n"; }
+info()   { echo -e "${GREEN}[+]${RESET} $1"; }
+warn()   { echo -e "${YELLOW}[!]${RESET} $1"; }
+fail()   { echo -e "${RED}[x]${RESET} $1"; exit 1; }
+
+check_deps() {
+    for cmd in kubectl jq; do
+        command -v "$cmd" &>/dev/null || fail "Required command not found: $cmd"
+    done
+}
+
+cleanup() {
+    banner "Cleanup"
+
+    # Remove collapseConfig.json key from ConfigMap
+    info "Removing collapseConfig.json from ConfigMap ${CM_NAME}..."
+    kubectl patch configmap "$CM_NAME" -n "$KS_NS" \
+        --type merge -p '{"data":{"collapseConfig.json":null}}' 2>/dev/null || true
+
+    # Delete test profiles
+    for name in demo-default-threshold demo-raised-threshold; do
+        kubectl delete applicationprofiles.${API_GROUP} "$name" -n "$TEST_NS" 2>/dev/null || true
+    done
+
+    # Delete test namespace
+    kubectl delete namespace "$TEST_NS" --wait=false 2>/dev/null || true
+
+    info "Cleanup complete."
+}
+trap cleanup EXIT
+
+# Creates an ApplicationProfile YAML with N unique opens under a given prefix
+generate_profile_yaml() {
+    local name="$1"
+    local prefix="$2"
+    local count="$3"
+
+    local opens=""
+    for i in $(seq 1 "$count"); do
+        opens="${opens}
+        - path: \"${prefix}/file${i}.pid\"
+          flags: [\"O_RDONLY\"]"
+    done
+
+    cat <<EOF
+apiVersion: ${API_GROUP}/${API_VERSION}
+kind: ApplicationProfile
+metadata:
+  name: ${name}
+  namespace: ${TEST_NS}
+  labels:
+    kubescape.io/managed-by: "User"
+  annotations:
+    kubescape.io/status: "completed"
+    kubescape.io/completion: "complete"
+spec:
+  containers:
+    - name: demo-container
+      syscalls: ["read", "open"]
+      opens:${opens}
+      capabilities: []
+      execs: []
+      endpoints: []
+EOF
+}
+
+# Retrieves opens from a stored profile and prints them
+get_stored_opens() {
+    local name="$1"
+    kubectl get applicationprofiles.${API_GROUP} "$name" -n "$TEST_NS" -o json \
+        | jq -r '.spec.containers[0].opens[] | .path'
+}
+
+# --- Main --------------------------------------------------------------------
+check_deps
+
+banner "Hot-Reload CollapseConfig Demo"
+echo -e "This demo proves that storage collapse thresholds can be changed at"
+echo -e "runtime via the ${BOLD}${CM_NAME}${RESET} ConfigMap — no pod restart needed.\n"
+echo -e "Default /var/run threshold: ${BOLD}3${RESET}  (paths > 3 get collapsed)"
+echo -e "We'll create 4 files under /var/run, then raise the threshold to 10.\n"
+
+# --- Step 0: Prerequisites ---------------------------------------------------
+banner "Step 0: Prerequisites"
+
+info "Creating test namespace: ${TEST_NS}"
+kubectl create namespace "$TEST_NS"
+
+info "Verifying storage pod is running..."
+kubectl get pods -n "$KS_NS" -l app=storage --no-headers \
+    | grep -q Running || fail "Storage pod not running in ${KS_NS}"
+info "Storage pod is healthy."
+
+# --- Step 1: Show current ConfigMap ------------------------------------------
+banner "Step 1: Current ConfigMap state"
+
+info "ConfigMap ${CM_NAME} in ${KS_NS}:"
+echo ""
+kubectl get configmap "$CM_NAME" -n "$KS_NS" -o jsonpath='{.data}' | jq .
+echo ""
+warn "Note: No 'collapseConfig.json' key — defaults are active."
+echo -e "  Default collapse configs:"
+echo -e "    /etc           threshold=100"
+echo -e "    /etc/apache2   threshold=5"
+echo -e "    /opt           threshold=5"
+echo -e "    ${BOLD}/var/run       threshold=3${RESET}"
+echo -e "    /app           threshold=1"
+
+# --- Step 2: Create profile with defaults ------------------------------------
+banner "Step 2: Create profile with 4 /var/run paths (default threshold=3)"
+
+info "Generating ApplicationProfile 'demo-default-threshold' with 4 /var/run opens..."
+generate_profile_yaml "demo-default-threshold" "/var/run" 4 | kubectl apply -f -
+
+sleep 1
+info "Stored opens:"
+echo ""
+OPENS_BEFORE=$(get_stored_opens "demo-default-threshold")
+echo "$OPENS_BEFORE" | while read -r path; do
+    echo -e "  ${path}"
+done
+echo ""
+
+COUNT_BEFORE=$(echo "$OPENS_BEFORE" | wc -l)
+if [ "$COUNT_BEFORE" -lt 4 ]; then
+    info "${GREEN}4 paths collapsed to ${COUNT_BEFORE} (4 > threshold 3) — expected!${RESET}"
+else
+    warn "Paths did NOT collapse (count=${COUNT_BEFORE}). Threshold may already be raised."
+fi
+
+# --- Step 3: Patch ConfigMap to raise threshold ------------------------------
+banner "Step 3: Hot-reload — raise /var/run threshold to 10"
+
+COLLAPSE_CONFIG='{"openDynamicThreshold":50,"endpointDynamicThreshold":100,"collapseConfigs":[{"prefix":"/etc","threshold":100},{"prefix":"/etc/apache2","threshold":5},{"prefix":"/opt","threshold":5},{"prefix":"/var/run","threshold":10},{"prefix":"/app","threshold":1}]}'
+
+info "Patching ConfigMap with collapseConfig.json..."
+kubectl patch configmap "$CM_NAME" -n "$KS_NS" \
+    --type merge \
+    -p "{\"data\":{\"collapseConfig.json\":$(echo "$COLLAPSE_CONFIG" | jq -Rs .)}}"
+
+info "Updated ConfigMap:"
+echo ""
+kubectl get configmap "$CM_NAME" -n "$KS_NS" -o jsonpath='{.data}' | jq .
+echo ""
+
+info "Waiting ${INFORMER_WAIT}s for informer to pick up the change..."
+sleep "$INFORMER_WAIT"
+info "Informer should have updated the provider by now."
+
+# --- Step 4: Create second profile with raised threshold ---------------------
+banner "Step 4: Create profile with same 4 /var/run paths (threshold now 10)"
+
+info "Generating ApplicationProfile 'demo-raised-threshold' with 4 /var/run opens..."
+generate_profile_yaml "demo-raised-threshold" "/var/run" 4 | kubectl apply -f -
+
+sleep 1
+info "Stored opens:"
+echo ""
+OPENS_AFTER=$(get_stored_opens "demo-raised-threshold")
+echo "$OPENS_AFTER" | while read -r path; do
+    echo -e "  ${path}"
+done
+echo ""
+
+COUNT_AFTER=$(echo "$OPENS_AFTER" | wc -l)
+if [ "$COUNT_AFTER" -eq 4 ]; then
+    info "${GREEN}4 paths remain individual (4 < threshold 10) — hot-reload worked!${RESET}"
+else
+    warn "Paths were collapsed (count=${COUNT_AFTER}). Hot-reload may not have taken effect."
+fi
+
+# --- Step 5: Side-by-side comparison ----------------------------------------
+banner "Step 5: Side-by-side comparison"
+
+echo -e "${BOLD}BEFORE (default threshold=3):${RESET}"
+echo "$OPENS_BEFORE" | while read -r path; do echo "  $path"; done
+echo -e "  Total paths: ${BOLD}${COUNT_BEFORE}${RESET}"
+echo ""
+
+echo -e "${BOLD}AFTER (threshold raised to 10):${RESET}"
+echo "$OPENS_AFTER" | while read -r path; do echo "  $path"; done
+echo -e "  Total paths: ${BOLD}${COUNT_AFTER}${RESET}"
+echo ""
+
+if [ "$COUNT_BEFORE" -lt 4 ] && [ "$COUNT_AFTER" -eq 4 ]; then
+    echo -e "${GREEN}${BOLD}SUCCESS: Hot-reload changed collapse behavior without restarting storage!${RESET}"
+else
+    echo -e "${YELLOW}${BOLD}INCONCLUSIVE: Results don't match expected pattern. Check storage logs:${RESET}"
+    echo -e "  kubectl logs -n ${KS_NS} -l app=storage --tail=50 | grep 'collapse config'"
+fi
+
+echo ""
+info "Demo complete. Cleanup will run automatically."